Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
RFQ_31362.exe

Overview

General Information

Sample Name:RFQ_31362.exe
Analysis ID:831166
MD5:c3c291b38d054d5e71fe17a10d737249
SHA1:86411ff9d41eb140c80753873b943d80be323130
SHA256:9fcf0a498b86fc20af3cc28a984135f0cc202f6577af79f96ec63ca6cb227c3c
Tags:AveMariaRATexeRAT
Infos:

Detection

AveMaria, UACMe
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected UACMe UAC Bypass tool
Yara detected AveMaria stealer
Snort IDS alert for network traffic
Installs a global keyboard hook
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Increases the number of concurrent connection per server for Internet Explorer
Contains functionality to hide user accounts
Machine Learning detection for sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Adds a directory exclusion to Windows Defender
Hides that the sample has been downloaded from the Internet (zone.identifier)
Uses dynamic DNS services
Tries to harvest and steal browser information (history, passwords, etc)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Internet Provider seen in connection with other malware
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
Contains long sleeps (>= 3 min)
Abnormal high CPU Usage
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Installs a raw input device (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
Detected TCP or UDP traffic on non-standard ports
Creates a process in suspended mode (likely to inject code)

Classification

  • System is w10x64
  • RFQ_31362.exe (PID: 1964 cmdline: C:\Users\user\Desktop\RFQ_31362.exe MD5: C3C291B38D054D5E71FE17A10D737249)
    • powershell.exe (PID: 5228 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_31362.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 2092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • RFQ_31362.exe (PID: 2300 cmdline: C:\Users\user\Desktop\RFQ_31362.exe MD5: C3C291B38D054D5E71FE17A10D737249)
      • cmd.exe (PID: 4272 cmdline: C:\Windows\System32\cmd.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
        • conhost.exe (PID: 1916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
Ave Maria, AveMariaRAT, avemariaInformation stealer which uses AutoIT for wrapping.
  • Anunak
https://malpedia.caad.fkie.fraunhofer.de/details/win.ave_maria
NameDescriptionAttributionBlogpost URLsLink
UACMeA toolkit maintained by hfiref0x which incorporates numerous UAC bypass techniques for Windows 7 - Windows 10. Typically, components of this tool are stripped out and reused by malicious actors.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.uacme
{"C2 url": "panchak.duckdns.org", "port": 5050}
SourceRuleDescriptionAuthorStrings
0000000C.00000002.510449817.000000000054F000.00000040.00000400.00020000.00000000.sdmpCodoso_Gh0st_1Detects Codoso APT Gh0st MalwareFlorian Roth (Nextron Systems)
  • 0xdf0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
  • 0xdf0:$c1: Elevation:Administrator!new:
0000000C.00000002.510449817.000000000054F000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_UACMeYara detected UACMe UAC Bypass toolJoe Security
    0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmpMAL_Envrial_Jan18_1Detects Encrial credential stealer malwareFlorian Roth (Nextron Systems)
    • 0x150e8:$a1: \Opera Software\Opera Stable\Login Data
    • 0x15410:$a2: \Comodo\Dragon\User Data\Default\Login Data
    • 0x14d58:$a3: \Google\Chrome\User Data\Default\Login Data
    0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
      0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_AveMariaYara detected AveMaria stealerJoe Security
        Click to see the 14 entries
        SourceRuleDescriptionAuthorStrings
        12.3.RFQ_31362.exe.12087c0.6.unpackCodoso_Gh0st_2Detects Codoso APT Gh0st MalwareFlorian Roth (Nextron Systems)
        • 0x5f8:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
        • 0x3400:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
        12.3.RFQ_31362.exe.12087c0.6.unpackCodoso_Gh0st_1Detects Codoso APT Gh0st MalwareFlorian Roth (Nextron Systems)
        • 0x5f8:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
        • 0x3400:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
        • 0x5f8:$c1: Elevation:Administrator!new:
        • 0x3400:$c1: Elevation:Administrator!new:
        12.3.RFQ_31362.exe.12087c0.6.unpackJoeSecurity_UACMeYara detected UACMe UAC Bypass toolJoe Security
          12.3.RFQ_31362.exe.12087c0.2.unpackCodoso_Gh0st_2Detects Codoso APT Gh0st MalwareFlorian Roth (Nextron Systems)
          • 0x5f8:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
          • 0x3400:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
          12.3.RFQ_31362.exe.12087c0.2.unpackCodoso_Gh0st_1Detects Codoso APT Gh0st MalwareFlorian Roth (Nextron Systems)
          • 0x5f8:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
          • 0x3400:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
          • 0x5f8:$c1: Elevation:Administrator!new:
          • 0x3400:$c1: Elevation:Administrator!new:
          Click to see the 30 entries
          No Sigma rule has matched
          Timestamp:192.168.2.3193.42.33.1604969850502852327 03/21/23-07:28:20.459629
          SID:2852327
          Source Port:49698
          Destination Port:5050
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:193.42.33.160192.168.2.35050496982852330 03/21/23-07:28:21.036418
          SID:2852330
          Source Port:5050
          Destination Port:49698
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:193.42.33.160192.168.2.35050496982036735 03/21/23-07:28:20.393972
          SID:2036735
          Source Port:5050
          Destination Port:49698
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:192.168.2.3193.42.33.1604969850502036734 03/21/23-07:28:20.459629
          SID:2036734
          Source Port:49698
          Destination Port:5050
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:192.168.2.3193.42.33.1604969850502852328 03/21/23-07:28:41.267270
          SID:2852328
          Source Port:49698
          Destination Port:5050
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:193.42.33.160192.168.2.35050496982852335 03/21/23-07:28:21.246341
          SID:2852335
          Source Port:5050
          Destination Port:49698
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:193.42.33.160192.168.2.35050496982852326 03/21/23-07:29:04.187918
          SID:2852326
          Source Port:5050
          Destination Port:49698
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:192.168.2.3193.42.33.1604969850502852332 03/21/23-07:28:21.039150
          SID:2852332
          Source Port:49698
          Destination Port:5050
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:192.168.2.3193.42.33.1604969850502852331 03/21/23-07:28:25.813962
          SID:2852331
          Source Port:49698
          Destination Port:5050
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:193.42.33.160192.168.2.35050496982852329 03/21/23-07:28:41.266781
          SID:2852329
          Source Port:5050
          Destination Port:49698
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:192.168.2.3193.42.33.1604969850502852334 03/21/23-07:28:21.039150
          SID:2852334
          Source Port:49698
          Destination Port:5050
          Protocol:TCP
          Classtype:A Network Trojan was detected

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Source: RFQ_31362.exeReversingLabs: Detection: 28%
          Source: RFQ_31362.exeVirustotal: Detection: 30%Perma Link
          Source: Yara matchFile source: 12.2.RFQ_31362.exe.400000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.RFQ_31362.exe.400000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000003.406416749.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000003.405873618.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: RFQ_31362.exeJoe Sandbox ML: detected
          Source: 12.2.RFQ_31362.exe.400000.1.unpackAvira: Label: TR/Redcap.ghjpt
          Source: 12.2.RFQ_31362.exe.5508e0.0.raw.unpackMalware Configuration Extractor: AveMaria {"C2 url": "panchak.duckdns.org", "port": 5050}

          Exploits

          barindex
          Source: Yara matchFile source: 12.3.RFQ_31362.exe.12087c0.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.3.RFQ_31362.exe.12087c0.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.3.RFQ_31362.exe.1208c38.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.3.RFQ_31362.exe.12087c0.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.3.RFQ_31362.exe.120a4a8.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.3.RFQ_31362.exe.12087c0.5.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.RFQ_31362.exe.400000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000C.00000002.510449817.000000000054F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000003.405873618.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: RFQ_31362.exe PID: 2300, type: MEMORYSTR
          Source: RFQ_31362.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
          Source: C:\Users\user\Desktop\RFQ_31362.exeDirectory created: C:\Program Files\Microsoft DN1Jump to behavior
          Source: RFQ_31362.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: Binary string: XwuV.pdb source: RFQ_31362.exe
          Source: Binary string: C:\Users\Tim\documents\visual studio 2010\Projects\sqlite\Release\sqlite3.pdb source: RFQ_31362.exe, RFQ_31362.exe, 0000000C.00000003.421838404.0000000004846000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.421690451.0000000001223000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.424218853.00000000049F0000.00000040.00001000.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.422594324.00000000047D1000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.423294059.0000000001230000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.421973246.00000000049F1000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.422594324.0000000004853000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: wuser32.pdb source: RFQ_31362.exe, 0000000C.00000002.516063371.0000000004500000.00000040.00001000.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000002.514122808.00000000040F1000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: wuser32.pdbUGP source: RFQ_31362.exe, 0000000C.00000002.516063371.0000000004500000.00000040.00001000.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000002.514122808.00000000040F1000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\Tim\documents\visual studio 2010\Projects\sqlite\Release\sqlite3.pdb source: RFQ_31362.exe, 0000000C.00000003.421838404.0000000004846000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.421690451.0000000001223000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.424218853.00000000049F0000.00000040.00001000.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.422594324.00000000047D1000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.423294059.0000000001230000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.421973246.00000000049F1000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.422594324.0000000004853000.00000004.00000020.00020000.00000000.sdmp

          Networking

          barindex
          Source: TrafficSnort IDS: 2852326 ETPRO TROJAN Ave Maria/Warzone RAT InitializePacket 193.42.33.160:5050 -> 192.168.2.3:49698
          Source: TrafficSnort IDS: 2036735 ET TROJAN Ave Maria/Warzone RAT Encrypted CnC Checkin (Inbound) 193.42.33.160:5050 -> 192.168.2.3:49698
          Source: TrafficSnort IDS: 2852327 ETPRO TROJAN Ave Maria/Warzone RAT BeaconResponse 192.168.2.3:49698 -> 193.42.33.160:5050
          Source: TrafficSnort IDS: 2036734 ET TROJAN Ave Maria/Warzone RAT Encrypted CnC Checkin 192.168.2.3:49698 -> 193.42.33.160:5050
          Source: TrafficSnort IDS: 2852330 ETPRO TROJAN Ave Maria/Warzone RAT ListPasswordsCommand 193.42.33.160:5050 -> 192.168.2.3:49698
          Source: TrafficSnort IDS: 2852334 ETPRO TROJAN Ave Maria/Warzone RAT VNCGetModule 192.168.2.3:49698 -> 193.42.33.160:5050
          Source: TrafficSnort IDS: 2852332 ETPRO TROJAN Ave Maria/Warzone RAT DownloadAndExecuteCommand 192.168.2.3:49698 -> 193.42.33.160:5050
          Source: TrafficSnort IDS: 2852335 ETPRO TROJAN Ave Maria/Warzone RAT RemoteModuleLoadResponse 193.42.33.160:5050 -> 192.168.2.3:49698
          Source: TrafficSnort IDS: 2852331 ETPRO TROJAN Ave Maria/Warzone RAT ListPasswordsResponse 192.168.2.3:49698 -> 193.42.33.160:5050
          Source: TrafficSnort IDS: 2852329 ETPRO TROJAN Ave Maria/Warzone RAT PingCommand 193.42.33.160:5050 -> 192.168.2.3:49698
          Source: TrafficSnort IDS: 2852328 ETPRO TROJAN Ave Maria/Warzone RAT PingResponse 192.168.2.3:49698 -> 193.42.33.160:5050
          Source: Malware configuration extractorURLs: panchak.duckdns.org
          Source: unknownDNS query: name: panchak.duckdns.org
          Source: Joe Sandbox ViewASN Name: EENET-ASEE EENET-ASEE
          Source: global trafficTCP traffic: 192.168.2.3:49698 -> 193.42.33.160:5050
          Source: RFQ_31362.exe, 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.405873618.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.406416749.00000000011F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/syohex/java-simple-mine-sweeperC:
          Source: unknownDNS traffic detected: queries for: panchak.duckdns.org

          Key, Mouse, Clipboard, Microphone and Screen Capturing

          barindex
          Source: C:\Users\user\Desktop\RFQ_31362.exeWindows user hook set: 0 keyboard low level C:\Users\user\Desktop\RFQ_31362.exeJump to behavior
          Source: RFQ_31362.exe, 0000000C.00000003.406337641.00000000011FD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: RegisterRawInputDevices

          E-Banking Fraud

          barindex
          Source: Yara matchFile source: 12.2.RFQ_31362.exe.400000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.RFQ_31362.exe.400000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000003.406416749.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000003.405873618.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

          System Summary

          barindex
          Source: 12.3.RFQ_31362.exe.12087c0.6.unpack, type: UNPACKEDPEMatched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth (Nextron Systems)
          Source: 12.3.RFQ_31362.exe.12087c0.2.unpack, type: UNPACKEDPEMatched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth (Nextron Systems)
          Source: 12.3.RFQ_31362.exe.1208c38.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth (Nextron Systems)
          Source: 12.3.RFQ_31362.exe.12087c0.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth (Nextron Systems)
          Source: 12.3.RFQ_31362.exe.120a4a8.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth (Nextron Systems)
          Source: 12.3.RFQ_31362.exe.12087c0.5.unpack, type: UNPACKEDPEMatched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth (Nextron Systems)
          Source: 12.2.RFQ_31362.exe.400000.1.unpack, type: UNPACKEDPEMatched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth (Nextron Systems)
          Source: 12.2.RFQ_31362.exe.400000.1.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth (Nextron Systems)
          Source: 12.2.RFQ_31362.exe.400000.1.unpack, type: UNPACKEDPEMatched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
          Source: 12.2.RFQ_31362.exe.400000.1.unpack, type: UNPACKEDPEMatched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
          Source: 12.2.RFQ_31362.exe.400000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AveMaria_31d2bce9 Author: unknown
          Source: 12.2.RFQ_31362.exe.400000.1.unpack, type: UNPACKEDPEMatched rule: AveMaria_WarZone Author: unknown
          Source: 12.2.RFQ_31362.exe.400000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth (Nextron Systems)
          Source: 12.2.RFQ_31362.exe.400000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
          Source: 12.2.RFQ_31362.exe.400000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
          Source: 12.2.RFQ_31362.exe.400000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AveMaria_31d2bce9 Author: unknown
          Source: 12.2.RFQ_31362.exe.400000.1.raw.unpack, type: UNPACKEDPEMatched rule: AveMaria_WarZone Author: unknown
          Source: 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth (Nextron Systems)
          Source: 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
          Source: 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
          Source: 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_AveMaria_31d2bce9 Author: unknown
          Source: 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: AveMaria_WarZone Author: unknown
          Source: 0000000C.00000003.406416749.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_AveMaria_31d2bce9 Author: unknown
          Source: 0000000C.00000003.405873618.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_AveMaria_31d2bce9 Author: unknown
          Source: RFQ_31362.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
          Source: 12.3.RFQ_31362.exe.12087c0.6.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth (Nextron Systems), description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
          Source: 12.3.RFQ_31362.exe.12087c0.6.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth (Nextron Systems), description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
          Source: 12.3.RFQ_31362.exe.12087c0.2.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth (Nextron Systems), description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
          Source: 12.3.RFQ_31362.exe.12087c0.2.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth (Nextron Systems), description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
          Source: 12.3.RFQ_31362.exe.1208c38.0.raw.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth (Nextron Systems), description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
          Source: 12.3.RFQ_31362.exe.1208c38.0.raw.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth (Nextron Systems), description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
          Source: 12.3.RFQ_31362.exe.12087c0.2.raw.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth (Nextron Systems), description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
          Source: 12.3.RFQ_31362.exe.12087c0.2.raw.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth (Nextron Systems), description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
          Source: 12.3.RFQ_31362.exe.120a4a8.1.raw.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth (Nextron Systems), description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
          Source: 12.3.RFQ_31362.exe.120a4a8.1.raw.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth (Nextron Systems), description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
          Source: 12.3.RFQ_31362.exe.12087c0.5.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth (Nextron Systems), description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
          Source: 12.3.RFQ_31362.exe.12087c0.5.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth (Nextron Systems), description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
          Source: 12.2.RFQ_31362.exe.400000.1.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth (Nextron Systems), description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
          Source: 12.2.RFQ_31362.exe.400000.1.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth (Nextron Systems), description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
          Source: 12.2.RFQ_31362.exe.400000.1.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth (Nextron Systems), description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
          Source: 12.2.RFQ_31362.exe.400000.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
          Source: 12.2.RFQ_31362.exe.400000.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
          Source: 12.2.RFQ_31362.exe.400000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AveMaria_31d2bce9 reference_sample = 5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b, os = windows, severity = x86, creation_date = 2021-05-30, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AveMaria, fingerprint = 8f75e2d8308227a42743168deb021de18ad485763fd257991c5e627c025c30c0, id = 31d2bce9-3266-447b-9a2d-57cf11a0ff1f, last_modified = 2021-08-23
          Source: 12.2.RFQ_31362.exe.400000.1.unpack, type: UNPACKEDPEMatched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
          Source: 12.2.RFQ_31362.exe.400000.1.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth (Nextron Systems), description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
          Source: 12.2.RFQ_31362.exe.400000.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
          Source: 12.2.RFQ_31362.exe.400000.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
          Source: 12.2.RFQ_31362.exe.400000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AveMaria_31d2bce9 reference_sample = 5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b, os = windows, severity = x86, creation_date = 2021-05-30, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AveMaria, fingerprint = 8f75e2d8308227a42743168deb021de18ad485763fd257991c5e627c025c30c0, id = 31d2bce9-3266-447b-9a2d-57cf11a0ff1f, last_modified = 2021-08-23
          Source: 12.2.RFQ_31362.exe.400000.1.raw.unpack, type: UNPACKEDPEMatched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
          Source: 0000000C.00000002.510449817.000000000054F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth (Nextron Systems), description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
          Source: 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth (Nextron Systems), description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
          Source: 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
          Source: 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
          Source: 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_AveMaria_31d2bce9 reference_sample = 5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b, os = windows, severity = x86, creation_date = 2021-05-30, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AveMaria, fingerprint = 8f75e2d8308227a42743168deb021de18ad485763fd257991c5e627c025c30c0, id = 31d2bce9-3266-447b-9a2d-57cf11a0ff1f, last_modified = 2021-08-23
          Source: 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
          Source: 0000000C.00000003.406416749.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_AveMaria_31d2bce9 reference_sample = 5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b, os = windows, severity = x86, creation_date = 2021-05-30, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AveMaria, fingerprint = 8f75e2d8308227a42743168deb021de18ad485763fd257991c5e627c025c30c0, id = 31d2bce9-3266-447b-9a2d-57cf11a0ff1f, last_modified = 2021-08-23
          Source: 0000000C.00000003.405873618.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth (Nextron Systems), description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
          Source: 0000000C.00000003.405873618.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_AveMaria_31d2bce9 reference_sample = 5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b, os = windows, severity = x86, creation_date = 2021-05-30, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AveMaria, fingerprint = 8f75e2d8308227a42743168deb021de18ad485763fd257991c5e627c025c30c0, id = 31d2bce9-3266-447b-9a2d-57cf11a0ff1f, last_modified = 2021-08-23
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess Stats: CPU usage > 98%
          Source: RFQ_31362.exe, 00000000.00000000.242836805.0000000000346000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameXwuV.exeR vs RFQ_31362.exe
          Source: RFQ_31362.exe, 0000000C.00000002.512381130.000000000316C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameXwuV.exeR vs RFQ_31362.exe
          Source: RFQ_31362.exe, 0000000C.00000002.516063371.000000000459B000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameuser32j% vs RFQ_31362.exe
          Source: RFQ_31362.exe, 0000000C.00000002.514122808.00000000040F1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameuser32j% vs RFQ_31362.exe
          Source: RFQ_31362.exeBinary or memory string: OriginalFilenameXwuV.exeR vs RFQ_31362.exe
          Source: RFQ_31362.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: RFQ_31362.exeReversingLabs: Detection: 28%
          Source: RFQ_31362.exeVirustotal: Detection: 30%
          Source: C:\Users\user\Desktop\RFQ_31362.exeFile read: C:\Users\user\Desktop\RFQ_31362.exeJump to behavior
          Source: RFQ_31362.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: C:\Users\user\Desktop\RFQ_31362.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: unknownProcess created: C:\Users\user\Desktop\RFQ_31362.exe C:\Users\user\Desktop\RFQ_31362.exe
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_31362.exe
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess created: C:\Users\user\Desktop\RFQ_31362.exe C:\Users\user\Desktop\RFQ_31362.exe
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_31362.exeJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess created: C:\Users\user\Desktop\RFQ_31362.exe C:\Users\user\Desktop\RFQ_31362.exeJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exeJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32Jump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RFQ_31362.exe.logJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qyfxnjpd.w3d.ps1Jump to behavior
          Source: classification engineClassification label: mal100.phis.troj.spyw.expl.evad.winEXE@9/6@1/1
          Source: C:\Users\user\Desktop\RFQ_31362.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
          Source: RFQ_31362.exe, 0000000C.00000003.421838404.0000000004846000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.421690451.0000000001223000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.424218853.00000000049F0000.00000040.00001000.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.422594324.00000000047D1000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.423294059.0000000001230000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.421973246.00000000049F1000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.422594324.0000000004853000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
          Source: RFQ_31362.exe, RFQ_31362.exe, 0000000C.00000003.421838404.0000000004846000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.421690451.0000000001223000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.424218853.00000000049F0000.00000040.00001000.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.422594324.00000000047D1000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.423294059.0000000001230000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.421973246.00000000049F1000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.422594324.0000000004853000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
          Source: RFQ_31362.exe, 0000000C.00000003.421838404.0000000004846000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.424218853.00000000049F0000.00000040.00001000.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.422594324.00000000047D1000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.423294059.0000000001230000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.421973246.00000000049F1000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.422594324.0000000004853000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
          Source: RFQ_31362.exe, 0000000C.00000003.421838404.0000000004846000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.421690451.0000000001223000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.424218853.00000000049F0000.00000040.00001000.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.422594324.00000000047D1000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.423294059.0000000001230000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.421973246.00000000049F1000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.422594324.0000000004853000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
          Source: RFQ_31362.exe, 0000000C.00000003.421838404.0000000004846000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.424218853.00000000049F0000.00000040.00001000.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.422594324.00000000047D1000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.423294059.0000000001230000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.421973246.00000000049F1000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.422594324.0000000004853000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
          Source: RFQ_31362.exe, RFQ_31362.exe, 0000000C.00000003.421838404.0000000004846000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.421690451.0000000001223000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.424218853.00000000049F0000.00000040.00001000.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.422594324.00000000047D1000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.423294059.0000000001230000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.421973246.00000000049F1000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.422594324.0000000004853000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
          Source: RFQ_31362.exe, 0000000C.00000002.517990216.0000000004D07000.00000004.00000020.00020000.00000000.sdmp, rEJHIjC.tmp.12.drBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
          Source: RFQ_31362.exe, RFQ_31362.exe, 0000000C.00000003.421838404.0000000004846000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.421690451.0000000001223000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.424218853.00000000049F0000.00000040.00001000.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.422594324.00000000047D1000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.423294059.0000000001230000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.421973246.00000000049F1000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.422594324.0000000004853000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
          Source: RFQ_31362.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
          Source: C:\Users\user\Desktop\RFQ_31362.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1916:120:WilError_01
          Source: C:\Users\user\Desktop\RFQ_31362.exeMutant created: \Sessions\1\BaseNamedObjects\NKeDzLPYQQtInDVfgWDB
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2092:120:WilError_01
          Source: C:\Users\user\Desktop\RFQ_31362.exeFile created: C:\Program Files\Microsoft DN1Jump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: C:\Users\user\Desktop\RFQ_31362.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
          Source: RFQ_31362.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
          Source: C:\Users\user\Desktop\RFQ_31362.exeDirectory created: C:\Program Files\Microsoft DN1Jump to behavior
          Source: RFQ_31362.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: RFQ_31362.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
          Source: Binary string: XwuV.pdb source: RFQ_31362.exe
          Source: Binary string: C:\Users\Tim\documents\visual studio 2010\Projects\sqlite\Release\sqlite3.pdb source: RFQ_31362.exe, RFQ_31362.exe, 0000000C.00000003.421838404.0000000004846000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.421690451.0000000001223000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.424218853.00000000049F0000.00000040.00001000.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.422594324.00000000047D1000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.423294059.0000000001230000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.421973246.00000000049F1000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.422594324.0000000004853000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: wuser32.pdb source: RFQ_31362.exe, 0000000C.00000002.516063371.0000000004500000.00000040.00001000.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000002.514122808.00000000040F1000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: wuser32.pdbUGP source: RFQ_31362.exe, 0000000C.00000002.516063371.0000000004500000.00000040.00001000.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000002.514122808.00000000040F1000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\Tim\documents\visual studio 2010\Projects\sqlite\Release\sqlite3.pdb source: RFQ_31362.exe, 0000000C.00000003.421838404.0000000004846000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.421690451.0000000001223000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.424218853.00000000049F0000.00000040.00001000.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.422594324.00000000047D1000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.423294059.0000000001230000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.421973246.00000000049F1000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.422594324.0000000004853000.00000004.00000020.00020000.00000000.sdmp
          Source: initial sampleStatic PE information: section name: .text entropy: 7.432792399181768

          Hooking and other Techniques for Hiding and Protection

          barindex
          Source: RFQ_31362.exe, 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
          Source: RFQ_31362.exe, 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
          Source: RFQ_31362.exe, 0000000C.00000003.405873618.00000000011FA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
          Source: RFQ_31362.exe, 0000000C.00000003.405873618.00000000011FA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
          Source: RFQ_31362.exe, 0000000C.00000003.406416749.00000000011F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
          Source: RFQ_31362.exe, 0000000C.00000003.406416749.00000000011F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
          Source: C:\Users\user\Desktop\RFQ_31362.exeFile opened: C:\Users\user\Desktop\:Zone.Identifier read attributes | deleteJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exe TID: 3516Thread sleep time: -40023s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exe TID: 6084Thread sleep time: -922337203685477s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1012Thread sleep time: -2767011611056431s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exe TID: 1112Thread sleep count: 60 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\cmd.exe TID: 2100Thread sleep count: 401 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\cmd.exe TID: 2100Thread sleep time: -4812000s >= -30000sJump to behavior
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\RFQ_31362.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8905Jump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeWindow / User API: threadDelayed 401Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeThread delayed: delay time: 40023Jump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: RFQ_31362.exe, 0000000C.00000003.405873618.00000000011FA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeMemory allocated: page read and write | page guardJump to behavior

          HIPS / PFW / Operating System Protection Evasion

          barindex
          Source: C:\Users\user\Desktop\RFQ_31362.exeMemory written: C:\Windows\SysWOW64\cmd.exe base: 3480000Jump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeMemory written: C:\Windows\SysWOW64\cmd.exe base: 34E0000Jump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeMemory allocated: C:\Windows\SysWOW64\cmd.exe base: 3480000 protect: page execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeMemory allocated: C:\Windows\SysWOW64\cmd.exe base: 34E0000 protect: page read and writeJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeThread created: C:\Windows\SysWOW64\cmd.exe EIP: 348010EJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_31362.exe
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_31362.exeJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_31362.exeJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeProcess created: C:\Users\user\Desktop\RFQ_31362.exe C:\Users\user\Desktop\RFQ_31362.exeJump to behavior
          Source: RFQ_31362.exe, 0000000C.00000002.511740208.00000000011D8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerOP
          Source: RFQ_31362.exe, 0000000C.00000002.511740208.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000002.511740208.000000000120B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager
          Source: RFQ_31362.exe, 0000000C.00000002.516063371.0000000004500000.00000040.00001000.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000002.514122808.00000000040F1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: GetProgmanWindow
          Source: RFQ_31362.exe, 0000000C.00000002.511740208.00000000011D8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerGP
          Source: RFQ_31362.exe, 0000000C.00000002.511740208.000000000120B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerO
          Source: RFQ_31362.exe, 0000000C.00000002.516063371.0000000004500000.00000040.00001000.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000002.514122808.00000000040F1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SetProgmanWindow
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Users\user\Desktop\RFQ_31362.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

          Lowering of HIPS / PFW / Operating System Security Settings

          barindex
          Source: C:\Users\user\Desktop\RFQ_31362.exeRegistry key created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings MaxConnectionsPerServer 10Jump to behavior

          Stealing of Sensitive Information

          barindex
          Source: Yara matchFile source: 12.2.RFQ_31362.exe.400000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.RFQ_31362.exe.400000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000003.406416749.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000003.405873618.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: C:\Users\user\Desktop\RFQ_31362.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
          Source: C:\Users\user\Desktop\RFQ_31362.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
          Source: Yara matchFile source: 12.2.RFQ_31362.exe.400000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.RFQ_31362.exe.400000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000003.406416749.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000003.405873618.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: RFQ_31362.exe PID: 2300, type: MEMORYSTR

          Remote Access Functionality

          barindex
          Source: Yara matchFile source: 12.2.RFQ_31362.exe.400000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.RFQ_31362.exe.400000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000003.406416749.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000003.405873618.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
          Valid AccountsWindows Management InstrumentationPath Interception312
          Process Injection
          3
          Masquerading
          1
          OS Credential Dumping
          1
          Security Software Discovery
          Remote Services1
          Email Collection
          Exfiltration Over Other Network Medium1
          Non-Standard Port
          Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
          Endpoint Denial of Service
          Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts11
          Disable or Modify Tools
          111
          Input Capture
          2
          Process Discovery
          Remote Desktop Protocol111
          Input Capture
          Exfiltration Over Bluetooth1
          Non-Application Layer Protocol
          Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
          Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)21
          Virtualization/Sandbox Evasion
          Security Account Manager21
          Virtualization/Sandbox Evasion
          SMB/Windows Admin Shares1
          Data from Local System
          Automated Exfiltration21
          Application Layer Protocol
          Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
          Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)312
          Process Injection
          NTDS1
          Application Window Discovery
          Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
          Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
          Hidden Files and Directories
          LSA Secrets1
          Remote System Discovery
          SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
          Replication Through Removable MediaLaunchdRc.commonRc.common1
          Hidden Users
          Cached Domain Credentials1
          File and Directory Discovery
          VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
          External Remote ServicesScheduled TaskStartup ItemsStartup Items1
          Obfuscated Files or Information
          DCSync13
          System Information Discovery
          Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
          Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job3
          Software Packing
          Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 signatures2 2 Behavior Graph ID: 831166 Sample: RFQ_31362.exe Startdate: 21/03/2023 Architecture: WINDOWS Score: 100 28 Snort IDS alert for network traffic 2->28 30 Malicious sample detected (through community Yara rule) 2->30 32 Multi AV Scanner detection for submitted file 2->32 34 6 other signatures 2->34 8 RFQ_31362.exe 4 2->8         started        process3 file4 24 C:\Users\user\AppData\...\RFQ_31362.exe.log, ASCII 8->24 dropped 36 Adds a directory exclusion to Windows Defender 8->36 12 RFQ_31362.exe 3 6 8->12         started        16 powershell.exe 21 8->16         started        signatures5 process6 dnsIp7 26 panchak.duckdns.org 193.42.33.160, 49698, 5050 EENET-ASEE Germany 12->26 38 Tries to steal Mail credentials (via file / registry access) 12->38 40 Tries to harvest and steal browser information (history, passwords, etc) 12->40 42 Writes to foreign memory regions 12->42 44 5 other signatures 12->44 18 cmd.exe 1 12->18         started        20 conhost.exe 16->20         started        signatures8 process9 process10 22 conhost.exe 18->22         started       

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand
          SourceDetectionScannerLabelLink
          RFQ_31362.exe28%ReversingLabsWin32.Trojan.Generic
          RFQ_31362.exe30%VirustotalBrowse
          RFQ_31362.exe100%Joe Sandbox ML
          No Antivirus matches
          SourceDetectionScannerLabelLinkDownload
          12.2.RFQ_31362.exe.400000.1.unpack100%AviraTR/Redcap.ghjptDownload File
          No Antivirus matches
          SourceDetectionScannerLabelLink
          panchak.duckdns.org0%Avira URL Cloudsafe
          NameIPActiveMaliciousAntivirus DetectionReputation
          panchak.duckdns.org
          193.42.33.160
          truetrue
            unknown
            NameMaliciousAntivirus DetectionReputation
            panchak.duckdns.orgtrue
            • Avira URL Cloud: safe
            unknown
            NameSourceMaliciousAntivirus DetectionReputation
            https://github.com/syohex/java-simple-mine-sweeperC:RFQ_31362.exe, 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.405873618.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, RFQ_31362.exe, 0000000C.00000003.406416749.00000000011F5000.00000004.00000020.00020000.00000000.sdmpfalse
              high
              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs
              IPDomainCountryFlagASNASN NameMalicious
              193.42.33.160
              panchak.duckdns.orgGermany
              3221EENET-ASEEtrue
              Joe Sandbox Version:37.0.0 Beryl
              Analysis ID:831166
              Start date and time:2023-03-21 07:26:09 +01:00
              Joe Sandbox Product:CloudBasic
              Overall analysis duration:0h 7m 49s
              Hypervisor based Inspection enabled:false
              Report type:full
              Cookbook file name:default.jbs
              Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
              Number of analysed new started processes analysed:18
              Number of new started drivers analysed:0
              Number of existing processes analysed:0
              Number of existing drivers analysed:0
              Number of injected processes analysed:0
              Technologies:
              • HCA enabled
              • EGA enabled
              • HDC enabled
              • AMSI enabled
              Analysis Mode:default
              Analysis stop reason:Timeout
              Sample file name:RFQ_31362.exe
              Detection:MAL
              Classification:mal100.phis.troj.spyw.expl.evad.winEXE@9/6@1/1
              EGA Information:Failed
              HDC Information:Failed
              HCA Information:
              • Successful, ratio: 81%
              • Number of executed functions: 0
              • Number of non-executed functions: 0
              Cookbook Comments:
              • Found application associated with file extension: .exe
              • Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
              • Excluded domains from analysis (whitelisted): fs.microsoft.com
              • Not all processes where analyzed, report is missing behavior information
              • Report size getting too big, too many NtAllocateVirtualMemory calls found.
              • Report size getting too big, too many NtOpenKeyEx calls found.
              • Report size getting too big, too many NtProtectVirtualMemory calls found.
              • Report size getting too big, too many NtQueryValueKey calls found.
              TimeTypeDescription
              07:28:14API Interceptor1x Sleep call for process: RFQ_31362.exe modified
              07:28:16API Interceptor26x Sleep call for process: powershell.exe modified
              07:28:19API Interceptor402x Sleep call for process: cmd.exe modified
              No context
              No context
              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              EENET-ASEEshipmentDocs9807654.pdf.jarGet hashmaliciousSTRRATBrowse
              • 193.42.32.233
              X89JOn3npC.exeGet hashmaliciousStealc, VidarBrowse
              • 193.42.32.154
              boatnet.arm.elfGet hashmaliciousMiraiBrowse
              • 193.42.33.66
              boatnet.x86.elfGet hashmaliciousMiraiBrowse
              • 193.42.33.66
              fPxH9SMXKi.elfGet hashmaliciousUnknownBrowse
              • 193.42.33.66
              d7p1Yg3yRV.elfGet hashmaliciousMiraiBrowse
              • 193.42.33.66
              92X4prGCwE.elfGet hashmaliciousMiraiBrowse
              • 193.42.33.66
              mJB1euTWzK.elfGet hashmaliciousMiraiBrowse
              • 193.42.33.66
              boatnet.arm7.elfGet hashmaliciousMiraiBrowse
              • 193.42.33.66
              boatnet.i686.elfGet hashmaliciousMiraiBrowse
              • 193.42.33.66
              boatnet.x86_64.elfGet hashmaliciousMiraiBrowse
              • 193.42.33.66
              boatnet.mips.elfGet hashmaliciousMiraiBrowse
              • 193.42.33.66
              offlinemaps.exeGet hashmaliciousRemcosBrowse
              • 193.42.32.86
              https://stmservice.crm.gabriels.net/tracking?action=redirect&verificationcode=3CBE9F20-BC72-48BE-B192-B1EEDD26B975&redirect=//cesarcabra.com%2F%2F%2F%2F%2F%2F%2F%2F/auth/%2F%2F%2F%2F/tdgkzz%2F%2F%2F%2Fmjoyce@redsapsolutions.comGet hashmaliciousHTMLPhisherBrowse
              • 193.42.32.28
              Review.exeGet hashmaliciousRemcosBrowse
              • 193.42.32.19
              8oWl468FmL.elfGet hashmaliciousMiraiBrowse
              • 193.42.33.21
              albwedzA0J.elfGet hashmaliciousMiraiBrowse
              • 193.42.33.21
              9O5iEl8Sz6.exeGet hashmaliciousRedLineBrowse
              • 193.42.32.107
              KNQExSuvCK.exeGet hashmaliciousRedLineBrowse
              • 193.42.32.107
              BANK-INFO.docGet hashmaliciousRedLineBrowse
              • 193.42.32.107
              No context
              No context
              Process:C:\Users\user\Desktop\RFQ_31362.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1216
              Entropy (8bit):5.355304211458859
              Encrypted:false
              SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
              MD5:FED34146BF2F2FA59DCF8702FCC8232E
              SHA1:B03BFEA175989D989850CF06FE5E7BBF56EAA00A
              SHA-256:123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
              SHA-512:1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
              Malicious:true
              Reputation:high, very likely benign file
              Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:data
              Category:dropped
              Size (bytes):21952
              Entropy (8bit):5.597899480556724
              Encrypted:false
              SSDEEP:384:8tCRdM07+eANV8M27bynHSBxn0uhbiV9gpSJ3uyVQ+m021AVrd/+7OA+ifYb:zAJ27AH4x0uhbpcuWXtb
              MD5:BB89DC902E4077587FAB7D3C7D4184EA
              SHA1:0936AC18F194EA069D74D3B2330D967F0DD858D4
              SHA-256:5620FABE4F1498BDA6CC3D5A1B235327377338D8E81A5829A4450CD7F2FFF43E
              SHA-512:FBD9AD13DD578094022CD47512C3FB4C1B16A4CD1D8C6F349CE37AEBDDDA0F2B166B7A0DFABF5B8A85B25AAEB064A9F1B7404A27B533828815D5295B5E52367A
              Malicious:false
              Reputation:low
              Preview:@...e...........(........._.Q.F.$...9.y..............@..........H...............<@.^.L."My...:P..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)........System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.....#.......System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:very short file (no magic)
              Category:dropped
              Size (bytes):1
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:3:U:U
              MD5:C4CA4238A0B923820DCC509A6F75849B
              SHA1:356A192B7913B04C54574D18C28D46E6395428AB
              SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
              SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
              Malicious:false
              Reputation:high, very likely benign file
              Preview:1
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:very short file (no magic)
              Category:dropped
              Size (bytes):1
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:3:U:U
              MD5:C4CA4238A0B923820DCC509A6F75849B
              SHA1:356A192B7913B04C54574D18C28D46E6395428AB
              SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
              SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
              Malicious:false
              Preview:1
              Process:C:\Users\user\Desktop\RFQ_31362.exe
              File Type:SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2
              Category:dropped
              Size (bytes):49152
              Entropy (8bit):0.7876734657715041
              Encrypted:false
              SSDEEP:48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
              MD5:CF7758A2FF4A94A5D589DEBAED38F82E
              SHA1:D3380E70D0CAEB9AD78D14DD970EA480E08232B8
              SHA-256:6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
              SHA-512:1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
              Malicious:false
              Preview:SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
              Process:C:\Users\user\Desktop\RFQ_31362.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):61356
              Entropy (8bit):6.071946363928989
              Encrypted:false
              SSDEEP:1536:kX71LMtANJaRBOHK5KvtgBhqQ0HTgHImA01exhi8qjyDKly2:g711NyBTOgd0HhmAnhqj3L
              MD5:A4F10AC4E9DF2BEBE496AE2386BC7B8C
              SHA1:2D457ECEAA0501744A3A0E86436C435A2973C5EE
              SHA-256:BAED8CDB4BE43EBABE614B0ED48D042F0C8B80D834995284144F808579FDB55B
              SHA-512:FA6203B19B3CFAA2BF4B6DA732DF340AA59B91AF3979CFB8A7FA3D2E7834656A7843755967390BD46DB96052AE6DF0F8F2CA7FC90CE23A60C12ABD37D7FDC252
              Malicious:false
              Preview:{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.660685744940254e+12,"network":1.660653319e+12,"ticks":922844395.0,"uncertainty":1339796.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABL95WKt94zTZq03WydzHLcAAAAAAIAAAAAABBmAAAAAQAAIAAAABAL2tyan+lsWtxhoUVdUYrYiwg8iJkppNr2ZbBFie9UAAAAAA6AAAAAAgAAIAAAABDv4gjLq1dOS7lkRG21YVXojnHhsRhNbP8/D1zs78mXMAAAAB045Od5v4BxiFP4bdRYJjDXn4W2fxYqQj2xfYeAnS1vCL4JXAsdfljw4oXIE4R7l0AAAABlt36FqChftM9b7EtaPw98XRX5Y944rq1WsGWcOPFyXOajfBL3GXBUhMXghJbDGb5WCu+JEdxa
              File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
              Entropy (8bit):7.4286325944521066
              TrID:
              • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
              • Win32 Executable (generic) a (10002005/4) 49.78%
              • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
              • Generic Win/DOS Executable (2004/3) 0.01%
              • DOS Executable Generic (2002/1) 0.01%
              File name:RFQ_31362.exe
              File size:865280
              MD5:c3c291b38d054d5e71fe17a10d737249
              SHA1:86411ff9d41eb140c80753873b943d80be323130
              SHA256:9fcf0a498b86fc20af3cc28a984135f0cc202f6577af79f96ec63ca6cb227c3c
              SHA512:3b1b4f937b51d6bef403e44cc4b92ab52c0c5e2b7b503aea46030e9f5f058f77a5b9266c24565bfe18671e666b701c097dac3df089621ec8572f277415f2cdf6
              SSDEEP:12288:2nmIb3fNeH++znVXoW87FqKqi13U3mWxw7DG0mCuT7Yeg4firr:2m03fY+WnVX18BqBAU3e5mnn3
              TLSH:EF0508425EBB5085E8B70F2C547B76880B34E953BEC9903B7CC9B61A4FFA69364063D1
              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d..............0..*...........I... ...`....@.. ....................................@................................
              Icon Hash:00828e8e8686b000
              Entrypoint:0x4d490e
              Entrypoint Section:.text
              Digitally signed:false
              Imagebase:0x400000
              Subsystem:windows gui
              Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
              Time Stamp:0x64191306 [Tue Mar 21 02:14:30 2023 UTC]
              TLS Callbacks:
              CLR (.Net) Version:
              OS Version Major:4
              OS Version Minor:0
              File Version Major:4
              File Version Minor:0
              Subsystem Version Major:4
              Subsystem Version Minor:0
              Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744
              Instruction
              jmp dword ptr [00402000h]
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              NameVirtual AddressVirtual Size Is in Section
              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
              IMAGE_DIRECTORY_ENTRY_IMPORT0xd48c00x4b.text
              IMAGE_DIRECTORY_ENTRY_RESOURCE0xd60000x5d8.rsrc
              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
              IMAGE_DIRECTORY_ENTRY_BASERELOC0xd80000xc.reloc
              IMAGE_DIRECTORY_ENTRY_DEBUG0xd48820x1c.text
              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
              IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
              NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
              .text0x20000xd29140xd2a00False0.7573778282640949SysEx File - Victor7.432792399181768IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              .rsrc0xd60000x5d80x600False0.4309895833333333data4.1609318281960155IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
              .reloc0xd80000xc0x200False0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
              NameRVASizeTypeLanguageCountry
              RT_VERSION0xd60a00x34cdata
              RT_MANIFEST0xd63ec0x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
              DLLImport
              mscoree.dll_CorExeMain
              TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
              192.168.2.3193.42.33.1604969850502852327 03/21/23-07:28:20.459629TCP2852327ETPRO TROJAN Ave Maria/Warzone RAT BeaconResponse496985050192.168.2.3193.42.33.160
              193.42.33.160192.168.2.35050496982852330 03/21/23-07:28:21.036418TCP2852330ETPRO TROJAN Ave Maria/Warzone RAT ListPasswordsCommand505049698193.42.33.160192.168.2.3
              193.42.33.160192.168.2.35050496982036735 03/21/23-07:28:20.393972TCP2036735ET TROJAN Ave Maria/Warzone RAT Encrypted CnC Checkin (Inbound)505049698193.42.33.160192.168.2.3
              192.168.2.3193.42.33.1604969850502036734 03/21/23-07:28:20.459629TCP2036734ET TROJAN Ave Maria/Warzone RAT Encrypted CnC Checkin496985050192.168.2.3193.42.33.160
              192.168.2.3193.42.33.1604969850502852328 03/21/23-07:28:41.267270TCP2852328ETPRO TROJAN Ave Maria/Warzone RAT PingResponse496985050192.168.2.3193.42.33.160
              193.42.33.160192.168.2.35050496982852335 03/21/23-07:28:21.246341TCP2852335ETPRO TROJAN Ave Maria/Warzone RAT RemoteModuleLoadResponse505049698193.42.33.160192.168.2.3
              193.42.33.160192.168.2.35050496982852326 03/21/23-07:29:04.187918TCP2852326ETPRO TROJAN Ave Maria/Warzone RAT InitializePacket505049698193.42.33.160192.168.2.3
              192.168.2.3193.42.33.1604969850502852332 03/21/23-07:28:21.039150TCP2852332ETPRO TROJAN Ave Maria/Warzone RAT DownloadAndExecuteCommand496985050192.168.2.3193.42.33.160
              192.168.2.3193.42.33.1604969850502852331 03/21/23-07:28:25.813962TCP2852331ETPRO TROJAN Ave Maria/Warzone RAT ListPasswordsResponse496985050192.168.2.3193.42.33.160
              193.42.33.160192.168.2.35050496982852329 03/21/23-07:28:41.266781TCP2852329ETPRO TROJAN Ave Maria/Warzone RAT PingCommand505049698193.42.33.160192.168.2.3
              192.168.2.3193.42.33.1604969850502852334 03/21/23-07:28:21.039150TCP2852334ETPRO TROJAN Ave Maria/Warzone RAT VNCGetModule496985050192.168.2.3193.42.33.160
              TimestampSource PortDest PortSource IPDest IP
              Mar 21, 2023 07:28:19.142501116 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:19.174215078 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:19.174313068 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:20.393971920 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:20.459629059 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:20.552443981 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:20.552617073 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:20.652137041 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.036417961 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.039150000 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.152304888 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.246340990 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.246397972 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.246442080 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.246484041 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.246526003 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.246566057 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.246591091 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.246608973 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.246651888 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.246660948 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.246715069 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.246726990 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.246758938 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.246845007 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.277149916 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.277200937 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.277246952 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.277291059 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.277302027 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.277338982 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.277343988 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.277384996 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.277430058 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.277439117 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.277498007 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.277544022 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.277558088 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.277589083 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.277636051 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.277647018 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.277683020 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.277728081 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.277736902 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.277775049 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.277820110 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.277832985 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.277867079 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.277915001 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.277925014 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.277961016 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.278007984 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.278017044 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.278059006 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.278112888 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.308291912 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.308355093 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.308402061 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.308445930 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.308449030 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.308512926 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.308515072 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.308566093 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.308614969 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.308625937 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.308662891 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.308708906 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.308734894 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.308756113 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.308804989 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.308820963 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.308851957 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.308898926 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.308906078 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.308944941 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.308990955 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.308996916 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.309039116 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.309084892 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.309114933 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.309130907 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.309178114 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.309202909 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.309226990 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.309272051 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.309314013 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.309317112 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.309365988 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.309381962 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.309412003 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.309459925 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.309478045 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.309508085 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.309556961 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.309570074 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.309604883 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.309652090 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.309684992 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.309699059 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.309746027 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.309772015 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.309792995 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.309839964 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.309859991 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.309886932 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.309933901 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.309954882 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.309983015 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.310029030 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.310069084 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.310077906 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.310126066 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.310172081 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.310240030 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.310240030 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.361267090 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.361330986 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.361381054 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.361402988 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.361427069 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.361474037 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.361483097 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.361521959 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.361567974 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.361577988 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.361614943 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.361664057 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.361666918 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.361710072 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.361756086 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.361779928 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.361803055 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.361848116 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.361857891 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.361896038 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.361942053 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.361989975 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.362013102 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.362039089 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.362055063 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.362087965 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.362133980 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.362154961 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.362179041 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.362226009 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.362261057 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.362274885 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.362322092 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.362341881 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.362369061 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.362415075 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.362448931 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.362461090 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.362507105 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.362528086 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.362552881 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.362600088 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.362616062 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.362646103 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.362715006 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.362750053 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.362770081 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.362835884 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.367163897 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.367213011 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.367257118 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.367301941 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.367302895 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.367346048 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.367377043 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.367392063 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.367436886 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.367456913 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.367480993 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.367525101 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.367539883 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.367568970 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.367614985 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.367631912 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.367660999 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.367705107 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.367719889 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.367748976 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.367793083 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.367805004 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.367835999 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.367880106 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.367911100 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.367923975 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.367988110 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.443248987 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.443310976 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.443356991 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.443398952 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.443403006 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.443449974 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.443480968 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.443497896 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.443545103 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.443562984 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.443592072 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.443638086 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.443681955 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.443686008 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.443732023 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.443763018 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.443777084 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.443824053 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.443846941 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.443869114 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.443917036 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.443953991 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.443965912 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.444030046 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.444098949 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.444168091 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.444215059 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.444235086 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.444261074 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.444308996 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.444329977 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.444355011 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.444400072 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.444415092 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.444447994 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.444494009 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.444509983 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.444540977 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.444587946 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.444606066 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.444636106 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.444690943 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.710176945 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.741183043 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.741245985 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.741295099 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.741343021 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.741345882 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.741395950 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.741409063 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.741456032 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.741502047 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.741508961 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.741548061 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.741595030 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.741601944 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.741641045 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.741687059 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.741693020 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.741734982 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.741780043 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.741786957 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.741826057 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.741872072 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.741894007 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.741916895 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.741962910 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.741969109 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.742008924 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.742054939 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.742077112 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.742103100 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.742149115 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.742153883 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.742196083 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.742244005 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.742254019 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.742290020 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.742336988 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.742343903 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.742383003 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.742429972 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.742443085 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.742476940 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.742522001 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.742522955 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.742569923 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.742615938 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.742624998 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.742661953 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.742722988 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.742727995 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.742775917 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.742820024 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.742831945 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.742866039 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.742913961 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.742918015 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.742959023 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.743004084 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:21.743009090 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:21.788769960 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.121396065 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.968169928 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.968242884 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.968290091 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.968305111 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.968338013 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.968384981 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.968434095 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.968434095 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.968504906 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.968559980 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.968564987 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.968611002 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.968621016 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.968657970 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.968703032 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.968717098 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.968749046 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.968796015 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.968842030 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.968856096 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.968888998 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.968935013 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.968938112 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.968981028 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.968991995 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.969029903 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.969077110 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.969085932 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.969121933 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.969167948 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.969177008 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.969217062 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.969261885 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.969306946 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.969317913 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.969352961 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.969398022 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.969408035 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.969444990 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.969450951 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.969495058 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.969561100 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.969561100 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.969615936 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.969661951 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.969674110 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.969708920 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.969755888 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.969803095 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.969805956 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.969849110 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.969897985 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.969899893 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.969944000 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.969949961 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.970011950 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.970057964 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.970063925 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.970104933 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.970150948 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.970153093 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.970200062 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.970244884 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.970280886 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.970290899 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.970335960 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.970372915 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.970381975 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.970423937 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.970443964 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.970470905 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.970516920 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.970561981 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.970566988 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:22.970609903 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:22.970662117 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.001246929 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.001318932 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.001364946 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.001382113 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.001413107 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.001460075 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.001490116 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.001508951 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.001554966 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.001571894 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.001601934 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.001610041 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.001648903 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.001697063 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.001703978 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.001744032 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.001790047 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.001796961 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.001837015 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.001883984 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.001929998 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.001936913 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.001976967 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.002023935 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.002028942 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.002070904 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.002078056 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.002118111 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.002165079 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.002173901 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.002213955 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.002262115 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.002279997 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.002310038 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.002355099 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.002401114 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.002417088 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.002448082 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.002494097 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.002501965 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.002541065 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.002546072 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.002588034 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.002634048 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.002665043 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.002681971 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.002767086 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.002832890 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.002886057 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.002886057 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.002886057 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.002932072 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.002979040 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.002991915 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.003026009 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.003071070 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.003115892 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.003125906 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.003165007 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.003197908 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.003215075 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.003262043 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.003308058 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.003308058 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.003355980 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.003401995 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.003421068 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.003448963 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.003494978 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.003525019 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.003540993 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.003562927 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.003590107 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.003637075 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.003676891 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.038450003 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.039302111 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.117427111 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.148310900 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148345947 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148366928 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148389101 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148408890 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148427963 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148427010 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.148447990 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148469925 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148482084 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.148492098 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148514032 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148515940 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.148535013 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148555994 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148557901 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.148577929 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148597956 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148617983 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148623943 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.148638964 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148648977 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.148660898 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148683071 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148703098 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148709059 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.148724079 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148732901 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.148745060 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148766041 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148786068 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148789883 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.148807049 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148818016 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.148828983 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148850918 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148852110 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.148873091 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148893118 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148911953 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148916960 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.148932934 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148942947 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.148953915 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148973942 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.148979902 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.148994923 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.149015903 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.149034977 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.149039984 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.149055004 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.149064064 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.149084091 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.149100065 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.149105072 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.149127007 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.149147034 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.149167061 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.149188042 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.149198055 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.149209023 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.149230957 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.149236917 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.149256945 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.149277925 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.149281979 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.149298906 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.149319887 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.149343014 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.149347067 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.149363995 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.149373055 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.149408102 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.520304918 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.551222086 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.551295996 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.551342964 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.551388025 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.551389933 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.551431894 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.551476955 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.551495075 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.551522970 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.551567078 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.551584005 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.551613092 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.551657915 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.551672935 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.551706076 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.551727057 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.551752090 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.551796913 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.551820040 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.551841974 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.551887035 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.551930904 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.551963091 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.551975012 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.552020073 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.552033901 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.552066088 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.552073956 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.552112103 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.552155018 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.552166939 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.552200079 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.552253008 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.552277088 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.552299023 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.552346945 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.552355051 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.552393913 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.552439928 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.552488089 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.552495956 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.552535057 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.552582026 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.552592039 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.552628994 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.552638054 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.552673101 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.552720070 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.552727938 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.552764893 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.552808046 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.552823067 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.552844048 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.553806067 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.904800892 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.965450048 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.965486050 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.965507030 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.965532064 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.965543032 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.965555906 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.965581894 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.965603113 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.965604067 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.965626955 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.965643883 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.965655088 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.965682030 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.965692043 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.965704918 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.965733051 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.965745926 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.965754986 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.965783119 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.965785980 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.965809107 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.965835094 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.965835094 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.965856075 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.965881109 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.965883970 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.965903044 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.965924025 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.965948105 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.965948105 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.965969086 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.965975046 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.965996981 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966022015 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966031075 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.966054916 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966077089 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966077089 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.966098070 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966120005 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966131926 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.966144085 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966169119 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966171026 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.966188908 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966217995 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.966221094 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966239929 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966263056 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.966264963 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966284990 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966305971 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966321945 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.966326952 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966351032 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966353893 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.966375113 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966401100 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966404915 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.966422081 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966445923 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966455936 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.966468096 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966491938 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966511011 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966514111 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.966535091 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966537952 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:23.966553926 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:23.966583967 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:24.007781029 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:24.350615025 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:25.813961983 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:25.951946020 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:41.266781092 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:28:41.267270088 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:28:41.351635933 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:29:04.187917948 CET505049698193.42.33.160192.168.2.3
              Mar 21, 2023 07:29:04.188358068 CET496985050192.168.2.3193.42.33.160
              Mar 21, 2023 07:29:04.259648085 CET505049698193.42.33.160192.168.2.3
              TimestampSource PortDest PortSource IPDest IP
              Mar 21, 2023 07:28:18.979588032 CET6270453192.168.2.38.8.8.8
              Mar 21, 2023 07:28:19.090074062 CET53627048.8.8.8192.168.2.3
              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
              Mar 21, 2023 07:28:18.979588032 CET192.168.2.38.8.8.80x4e01Standard query (0)panchak.duckdns.orgA (IP address)IN (0x0001)false
              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
              Mar 21, 2023 07:28:19.090074062 CET8.8.8.8192.168.2.30x4e01No error (0)panchak.duckdns.org193.42.33.160A (IP address)IN (0x0001)false

              Click to jump to process

              Click to jump to process

              Click to dive into process behavior distribution

              Click to jump to process

              Target ID:0
              Start time:07:27:01
              Start date:21/03/2023
              Path:C:\Users\user\Desktop\RFQ_31362.exe
              Wow64 process (32bit):true
              Commandline:C:\Users\user\Desktop\RFQ_31362.exe
              Imagebase:0x270000
              File size:865280 bytes
              MD5 hash:C3C291B38D054D5E71FE17A10D737249
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:.Net C# or VB.NET
              Reputation:low

              Target ID:10
              Start time:07:28:14
              Start date:21/03/2023
              Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              Wow64 process (32bit):true
              Commandline:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_31362.exe
              Imagebase:0x9e0000
              File size:430592 bytes
              MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:.Net C# or VB.NET
              Reputation:high

              Target ID:11
              Start time:07:28:15
              Start date:21/03/2023
              Path:C:\Windows\System32\conhost.exe
              Wow64 process (32bit):false
              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Imagebase:0x7ff745070000
              File size:625664 bytes
              MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:high

              Target ID:12
              Start time:07:28:15
              Start date:21/03/2023
              Path:C:\Users\user\Desktop\RFQ_31362.exe
              Wow64 process (32bit):true
              Commandline:C:\Users\user\Desktop\RFQ_31362.exe
              Imagebase:0x940000
              File size:865280 bytes
              MD5 hash:C3C291B38D054D5E71FE17A10D737249
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Yara matches:
              • Rule: Codoso_Gh0st_1, Description: Detects Codoso APT Gh0st Malware, Source: 0000000C.00000002.510449817.000000000054F000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
              • Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 0000000C.00000002.510449817.000000000054F000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
              • Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
              • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
              • Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
              • Rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM, Description: Detects executables embedding command execution via IExecuteCommand COM object, Source: 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
              • Rule: MALWARE_Win_WarzoneRAT, Description: Detects AveMaria/WarzoneRAT, Source: 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
              • Rule: Windows_Trojan_AveMaria_31d2bce9, Description: unknown, Source: 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
              • Rule: AveMaria_WarZone, Description: unknown, Source: 0000000C.00000002.510449817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
              • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.406416749.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
              • Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 0000000C.00000003.406416749.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
              • Rule: Windows_Trojan_AveMaria_31d2bce9, Description: unknown, Source: 0000000C.00000003.406416749.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
              • Rule: Codoso_Gh0st_1, Description: Detects Codoso APT Gh0st Malware, Source: 0000000C.00000003.405873618.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
              • Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 0000000C.00000003.405873618.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
              • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.405873618.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
              • Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 0000000C.00000003.405873618.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
              • Rule: Windows_Trojan_AveMaria_31d2bce9, Description: unknown, Source: 0000000C.00000003.405873618.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
              Reputation:low

              Target ID:13
              Start time:07:28:17
              Start date:21/03/2023
              Path:C:\Windows\SysWOW64\cmd.exe
              Wow64 process (32bit):true
              Commandline:C:\Windows\System32\cmd.exe
              Imagebase:0xb0000
              File size:232960 bytes
              MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:high

              Target ID:14
              Start time:07:28:17
              Start date:21/03/2023
              Path:C:\Windows\System32\conhost.exe
              Wow64 process (32bit):false
              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Imagebase:0x7ff745070000
              File size:625664 bytes
              MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:high

              No disassembly