Play interactive tour

Edit tour

Analysis Report WcHO1ZGiIn

Overview

General Information

Sample Name:	WcHO1ZGiIn (renamed file extension from none to exe)
Analysis ID:	432864
MD5:	c7b10eb81f543debd7092703917cf6e5
SHA1:	cfa927622c9ffb371aeb7fdbb4c32798ec6fbcdd
SHA256:	aa46ed83ddd4f41f0c8eff6a404206cad70a7ecf4dd8754ee305655ffffee4bb
Infos:
Most interesting Screenshot:

Detection

AgentTesla Matiex

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected Matiex Keylogger

Machine Learning detection for dropped file

Machine Learning detection for sample

Yara detected Beds Obfuscator

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

WcHO1ZGiIn.exe (PID: 6304 cmdline: 'C:\Users\user\Desktop\WcHO1ZGiIn.exe' MD5: C7B10EB81F543DEBD7092703917CF6E5)

Serwices.exe (PID: 6792 cmdline: 'C:\Users\user\AppData\Local\Temp\Serwices.exe' MD5: CF1048A8362B93B9CDF47260B50D8F37)

WerFault.exe (PID: 7032 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6792 -s 852 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000002.254827606.0000000004475000.00000004.00000001.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
00000004.00000002.254827606.0000000004475000.00000004.00000001.sdmp	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
00000004.00000002.254827606.0000000004475000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000000.236597835.0000000004475000.00000004.00000001.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
00000004.00000000.236597835.0000000004475000.00000004.00000001.sdmp	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
00000004.00000000.236597835.0000000004475000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000000.241943402.0000000004475000.00000004.00000001.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
00000004.00000000.241943402.0000000004475000.00000004.00000001.sdmp	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
00000004.00000000.241943402.0000000004475000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000000.241561167.0000000004319000.00000004.00000001.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
00000004.00000000.241561167.0000000004319000.00000004.00000001.sdmp	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
00000004.00000000.241561167.0000000004319000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000000.236472239.0000000004319000.00000004.00000001.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
00000004.00000000.236472239.0000000004319000.00000004.00000001.sdmp	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
00000004.00000000.236472239.0000000004319000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Process Memory Space: Serwices.exe PID: 6792	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
Process Memory Space: Serwices.exe PID: 6792	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author
4.0.Serwices.exe.43e7f14.13.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
4.0.Serwices.exe.43e7f14.13.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
4.2.Serwices.exe.4475bd0.6.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
4.2.Serwices.exe.4475bd0.6.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
4.2.Serwices.exe.4475bd0.6.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.2.Serwices.exe.43c7870.4.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
4.2.Serwices.exe.43c7870.4.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
4.2.Serwices.exe.43c7870.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.2.Serwices.exe.43c7870.4.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
4.2.Serwices.exe.43c7870.4.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
4.2.Serwices.exe.43c7870.4.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.Serwices.exe.4496274.14.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
4.0.Serwices.exe.4496274.14.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
4.0.Serwices.exe.4475bd0.15.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
4.0.Serwices.exe.4475bd0.15.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
4.0.Serwices.exe.4475bd0.15.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.2.Serwices.exe.43e7f14.3.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
4.2.Serwices.exe.43e7f14.3.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
4.2.Serwices.exe.4475bd0.6.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
4.2.Serwices.exe.4475bd0.6.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
4.2.Serwices.exe.4475bd0.6.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.2.Serwices.exe.4496274.5.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
4.2.Serwices.exe.4496274.5.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
4.0.Serwices.exe.4475bd0.6.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
4.0.Serwices.exe.4475bd0.6.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
4.0.Serwices.exe.4475bd0.6.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.Serwices.exe.4475bd0.6.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
4.0.Serwices.exe.4475bd0.6.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
4.0.Serwices.exe.4475bd0.6.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.Serwices.exe.43c7870.12.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
4.0.Serwices.exe.43c7870.12.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
4.0.Serwices.exe.43c7870.12.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.Serwices.exe.43c7870.4.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
4.0.Serwices.exe.43c7870.4.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
4.0.Serwices.exe.43c7870.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.Serwices.exe.43c7870.12.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
4.0.Serwices.exe.43c7870.12.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
4.0.Serwices.exe.43c7870.12.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.Serwices.exe.43c7870.4.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
4.0.Serwices.exe.43c7870.4.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
4.0.Serwices.exe.43c7870.4.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.Serwices.exe.4475bd0.15.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
4.0.Serwices.exe.4475bd0.15.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
4.0.Serwices.exe.4475bd0.15.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.Serwices.exe.4496274.7.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
4.0.Serwices.exe.4496274.7.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
4.0.Serwices.exe.43e7f14.5.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
4.0.Serwices.exe.43e7f14.5.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
Click to see the 43 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\Serwices.exe

ReversingLabs: Detection: 65%

Multi AV Scanner detection for submitted file

Show sources

Source: WcHO1ZGiIn.exe	Virustotal: Detection: 41%			Perma Link
Source: WcHO1ZGiIn.exe	ReversingLabs: Detection: 58%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\Serwices.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: WcHO1ZGiIn.exe

Joe Sandbox ML: detected

Source: WcHO1ZGiIn.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: unknown

HTTPS traffic detected: 145.14.145.185:443 -> 192.168.2.3:49730 version: TLS 1.0

Source: WcHO1ZGiIn.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: System.Core.ni.pdbRSDSD source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: i8C:\Windows\WindowsApp26.pdb source: Serwices.exe, 00000004.00000002.253768306.0000000001339000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Serwices.PDB source: Serwices.exe, 00000004.00000002.253768306.0000000001339000.00000004.00000001.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: System.Core.pdb8~d source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: \??\C:\Windows\exe\WindowsApp26.pdb source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: jC:\Users\user\AppData\Local\Temp\WindowsApp26.pdb3 source: Serwices.exe, 00000004.00000002.253768306.0000000001339000.00000004.00000001.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb.10 source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: .pdbf source: Serwices.exe, 00000004.00000002.253768306.0000000001339000.00000004.00000001.sdmp
Source:	Binary string: WindowsFormsApp9.pdb source: WcHO1ZGiIn.exe
Source:	Binary string: WindowsApp26.pdbsApp26.pdbpdbp26.pdbsApp26.pdb209-4053062332-1002d source: Serwices.exe, 00000004.00000002.253768306.0000000001339000.00000004.00000001.sdmp
Source:	Binary string: System.Windows.Forms.pdb` source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: WindowsApp26.pdb source: WcHO1ZGiIn.exe, 00000000.00000002.1294603294.00000000026F1000.00000004.00000001.sdmp, Serwices.exe, Serwices.exe.0.dr
Source:	Binary string: System.pdb source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: D:\Before FprmT\Document VB project\FireFox Stub\FireFox Stub\obj\Debug\VNXT.pdbh} source: Serwices.exe, 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp
Source:	Binary string: System.Core.ni.pdb source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\WindowsApp26.pdb source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: symbols\exe\WindowsApp26.pdb) source: Serwices.exe, 00000004.00000002.253768306.0000000001339000.00000004.00000001.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: mscorlib.pdb source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbO source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\WindowsApp26.pdb source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Serwices.PDB1 source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbLIST source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: System.Core.pdb source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\WindowsApp26.pdbV source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: .pdb source: Serwices.exe, 00000004.00000002.253768306.0000000001339000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\WindowsApp26.pdba source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbz source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: System.ni.pdb source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: D:\Before FprmT\Document VB project\FireFox Stub\FireFox Stub\obj\Debug\VNXT.pdb source: Serwices.exe, 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown

HTTPS traffic detected: 145.14.145.185:443 -> 192.168.2.3:49730 version: TLS 1.0

Source: unknown

DNS traffic detected: queries for: mmeetalss.000webhostapp.com

Source: Serwices.exe, 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Serwices.exe, 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: Serwices.exe, 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: WcHO1ZGiIn.exe, 00000000.00000002.1294447076.0000000002695000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.rapidssl.com/RapidSSLRSACA2018.crt0
Source: WcHO1ZGiIn.exe, 00000000.00000002.1294447076.0000000002695000.00000004.00000001.sdmp	String found in binary or memory: http://cdp.rapidssl.com/RapidSSLRSACA2018.crl0L
Source: Serwices.exe, 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: Serwices.exe, 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: WcHO1ZGiIn.exe, 00000000.00000002.1294550425.00000000026D4000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0c
Source: Serwices.exe, 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: Serwices.exe, 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Serwices.exe, 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Serwices.exe, 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: Serwices.exe, 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: WcHO1ZGiIn.exe, 00000000.00000002.1294550425.00000000026D4000.00000004.00000001.sdmp	String found in binary or memory: http://mmeetalss.000webhostapp.com
Source: WcHO1ZGiIn.exe, 00000000.00000002.1294550425.00000000026D4000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0B
Source: Serwices.exe, 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: Serwices.exe, 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: Serwices.exe, 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: WcHO1ZGiIn.exe, 00000000.00000002.1294517377.00000000026BE000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: WcHO1ZGiIn.exe, 00000000.00000002.1294447076.0000000002695000.00000004.00000001.sdmp	String found in binary or memory: http://status.rapidssl.com0=
Source: WcHO1ZGiIn.exe, 00000000.00000002.1294550425.00000000026D4000.00000004.00000001.sdmp	String found in binary or memory: http://us-east-1.route-1.000webhost.awex.io
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: WcHO1ZGiIn.exe, 00000000.00000003.211918640.000000000558E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: WcHO1ZGiIn.exe, 00000000.00000003.211918640.000000000558E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comTz
Source: WcHO1ZGiIn.exe, 00000000.00000003.211918640.000000000558E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comY
Source: WcHO1ZGiIn.exe, 00000000.00000003.211918640.000000000558E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.come
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: WcHO1ZGiIn.exe, 00000000.00000003.211918640.000000000558E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comq
Source: Serwices.exe, 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: WcHO1ZGiIn.exe, 00000000.00000002.1297765767.0000000005550000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.come.com
Source: WcHO1ZGiIn.exe, 00000000.00000002.1297765767.0000000005550000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comm
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: WcHO1ZGiIn.exe, 00000000.00000003.210271161.000000000558E000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comW
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: WcHO1ZGiIn.exe, 00000000.00000003.220727614.000000000558D000.00000004.00000001.sdmp	String found in binary or memory: http://www.monotype.
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: WcHO1ZGiIn.exe, 00000000.00000003.210726833.000000000556B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comy
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: WcHO1ZGiIn.exe, 00000000.00000002.1294517377.00000000026BE000.00000004.00000001.sdmp	String found in binary or memory: https://mmeetalss.000webhostapT
Source: WcHO1ZGiIn.exe, 00000000.00000002.1294517377.00000000026BE000.00000004.00000001.sdmp	String found in binary or memory: https://mmeetalss.000webhostapp.com
Source: WcHO1ZGiIn.exe, WcHO1ZGiIn.exe, 00000000.00000002.1294375558.0000000002661000.00000004.00000001.sdmp	String found in binary or memory: https://mmeetalss.000webhostapp.com/Serwices.exe
Source: WcHO1ZGiIn.exe	String found in binary or memory: https://mmeetalss.000webhostapp.com/Serwices.exe)WindowsFormsApp7.exe
Source: WcHO1ZGiIn.exe, 00000000.00000002.1294447076.0000000002695000.00000004.00000001.sdmp, Serwices.exe, 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Code function: 0_2_025EC014	0_2_025EC014
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Code function: 0_2_025EE9F8	0_2_025EE9F8
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Code function: 0_2_025EE9EA	0_2_025EE9EA
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Code function: 0_2_072A3008	0_2_072A3008

Source: C:\Users\user\AppData\Local\Temp\Serwices.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6792 -s 852

Source: WcHO1ZGiIn.exe, 00000000.00000000.208020059.0000000000378000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameWindowsFormsApp9.exeB vs WcHO1ZGiIn.exe
Source: WcHO1ZGiIn.exe, 00000000.00000002.1300324417.0000000007BA0000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs WcHO1ZGiIn.exe
Source: WcHO1ZGiIn.exe, 00000000.00000002.1300324417.0000000007BA0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs WcHO1ZGiIn.exe
Source: WcHO1ZGiIn.exe, 00000000.00000002.1294603294.00000000026F1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamevmware.exeH& vs WcHO1ZGiIn.exe
Source: WcHO1ZGiIn.exe, 00000000.00000002.1299162550.0000000006B40000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs WcHO1ZGiIn.exe
Source: WcHO1ZGiIn.exe, 00000000.00000002.1300050752.0000000007AA0000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs WcHO1ZGiIn.exe
Source: WcHO1ZGiIn.exe	Binary or memory string: OriginalFilenameWindowsFormsApp9.exeB vs WcHO1ZGiIn.exe

Source: WcHO1ZGiIn.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: WcHO1ZGiIn.exe, 00000000.00000003.211424744.000000000558D000.00000004.00000001.sdmp

Binary or memory string: 0s.slnt

Source: classification engine

Classification label: mal84.troj.evad.winEXE@4/5@2/2

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6792

Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe

File created: C:\Users\user\AppData\Local\Temp\Serwices.exe

Jump to behavior

Source: WcHO1ZGiIn.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: WcHO1ZGiIn.exe	Virustotal: Detection: 41%
Source: WcHO1ZGiIn.exe	ReversingLabs: Detection: 58%

Source: unknown	Process created: C:\Users\user\Desktop\WcHO1ZGiIn.exe 'C:\Users\user\Desktop\WcHO1ZGiIn.exe'
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process created: C:\Users\user\AppData\Local\Temp\Serwices.exe 'C:\Users\user\AppData\Local\Temp\Serwices.exe'
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6792 -s 852
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process created: C:\Users\user\AppData\Local\Temp\Serwices.exe 'C:\Users\user\AppData\Local\Temp\Serwices.exe'	Jump to behavior

Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F324E4F9-8496-40b2-A1FF-9617C1C9AFFE}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Serwices.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: WcHO1ZGiIn.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: WcHO1ZGiIn.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: WcHO1ZGiIn.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: System.Core.ni.pdbRSDSD source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: i8C:\Windows\WindowsApp26.pdb source: Serwices.exe, 00000004.00000002.253768306.0000000001339000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Serwices.PDB source: Serwices.exe, 00000004.00000002.253768306.0000000001339000.00000004.00000001.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: System.Core.pdb8~d source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: \??\C:\Windows\exe\WindowsApp26.pdb source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: jC:\Users\user\AppData\Local\Temp\WindowsApp26.pdb3 source: Serwices.exe, 00000004.00000002.253768306.0000000001339000.00000004.00000001.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb.10 source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: .pdbf source: Serwices.exe, 00000004.00000002.253768306.0000000001339000.00000004.00000001.sdmp
Source:	Binary string: WindowsFormsApp9.pdb source: WcHO1ZGiIn.exe
Source:	Binary string: WindowsApp26.pdbsApp26.pdbpdbp26.pdbsApp26.pdb209-4053062332-1002d source: Serwices.exe, 00000004.00000002.253768306.0000000001339000.00000004.00000001.sdmp
Source:	Binary string: System.Windows.Forms.pdb` source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: WindowsApp26.pdb source: WcHO1ZGiIn.exe, 00000000.00000002.1294603294.00000000026F1000.00000004.00000001.sdmp, Serwices.exe, Serwices.exe.0.dr
Source:	Binary string: System.pdb source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: D:\Before FprmT\Document VB project\FireFox Stub\FireFox Stub\obj\Debug\VNXT.pdbh} source: Serwices.exe, 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp
Source:	Binary string: System.Core.ni.pdb source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\WindowsApp26.pdb source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: symbols\exe\WindowsApp26.pdb) source: Serwices.exe, 00000004.00000002.253768306.0000000001339000.00000004.00000001.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: mscorlib.pdb source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbO source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\WindowsApp26.pdb source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Serwices.PDB1 source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbLIST source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: System.Core.pdb source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\WindowsApp26.pdbV source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: .pdb source: Serwices.exe, 00000004.00000002.253768306.0000000001339000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\WindowsApp26.pdba source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbz source: Serwices.exe, 00000004.00000000.236155688.0000000001647000.00000004.00000020.sdmp
Source:	Binary string: System.ni.pdb source: WER46DA.tmp.dmp.7.dr
Source:	Binary string: D:\Before FprmT\Document VB project\FireFox Stub\FireFox Stub\obj\Debug\VNXT.pdb source: Serwices.exe, 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp

Data Obfuscation:

Yara detected Beds Obfuscator

Show sources

Source: Yara match	File source: 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.254827606.0000000004475000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.236597835.0000000004475000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.241943402.0000000004475000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.241561167.0000000004319000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.236472239.0000000004319000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Serwices.exe PID: 6792, type: MEMORY
Source: Yara match	File source: 4.0.Serwices.exe.43e7f14.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.4475bd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.43c7870.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.43c7870.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4496274.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.43e7f14.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.4475bd0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.4496274.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4496274.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43e7f14.5.raw.unpack, type: UNPACKEDPE

Source: WcHO1ZGiIn.exe

Static PE information: 0xF65E7472 [Sat Dec 25 02:35:30 2100 UTC]

Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Code function: 0_2_025E1C58 push ebx; iretd		0_2_025E1C7A
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Code function: 0_2_072A01A8 push esp; ret		0_2_072A01C1

Source: initial sample

Static PE information: section name: .text entropy: 7.91688767113

Source: WcHO1ZGiIn.exe, WindowsFormsApp9/kjhgfdghjkhgfh.cs	High entropy of concatenated method names: '.ctor', 'C3p4TV0ir', 'KoroguPyf', 'Dispose', 'AcMTiZDNq', 'NyTprRSGMXYTnKvgym', 'GDjjQJlB5GI1bt2nwq', 'YPmQgitlR69JPJa33v', 'g8n7cActjtqgYgX6WY', 'zno71hO4poZDovBlCN'
Source: Serwices.exe.0.dr, I2Y7vavHC9qgftfSCu/nXZxglXV1rOyshs1RQ.cs	High entropy of concatenated method names: '.cctor', 'h8q52ULNx', 'gRGNERdmx', 'W9VGOWgSf3458mrljM', 'fjFOO4LMo2rdANUaD9', 'CrZrhrA4pwTrds12Rt', 'gImJSuIU3Zaex5Tynd', 'y12M5Pn7nUcLhekjTd', 'Ey7Nt5tk0U9hQnMwIr', 'CNZaQm1cuhuOG4W8K3'
Source: Serwices.exe.0.dr, PM25fBOq7Pf7PhkGtX/woTy5UlLKpvAdBi2Mo.cs	High entropy of concatenated method names: 'lnBjXs55MCGCF', '.ctor', '.cctor', 'YTctZ6qA3lZpHQSQiVo', 'caOwMsqIyuMkcktLb6j', 'X2bRVEqg9CkrpLjR9rZ', 'EfXnCKqL5mum5G1OiFu', 'mAwFd2qHAPqeKNCGgSF', 'sQl1KSq4rePBn8xeN5h', 'KWpNfuqnbeU6b7D5RT1'
Source: 0.0.WcHO1ZGiIn.exe.370000.0.unpack, WindowsFormsApp9/kjhgfdghjkhgfh.cs	High entropy of concatenated method names: '.ctor', 'C3p4TV0ir', 'KoroguPyf', 'Dispose', 'AcMTiZDNq', 'NyTprRSGMXYTnKvgym', 'GDjjQJlB5GI1bt2nwq', 'YPmQgitlR69JPJa33v', 'g8n7cActjtqgYgX6WY', 'zno71hO4poZDovBlCN'
Source: 0.2.WcHO1ZGiIn.exe.370000.0.unpack, WindowsFormsApp9/kjhgfdghjkhgfh.cs	High entropy of concatenated method names: '.ctor', 'C3p4TV0ir', 'KoroguPyf', 'Dispose', 'AcMTiZDNq', 'NyTprRSGMXYTnKvgym', 'GDjjQJlB5GI1bt2nwq', 'YPmQgitlR69JPJa33v', 'g8n7cActjtqgYgX6WY', 'zno71hO4poZDovBlCN'
Source: 4.0.Serwices.exe.ee0000.0.unpack, I2Y7vavHC9qgftfSCu/nXZxglXV1rOyshs1RQ.cs	High entropy of concatenated method names: '.cctor', 'h8q52ULNx', 'gRGNERdmx', 'W9VGOWgSf3458mrljM', 'fjFOO4LMo2rdANUaD9', 'CrZrhrA4pwTrds12Rt', 'gImJSuIU3Zaex5Tynd', 'y12M5Pn7nUcLhekjTd', 'Ey7Nt5tk0U9hQnMwIr', 'CNZaQm1cuhuOG4W8K3'
Source: 4.0.Serwices.exe.ee0000.0.unpack, PM25fBOq7Pf7PhkGtX/woTy5UlLKpvAdBi2Mo.cs	High entropy of concatenated method names: 'lnBjXs55MCGCF', '.ctor', '.cctor', 'YTctZ6qA3lZpHQSQiVo', 'caOwMsqIyuMkcktLb6j', 'X2bRVEqg9CkrpLjR9rZ', 'EfXnCKqL5mum5G1OiFu', 'mAwFd2qHAPqeKNCGgSF', 'sQl1KSq4rePBn8xeN5h', 'KWpNfuqnbeU6b7D5RT1'
Source: 4.2.Serwices.exe.ee0000.0.unpack, I2Y7vavHC9qgftfSCu/nXZxglXV1rOyshs1RQ.cs	High entropy of concatenated method names: '.cctor', 'h8q52ULNx', 'gRGNERdmx', 'W9VGOWgSf3458mrljM', 'fjFOO4LMo2rdANUaD9', 'CrZrhrA4pwTrds12Rt', 'gImJSuIU3Zaex5Tynd', 'y12M5Pn7nUcLhekjTd', 'Ey7Nt5tk0U9hQnMwIr', 'CNZaQm1cuhuOG4W8K3'
Source: 4.2.Serwices.exe.ee0000.0.unpack, PM25fBOq7Pf7PhkGtX/woTy5UlLKpvAdBi2Mo.cs	High entropy of concatenated method names: 'lnBjXs55MCGCF', '.ctor', '.cctor', 'YTctZ6qA3lZpHQSQiVo', 'caOwMsqIyuMkcktLb6j', 'X2bRVEqg9CkrpLjR9rZ', 'EfXnCKqL5mum5G1OiFu', 'mAwFd2qHAPqeKNCGgSF', 'sQl1KSq4rePBn8xeN5h', 'KWpNfuqnbeU6b7D5RT1'
Source: 4.0.Serwices.exe.ee0000.9.unpack, I2Y7vavHC9qgftfSCu/nXZxglXV1rOyshs1RQ.cs	High entropy of concatenated method names: '.cctor', 'h8q52ULNx', 'gRGNERdmx', 'W9VGOWgSf3458mrljM', 'fjFOO4LMo2rdANUaD9', 'CrZrhrA4pwTrds12Rt', 'gImJSuIU3Zaex5Tynd', 'y12M5Pn7nUcLhekjTd', 'Ey7Nt5tk0U9hQnMwIr', 'CNZaQm1cuhuOG4W8K3'
Source: 4.0.Serwices.exe.ee0000.9.unpack, PM25fBOq7Pf7PhkGtX/woTy5UlLKpvAdBi2Mo.cs	High entropy of concatenated method names: 'lnBjXs55MCGCF', '.ctor', '.cctor', 'YTctZ6qA3lZpHQSQiVo', 'caOwMsqIyuMkcktLb6j', 'X2bRVEqg9CkrpLjR9rZ', 'EfXnCKqL5mum5G1OiFu', 'mAwFd2qHAPqeKNCGgSF', 'sQl1KSq4rePBn8xeN5h', 'KWpNfuqnbeU6b7D5RT1'
Source: 4.0.Serwices.exe.ee0000.1.unpack, I2Y7vavHC9qgftfSCu/nXZxglXV1rOyshs1RQ.cs	High entropy of concatenated method names: '.cctor', 'h8q52ULNx', 'gRGNERdmx', 'W9VGOWgSf3458mrljM', 'fjFOO4LMo2rdANUaD9', 'CrZrhrA4pwTrds12Rt', 'gImJSuIU3Zaex5Tynd', 'y12M5Pn7nUcLhekjTd', 'Ey7Nt5tk0U9hQnMwIr', 'CNZaQm1cuhuOG4W8K3'
Source: 4.0.Serwices.exe.ee0000.1.unpack, PM25fBOq7Pf7PhkGtX/woTy5UlLKpvAdBi2Mo.cs	High entropy of concatenated method names: 'lnBjXs55MCGCF', '.ctor', '.cctor', 'YTctZ6qA3lZpHQSQiVo', 'caOwMsqIyuMkcktLb6j', 'X2bRVEqg9CkrpLjR9rZ', 'EfXnCKqL5mum5G1OiFu', 'mAwFd2qHAPqeKNCGgSF', 'sQl1KSq4rePBn8xeN5h', 'KWpNfuqnbeU6b7D5RT1'

Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe

File created: C:\Users\user\AppData\Local\Temp\Serwices.exe

Jump to dropped file

Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected Beds Obfuscator

Show sources

Source: Yara match	File source: 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.254827606.0000000004475000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.236597835.0000000004475000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.241943402.0000000004475000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.241561167.0000000004319000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.236472239.0000000004319000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Serwices.exe PID: 6792, type: MEMORY
Source: Yara match	File source: 4.0.Serwices.exe.43e7f14.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.4475bd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.43c7870.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.43c7870.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4496274.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.43e7f14.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.4475bd0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.4496274.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4496274.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43e7f14.5.raw.unpack, type: UNPACKEDPE

Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Serwices.exe TID: 6796	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe TID: 6796	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Thread delayed: delay time: 30000			Jump to behavior

Source: Serwices.exe.0.dr	Binary or memory string: CompanyNameVMware, Inc.P&
Source: Serwices.exe.0.dr	Binary or memory string: OriginalFilenamevmware.exeH&
Source: WcHO1ZGiIn.exe, 00000000.00000002.1294603294.00000000026F1000.00000004.00000001.sdmp	Binary or memory string: ProductNameVMware WorkstmKRo
Source: Serwices.exe.0.dr	Binary or memory string: ProductNameVMware WorkstationP,
Source: WcHO1ZGiIn.exe, 00000000.00000002.1299162550.0000000006B40000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: Serwices.exe	Binary or memory string: VMware, Inc.
Source: Serwices.exe	Binary or memory string: vmware.exe
Source: Report.wer.7.dr	Binary or memory string: AppName=VMware Workstation
Source: WcHO1ZGiIn.exe, 00000000.00000002.1292914765.00000000009D2000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllr
Source: Serwices.exe.0.dr	Binary or memory string: FileDescriptionVMware WorkstationL,
Source: Serwices.exe.0.dr	Binary or memory string: 1998-2021 VMware, Inc.@
Source: WcHO1ZGiIn.exe, 00000000.00000002.1299162550.0000000006B40000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: Serwices.exe	Binary or memory string: 1998-2021 VMware, Inc.
Source: Report.wer.7.dr	Binary or memory string: OriginalFilename=vmware.exe
Source: WER4AC4.tmp.xml.7.dr	Binary or memory string: <arg nm="apporiginalfilename" val="vmware.exe" />
Source: WcHO1ZGiIn.exe, 00000000.00000002.1299162550.0000000006B40000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: WcHO1ZGiIn.exe, 00000000.00000002.1292914765.00000000009D2000.00000004.00000001.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: WcHO1ZGiIn.exe, 00000000.00000002.1294603294.00000000026F1000.00000004.00000001.sdmp	Binary or memory string: ProductNameVMware WorkstZ\|L}X
Source: Serwices.exe	Binary or memory string: VMware Workstation
Source: WcHO1ZGiIn.exe, 00000000.00000002.1299162550.0000000006B40000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe

Process created: C:\Users\user\AppData\Local\Temp\Serwices.exe 'C:\Users\user\AppData\Local\Temp\Serwices.exe'

Jump to behavior

Source: WcHO1ZGiIn.exe, 00000000.00000002.1293573998.00000000010D0000.00000002.00000001.sdmp, Serwices.exe, 00000004.00000000.236355857.0000000001D50000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: WcHO1ZGiIn.exe, 00000000.00000002.1293573998.00000000010D0000.00000002.00000001.sdmp, Serwices.exe, 00000004.00000000.236355857.0000000001D50000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: WcHO1ZGiIn.exe, 00000000.00000002.1293573998.00000000010D0000.00000002.00000001.sdmp, Serwices.exe, 00000004.00000000.236355857.0000000001D50000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: WcHO1ZGiIn.exe, 00000000.00000002.1293573998.00000000010D0000.00000002.00000001.sdmp, Serwices.exe, 00000004.00000000.236355857.0000000001D50000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Users\user\Desktop\WcHO1ZGiIn.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Serwices.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Serwices.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\WcHO1ZGiIn.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.254827606.0000000004475000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.236597835.0000000004475000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.241943402.0000000004475000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.241561167.0000000004319000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.236472239.0000000004319000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.Serwices.exe.4475bd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.43c7870.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.43c7870.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.4475bd0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.15.raw.unpack, type: UNPACKEDPE

Yara detected Matiex Keylogger

Show sources

Source: Yara match	File source: 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.254827606.0000000004475000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.236597835.0000000004475000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.241943402.0000000004475000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.241561167.0000000004319000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.236472239.0000000004319000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Serwices.exe PID: 6792, type: MEMORY
Source: Yara match	File source: 4.0.Serwices.exe.43e7f14.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.4475bd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.43c7870.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.43c7870.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4496274.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.43e7f14.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.4475bd0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.4496274.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4496274.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43e7f14.5.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.254827606.0000000004475000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.236597835.0000000004475000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.241943402.0000000004475000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.241561167.0000000004319000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.236472239.0000000004319000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.Serwices.exe.4475bd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.43c7870.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.43c7870.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.4475bd0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.15.raw.unpack, type: UNPACKEDPE

Yara detected Matiex Keylogger

Show sources

Source: Yara match	File source: 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.254827606.0000000004475000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.236597835.0000000004475000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.241943402.0000000004475000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.241561167.0000000004319000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.236472239.0000000004319000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Serwices.exe PID: 6792, type: MEMORY
Source: Yara match	File source: 4.0.Serwices.exe.43e7f14.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.4475bd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.43c7870.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.43c7870.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4496274.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.43e7f14.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.4475bd0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Serwices.exe.4496274.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43c7870.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4475bd0.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.4496274.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Serwices.exe.43e7f14.5.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection12	Disable or Modify Tools1	OS Credential Dumping	Security Software Discovery121	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion31	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection12	Security Account Manager	Virtualization/Sandbox Evasion31	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information2	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing1	LSA Secrets	File and Directory Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Timestomp1	Cached Domain Credentials	System Information Discovery12	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
WcHO1ZGiIn.exe	41%	Virustotal		Browse
WcHO1ZGiIn.exe	59%	ReversingLabs	ByteCode-MSIL.Trojan.Fsysna
WcHO1ZGiIn.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\Serwices.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Serwices.exe	66%	ReversingLabs	ByteCode-MSIL.Spyware.Noon

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
us-east-1.route-1.000webhost.awex.io	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://status.rapidssl.com0=	0%	Avira URL Cloud	safe
http://www.carterandcone.come	0%	URL Reputation	safe
http://www.carterandcone.come	0%	URL Reputation	safe
http://www.carterandcone.come	0%	URL Reputation	safe
http://www.carterandcone.come	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.tiro.comy	0%	Avira URL Cloud	safe
http://www.carterandcone.comY	0%	Avira URL Cloud	safe
http://www.carterandcone.comq	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.fonts.comW	0%	Avira URL Cloud	safe
http://www.fontbureau.come.com	0%	URL Reputation	safe
http://www.fontbureau.come.com	0%	URL Reputation	safe
http://www.fontbureau.come.com	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.monotype.	0%	URL Reputation	safe
http://www.monotype.	0%	URL Reputation	safe
http://www.monotype.	0%	URL Reputation	safe
https://mmeetalss.000webhostapT	0%	Avira URL Cloud	safe
http://www.fontbureau.comm	0%	URL Reputation	safe
http://www.fontbureau.comm	0%	URL Reputation	safe
http://www.fontbureau.comm	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://us-east-1.route-1.000webhost.awex.io	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.carterandcone.comTz	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
us-east-1.route-1.000webhost.awex.io	145.14.145.185	true	false	2%, Virustotal, Browse	unknown
mmeetalss.000webhostapp.com	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://status.rapidssl.com0=	WcHO1ZGiIn.exe, 00000000.00000002.1294447076.0000000002695000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://mmeetalss.000webhostapp.com	WcHO1ZGiIn.exe, 00000000.00000002.1294550425.00000000026D4000.00000004.00000001.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false		high
http://cdp.rapidssl.com/RapidSSLRSACA2018.crl0L	WcHO1ZGiIn.exe, 00000000.00000002.1294447076.0000000002695000.00000004.00000001.sdmp	false		high
http://www.carterandcone.come	WcHO1ZGiIn.exe, 00000000.00000003.211918640.000000000558E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.tiro.comy	WcHO1ZGiIn.exe, 00000000.00000003.210726833.000000000556B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comY	WcHO1ZGiIn.exe, 00000000.00000003.211918640.000000000558E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false		high
http://www.carterandcone.comq	WcHO1ZGiIn.exe, 00000000.00000003.211918640.000000000558E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.com	WcHO1ZGiIn.exe, 00000000.00000003.211918640.000000000558E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fonts.comW	WcHO1ZGiIn.exe, 00000000.00000003.210271161.000000000558E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.come.com	WcHO1ZGiIn.exe, 00000000.00000002.1297765767.0000000005550000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coml	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://mmeetalss.000webhostapp.com	WcHO1ZGiIn.exe, 00000000.00000002.1294517377.00000000026BE000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false		high
http://www.monotype.	WcHO1ZGiIn.exe, 00000000.00000003.220727614.000000000558D000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://mmeetalss.000webhostapT	WcHO1ZGiIn.exe, 00000000.00000002.1294517377.00000000026BE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.comm	WcHO1ZGiIn.exe, 00000000.00000002.1297765767.0000000005550000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://mmeetalss.000webhostapp.com/Serwices.exe)WindowsFormsApp7.exe	WcHO1ZGiIn.exe	false		high
http://us-east-1.route-1.000webhost.awex.io	WcHO1ZGiIn.exe, 00000000.00000002.1294550425.00000000026D4000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://mmeetalss.000webhostapp.com/Serwices.exe	WcHO1ZGiIn.exe, WcHO1ZGiIn.exe, 00000000.00000002.1294375558.0000000002661000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers8	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false		high
http://www.carterandcone.comTz	WcHO1ZGiIn.exe, 00000000.00000003.211918640.000000000558E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://cacerts.rapidssl.com/RapidSSLRSACA2018.crt0	WcHO1ZGiIn.exe, 00000000.00000002.1294447076.0000000002695000.00000004.00000001.sdmp	false		high
http://www.zhongyicts.com.cn	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	WcHO1ZGiIn.exe, 00000000.00000002.1294517377.00000000026BE000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	WcHO1ZGiIn.exe, 00000000.00000002.1298857454.0000000006762000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
145.14.145.185	us-east-1.route-1.000webhost.awex.io	Netherlands		204915	AWEXUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	432864
Start date:	10.06.2021
Start time:	21:13:20
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	WcHO1ZGiIn (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.evad.winEXE@4/5@2/2
EGA Information:	Successful, ratio: 50%
HDC Information:	Successful, ratio: 0.3% (good quality ratio 0.1%) Quality average: 29.4% Quality standard deviation: 39.8%
HCA Information:	Successful, ratio: 100% Number of executed functions: 14 Number of non-executed functions: 3
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, RuntimeBroker.exe, backgroundTaskHost.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, MusNotifyIcon.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 93.184.220.29, 168.61.161.212, 184.30.21.144, 104.43.193.48, 52.255.188.83, 23.57.80.111, 20.82.209.183, 51.103.5.186, 93.184.221.240, 20.54.26.129, 92.122.213.247, 92.122.213.194 Excluded domains from analysis (whitelisted): cs9.wac.phicdn.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, wu.azureedge.net, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, ocsp.digicert.com, audownload.windowsupdate.nsatc.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, wu.wpc.apr-52dd2.edgecastdns.net, au-bg-shim.trafficmanager.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, client.wns.windows.com, fs.microsoft.com, wu.ec.azureedge.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net Execution Graph export aborted for target Serwices.exe, PID 6792 because there are no executed function Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:14:22	API Interceptor	1x Sleep call for process: WcHO1ZGiIn.exe modified
21:14:23	API Interceptor	2x Sleep call for process: Serwices.exe modified
21:14:33	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
145.14.145.185	https://bit.ly/2Bex4ks	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
us-east-1.route-1.000webhost.awex.io	PURCHASE ORDER.exe	Get hash	malicious	Browse	145.14.144.45
	01_extracted.exe	Get hash	malicious	Browse	145.14.144.111
	OyVPRUTe0s.exe	Get hash	malicious	Browse	145.14.144.197
	hfrEZuBd5B.exe	Get hash	malicious	Browse	145.14.144.156
	1Z4191ecDy.exe	Get hash	malicious	Browse	145.14.144.12
	j6RwLGBzlz.exe	Get hash	malicious	Browse	145.14.144.66
	sample products 1,2,&,4.exe	Get hash	malicious	Browse	145.14.144.32
	WAnYq4Yh0Z.exe	Get hash	malicious	Browse	145.14.144.64
	Z4uLK26mIK.exe	Get hash	malicious	Browse	145.14.145.148
	nb3WueUqUD.exe	Get hash	malicious	Browse	145.14.144.105
	04721BFDE5ECE7D75CE90D7D09DDCC71028B26F229038.exe	Get hash	malicious	Browse	145.14.144.143
	04721BFDE5ECE7D75CE90D7D09DDCC71028B26F229038.exe	Get hash	malicious	Browse	145.14.144.2
	6PKQHgSfco.exe	Get hash	malicious	Browse	145.14.144.105
	OneNote.html	Get hash	malicious	Browse	145.14.144.102
	ZKUR81PQIM.exe	Get hash	malicious	Browse	145.14.144.86
	darkin.exe	Get hash	malicious	Browse	145.14.144.241
	2021_03_09.exe	Get hash	malicious	Browse	145.14.144.250
	dfbzXONkPM.exe	Get hash	malicious	Browse	145.14.145.225
	0wTbI1V07f.exe	Get hash	malicious	Browse	145.14.144.210
	i795zXB64c.exe	Get hash	malicious	Browse	145.14.145.83

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AWEXUS	All Details.exe	Get hash	malicious	Browse	145.14.144.54
	All the Documents and Details.exe	Get hash	malicious	Browse	145.14.145.180
	PURCHASE ORDER.exe	Get hash	malicious	Browse	145.14.144.45
	01_extracted.exe	Get hash	malicious	Browse	145.14.144.111
	Additional documents required.pdf.exe	Get hash	malicious	Browse	145.14.145.180
	Kabyria El Arab-14326587.exe	Get hash	malicious	Browse	145.14.145.180
	Kabyria El Arab-14326587.exe	Get hash	malicious	Browse	145.14.144.209
	FedEx Receipt with Reference Code.exe	Get hash	malicious	Browse	145.14.144.209
	OyVPRUTe0s.exe	Get hash	malicious	Browse	145.14.144.197
	hfrEZuBd5B.exe	Get hash	malicious	Browse	145.14.144.156
	1Z4191ecDy.exe	Get hash	malicious	Browse	145.14.144.12
	j6RwLGBzlz.exe	Get hash	malicious	Browse	145.14.144.66
	Scan copy of said documents.exe	Get hash	malicious	Browse	145.14.144.209
	A018379D343600DAB5B728E46D2EE4E12D3853837FCF1.exe	Get hash	malicious	Browse	145.14.144.210
	Abusive email letter from your account.exe	Get hash	malicious	Browse	145.14.145.180
	sample products 1,2,&,4.exe	Get hash	malicious	Browse	145.14.144.32
	Scan copy of said documents.exe	Get hash	malicious	Browse	145.14.145.177
	Scan copy of said documents.exe	Get hash	malicious	Browse	145.14.144.149
	Scan copy of said documents.exe	Get hash	malicious	Browse	145.14.144.209
	Additional documents.exe	Get hash	malicious	Browse	145.14.145.177

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	3c2pU82NQD.exe	Get hash	malicious	Browse	145.14.145.185
	RFQ-sib.exe	Get hash	malicious	Browse	145.14.145.185
	SecuriteInfo.com.Trojan.PackedNET.825.24532.exe	Get hash	malicious	Browse	145.14.145.185
	090049000009000.exe	Get hash	malicious	Browse	145.14.145.185
	DocumentScanCopy2021_pdf.exe	Get hash	malicious	Browse	145.14.145.185
	SecuriteInfo.com.Trojan.PackedNET.831.4134.exe	Get hash	malicious	Browse	145.14.145.185
	SWIFT COMMERCIAL DUTY 0218J.exe	Get hash	malicious	Browse	145.14.145.185
	p8Wo6PbOjL.exe	Get hash	malicious	Browse	145.14.145.185
	b7cgnOpObK.exe	Get hash	malicious	Browse	145.14.145.185
	Invoice 8-6-2021.exe	Get hash	malicious	Browse	145.14.145.185
	090009000000090.exe	Get hash	malicious	Browse	145.14.145.185
	Urgent Contract Order GH78566484,pdf.exe	Get hash	malicious	Browse	145.14.145.185
	Invoice_OS169ENG 000003893148.exe	Get hash	malicious	Browse	145.14.145.185
	00404000004.exe	Get hash	malicious	Browse	145.14.145.185
	40900900090000.exe	Get hash	malicious	Browse	145.14.145.185
	INVO090090202.exe	Get hash	malicious	Browse	145.14.145.185
	Yl6482CO6U.exe	Get hash	malicious	Browse	145.14.145.185
	ZmZvKByoew.exe	Get hash	malicious	Browse	145.14.145.185
	V2GC02n03l.exe	Get hash	malicious	Browse	145.14.145.185
	SecuriteInfo.com.Trojan.PackedNET.832.3222.exe	Get hash	malicious	Browse	145.14.145.185

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Serwices.exe_93af22b7c6936c1e8864515da72a114c413263e5_cb538d12_1b15506f\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	12010
Entropy (8bit):	3.774565564979862
Encrypted:	false
SSDEEP:	96:cKBY1blUOaHoCKA+HxyrFpXIQcQvc6QcEDMcw3D7+BHUHZ0ownOgtYsH5Ef5BAKD:365CONJkHBUZMXCaK5/u7sWS274ItS8
MD5:	5DAA7ECC705CD7DFB9CBF018ECDE97B1
SHA1:	F46A6FB75438243DAE15455B18483478ED84B9A8
SHA-256:	225C88C1C83DA91E88F36EBAA843756AF01AB7583A884E437AD7E8A43CD4AA24
SHA-512:	BFDD484930711CB1FFB9F533878EC308CB63CFAEFB09299EE6DE2FCCCC91DCDF0A252F4A83E66AF4CDEF94279329AFFD7B7448E0106FD91E42871AB28A469E5C
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.2.6.7.8.5.8.4.7.0.6.6.5.2.8.1.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.6.7.8.5.8.4.7.1.8.2.1.5.2.4.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.2.6.8.4.3.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.3.6.e.8.2.2.1.-.9.7.0.4.-.4.2.6.6.-.8.5.0.d.-.6.4.8.0.0.5.3.6.0.1.c.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.b.0.5.5.b.f.5.-.c.6.1.1.-.4.2.d.3.-.a.7.7.5.-.b.e.9.5.d.a.e.b.e.2.7.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.r.w.i.c.e.s...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.v.m.w.a.r.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.8.8.-.0.0.0.1.-.0.0.1.7.-.1.c.1.8.-.4.9.4.2.7.8.5.e.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.9.5.9.c.1.5.1.2.c.7.6.9.4.f.9.f.a.b.8.4.8.8.f.2.9.4.7.5.e.9.2.0.0.0.0.0.9.0.4.!.0.0.0.0.6.7.f.2.3.a.5.9.9.e.4.a.5.4.a.2.f.3.c.e.1.2.1.9.9.8.4.4.5.e.1.2.c.9.7.b.a.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER46DA.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Jun 11 04:14:31 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	173962
Entropy (8bit):	4.082057247202298
Encrypted:	false
SSDEEP:	3072:wZ8M019jd+pUuKlaxaA9gIOgF5EJ0wUCgUA4uEdE4S:kR01CpU/G9RpDEJ/TjF52
MD5:	9C8F47B83F268474E818DA5ACE982FF2
SHA1:	F41755213227525E94F452F2B81FDC930C451DE1
SHA-256:	F0325AC74642D469244F61D2547BDB6415D4512A5ADB731A0EBD91CAA9E7CE20
SHA-512:	99C94E3F330598D7FDAFBC77F387A5817D3A1FE0833E46A3C52797F893A7D701A86C523BE2C91490D32F8E24458E1E147C7DA9714129A9036E8B69B8B30B32D7
Malicious:	false
Reputation:	low
Preview:	MDMP....... .......'..`...................U...........B..............GenuineIntelW...........T..............`.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4A27.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8426
Entropy (8bit):	3.691768294096698
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNicd6f6Y3R66EgmfZyZSACpra89be2sf0Uqm:RrlsNiG6f6Ys6EgmfsZSLeVfh
MD5:	FB0677DEBD76EB2BCEAF2ED1178995DF
SHA1:	E6666F89FE4D01824C3CDF32171B0CC0E8E9E4E7
SHA-256:	11099575EAA1A33756986BF3EC35E8D712AF52A2F76D70540538CB6317738AF4
SHA-512:	CDA4FDBBB519F41A5F70C43BF4AC8113387E39D83B3F023651C6BE5CD37768E1ACFA3D4BE9F9ACE10B930DA607F70BE4C749B1B089A5EA591EBC2180367D50EA
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.9.2.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4AC4.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4769
Entropy (8bit):	4.467016938878392
Encrypted:	false
SSDEEP:	48:cvIwSD8zsDQ+JgtWI96cWSC8BV8fm8M4JRuJ7Z9prFf3+q8vvJ7Z9p7QbLCtd:uITfDndVSNYJmHpB3KRHp74LCtd
MD5:	99C00274635D1060D1F6D7DBDD56940B
SHA1:	6264B67C73AAC31E63B86E0820786C1C81A13F1D
SHA-256:	3A3E92B8E574BCB6EF773CD966D196E4789A28E55019ED47689589263260A8A8
SHA-512:	4ADAFA97E98D203309DD16FE5D11C94AC71EAA51D5CD7F9609F92419E363A5099F732B1F91AD015995ED2C4D1D7F4443E4CAE8849E59164DC6C157529DA06281
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1028965" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Local\Temp\Serwices.exe Download File
Process:	C:\Users\user\Desktop\WcHO1ZGiIn.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	795648
Entropy (8bit):	7.913350326783711
Encrypted:	false
SSDEEP:	12288:wZJ5gK0I2omOHu1/CQ8tl//tR05iIm5Cqz7cQuBcTex:s6KlifUQ8bHtUm8qz7IBR
MD5:	CF1048A8362B93B9CDF47260B50D8F37
SHA1:	67F23A599E4A54A2F3CE121998445E12C97BA1BA
SHA-256:	CB9CD8363620446C577396DD11CA16CD0AC377534C7A708CAC3F94CE6D898279
SHA-512:	600B9B617BB409D3C00305CBF79E0D3E9DE5101C9A5BF5417C3FEA79378437D5837F0D2E2BC64F4098C584ADE1438B0A9E4E486E854870E5B91CFB584F2F3258
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../.................P..............9... ...@....@.. ....................................@..................................8..K....@.......................`.......8............................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................9......H........@...:......D...L{..Z............................................0..@.......+.(.:59(....8.....(.... .....9....&8....8........E........8....:+.(..y\.(.....B+.(6.j>~..........6+.(..!9~.......0..B.......+.(._d(....8......(.... .....9....&8....8........E........8.......:+.(..f0.(.....B+.(e..7~..........6+.(.LrV~.......0..........+.((/4T ........8........E....f...+...u...........8a...*(.... .....:....&8....s.........8....s......... .....:....&8....s......... .....

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.272353284477175
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	WcHO1ZGiIn.exe
File size:	19456
MD5:	c7b10eb81f543debd7092703917cf6e5
SHA1:	cfa927622c9ffb371aeb7fdbb4c32798ec6fbcdd
SHA256:	aa46ed83ddd4f41f0c8eff6a404206cad70a7ecf4dd8754ee305655ffffee4bb
SHA512:	6aa867a242f0fdec77310e18ef09796ce3f56b6b60afd801f33148abe2c5d1ff0bac7824b6133ab7b8b7d479f1d7781e1ac8b30c29aea98562f93d8e83dbf39f
SSDEEP:	384:IuVlhGV5r4e8H+3LgLzLrnUZMctVdLtLCmL9qJRRYff9vwEG9/XwJwq6uJfq2GSq:IuI5r4VeknXctRCy4RRR2GzNigP
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...rt^...............0..B...........a... ........@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x40611e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0xF65E7472 [Sat Dec 25 02:35:30 2100 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x60d0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8000	0x5e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x6082	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x4124	0x4200	False	0.441761363636	data	5.48630335217	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x8000	0x5e8	0x600	False	0.42578125	data	4.1909894425	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa000	0xc	0x200	False	0.044921875	data	0.0815394123432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x80a0	0x35c	data
RT_MANIFEST	0x83fc	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2021
Assembly Version	1.0.0.0
InternalName	WindowsFormsApp9.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	WindowsFormsApp9
ProductVersion	1.0.0.0
FileDescription	WindowsFormsApp9
OriginalFilename	WindowsFormsApp9.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 10, 2021 21:14:19.525855064 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:19.681579113 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:19.681726933 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:19.713035107 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:19.868745089 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:19.870215893 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:19.870240927 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:19.870256901 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:19.870270967 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:19.870285988 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:19.870363951 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:19.875194073 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.032926083 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.086909056 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.246254921 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.246299982 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.246337891 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.246366978 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.246402025 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.246417046 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.246442080 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.246442080 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.246480942 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.246488094 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.246527910 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.246570110 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.246582985 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.246608019 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.246655941 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.402234077 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.402275085 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.402309895 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.402326107 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.402345896 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.402381897 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.402394056 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.402420044 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.402462959 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.402463913 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.402503014 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.402538061 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.402549028 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.402573109 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.402607918 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.402618885 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.402643919 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.402678967 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.402688980 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.402714014 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.402755022 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.402757883 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.402797937 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.402831078 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.402841091 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.402865887 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.402901888 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.402909040 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.402937889 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.402981043 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.558526993 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558551073 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558572054 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558589935 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558604956 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558608055 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.558621883 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558629990 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.558641911 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558657885 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558659077 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.558686018 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558689117 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558698893 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558702946 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.558712959 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558726072 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558738947 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558758020 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558774948 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558792114 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558808088 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558820963 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.558825970 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558847904 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558850050 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.558866978 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558883905 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558901072 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558902025 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.558917999 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558933973 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558937073 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.558952093 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558958054 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.558969975 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558990002 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.558995008 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.559009075 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.559025049 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.559031963 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.559042931 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.559060097 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.559076071 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.559082031 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.559093952 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.559109926 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.559127092 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.559135914 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.559150934 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.559170961 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.559187889 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.559189081 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.559205055 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.559221983 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.559228897 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.559257984 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.714880943 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.714906931 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.714920998 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.714932919 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.714948893 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.714965105 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.714979887 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.714998007 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.714997053 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.715013027 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715028048 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.715033054 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715049982 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715056896 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.715065956 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715075970 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.715082884 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715101004 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715110064 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.715135098 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715140104 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.715152025 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715167999 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715187073 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715199947 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.715204000 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715221882 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.715221882 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715240955 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715260029 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715275049 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715282917 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.715292931 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715308905 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715317011 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.715326071 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715334892 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.715344906 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715362072 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715368032 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.715379000 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715398073 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715404987 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.715420961 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715436935 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715454102 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715457916 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.715471983 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715487003 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715496063 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.715502977 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715519905 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715534925 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715548992 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715549946 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.715559959 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.715565920 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715579033 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.715584993 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715603113 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715611935 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.715620041 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715636015 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715646982 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.715651989 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715667963 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715676069 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.715683937 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715701103 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.715723038 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.715759993 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.871356010 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.871401072 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.871440887 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.871465921 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.871483088 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.871521950 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.871539116 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.871562004 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.871601105 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.871612072 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.871651888 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.871685982 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.871726990 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.871738911 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.871766090 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.871777058 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.871805906 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.871853113 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.871854067 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.871897936 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.871936083 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.871948004 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.871973991 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872013092 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872020006 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.872049093 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872087002 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872102022 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.872126102 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872173071 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.872173071 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872217894 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872253895 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872263908 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.872292995 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872330904 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872334957 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.872368097 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872406006 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872416019 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.872445107 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872490883 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.872493029 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872535944 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872572899 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872580051 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.872612953 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872651100 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872657061 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.872687101 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872725964 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872731924 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.872762918 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872807980 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.872809887 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872853041 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872889996 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872900963 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.872931004 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872970104 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.872977972 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.873008966 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.873047113 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.873058081 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.873085976 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.873131037 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.873138905 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.873182058 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.873219013 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.873224020 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:20.873259068 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:20.873302937 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.028887987 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.028922081 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.028944969 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.028966904 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.028987885 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029014111 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029041052 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029057026 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.029062033 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029086113 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029107094 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029114962 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.029119015 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.029129982 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029150963 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029165983 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.029174089 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029198885 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029207945 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.029222965 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029243946 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029248953 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.029261112 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029283047 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029297113 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.029308081 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029330969 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029334068 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.029352903 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029376030 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029397011 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029417038 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029437065 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.029452085 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029474020 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029476881 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.029500961 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029519081 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.029522896 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029544115 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029565096 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029573917 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.029587030 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029607058 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029618025 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.029627085 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029649019 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029652119 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.029665947 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029686928 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029700994 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.029706001 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029728889 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029736996 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.029751062 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029777050 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029777050 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.029800892 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029820919 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029828072 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.029843092 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029865026 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029874086 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.029886961 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029907942 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029911041 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.029930115 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029958963 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.029959917 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.030015945 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.188559055 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.188616037 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.188649893 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.188694954 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.188736916 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.188772917 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.188808918 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.188843966 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.188879013 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.188914061 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.188950062 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.188952923 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.188994884 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189007998 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.189033985 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189069986 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189090014 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.189105988 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189116955 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.189143896 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189171076 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189198971 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189234972 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189241886 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.189270973 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.189271927 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189306021 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189348936 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189352989 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.189388037 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189421892 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.189424038 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189460039 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189476967 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.189511061 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189527035 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189547062 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189587116 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189606905 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189640999 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189677000 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189711094 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189743996 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189778090 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189811945 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189853907 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189892054 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189925909 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189961910 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.189996958 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.190030098 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.190063953 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.190098047 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.190133095 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.190140963 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.190180063 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.190181017 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.190216064 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.190228939 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.190252066 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.190411091 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.345937014 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.345968008 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.345980883 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.345998049 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346009970 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346023083 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346035004 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346051931 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346067905 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346084118 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346100092 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346116066 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346133947 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346152067 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346173048 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346189976 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346205950 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346223116 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346240997 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346257925 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346276999 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346275091 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.346292973 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346314907 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346324921 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.346335888 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346344948 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.346354961 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346368074 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346385002 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346393108 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.346405983 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346415997 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.346427917 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346445084 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346445084 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.346462011 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346477985 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346488953 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.346498013 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346514940 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346524954 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.346533060 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346554995 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346559048 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.346575022 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346592903 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346613884 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346621037 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.346631050 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346647024 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346654892 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.346663952 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346677065 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.346682072 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346703053 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346710920 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.346720934 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346738100 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346754074 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346764088 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.346771002 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346788883 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346796989 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.346807003 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346822977 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.346824884 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346846104 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346854925 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.346864939 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346883059 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346896887 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.346900940 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346918106 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346926928 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.346936941 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346955061 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346967936 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.346971989 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.346992016 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347002029 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347021103 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347038031 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347047091 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347054958 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347068071 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347080946 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347094059 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347094059 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347110033 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347134113 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347157955 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347170115 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347176075 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347193003 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347208023 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347223997 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347232103 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347244978 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347251892 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347255945 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347264051 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347280025 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347287893 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347297907 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347306967 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347313881 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347330093 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347345114 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347354889 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347362041 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347382069 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347392082 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347399950 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347414970 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347418070 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347435951 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347443104 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347451925 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347466946 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347476959 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347486019 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347501993 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347522020 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347529888 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347539902 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347556114 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347564936 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347572088 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347580910 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347589970 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347608089 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347624063 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347626925 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347640038 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347660065 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347670078 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347678900 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347693920 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347703934 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347711086 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347723961 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347728968 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347745895 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347755909 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347762108 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347778082 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347790956 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347798109 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347812891 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347815037 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347831964 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347847939 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347856998 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347863913 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347878933 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347893000 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347894907 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347910881 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347915888 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.347930908 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347949028 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.347949028 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.348017931 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.348165989 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.349737883 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.503689051 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.503720045 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.503731012 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.503743887 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.503757000 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.503770113 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.503781080 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.503794909 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.503807068 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.503818989 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.503830910 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.503842115 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.503854990 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.503854990 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.503869057 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.503881931 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.503895044 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.503905058 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.503909111 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.503922939 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.503937960 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.503951073 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.503963947 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.503972054 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.503977060 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.503989935 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504002094 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504003048 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504017115 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504024029 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504029989 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504045963 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504048109 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504065037 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504079103 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504085064 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504086971 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504092932 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504106998 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504118919 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504131079 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504143000 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504156113 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504163980 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504168034 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504194975 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504216909 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504223108 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504241943 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504254103 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504266024 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504278898 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504292965 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504292965 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504307032 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504319906 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504321098 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504336119 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504348040 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504352093 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504360914 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504375935 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504378080 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504388094 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504400015 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504410982 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504424095 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504436970 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504448891 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504460096 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504475117 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504486084 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504498959 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504503965 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504512072 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504525900 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504539013 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504550934 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504554987 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504568100 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504585028 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504586935 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504606009 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504607916 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504622936 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504640102 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504640102 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504653931 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504667997 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504673958 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504692078 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504709005 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504719973 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504739046 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504753113 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504755020 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504771948 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504785061 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504787922 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504802942 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504817963 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504821062 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504831076 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504843950 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504846096 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504859924 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504872084 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504884958 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504897118 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504898071 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504909039 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504924059 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504933119 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.504935026 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504971027 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.504977942 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.505002975 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.505007982 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.505024910 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.505040884 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.505055904 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.505070925 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.505074978 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.505101919 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.505125046 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.505778074 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.505953074 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.505970955 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.505981922 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.505994081 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.506006002 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.506019115 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.506021976 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.506030083 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.506047010 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.506059885 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.506068945 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.506072998 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.506094933 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.506103992 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.506123066 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.506134987 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.506139994 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.506154060 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.506166935 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.506171942 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.506181002 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.506194115 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.506206989 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.506218910 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.506231070 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.506232977 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.506248951 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.506258965 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.506270885 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.506279945 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.506321907 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.506344080 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.507981062 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.661664963 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.661720037 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.661737919 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.661753893 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.661781073 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.661802053 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.661824942 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.661845922 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.661863089 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.661894083 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.661896944 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.661921978 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.661933899 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.661946058 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.661959887 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.661967993 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.661990881 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.661993027 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662015915 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662035942 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662044048 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.662055969 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662074089 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.662076950 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662098885 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662120104 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662141085 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662163973 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662185907 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662205935 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662231922 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662252903 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662275076 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662297010 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662316084 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662339926 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662362099 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662381887 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662401915 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662422895 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662436962 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.662446976 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662470102 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662478924 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.662489891 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662513018 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662524939 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.662555933 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662579060 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662601948 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662606955 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.662625074 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662645102 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662663937 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662664890 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.662686110 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662705898 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.662710905 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662733078 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662734985 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.662755013 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662766933 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.662777901 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662801027 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662815094 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.662822008 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662846088 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662863016 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662877083 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.662880898 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662898064 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662914038 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.662919998 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662934065 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.662938118 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662955999 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662966967 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.662971020 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.662987947 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663002968 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663017035 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663017035 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.663028955 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663043976 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663064003 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.663074017 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663086891 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.663089037 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663132906 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.663141012 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663156986 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663172007 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663187981 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663198948 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.663203955 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663219929 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663228035 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.663233995 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663245916 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663256884 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.663261890 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663276911 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663284063 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.663294077 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663310051 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663311005 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.663328886 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663336039 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.663346052 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663362026 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663369894 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.663377047 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663393974 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663403034 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.663408995 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663424969 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663429022 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.663438082 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663455009 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663470984 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663485050 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663486958 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.663500071 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663516998 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663533926 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663549900 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663563013 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663573980 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663588047 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663605928 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663621902 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663636923 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663651943 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663667917 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663681984 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663697004 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663712978 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663731098 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663748026 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663764000 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663779020 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663794994 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663809061 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663824081 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:21.663949013 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.664005041 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.664007902 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.664011002 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.664012909 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.664016008 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.664017916 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.664020061 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.664021969 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.664022923 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.664025068 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.664027929 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.664030075 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:21.664133072 CEST	49730	443	192.168.2.3	145.14.145.185
Jun 10, 2021 21:14:26.503714085 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:26.503777981 CEST	443	49730	145.14.145.185	192.168.2.3
Jun 10, 2021 21:14:26.503876925 CEST	49730	443	192.168.2.3	145.14.145.185

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 10, 2021 21:14:04.051471949 CEST	65110	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:04.106400967 CEST	53	65110	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:04.893229961 CEST	58361	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:04.943209887 CEST	53	58361	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:05.265923023 CEST	63492	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:05.329279900 CEST	53	63492	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:05.830352068 CEST	60831	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:05.883260965 CEST	53	60831	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:06.741235018 CEST	60100	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:06.794199944 CEST	53	60100	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:08.078217030 CEST	53195	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:08.136753082 CEST	53	53195	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:09.372401953 CEST	50141	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:09.422800064 CEST	53	50141	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:10.403006077 CEST	53023	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:10.461813927 CEST	53	53023	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:11.502954960 CEST	49563	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:11.564218998 CEST	53	49563	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:13.270251989 CEST	51352	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:13.320274115 CEST	53	51352	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:14.110471964 CEST	59349	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:14.160654068 CEST	53	59349	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:15.065490007 CEST	57084	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:15.116055012 CEST	53	57084	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:15.917059898 CEST	58823	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:15.968802929 CEST	53	58823	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:17.128721952 CEST	57568	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:17.180223942 CEST	53	57568	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:18.163235903 CEST	50540	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:18.216157913 CEST	53	50540	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:19.231982946 CEST	54366	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:19.282469988 CEST	53	54366	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:19.337354898 CEST	53034	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:19.411669016 CEST	53	53034	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:19.430387020 CEST	57762	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:19.504928112 CEST	53	57762	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:20.184261084 CEST	55435	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:20.250989914 CEST	53	55435	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:21.093998909 CEST	50713	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:21.153203011 CEST	53	50713	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:22.254842997 CEST	56132	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:22.314357996 CEST	53	56132	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:23.148286104 CEST	58987	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:23.201273918 CEST	53	58987	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:31.792181015 CEST	56579	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:31.843832970 CEST	53	56579	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:38.072204113 CEST	60633	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:38.194169998 CEST	53	60633	8.8.8.8	192.168.2.3
Jun 10, 2021 21:14:41.569597960 CEST	61292	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:14:41.639436960 CEST	53	61292	8.8.8.8	192.168.2.3
Jun 10, 2021 21:15:00.065572023 CEST	63619	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:15:00.119738102 CEST	53	63619	8.8.8.8	192.168.2.3
Jun 10, 2021 21:15:00.299175024 CEST	64938	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:15:00.350433111 CEST	53	64938	8.8.8.8	192.168.2.3
Jun 10, 2021 21:15:00.458833933 CEST	61946	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:15:00.511607885 CEST	53	61946	8.8.8.8	192.168.2.3
Jun 10, 2021 21:15:13.783803940 CEST	64910	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:15:13.862616062 CEST	53	64910	8.8.8.8	192.168.2.3
Jun 10, 2021 21:15:15.366724968 CEST	52123	53	192.168.2.3	8.8.8.8
Jun 10, 2021 21:15:15.429522991 CEST	53	52123	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 10, 2021 21:14:19.337354898 CEST	192.168.2.3	8.8.8.8	0xf17a	Standard query (0)	mmeetalss.000webhostapp.com	A (IP address)	IN (0x0001)
Jun 10, 2021 21:14:19.430387020 CEST	192.168.2.3	8.8.8.8	0xe7c4	Standard query (0)	mmeetalss.000webhostapp.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jun 10, 2021 21:14:19.411669016 CEST	8.8.8.8	192.168.2.3	0xf17a	No error (0)	mmeetalss.000webhostapp.com	us-east-1.route-1.000webhost.awex.io		CNAME (Canonical name)	IN (0x0001)
Jun 10, 2021 21:14:19.411669016 CEST	8.8.8.8	192.168.2.3	0xf17a	No error (0)	us-east-1.route-1.000webhost.awex.io		145.14.145.185	A (IP address)	IN (0x0001)
Jun 10, 2021 21:14:19.504928112 CEST	8.8.8.8	192.168.2.3	0xe7c4	No error (0)	mmeetalss.000webhostapp.com	us-east-1.route-1.000webhost.awex.io		CNAME (Canonical name)	IN (0x0001)
Jun 10, 2021 21:14:19.504928112 CEST	8.8.8.8	192.168.2.3	0xe7c4	No error (0)	us-east-1.route-1.000webhost.awex.io		145.14.144.201	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jun 10, 2021 21:14:19.870256901 CEST	145.14.145.185	443	192.168.2.3	49730	CN=*.000webhostapp.com CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Jun 11 02:00:00 CEST 2019 Mon Nov 06 13:23:33 CET 2017 Fri Nov 10 01:00:00 CET 2006	Sat Jul 10 14:00:00 CEST 2021 Sat Nov 06 13:23:33 CET 2027 Mon Nov 10 01:00:00 CET 2031	769,49162-49161-49172-49171-53-47-10,0-10-11-35-23-65281,29-23-24,0	54328bd36c14bd82ddaa0c04b25ed9ad
					CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:33 CET 2017	Sat Nov 06 13:23:33 CET 2027
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: WcHO1ZGiIn.exe PID: 6304 Parent PID: 5824

General

Start time:	21:14:11
Start date:	10/06/2021
Path:	C:\Users\user\Desktop\WcHO1ZGiIn.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\WcHO1ZGiIn.exe'
Imagebase:	0x370000
File size:	19456 bytes
MD5 hash:	C7B10EB81F543DEBD7092703917CF6E5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: Serwices.exe PID: 6792 Parent PID: 6304

General

Start time:	21:14:23
Start date:	10/06/2021
Path:	C:\Users\user\AppData\Local\Temp\Serwices.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\Serwices.exe'
Imagebase:	0xee0000
File size:	795648 bytes
MD5 hash:	CF1048A8362B93B9CDF47260B50D8F37
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Matiex, Description: Yara detected Matiex Keylogger, Source: 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_BedsObfuscator, Description: Yara detected Beds Obfuscator, Source: 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000002.254454317.0000000004319000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Matiex, Description: Yara detected Matiex Keylogger, Source: 00000004.00000002.254827606.0000000004475000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_BedsObfuscator, Description: Yara detected Beds Obfuscator, Source: 00000004.00000002.254827606.0000000004475000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000002.254827606.0000000004475000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Matiex, Description: Yara detected Matiex Keylogger, Source: 00000004.00000000.236597835.0000000004475000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_BedsObfuscator, Description: Yara detected Beds Obfuscator, Source: 00000004.00000000.236597835.0000000004475000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.236597835.0000000004475000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Matiex, Description: Yara detected Matiex Keylogger, Source: 00000004.00000000.241943402.0000000004475000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_BedsObfuscator, Description: Yara detected Beds Obfuscator, Source: 00000004.00000000.241943402.0000000004475000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.241943402.0000000004475000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Matiex, Description: Yara detected Matiex Keylogger, Source: 00000004.00000000.241561167.0000000004319000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_BedsObfuscator, Description: Yara detected Beds Obfuscator, Source: 00000004.00000000.241561167.0000000004319000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.241561167.0000000004319000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Matiex, Description: Yara detected Matiex Keylogger, Source: 00000004.00000000.236472239.0000000004319000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_BedsObfuscator, Description: Yara detected Beds Obfuscator, Source: 00000004.00000000.236472239.0000000004319000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.236472239.0000000004319000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 66%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: WerFault.exe PID: 7032 Parent PID: 6792

General

Start time:	21:14:29
Start date:	10/06/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6792 -s 852
Imagebase:	0x1110000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: WcHO1ZGiIn.exe PID: 6304 Parent PID: 5824 WcHO1ZGiIn.exeCOMMON

Execution Graph

Execution Coverage:	11.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.3%
Total number of Nodes:	132
Total number of Limit Nodes:	8

Executed Functions

Function 072A3008, Relevance: .4, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1299475132.00000000072A0000.00000040.00000001.sdmp, Offset: 072A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72a0000_WcHO1ZGiIn.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: a7cc2b03af3103608960c7708d46fb1f294da9feb041cb1fe84d6252a5644b9b
Instruction ID: b9b3ec9f4345bb74beec663229735ecaee25f99392487d87f9b86b428f9c7c2d
Opcode Fuzzy Hash: a7cc2b03af3103608960c7708d46fb1f294da9feb041cb1fe84d6252a5644b9b
Instruction Fuzzy Hash: DBF18FB0A1020AEFDB14DFA9C844B9DBBF1FF88314F158569E405AF266DB70E845CB41

Uniqueness

Uniqueness Score: -1.00%

Function 025E9828, Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 025E9A6E

Memory Dump Source

Source File: 00000000.00000002.1293936559.00000000025E0000.00000040.00000001.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_WcHO1ZGiIn.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f4339dcb38568f2af88aaa2b9b30eb61fe9c2d279102485175fbb1158dee3b8e
Instruction ID: 36c3804e89e7cd7d3ff22aeea3f7a2a5e7db51ec9129336d395d45a721c83b3c
Opcode Fuzzy Hash: f4339dcb38568f2af88aaa2b9b30eb61fe9c2d279102485175fbb1158dee3b8e
Instruction Fuzzy Hash: DC7124B0A00B058FDB28DF2AC05475ABBF5FF88214F00892EE49AD7A50DB35E805CB95

Uniqueness

Uniqueness Score: -1.00%

Function 025E53C7, Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 025E5481

Memory Dump Source

Source File: 00000000.00000002.1293936559.00000000025E0000.00000040.00000001.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_WcHO1ZGiIn.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 385aa3bf7d210b174fc00b8b2fb60c9ef0113ec4eaf1526f3aaa6e586a0d94b1
Instruction ID: 70907b95c6611518ca1ed8994aa55a03ba5aa159ac8134b306cf85527008bb49
Opcode Fuzzy Hash: 385aa3bf7d210b174fc00b8b2fb60c9ef0113ec4eaf1526f3aaa6e586a0d94b1
Instruction Fuzzy Hash: D441F171C00619CFDB24DFA9C844BDEBBB1BF88308F20806AD509BB251DB756946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 025E3CC4, Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 025E5481

Memory Dump Source

Source File: 00000000.00000002.1293936559.00000000025E0000.00000040.00000001.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_WcHO1ZGiIn.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3eac1ea0f1b4cbe7a2e9db22d067f603e8ac6dc1b3e9c66a0cc61a1dd7ae9f1e
Instruction ID: c3d836b9cc963446753b82a5b3662e9fdaf154fc816ed8a7baf74b9fc85ee6ad
Opcode Fuzzy Hash: 3eac1ea0f1b4cbe7a2e9db22d067f603e8ac6dc1b3e9c66a0cc61a1dd7ae9f1e
Instruction Fuzzy Hash: B5410271C00619CBDF24DFA9C844BCEBBB1BF48308F60846AD509BB251EB756945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 025EC13A, Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,025EC106,?,?,?,?,?), ref: 025EC1C7

Memory Dump Source

Source File: 00000000.00000002.1293936559.00000000025E0000.00000040.00000001.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_WcHO1ZGiIn.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 320e3f3f29437b0e8541296af8366685d0f886e934a31ff3ad00702719f569f6
Instruction ID: 2453c3cd47fc67cf3ff21aa4f790449dab4a5109a2ed568eb7b00d0bfe821921
Opcode Fuzzy Hash: 320e3f3f29437b0e8541296af8366685d0f886e934a31ff3ad00702719f569f6
Instruction Fuzzy Hash: 5021E3B59002489FDB10CFAAD884ADEBBF8FB48324F14841AE955A7310C374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 025EA58C, Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,025EC106,?,?,?,?,?), ref: 025EC1C7

Memory Dump Source

Source File: 00000000.00000002.1293936559.00000000025E0000.00000040.00000001.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_WcHO1ZGiIn.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 64c7b5e430b6743ba5ba716b78f14fc279d8eebdeb809143bbe58e9fa476d1f4
Instruction ID: 5e0364a015d4c6fec1fb061ef2ab4d27fa01c4c0dc61a00519be1cf6b285330b
Opcode Fuzzy Hash: 64c7b5e430b6743ba5ba716b78f14fc279d8eebdeb809143bbe58e9fa476d1f4
Instruction Fuzzy Hash: CD21E5B59002089FDF14DF9AD984ADEBBF4FB48324F14845AE915B3310D374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 025E8BA8, Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,025E9AE9,00000800,00000000,00000000), ref: 025E9CFA

Memory Dump Source

Source File: 00000000.00000002.1293936559.00000000025E0000.00000040.00000001.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_WcHO1ZGiIn.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d9b72fcca5b40b9b859790c3d6b9e81ac768247d22d65999ef67ef3af6abf09d
Instruction ID: 3010eb68da8148686b185dc88873e61cb26f911b35142c101e1135f90716eae7
Opcode Fuzzy Hash: d9b72fcca5b40b9b859790c3d6b9e81ac768247d22d65999ef67ef3af6abf09d
Instruction Fuzzy Hash: F01103B69002099FDB14DF9AC844ADEBBF4FB88324F10842AE51AB7200C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 025E9A08, Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 025E9A6E

Memory Dump Source

Source File: 00000000.00000002.1293936559.00000000025E0000.00000040.00000001.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_WcHO1ZGiIn.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1d9e258943aa854174a78c3421768bfc375539c84e3ef0ad420ac13f4b48c266
Instruction ID: a60adc64c11d2c71445f1a9f04cfccdac23cf48fb01770e70a11f17ac916283a
Opcode Fuzzy Hash: 1d9e258943aa854174a78c3421768bfc375539c84e3ef0ad420ac13f4b48c266
Instruction Fuzzy Hash: DA11DFB6D006498FCB24CF9AC844ADEFBF4AF88224F14855AD46AA7600C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 072A1B0C, Relevance: 1.5, APIs: 1, Instructions: 46
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,072A332F), ref: 072A3DC5

Memory Dump Source

Source File: 00000000.00000002.1299475132.00000000072A0000.00000040.00000001.sdmp, Offset: 072A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72a0000_WcHO1ZGiIn.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 8e7782a58bfcd5af1e38227c7e82ef2617021a79cea07d566aa84946f562c4f5
Instruction ID: e3ae2b36faabd420117768b81fce8a523c8a319dfd191632c043faa0f0656716
Opcode Fuzzy Hash: 8e7782a58bfcd5af1e38227c7e82ef2617021a79cea07d566aa84946f562c4f5
Instruction Fuzzy Hash: A211FEB1D14649DFDB20DF9AD844BDEBBF4EB48324F10886AE419B3600D378A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 072A3D60, Relevance: 1.5, APIs: 1, Instructions: 45
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,072A332F), ref: 072A3DC5

Memory Dump Source

Source File: 00000000.00000002.1299475132.00000000072A0000.00000040.00000001.sdmp, Offset: 072A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72a0000_WcHO1ZGiIn.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 35bb30351314a1174fb23e995bfc598ced74835503ff3e69e8b6d06f94c29709
Instruction ID: 7a702cd024683936767dfda85a82306c874b61551977b91da3cbafff406e45c9
Opcode Fuzzy Hash: 35bb30351314a1174fb23e995bfc598ced74835503ff3e69e8b6d06f94c29709
Instruction Fuzzy Hash: E911F2B5D04689DFCB10DF9AD844BDEBBF4EB48324F10881AD469B7600D778A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C4D1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293068825.0000000000C4D000.00000040.00000001.sdmp, Offset: 00C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c4d000_WcHO1ZGiIn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 983de6c32fa364668d15dc121f1e8003cf0938ae379b0561d143e145046c7eb2
Instruction ID: e1ac18efbb94dde468fec4431df74d7165fc5d49e958283955d0cd2c96dab428
Opcode Fuzzy Hash: 983de6c32fa364668d15dc121f1e8003cf0938ae379b0561d143e145046c7eb2
Instruction Fuzzy Hash: ED2107B1504200DFDB15EF14D9C0B26BBA5FB84318F24C6ADE90A4B342C776DC46CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00C4D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293068825.0000000000C4D000.00000040.00000001.sdmp, Offset: 00C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c4d000_WcHO1ZGiIn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab15ff9c5052af4eec1cc135a4ca17f43ed80f08cb3cdbc884b76f0fded956eb
Instruction ID: a694b850bf3b9c13c8c9c383905c2a8677bf885c3768e917183bdc87934343f1
Opcode Fuzzy Hash: ab15ff9c5052af4eec1cc135a4ca17f43ed80f08cb3cdbc884b76f0fded956eb
Instruction Fuzzy Hash: EC21F2B5504240DFCB14EF24D9C4B26BB65FB84318F24C5A9E90A4B246C73AD847CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00C4D005, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293068825.0000000000C4D000.00000040.00000001.sdmp, Offset: 00C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c4d000_WcHO1ZGiIn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35078fcb9f367eec25d304a6f07d60ae3c12b990051584f8a6e335e1da245459
Instruction ID: cd58922fe69c3625c20bf7bd9ec815ab19fd73cbb2631c1083c28886db250445
Opcode Fuzzy Hash: 35078fcb9f367eec25d304a6f07d60ae3c12b990051584f8a6e335e1da245459
Instruction Fuzzy Hash: 052180755093C08FCB02DF24D994715BF71FB46314F28C5EAD8498B697C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C4D1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293068825.0000000000C4D000.00000040.00000001.sdmp, Offset: 00C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c4d000_WcHO1ZGiIn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa6bdbb04686500b4f88f9c2907b36233d3495acb1519a01dcdcc91fed9e3004
Instruction ID: a534b3ec53290cc583ef6183d619e2fac5c747a1f16beeca5a58beb6448e0424
Opcode Fuzzy Hash: aa6bdbb04686500b4f88f9c2907b36233d3495acb1519a01dcdcc91fed9e3004
Instruction Fuzzy Hash: 20119D75904280DFCB11DF14D5C4B15FBB1FB84324F28C6ADD84A4B656C37AD94ACB61

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 025EE9F8, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293936559.00000000025E0000.00000040.00000001.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_WcHO1ZGiIn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d33bc17dd70517a0c9c0832431f1f3fcd903529d903cc942ff139fb290da848
Instruction ID: a6f2d3f00d805ef79f0c3dacdba9bb537cccc7668e94821fb11829b396aec527
Opcode Fuzzy Hash: 2d33bc17dd70517a0c9c0832431f1f3fcd903529d903cc942ff139fb290da848
Instruction Fuzzy Hash: 4012C6F9C917468BD310DF65E49818D3BE1B761328BD06A0AD2E32AAD1D7B411EECF44

Uniqueness

Uniqueness Score: -1.00%

Function 025EC014, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293936559.00000000025E0000.00000040.00000001.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_WcHO1ZGiIn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c26b20839ac91efdf9ee8c87e8a3e93498f076fb7a76f9db52fee4b423a5b77e
Instruction ID: 7401bf702688ce98c006f2b972b60030bc4c36ad9cdd9cdf29fbfa6c90b3d8d1
Opcode Fuzzy Hash: c26b20839ac91efdf9ee8c87e8a3e93498f076fb7a76f9db52fee4b423a5b77e
Instruction Fuzzy Hash: 57A17D36E1061ACFCF09DFB5C8445ADBBB2FF85304B15856AE906AB220EB71E955CF40

Uniqueness

Uniqueness Score: -1.00%

Function 025EE9EA, Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293936559.00000000025E0000.00000040.00000001.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_WcHO1ZGiIn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaa3e961e1d46cd7caf1e1ec12b10fba552fd54dd474a503b283a2a67abfa199
Instruction ID: 71bcaa875f43029c1e3a234c25d78f219bed60c00219d133f6fe5ef4a3cec577
Opcode Fuzzy Hash: eaa3e961e1d46cd7caf1e1ec12b10fba552fd54dd474a503b283a2a67abfa199
Instruction Fuzzy Hash: F2C12FF9C517458BD710DF65E89418D3BE1BB65328F906A0AD2A32BAD0D7B410EECF84

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report WcHO1ZGiIn

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

CPU Usage

Function 072A3008, Relevance: .4, Instructions: 396
COMMON

Function 025E9828, Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Function 025E53C7, Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 025E3CC4, Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 025EC13A, Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 025EA58C, Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 025E8BA8, Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 025E9A08, Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 072A1B0C, Relevance: 1.5, APIs: 1, Instructions: 46
windowCOMMON

Function 072A3D60, Relevance: 1.5, APIs: 1, Instructions: 45
windowCOMMON